expressions: make assign_expression() take an op argument
[smatch.git] / smatch_function_hooks.c
blobf6d2c0cf0e7d26a5ce89e2268f481f68b3069ad7
1 /*
2 * Copyright (C) 2009 Dan Carpenter.
4 * This program is free software; you can redistribute it and/or
5 * modify it under the terms of the GNU General Public License
6 * as published by the Free Software Foundation; either version 2
7 * of the License, or (at your option) any later version.
9 * This program is distributed in the hope that it will be useful,
10 * but WITHOUT ANY WARRANTY; without even the implied warranty of
11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12 * GNU General Public License for more details.
14 * You should have received a copy of the GNU General Public License
15 * along with this program; if not, see http://www.gnu.org/copyleft/gpl.txt
19 * There are several types of function hooks:
20 * add_function_hook() - For any time a function is called.
21 * add_function_assign_hook() - foo = the_function().
22 * add_implied_return_hook() - Calculates the implied return value.
23 * add_macro_assign_hook() - foo = the_macro().
24 * return_implies_state() - For when a return value of 1 implies locked
25 * and 0 implies unlocked. etc. etc.
29 #include <stdlib.h>
30 #include <stdio.h>
31 #include "smatch.h"
32 #include "smatch_slist.h"
33 #include "smatch_extra.h"
34 #include "smatch_function_hashtable.h"
36 struct fcall_back {
37 int type;
38 struct data_range *range;
39 union {
40 func_hook *call_back;
41 implication_hook *ranged;
42 implied_return_hook *implied_return;
43 } u;
44 void *info;
47 ALLOCATOR(fcall_back, "call backs");
48 DECLARE_PTR_LIST(call_back_list, struct fcall_back);
50 DEFINE_FUNCTION_HASHTABLE_STATIC(callback, struct fcall_back, struct call_back_list);
51 static struct hashtable *func_hash;
53 #define REGULAR_CALL 0
54 #define RANGED_CALL 1
55 #define ASSIGN_CALL 2
56 #define IMPLIED_RETURN 3
57 #define MACRO_ASSIGN 4
58 #define MACRO_ASSIGN_EXTRA 5
60 struct return_implies_callback {
61 int type;
62 return_implies_hook *callback;
64 ALLOCATOR(return_implies_callback, "return_implies callbacks");
65 DECLARE_PTR_LIST(db_implies_list, struct return_implies_callback);
66 static struct db_implies_list *db_return_states_list;
68 typedef void (void_fn)(void);
69 DECLARE_PTR_LIST(void_fn_list, void_fn *);
70 static struct void_fn_list *return_states_before;
71 static struct void_fn_list *return_states_after;
73 static struct fcall_back *alloc_fcall_back(int type, void *call_back,
74 void *info)
76 struct fcall_back *cb;
78 cb = __alloc_fcall_back(0);
79 cb->type = type;
80 cb->u.call_back = call_back;
81 cb->info = info;
82 return cb;
85 void add_function_hook(const char *look_for, func_hook *call_back, void *info)
87 struct fcall_back *cb;
89 cb = alloc_fcall_back(REGULAR_CALL, call_back, info);
90 add_callback(func_hash, look_for, cb);
93 void add_function_assign_hook(const char *look_for, func_hook *call_back,
94 void *info)
96 struct fcall_back *cb;
98 cb = alloc_fcall_back(ASSIGN_CALL, call_back, info);
99 add_callback(func_hash, look_for, cb);
102 void add_implied_return_hook(const char *look_for,
103 implied_return_hook *call_back,
104 void *info)
106 struct fcall_back *cb;
108 cb = alloc_fcall_back(IMPLIED_RETURN, call_back, info);
109 add_callback(func_hash, look_for, cb);
112 void add_macro_assign_hook(const char *look_for, func_hook *call_back,
113 void *info)
115 struct fcall_back *cb;
117 cb = alloc_fcall_back(MACRO_ASSIGN, call_back, info);
118 add_callback(func_hash, look_for, cb);
121 void add_macro_assign_hook_extra(const char *look_for, func_hook *call_back,
122 void *info)
124 struct fcall_back *cb;
126 cb = alloc_fcall_back(MACRO_ASSIGN_EXTRA, call_back, info);
127 add_callback(func_hash, look_for, cb);
130 void return_implies_state(const char *look_for, long long start, long long end,
131 implication_hook *call_back, void *info)
133 struct fcall_back *cb;
135 cb = alloc_fcall_back(RANGED_CALL, call_back, info);
136 cb->range = alloc_range_perm(ll_to_sval(start), ll_to_sval(end));
137 add_callback(func_hash, look_for, cb);
140 void select_return_states_hook(int type, return_implies_hook *callback)
142 struct return_implies_callback *cb = __alloc_return_implies_callback(0);
144 cb->type = type;
