2 * smatch/smatch_buf_size.c
4 * Copyright (C) 2010 Dan Carpenter.
6 * Licensed under the Open Software License version 1.1
14 #include "smatch_slist.h"
15 #include "smatch_extra.h"
18 * This check has two smatch IDs.
19 * my_size_id - used to store the size of arrays.
20 * my_strlen_id - track the strlen() of buffers.
23 static int my_size_id
;
24 static int my_strlen_id
;
30 static struct limiter b0_l2
= {0, 2};
32 static _Bool params_set
[32];
34 void set_param_buf_size(const char *name
, struct symbol
*sym
, char *key
, char *value
)
39 if (strncmp(key
, "$$", 2))
42 snprintf(fullname
, 256, "%s%s", name
, key
+ 2);
45 size
= strtoul(value
, NULL
, 10);
49 set_state(my_size_id
, fullname
, sym
, alloc_state_num(size
));
52 static int get_initializer_size(struct expression
*expr
)
56 return expr
->string
->length
;
57 case EXPR_INITIALIZER
: {
58 struct expression
*tmp
;
62 FOR_EACH_PTR(expr
->expr_list
, tmp
) {
63 if (tmp
->type
== EXPR_INDEX
&& tmp
->idx_to
> max
)
66 } END_FOR_EACH_PTR(tmp
);
72 return get_array_size(expr
);
77 static float get_cast_ratio(struct expression
*unstripped
)
79 struct expression
*start_expr
;
80 struct symbol
*start_type
;
81 struct symbol
*end_type
;
85 start_expr
= strip_expr(unstripped
);
86 start_type
= get_type(start_expr
);
87 end_type
= get_type(unstripped
);
88 if (!start_type
|| !end_type
)
91 if (start_type
->type
== SYM_PTR
)
92 start_bytes
= (get_base_type(start_type
))->ctype
.alignment
;
93 if (start_type
->type
== SYM_ARRAY
)
94 start_bytes
= (get_base_type(start_type
))->bit_size
/ 8;
95 if (end_type
->type
== SYM_PTR
)
96 end_bytes
= (get_base_type(end_type
))->ctype
.alignment
;
97 if (end_type
->type
== SYM_ARRAY
)
98 end_bytes
= (get_base_type(end_type
))->bit_size
/ 8;
100 if (!start_bytes
|| !end_bytes
)
102 return start_bytes
/ end_bytes
;
105 int get_array_size(struct expression
*expr
)
108 struct smatch_state
*state
;
113 if (expr
->type
== EXPR_STRING
)
114 return expr
->string
->length
;
116 cast_ratio
= get_cast_ratio(expr
);
117 expr
= strip_expr(expr
);
118 tmp
= get_type(expr
);
122 if (tmp
->type
== SYM_ARRAY
) {
123 ret
= get_expression_value(tmp
->array_size
);
124 /* Dynamically sized array are -1 in sparse */
127 /* People put one element arrays on the end of structs */
131 return ret
* cast_ratio
;
134 state
= get_state_expr(my_size_id
, expr
);
135 if (state
== &merged
)
137 if (state
&& state
->data
) {
138 if (tmp
->type
== SYM_PTR
)
139 tmp
= get_base_type(tmp
);
140 if (!tmp
->ctype
.alignment
)
142 ret
= PTR_INT(state
->data
) / tmp
->ctype
.alignment
;
143 return ret
* cast_ratio
;
146 if (expr
->type
== EXPR_SYMBOL
&& expr
->symbol
->initializer
) {
147 if (expr
->symbol
->initializer
!= expr
) /* int a = a; */
148 return get_initializer_size(expr
->symbol
->initializer
) * cast_ratio
;
151 state
= get_state_expr(my_strlen_id
, expr
);
152 if (!state
|| !state
->data
)
154 if (get_implied_max((struct expression
*)state
->data
, &len
))
155 return len
+ 1; /* add one because strlen doesn't include the NULL */
160 static int db_size_callback(void *unused
, int argc
, char **argv
, char **azColName
)
162 db_size
= atoi(argv
[0]);
166 static int size_from_db(struct expression
*expr
)
173 name
= get_member_name(expr
);
178 run_sql(db_size_callback
, "select size from type_size where type = '%s'",
183 int get_array_size_bytes(struct expression
*expr
)
189 if (expr
->type
== EXPR_STRING
)
190 return expr
->string
->length
;
192 tmp
= get_type(expr
);
196 if (tmp
->type
== SYM_ARRAY
) {
197 tmp
= get_base_type(tmp
);
198 element_size
= tmp
->bit_size
/ 8;
199 } else if (tmp
->type
== SYM_PTR
) {
200 tmp
= get_base_type(tmp
);
201 element_size
= tmp
->ctype
.alignment