145 cb->callback = callback;
146 add_ptr_list(&db_return_states_list, cb);
149 void select_return_states_before(void_fn *fn)
151 void_fn **p = malloc(sizeof(void_fn *));
152 *p = fn;
153 add_ptr_list(&return_states_before, p);
156 void select_return_states_after(void_fn *fn)
158 void_fn **p = malloc(sizeof(void_fn *));
159 *p = fn;
160 add_ptr_list(&return_states_after, p);
163 static void call_return_states_before_hooks(void)
165 void_fn **fn;
167 FOR_EACH_PTR(return_states_before, fn) {
168 (*fn)();
169 } END_FOR_EACH_PTR(fn);
172 static void call_return_states_after_hooks(struct expression *expr)
174 void_fn **fn;
176 FOR_EACH_PTR(return_states_after, fn) {
177 (*fn)();
178 } END_FOR_EACH_PTR(fn);
179 __pass_to_client(expr, FUNCTION_CALL_HOOK_AFTER_DB);
182 static int call_call_backs(struct call_back_list *list, int type,
183 const char *fn, struct expression *expr)
185 struct fcall_back *tmp;
186 int handled = 0;
188 FOR_EACH_PTR(list, tmp) {
189 if (tmp->type == type) {
190 (tmp->u.call_back)(fn, expr, tmp->info);
191 handled = 1;
193 } END_FOR_EACH_PTR(tmp);
195 return handled;
198 static void call_ranged_call_backs(struct call_back_list *list,
199 const char *fn, struct expression *call_expr,
200 struct expression *assign_expr)
202 struct fcall_back *tmp;
204 FOR_EACH_PTR(list, tmp) {
205 (tmp->u.ranged)(fn, call_expr, assign_expr, tmp->info);
206 } END_FOR_EACH_PTR(tmp);
209 static struct call_back_list *get_same_ranged_call_backs(struct call_back_list *list,
210 struct data_range *drange)
212 struct call_back_list *ret = NULL;
213 struct fcall_back *tmp;
215 FOR_EACH_PTR(list, tmp) {
216 if (tmp->type != RANGED_CALL)
217 continue;
218 if (ranges_equiv(tmp->range, drange))
219 add_ptr_list(&ret, tmp);
220 } END_FOR_EACH_PTR(tmp);
221 return ret;
224 static int in_list_exact_sval(struct range_list *list, struct data_range *drange)
226 struct data_range *tmp;
228 FOR_EACH_PTR(list, tmp) {
229 if (ranges_equiv(tmp, drange))
230 return 1;
231 } END_FOR_EACH_PTR(tmp);
232 return 0;
235 static int assign_ranged_funcs(const char *fn, struct expression *expr,
236 struct call_back_list *call_backs)
238 struct fcall_back *tmp;
239 struct sm_state *sm;
240 char *var_name;
241 struct symbol *sym;
242 struct smatch_state *estate;
243 struct stree *tmp_stree;
244 struct stree *final_states = NULL;
245 struct range_list *handled_ranges = NULL;
246 struct call_back_list *same_range_call_backs = NULL;
247 int handled = 0;
249 if (!call_backs)
250 return 0;
252 var_name = expr_to_var_sym(expr->left, &sym);
253 if (!var_name || !sym)
254 goto free;
256 FOR_EACH_PTR(call_backs, tmp) {
257 if (tmp->type != RANGED_CALL)
258 continue;
260 if (in_list_exact_sval(handled_ranges, tmp->range))
261 continue;
262 __push_fake_cur_stree();
263 tack_on(&handled_ranges, tmp->range);
265 same_range_call_backs = get_same_ranged_call_backs(call_backs, tmp->range);
266 call_ranged_call_backs(same_range_call_backs, fn, expr->right, expr);
267 __free_ptr_list((struct ptr_list **)&same_range_call_backs);
269 estate = alloc_estate_range(tmp->range->min, tmp->range->max);
270 set_extra_mod(var_name, sym, expr->left, estate);
272 tmp_stree = __pop_fake_cur_stree();
273 merge_fake_stree(&final_states, tmp_stree);
274 free_stree(&tmp_stree);
275 handled = 1;
276 } END_FOR_EACH_PTR(tmp);
278 FOR_EACH_SM(final_states, sm) {
279 __set_sm(sm);
280 } END_FOR_EACH_SM(sm);
282 free_stree(&final_states);
283 free:
284 free_string(var_name);
285 return handled;
288 static void call_implies_callbacks(int comparison, struct expression *expr, sval_t sval, int left, struct stree **implied_true, struct stree **implied_false)
290 struct call_back_list *call_backs;
291 struct fcall_back *tmp;
292 const char *fn;
293 struct data_range *value_range;
294 struct stree *true_states = NULL;
295 struct stree *false_states = NULL;
296 struct stree *tmp_stree;
298 *implied_true = NULL;
299 *implied_false = NULL;
300 if (expr->fn->type != EXPR_SYMBOL || !expr->fn->symbol)
301 return;
302 fn = expr->fn->symbol->ident->name;
303 call_backs = search_callback(func_hash, (char *)expr->fn->symbol->ident->name);
304 if (!call_backs)
305 return;
306 value_range = alloc_range(sval, sval);
308 /* set true states */
309 __push_fake_cur_stree();
310 FOR_EACH_PTR(call_backs, tmp) {
311 if (tmp->type != RANGED_CALL)
312 continue;
313 if (!true_comparison_range_LR(comparison, tmp->range, value_range, left))
314 continue;
315 (tmp->u.ranged)(fn, expr, NULL, tmp->info);
316 } END_FOR_EACH_PTR(tmp);
317 tmp_stree = __pop_fake_cur_stree();
318 merge_fake_stree(&true_states, tmp_stree);
319 free_stree(&tmp_stree);
321 /* set false states */
322 __push_fake_cur_stree();
323 FOR_EACH_PTR(call_backs, tmp) {
324 if (tmp->type != RANGED_CALL)
325 continue;
326 if (!false_comparison_range_LR(comparison, tmp->range, value_range, left))
327 continue;
328 (tmp->u.ranged)(fn, expr, NULL, tmp->info);
329 } END_FOR_EACH_PTR(tmp);
330 tmp_stree = __pop_fake_cur_stree();
331 merge_fake_stree(&false_states, tmp_stree);
332 free_stree(&tmp_stree);
334 *implied_true = true_states;
335 *implied_false = false_states;
338 struct db_callback_info {
339 int true_side;
340 int comparison;
341 struct expression *expr;
342 struct range_list *rl;
343 int left;
344 struct stree *stree;
345 struct db_implies_list *callbacks;
346 int prev_return_id;
347 int cull;
348 int has_states;
349 struct smatch_state *ret_state;
350 struct expression *var_expr;
351 int handled;
354 static void store_return_state(struct db_callback_info *db_info, struct smatch_state *state)
356 db_info->ret_state = state;
359 static void set_return_state(struct expression *expr, struct db_callback_info *db_info)
361 struct smatch_state *state;
363 if (!db_info->ret_state)
364 return;
366 state = alloc_estate_rl(cast_rl(get_type(expr), clone_rl(estate_rl(db_info->ret_state))));
367 set_extra_expr_mod(expr, state);
368 db_info->ret_state = NULL;
371 static void handle_ret_equals_param(char *ret_string, struct range_list *rl, struct expression *call)
373 char *str;
374 long long param;
375 struct expression *arg;
376 struct range_list *orig;
378 str = strstr(ret_string, "==$");
379 if (!str)
380 return;
381 str += 3;
382 param = strtoll(str, NULL, 10);
383 arg = get_argument_from_call_expr(call->args, param);
384 if (!arg)
385 return;
386 get_absolute_rl(arg, &orig);
387 rl = rl_intersection(orig, rl);
388 if (!rl)
389 return;
390 set_extra_expr_nomod(arg, alloc_estate_rl(rl));
393 static int impossible_limit(struct expression *expr, int param, char *key, char *value)
395 struct expression *arg;
396 struct smatch_state *state;
397 struct range_list *passed;
398 struct range_list *limit;
399 struct symbol *compare_type;
401 while (expr->type == EXPR_ASSIGNMENT)
402 expr = strip_expr(expr->right);
403 if (expr->type != EXPR_CALL)
404 return 0;
406 arg = get_argument_from_call_expr(expr->args, param);
407 if (!arg)
408 return 0;
410 if (strcmp(key, "$") == 0) {
411 if (!get_implied_rl(arg, &passed))
412 return 0;
414 compare_type = get_arg_type(expr->fn, param);
415 } else {
416 char *name;
417 struct symbol *sym;
419 name = get_variable_from_key(arg, key, &sym);
420 if (!name || !sym)
421 return 0;
423 state = get_state(SMATCH_EXTRA, name, sym);
424 if (!state) {
425 free_string(name);
426 return 0;
428 passed = estate_rl(state);
429 if (!passed || is_whole_rl(passed)) {
430 free_string(name);
431 return 0;
434 compare_type = get_member_type_from_key(arg, key);
437 passed = cast_rl(compare_type, passed);
438 call_results_to_rl(expr, compare_type, value, &limit);
439 if (!limit || is_whole_rl(limit))
440 return 0;
441 if (possibly_true_rl(passed, SPECIAL_EQUAL, limit))
442 return 0;
443 if (option_debug || local_debug)
444 sm_msg("impossible: %d '%s' limit '%s' == '%s'", param, key, show_rl(passed), value);
445 return 1;
448 static int is_impossible_data(int type, struct expression *expr, int param, char *key, char *value)
450 if (type == PARAM_LIMIT && impossible_limit(expr, param, key, value))
451 return 1;
452 if (type == COMPARE_LIMIT && param_compare_limit_is_impossible(expr, param, key, value)) {
453 if (local_debug)
454 sm_msg("param_compare_limit_is_impossible: %d %s %s", param, key, value);
455 return 1;
457 return 0;
460 static int func_type_mismatch(struct expression *expr, const char *value)
462 struct symbol *type;
464 /* This makes faking returns easier */
465 if (!value || value[0] == '\0')
466 return 0;
468 while (expr->type == EXPR_ASSIGNMENT)
469 expr = strip_expr(expr->right);
472 * Short cut: We only care about function pointers that are struct
473 * members.