;
205 array_size
= get_array_size(expr
);
207 return array_size
* element_size
;
209 return size_from_db(expr
);
212 static void match_strlen_condition(struct expression
*expr
)
214 struct expression
*left
;
215 struct expression
*right
;
216 struct expression
*str
= NULL
;
218 int strlen_right
= 0;
220 struct smatch_state
*true_state
= NULL
;
221 struct smatch_state
*false_state
= NULL
;
223 if (expr
->type
!= EXPR_COMPARE
)
225 left
= strip_expr(expr
->left
);
226 right
= strip_expr(expr
->right
);
228 if (left
->type
== EXPR_CALL
&& sym_name_is("strlen", left
->fn
)) {
229 str
= get_argument_from_call_expr(left
->args
, 0);
232 if (right
->type
== EXPR_CALL
&& sym_name_is("strlen", right
->fn
)) {
233 str
= get_argument_from_call_expr(right
->args
, 0);
237 if (!strlen_left
&& !strlen_right
)
239 if (strlen_left
&& strlen_right
)
243 if (!get_value(right
, &val
))
247 if (!get_value(left
, &val
))
251 if (expr
->op
== SPECIAL_EQUAL
) {
252 set_true_false_states_expr(my_size_id
, str
, alloc_state_num(val
+ 1), NULL
);
255 if (expr
->op
== SPECIAL_NOTEQUAL
) {
256 set_true_false_states_expr(my_size_id
, str
, NULL
, alloc_state_num(val
+ 1));
262 case SPECIAL_UNSIGNED_LT
:
264 true_state
= alloc_state_num(val
);
266 false_state
= alloc_state_num(val
+ 1);
269 case SPECIAL_UNSIGNED_LTE
:
271 true_state
= alloc_state_num(val
+ 1);
273 false_state
= alloc_state_num(val
);
276 case SPECIAL_UNSIGNED_GTE
:
278 false_state
= alloc_state_num(val
);
280 true_state
= alloc_state_num(val
+ 1);
283 case SPECIAL_UNSIGNED_GT
:
285 false_state
= alloc_state_num(val
+ 1);
287 true_state
= alloc_state_num(val
);
290 set_true_false_states_expr(my_size_id
, str
, true_state
, false_state
);
293 static struct expression
*strip_ampersands(struct expression
*expr
)
297 if (expr
->type
!= EXPR_PREOP
)
301 type
= get_type(expr
->unop
);
302 if (!type
|| type
->type
!= SYM_ARRAY
)
307 static void match_array_assignment(struct expression
*expr
)
309 struct expression
*left
;
310 struct expression
*right
;
315 left
= strip_expr(expr
->left
);
316 right
= strip_expr(expr
->right
);
317 right
= strip_ampersands(right
);
318 array_size
= get_array_size_bytes(right
);
320 set_state_expr(my_size_id
, left
, alloc_state_num(array_size
));
323 static void match_alloc(const char *fn
, struct expression
*expr
, void *_size_arg
)
325 int size_arg
= PTR_INT(_size_arg
);
326 struct expression
*right
;
327 struct expression
*arg
;
330 right
= strip_expr(expr
->right
);
331 arg
= get_argument_from_call_expr(right
->args
, size_arg
);
332 if (!get_implied_value(arg
, &bytes
))
335 set_state_expr(my_size_id
, expr
->left
, alloc_state_num(bytes
));
338 char *member
= get_member_name(expr
->left
);
341 sm_msg("info: '%s' allocated_buf_size %lld",
347 static void match_calloc(const char *fn
, struct expression
*expr
, void *unused
)
349 struct expression
*right
;
350 struct expression
*arg
;
354 right
= strip_expr(expr
->right
);
355 arg
= get_argument_from_call_expr(right
->args
, 0);
356 if (!get_implied_value(arg
, &elements
))
358 arg
= get_argument_from_call_expr(right
->args
, 1);
359 if (!get_implied_value(arg
, &size
))
361 set_state_expr(my_size_id
, expr
->left
, alloc_state_num(elements
* size
));
364 static void match_strlen(const char *fn
, struct expression
*expr
, void *unused
)
366 struct expression
*right
;
367 struct expression
*str
;
368 struct expression
*len_expr
;
370 struct smatch_state
*state
;
372 right
= strip_expr(expr
->right
);
373 str
= get_argument_from_call_expr(right
->args
, 0);
374 len_expr
= strip_expr(expr
->left
);
376 len_name
= get_variable_from_expr(len_expr
, NULL
);
380 state
= __alloc_smatch_state(0);
381 state
->name
= len_name