476 if (expr->fn->type == EXPR_SYMBOL)
477 return 0;
479 type = get_type(expr->fn);
480 if (!type)
481 return 0;
482 if (type->type == SYM_PTR)
483 type = get_real_base_type(type);
485 if (strcmp(type_to_str(type), value) == 0)
486 return 0;
488 return 1;
491 static int db_compare_callback(void *_info, int argc, char **argv, char **azColName)
493 struct db_callback_info *db_info = _info;
494 struct range_list *var_rl = db_info->rl;
495 struct range_list *ret_range;
496 int type, param;
497 char *key, *value;
498 struct return_implies_callback *tmp;
499 struct stree *stree;
500 int return_id;
501 int comparison;
503 if (argc != 6)
504 return 0;
506 return_id = atoi(argv[0]);
507 type = atoi(argv[2]);
508 param = atoi(argv[3]);
509 key = argv[4];
510 value = argv[5];
512 db_info->has_states = 1;
513 if (db_info->prev_return_id != -1 && type == INTERNAL) {
514 set_return_state(db_info->var_expr, db_info);
515 stree = __pop_fake_cur_stree();
517 if (!db_info->cull)
518 merge_fake_stree(&db_info->stree, stree);
519 free_stree(&stree);
520 __push_fake_cur_stree();
521 db_info->cull = 0;
523 db_info->prev_return_id = return_id;
525 if (type == INTERNAL && func_type_mismatch(db_info->expr, value))
526 db_info->cull = 1;
527 if (db_info->cull)
528 return 0;
529 if (type == CULL_PATH) {
530 db_info->cull = 1;
531 return 0;
534 if (is_impossible_data(type, db_info->expr, param, key, value)) {
535 db_info->cull = 1;
536 return 0;
539 call_results_to_rl(db_info->expr, get_type(strip_expr(db_info->expr)), argv[1], &ret_range);
540 ret_range = cast_rl(get_type(db_info->expr), ret_range);
541 if (!ret_range)
542 ret_range = alloc_whole_rl(get_type(db_info->expr));
544 comparison = db_info->comparison;
545 if (db_info->left)
546 comparison = flip_comparison(comparison);
548 if (db_info->true_side) {
549 if (!possibly_true_rl(var_rl, comparison, ret_range))
550 return 0;
551 if (type == PARAM_LIMIT)
552 param_limit_implications(db_info->expr, param, key, value);
553 filter_by_comparison(&var_rl, comparison, ret_range);
554 filter_by_comparison(&ret_range, flip_comparison(comparison), var_rl);
555 } else {
556 if (!possibly_false_rl(var_rl, comparison, ret_range))
557 return 0;
558 if (type == PARAM_LIMIT)
559 param_limit_implications(db_info->expr, param, key, value);
560 filter_by_comparison(&var_rl, negate_comparison(comparison), ret_range);
561 filter_by_comparison(&ret_range, flip_comparison(negate_comparison(comparison)), var_rl);
564 handle_ret_equals_param(argv[1], ret_range, db_info->expr);
566 if (type == INTERNAL) {
567 set_state(-1, "unnull_path", NULL, &true_state);
568 __add_return_comparison(strip_expr(db_info->expr), argv[1]);
569 __add_return_to_param_mapping(db_info->expr, argv[1]);
572 FOR_EACH_PTR(db_info->callbacks, tmp) {
573 if (tmp->type == type)
574 tmp->callback(db_info->expr, param, key, value);
575 } END_FOR_EACH_PTR(tmp);
577 store_return_state(db_info, alloc_estate_rl(clone_rl(var_rl)));
578 return 0;
581 static void compare_db_return_states_callbacks(struct expression *left, int comparison, struct expression *right, struct stree *implied_true, struct stree *implied_false)
583 struct stree *orig_states;
584 struct stree *stree;
585 struct stree *true_states;
586 struct stree *false_states;
587 struct sm_state *sm;
588 struct db_callback_info db_info = {};
589 struct expression *var_expr;
590 struct expression *call_expr;
591 struct range_list *rl;
592 int call_on_left;
594 orig_states = clone_stree(__get_cur_stree());
596 /* legacy cruft. need to fix call_implies_callbacks(). */
597 call_on_left = 1;
598 call_expr = left;
599 var_expr = right;
600 if (left->type != EXPR_CALL) {
601 call_on_left = 0;
602 call_expr = right;
603 var_expr = left;
606 get_absolute_rl(var_expr, &rl);
608 db_info.comparison = comparison;
609 db_info.expr = call_expr;
610 db_info.rl = rl;
611 db_info.left = call_on_left;
612 db_info.callbacks = db_return_states_list;
613 db_info.var_expr = var_expr;
615 call_return_states_before_hooks();
617 db_info.true_side = 1;
618 db_info.stree = NULL;
619 db_info.prev_return_id = -1;
620 __push_fake_cur_stree();
621 sql_select_return_states("return_id, return, type, parameter, key, value",
622 call_expr, db_compare_callback, &db_info);
623 set_return_state(db_info.var_expr, &db_info);
624 stree = __pop_fake_cur_stree();
625 if (!db_info.cull) {
626 set_return_state(db_info.var_expr, &db_info);
627 merge_fake_stree(&db_info.stree, stree);
629 free_stree(&stree);
630 true_states = db_info.stree;
631 if (!true_states && db_info.has_states) {
632 __push_fake_cur_stree();
633 set_path_impossible();
634 true_states = __pop_fake_cur_stree();
637 nullify_path();
638 __unnullify_path();
639 FOR_EACH_SM(orig_states, sm) {
640 __set_sm_cur_stree(sm);
641 } END_FOR_EACH_SM(sm);
643 db_info.true_side = 0;
644 db_info.stree = NULL;
645 db_info.prev_return_id = -1;
646 db_info.cull = 0;
647 __push_fake_cur_stree();
648 sql_select_return_states("return_id, return, type, parameter, key, value", call_expr,
649 db_compare_callback, &db_info);
650 stree = __pop_fake_cur_stree();
651 if (!db_info.cull) {
652 set_return_state(db_info.var_expr, &db_info);
653 merge_fake_stree(&db_info.stree, stree);
655 free_stree(&stree);
656 false_states = db_info.stree;
657 if (!false_states && db_info.has_states) {
658 __push_fake_cur_stree();
659 set_path_impossible();
660 false_states = __pop_fake_cur_stree();
663 nullify_path();
664 __unnullify_path();
665 FOR_EACH_SM(orig_states, sm) {
666 __set_sm_cur_stree(sm);
667 } END_FOR_EACH_SM(sm);
669 free_stree(&orig_states);
671 FOR_EACH_SM(true_states, sm) {
672 __set_true_false_sm(sm, NULL);
673 } END_FOR_EACH_SM(sm);
674 FOR_EACH_SM(false_states, sm) {
675 __set_true_false_sm(NULL, sm);
676 } END_FOR_EACH_SM(sm);
678 free_stree(&true_states);
679 free_stree(&false_states);
681 call_return_states_after_hooks(call_expr);
683 FOR_EACH_SM(implied_true, sm) {
684 __set_true_false_sm(sm, NULL);
685 } END_FOR_EACH_SM(sm);
686 FOR_EACH_SM(implied_false, sm) {
687 __set_true_false_sm(NULL, sm);
688 } END_FOR_EACH_SM(sm);
691 void function_comparison(struct expression *left, int comparison, struct expression *right)
693 struct expression *var_expr;
694 struct expression *call_expr;
695 struct stree *implied_true = NULL;
696 struct stree *implied_false = NULL;
697 struct range_list *rl;
698 sval_t sval;
699 int call_on_left;
701 if (unreachable())
702 return;
704 /* legacy cruft. need to fix call_implies_callbacks(). */
705 call_on_left = 1;
706 call_expr = left;
707 var_expr = right;
708 if (left->type != EXPR_CALL) {
709 call_on_left = 0;
710 call_expr = right;
711 var_expr = left;
714 get_absolute_rl(var_expr, &rl);
716 if (rl_to_sval(rl, &sval))
717 call_implies_callbacks(comparison, call_expr, sval, call_on_left, &implied_true, &implied_false);
719 compare_db_return_states_callbacks(left, comparison, right, implied_true, implied_false);
720 free_stree(&implied_true);
721 free_stree(&implied_false);
724 static void call_ranged_return_hooks(struct db_callback_info *db_info)
726 struct call_back_list *call_backs;
727 struct expression *expr;
728 struct fcall_back *tmp;
729 char *fn;
731 expr = strip_expr(db_info->expr);
732 while (expr->type == EXPR_ASSIGNMENT)
733 expr = strip_expr(expr->right);
734 if (expr->type != EXPR_CALL ||
735 expr->fn->type != EXPR_SYMBOL)
736 return;
738 fn = expr->fn->symbol_name->name;
740 call_backs = search_callback(func_hash, fn);
741 FOR_EACH_PTR(call_backs, tmp) {
742 struct range_list *range_rl = NULL;
744 if (tmp->type != RANGED_CALL)
745 continue;
746 add_range(&range_rl, tmp->range->min, tmp->range->max);
747 range_rl = cast_rl(estate_type(db_info->ret_state), range_rl);
748 if (possibly_true_rl(range_rl, SPECIAL_EQUAL, estate_rl(db_info->ret_state))) {
749 if (!possibly_true_rl(rl_invert(range_rl), SPECIAL_EQUAL, estate_rl(db_info->ret_state)))
750 (tmp->u.ranged)(fn, expr, db_info->expr, tmp->info);
751 else
752 db_info->handled = -1;
754 } END_FOR_EACH_PTR(tmp);
757 static void fake_a_param_assignment(struct expression *expr, const char *return_str)
759 struct expression *arg, *left, *right, *fake_assign;
760 char *p;
761 int param;
762 char buf[256];
763 char *str;
765 if (expr->type != EXPR_ASSIGNMENT || expr->op != '=')
766 return;
767 left = expr->left;