;
382 state
->data
= len_expr
;
383 set_state_expr(my_strlen_id
, str
, state
);
386 static void match_limited(const char *fn
, struct expression
*expr
, void *_limiter
)
388 struct limiter
*limiter
= (struct limiter
*)_limiter
;
389 struct expression
*dest
;
390 struct expression
*size_expr
;
393 dest
= get_argument_from_call_expr(expr
->args
, limiter
->buf_arg
);
394 size_expr
= get_argument_from_call_expr(expr
->args
, limiter
->limit_arg
);
395 if (!get_implied_max(size_expr
, &size
))
397 set_state_expr(my_size_id
, dest
, alloc_state_num(size
));
400 static void match_strcpy(const char *fn
, struct expression
*expr
, void *unused
)
402 struct expression fake_assign
;
404 fake_assign
.op
= '=';
405 fake_assign
.left
= get_argument_from_call_expr(expr
->args
, 0);
406 fake_assign
.right
= get_argument_from_call_expr(expr
->args
, 1);
407 match_array_assignment(&fake_assign
);
410 static void match_strndup(const char *fn
, struct expression
*expr
, void *unused
)
412 struct expression
*fn_expr
;
413 struct expression
*size_expr
;
416 fn_expr
= strip_expr(expr
->right
);
417 size_expr
= get_argument_from_call_expr(fn_expr
->args
, 1);
418 if (!get_implied_max(size_expr
, &size
))
421 /* It's easy to forget space for the NUL char */
423 set_state_expr(my_size_id
, expr
->left
, alloc_state_num(size
));
426 static void match_call(struct expression
*expr
)
429 struct expression
*arg
;
433 name
= get_fnptr_name(expr
->fn
);
438 FOR_EACH_PTR(expr
->args
, arg
) {
439 bytes
= get_array_size_bytes(arg
);
441 sm_msg("info: passes_buffer '%s' %d '$$' %d", name
, i
, bytes
);
443 } END_FOR_EACH_PTR(arg
);
448 static void struct_member_callback(char *fn
, int param
, char *printed_name
, struct smatch_state
*state
)
450 if (state
== &merged
)
452 sm_msg("info: passes_buffer '%s' %d '%s' %s", fn
, param
, printed_name
, state
->name
);
455 static void match_func_end(struct symbol
*sym
)
457 memset(params_set
, 0, sizeof(params_set
));
460 void register_buf_size(int id
)
464 add_definition_db_callback(set_param_buf_size
, BUF_SIZE
);
466 add_function_assign_hook("malloc", &match_alloc
, INT_PTR(0));
467 add_function_assign_hook("calloc", &match_calloc
, NULL
);
468 add_function_assign_hook("memdup", &match_alloc
, INT_PTR(1));
469 if (option_project
== PROJ_KERNEL
) {
470 add_function_assign_hook("kmalloc", &match_alloc
, INT_PTR(0));
471 add_function_assign_hook("kzalloc", &match_alloc
, INT_PTR(0));
472 add_function_assign_hook("vmalloc", &match_alloc
, INT_PTR(0));
473 add_function_assign_hook("__vmalloc", &match_alloc
, INT_PTR(0));
474 add_function_assign_hook("kcalloc", &match_calloc
, NULL
);
475 add_function_assign_hook("drm_malloc_ab", &match_calloc
, NULL
);
476 add_function_assign_hook("drm_calloc_large", &match_calloc
, NULL
);
477 add_function_assign_hook("kmemdup", &match_alloc
, INT_PTR(1));
478 add_function_assign_hook("kmemdup_user", &match_alloc
, INT_PTR(1));
480 add_hook(&match_array_assignment
, ASSIGNMENT_HOOK
);
481 add_hook(&match_strlen_condition
, CONDITION_HOOK
);
482 add_function_assign_hook("strlen", &match_strlen
, NULL
);
484 add_function_hook("strlcpy", &match_limited
, &b0_l2
);
485 add_function_hook("strlcat", &match_limited
, &b0_l2
);
486 add_function_hook("memscan", &match_limited
, &b0_l2
);
488 add_function_hook("strcpy", &match_strcpy
, NULL
);
490 add_function_assign_hook("strndup", match_strndup
, NULL
);
491 if (option_project
== PROJ_KERNEL
)
492 add_function_assign_hook("kstrndup", match_strndup
, NULL
);
495 add_hook(&match_call
, FUNCTION_CALL_HOOK
);
496 add_member_info_callback(my_size_id
, struct_member_callback
);
499 add_hook(&match_func_end
, END_FUNC_HOOK
);
502 void register_strlen(int id
)