768 right = expr->right;
770 while (right->type == EXPR_ASSIGNMENT)
771 right = strip_expr(right->right);
772 if (!right || right->type != EXPR_CALL)
773 return;
775 p = strchr(return_str, '[');
776 if (!p)
777 return;
779 p++;
780 if (p[0] == '=' && p[1] == '=')
781 p += 2;
782 if (p[0] != '$')
783 return;
785 snprintf(buf, sizeof(buf), "%s", p);
787 p = buf;
788 p += 1;
789 param = strtol(p, &p, 10);
791 p = strchr(p, ']');
792 if (!p || *p != ']')
793 return;
794 *p = '\0';
796 arg = get_argument_from_call_expr(right->args, param);
797 if (!arg)
798 return;
800 * This is a sanity check to prevent side effects from evaluating stuff
801 * twice.
803 str = expr_to_chunk_sym_vsl(arg, NULL, NULL);
804 if (!str)
805 return;
806 free_string(str);
808 right = gen_expression_from_key(arg, buf);
809 if (!right) /* Mostly fails for binops like [$0 + 4032] */
810 return;
811 fake_assign = assign_expression(left, '=', right);
812 __in_fake_assign++;
813 __split_expr(fake_assign);
814 __in_fake_assign--;
817 static int db_assign_return_states_callback(void *_info, int argc, char **argv, char **azColName)
819 struct db_callback_info *db_info = _info;
820 struct range_list *ret_range;
821 int type, param;
822 char *key, *value;
823 struct return_implies_callback *tmp;
824 struct stree *stree;
825 int return_id;
827 if (argc != 6)
828 return 0;
830 return_id = atoi(argv[0]);
831 type = atoi(argv[2]);
832 param = atoi(argv[3]);
833 key = argv[4];
834 value = argv[5];
836 if (db_info->prev_return_id != -1 && type == INTERNAL) {
837 call_ranged_return_hooks(db_info);
838 set_return_state(db_info->expr->left, db_info);
839 stree = __pop_fake_cur_stree();
840 if (!db_info->cull)
841 merge_fake_stree(&db_info->stree, stree);
842 free_stree(&stree);
843 __push_fake_cur_stree();
844 db_info->cull = 0;
846 db_info->prev_return_id = return_id;
848 if (type == INTERNAL && func_type_mismatch(db_info->expr, value))
849 db_info->cull = 1;
850 if (db_info->cull)
851 return 0;
852 if (type == CULL_PATH) {
853 db_info->cull = 1;
854 return 0;
856 if (is_impossible_data(type, db_info->expr, param, key, value)) {
857 db_info->cull = 1;
858 return 0;
861 if (type == PARAM_LIMIT)
862 param_limit_implications(db_info->expr, param, key, value);
864 db_info->handled = 1;
865 call_results_to_rl(db_info->expr->right, get_type(strip_expr(db_info->expr->right)), argv[1], &ret_range);
866 if (!ret_range)
867 ret_range = alloc_whole_rl(get_type(strip_expr(db_info->expr->right)));
868 ret_range = cast_rl(get_type(db_info->expr->right), ret_range);
870 if (type == INTERNAL) {
871 set_state(-1, "unnull_path", NULL, &true_state);
872 __add_return_comparison(strip_expr(db_info->expr->right), argv[1]);
873 __add_comparison_info(db_info->expr->left, strip_expr(db_info->expr->right), argv[1]);
874 fake_a_param_assignment(db_info->expr, argv[1]);
875 __add_return_to_param_mapping(db_info->expr, argv[1]);
878 FOR_EACH_PTR(db_return_states_list, tmp) {
879 if (tmp->type == type)
880 tmp->callback(db_info->expr, param, key, value);
881 } END_FOR_EACH_PTR(tmp);
882 store_return_state(db_info, alloc_estate_rl(ret_range));
884 return 0;
887 static int db_return_states_assign(struct expression *expr)
889 struct expression *right;
890 struct sm_state *sm;
891 struct stree *stree;
892 struct db_callback_info db_info = {};
894 right = strip_expr(expr->right);
896 db_info.prev_return_id = -1;
897 db_info.expr = expr;
898 db_info.stree = NULL;
899 db_info.handled = 0;
901 call_return_states_before_hooks();
903 __push_fake_cur_stree();
904 sql_select_return_states("return_id, return, type, parameter, key, value",
905 right, db_assign_return_states_callback, &db_info);
906 if (option_debug) {
907 sm_msg("%s return_id %d return_ranges %s",
908 db_info.cull ? "culled" : "merging",
909 db_info.prev_return_id,
910 db_info.ret_state ? db_info.ret_state->name : "'<empty>'");
912 if (db_info.handled)
913 call_ranged_return_hooks(&db_info);
914 set_return_state(db_info.expr->left, &db_info);
915 stree = __pop_fake_cur_stree();
916 if (!db_info.cull)
917 merge_fake_stree(&db_info.stree, stree);
918 free_stree(&stree);
920 if (!db_info.stree && db_info.cull) { /* this means we culled everything */
921 set_extra_expr_mod(expr->left, alloc_estate_whole(get_type(expr->left)));
922 set_path_impossible();
924 FOR_EACH_SM(db_info.stree, sm) {
925 __set_sm(sm);
926 } END_FOR_EACH_SM(sm);
928 free_stree(&db_info.stree);
929 call_return_states_after_hooks(right);
931 return db_info.handled;
934 static int handle_implied_return(struct expression *expr)
936 struct range_list *rl;
938 if (!get_implied_return(expr->right, &rl))
939 return 0;
940 rl = cast_rl(get_type(expr->left), rl);
941 set_extra_expr_mod(expr->left, alloc_estate_rl(rl));
942 return 1;
945 static void match_assign_call(struct expression *expr)
947 struct call_back_list *call_backs;
948 const char *fn;
949 struct expression *right;
950 int handled = 0;
951 struct range_list *rl;
953 if (expr->op != '=')
954 return;
956 right = strip_expr(expr->right);
957 if (right->fn->type != EXPR_SYMBOL || !right->fn->symbol) {
958 handled |= db_return_states_assign(expr);
959 if (!handled)
960 goto assigned_unknown;
961 return;
963 if (is_fake_call(right)) {
964 set_extra_expr_mod(expr->left, alloc_estate_whole(get_type(expr->left)));
965 return;
968 fn = right->fn->symbol->ident->name;
969 call_backs = search_callback(func_hash, (char *)fn);
972 * The ordering here is sort of important.
973 * One example, of how this matters is that when we do:
975 * len = strlen(str);
977 * That is handled by smatch_common_functions.c and smatch_strlen.c.
978 * They use implied_return and function_assign_hook respectively.
979 * We want to get the implied return first before we do the function
980 * assignment hook otherwise we end up writing the wrong thing for len
981 * in smatch_extra.c because we assume that it already holds the
982 * strlen() when we haven't set it yet.
985 if (db_return_states_assign(expr) == 1)
986 handled = 1;
987 else
988 handled = assign_ranged_funcs(fn, expr, call_backs);
989 handled |= handle_implied_return(expr);
992 call_call_backs(call_backs, ASSIGN_CALL, fn, expr);
994 if (handled)
995 return;
997 assigned_unknown:
998 get_absolute_rl(expr->right, &rl);
999 rl = cast_rl(get_type(expr->left), rl);
1000 set_extra_expr_mod(expr->left, alloc_estate_rl(rl));
1003 static int db_return_states_callback(void *_info, int argc, char **argv, char **azColName)
1005 struct db_callback_info *db_info = _info;
1006 struct range_list *ret_range;
1007 int type, param;
1008 char *key, *value;
1009 struct return_implies_callback *tmp;
1010 struct stree *stree;
1011 int return_id;
1012 char buf[64];
1014 if (argc != 6)
1015 return 0;
1017 return_id = atoi(argv[0]);
1018 type = atoi(argv[2]);
1019 param = atoi(argv[3]);
1020 key = argv[4];
1021 value = argv[5];
1023 if (db_info->prev_return_id != -1 && type == INTERNAL) {
1024 stree = __pop_fake_cur_stree();
1025 if (!db_info->cull)
1026 merge_fake_stree(&db_info->stree, stree);
1027 free_stree(&stree);
1028 __push_fake_cur_stree();
1029 __unnullify_path();
1030 db_info->cull = 0;
1032 db_info->prev_return_id = return_id;
1034 if (type == INTERNAL && func_type_mismatch(db_info->expr, value))
1035 db_info->cull = 1;
1036 if (db_info->cull)
1037 return 0;
1038 if (type == CULL_PATH) {
1039 db_info->cull = 1;
1040 return 0;
1042 if (is_impossible_data(type, db_info->expr, param, key, value)) {
1043 db_info->cull = 1;
1044 return 0;
1047 if (type == PARAM_LIMIT)
1048 param_limit_implications(db_info->expr, param, key, value);
1050 call_results_to_rl(db_info->expr, get_type(strip_expr(db_info->expr)), argv[1], &ret_range);
1051 ret_range = cast_rl(get_type(db_info->expr), ret_range);
1053 if (type == INTERNAL) {
1054 set_state(-1, "unnull_path", NULL, &true_state);
1055 __add_return_comparison(strip_expr(db_info->expr), argv[1]);
1056 __add_return_to_param_mapping(db_info->expr, argv[1]);
1060 FOR_EACH_PTR(db_return_states_list, tmp) {
1061 if (tmp->type == type)
1062 tmp->callback(db_info->expr, param, key, value);
1063 } END_FOR_EACH_PTR(tmp);
1066 * We want to store the return values so that we can split the strees
1067 * in smatch_db.c. This uses set_state() directly because it's not a
1068 * real smatch_extra state.
1070 snprintf(buf, sizeof(buf), "return %p", db_info->expr);
1071 set_state(SMATCH_EXTRA, buf, NULL, alloc_estate_rl(ret_range));
1073 return 0;
1076 static void db_return_states(struct expression *expr)
1078 struct sm_state *sm;
1079 struct stree *stree;
1080 struct db_callback_info db_info = {};
1082 if (!__get_cur_stree()) /* no return functions */
1083 return;
1085 db_info.prev_return_id = -1;
1086 db_info.expr = expr;
1087 db_info.stree = NULL;
1089 call_return_states_before_hooks();
1091 __push_fake_cur_stree();
1092 __unnullify_path();
1093 sql_select_return_states("return_id, return, type, parameter, key, value",
1094 expr, db_return_states_callback, &db_info);
1095 stree = __pop_fake_cur_stree();
1096 if (!db_info.cull)
1097 merge_fake_stree(&db_info.stree, stree);
1098 free_stree(&stree);
1100 FOR_EACH_SM(db_info.stree, sm) {
1101 __set_sm(sm);
1102 } END_FOR_EACH_SM(sm);
1104 free_stree(&db_info.stree);
1105 call_return_states_after_hooks(expr);
1108 static int is_condition_call(struct expression *expr)
1110 struct expression *tmp;
1112 FOR_EACH_PTR_REVERSE(big_condition_stack, tmp) {
1113 if (expr == tmp || expr_get_parent_expr(expr) == tmp)
1114 return 1;
1115 if (tmp->pos.line < expr->pos.line)
1116 return 0;
1117 } END_FOR_EACH_PTR_REVERSE(tmp);
1119 return 0;
1122 static void db_return_states_call(struct expression *expr)
1124 if (unreachable())
1125 return;
1127 if (is_assigned_call(expr))
1128 return;
1129 if (is_condition_call(expr))
1130 return;
1131 db_return_states(expr);
1134 static void match_function_call(struct expression *expr)
1136 struct call_back_list *call_backs;
1138 if (expr->fn->type == EXPR_SYMBOL && expr->fn->symbol) {
1139 call_backs = search_callback(func_hash, (char *)expr->fn->symbol->ident->name);
1140 if (call_backs)
1141 call_call_backs(call_backs, REGULAR_CALL,
1142 expr->fn->symbol->ident->name, expr);
1144 db_return_states_call(expr);
1147 static void match_macro_assign(struct expression *expr)
1149 struct call_back_list *call_backs;
1150 const char *macro;
1151 struct expression *right;
1153 right = strip_expr(expr->right);
1154 macro = get_macro_name(right->pos);
1155 call_backs = search_callback(func_hash, (char *)macro);
1156 if (!call_backs)
1157 return;
1158 call_call_backs(call_backs, MACRO_ASSIGN, macro, expr);
1159 call_call_backs(call_backs, MACRO_ASSIGN_EXTRA, macro, expr);
1162 int get_implied_return(struct expression *expr, struct range_list **rl)
1164 struct call_back_list *call_backs;
1165 struct fcall_back *tmp;
1166 int handled = 0;
1167 char *fn;
1169 *rl = NULL;
1171 expr = strip_expr(expr);
1172 fn = expr_to_var(expr->fn);
1173 if (!fn)
1174 goto out;
1176 call_backs = search_callback(func_hash, fn);
1178 FOR_EACH_PTR(call_backs, tmp) {
1179 if (tmp->type == IMPLIED_RETURN) {
1180 (tmp->u.implied_return)(expr, tmp->info, rl);
1181 handled = 1;
1183 } END_FOR_EACH_PTR(tmp);
1185 out:
1186 free_string(fn);
1187 return handled;
1190 void create_function_hook_hash(void)
1192 func_hash = create_function_hashtable(5000);
1195 void register_function_hooks(int id)
1197 add_hook(&match_function_call, CALL_HOOK_AFTER_INLINE);
1198 add_hook(&match_assign_call, CALL_ASSIGNMENT_HOOK);
1199 add_hook(&match_macro_assign, MACRO_ASSIGNMENT_HOOK);