smatch_extra.c

   1 /*
   2  * sparse/smatch_extra.c
   3  *
   4  * Copyright (C) 2008 Dan Carpenter.
   5  *
   6  * Licensed under the Open Software License version 1.1
   7  *
   8  */
   9
  10 /*
  11  * smatch_extra.c is supposed to track the value of every variable.
  12  *
  13  */
  14
  15 #include <stdlib.h>
  16 #include <errno.h>
  17 #ifndef __USE_ISOC99
  18 #define __USE_ISOC99
  19 #endif
  20 #include <limits.h>
  21 #include "parse.h"
  22 #include "smatch.h"
  23 #include "smatch_slist.h"
  24 #include "smatch_extra.h"
  25
  26 static int my_id;
  27
  28 struct string_list *__ignored_macros = NULL;
  29 static int in_warn_on_macro()
  30 {
  31         struct statement *stmt;
  32         char *tmp;
  33         char *macro;
  34
  35         stmt = get_current_statement();
  36         if (!stmt)
  37                 return 0;
  38         macro = get_macro_name(stmt->pos);
  39         if (!macro)
  40                 return 0;
  41
  42         FOR_EACH_PTR(__ignored_macros, tmp) {
  43                 if (!strcmp(tmp, macro))
  44                         return 1;
  45         } END_FOR_EACH_PTR(tmp);
  46         return 0;
  47 }
  48
  49 typedef void (mod_hook)(const char *name, struct symbol *sym, struct smatch_state *state);
  50 DECLARE_PTR_LIST(void_fn_list, mod_hook *);
  51 static struct void_fn_list *extra_mod_hooks;
  52 void add_extra_mod_hook(mod_hook *fn)
  53 {
  54         mod_hook **p = malloc(sizeof(mod_hook *));
  55         *p = fn;
  56         add_ptr_list(&extra_mod_hooks, p);
  57 }
  58
  59 void call_extra_mod_hooks(const char *name, struct symbol *sym, struct smatch_state *state)
  60 {
  61         mod_hook **fn;
  62
  63         FOR_EACH_PTR(extra_mod_hooks, fn) {
  64                 (*fn)(name, sym, state);
  65         } END_FOR_EACH_PTR(fn);
  66 }
  67
  68 struct sm_state *set_extra_mod(const char *name, struct symbol *sym, struct smatch_state *state)
  69 {
  70         if (in_warn_on_macro())
  71                 return NULL;
  72         remove_from_equiv(name, sym);
  73         call_extra_mod_hooks(name, sym, state);
  74         return set_state(SMATCH_EXTRA, name, sym, state);
  75 }
  76
  77 struct sm_state *set_extra_expr_mod(struct expression *expr, struct smatch_state *state)
  78 {
  79         struct symbol *sym;
  80         char *name;
  81         struct sm_state *ret = NULL;
  82
  83         expr = strip_expr(expr);
  84         name = expr_to_var_sym(expr, &sym);
  85         if (!name || !sym)
  86                 goto free;
  87         ret = set_extra_mod(name, sym, state);
  88 free:
  89         free_string(name);
  90         return ret;
  91 }
  92
  93 void set_extra_nomod(const char *name, struct symbol *sym, struct smatch_state *state)
  94 {
  95         struct relation *rel;
  96         struct smatch_state *orig_state;
  97
  98         orig_state = get_state(SMATCH_EXTRA, name, sym);
  99
 100         if (!estate_related(orig_state)) {
 101                 set_state(SMATCH_EXTRA, name, sym, state);
 102                 return;
 103         }
 104
 105         set_related(state, estate_related(orig_state));
 106         FOR_EACH_PTR(estate_related(orig_state), rel) {
 107                 if (option_debug_related)
 108                         sm_msg("updating related %s to %s", rel->name, state->name);
 109                 set_state(SMATCH_EXTRA, rel->name, rel->sym, state);
 110         } END_FOR_EACH_PTR(rel);
 111 }
 112
 113 /*
 114  * This is for return_implies_state() hooks which modify a SMATCH_EXTRA state
 115  */
 116 void set_extra_expr_nomod(struct expression *expr, struct smatch_state *state)
 117 {
 118         char *name;
 119         struct symbol *sym;
 120
 121         name = expr_to_var_sym(expr, &sym);
 122         if (!name || !sym)
 123                 goto free;
 124         set_extra_nomod(name, sym, state);
 125 free:
 126         free_string(name);
 127
 128 }
 129
 130 static void set_extra_true_false(const char *name, struct symbol *sym,
 131                         struct smatch_state *true_state,
 132                         struct smatch_state *false_state)
 133 {
 134         struct relation *rel;
 135         struct smatch_state *orig_state;
 136
 137         if (in_warn_on_macro())
 138                 return;
 139
 140         orig_state = get_state(SMATCH_EXTRA, name, sym);
 141
 142         if (!estate_related(orig_state)) {
 143                 set_true_false_states(SMATCH_EXTRA, name, sym, true_state, false_state);
 144                 return;
 145         }
 146
 147         if (true_state)
 148                 set_related(true_state, estate_related(orig_state));
 149         if (false_state)
 150                 set_related(false_state, estate_related(orig_state));
 151
 152         FOR_EACH_PTR(estate_related(orig_state), rel) {
 153                 set_true_false_states(SMATCH_EXTRA, rel->name, rel->sym,
 154                                 true_state, false_state);
 155         } END_FOR_EACH_PTR(rel);
 156 }
 157
 158 static void set_extra_expr_true_false(struct expression *expr,
 159                 struct smatch_state *true_state,
 160                 struct smatch_state *false_state)
 161 {
 162         char *name;
 163         struct symbol *sym;
 164
 165         expr = strip_expr(expr);
 166         name = expr_to_var_sym(expr, &sym);
 167         if (!name || !sym)
 168                 goto free;
 169         set_extra_true_false(name, sym, true_state, false_state);
 170 free:
 171         free_string(name);
 172 }
 173
 174 static struct sm_state *handle_canonical_while_count_down(struct statement *loop)
 175 {
 176         struct expression *iter_var;
 177         struct expression *condition;
 178         struct sm_state *sm;
 179         struct smatch_state *estate;
 180         sval_t start;
 181
 182         condition = strip_expr(loop->iterator_pre_condition);
 183         if (!condition)
 184                 return NULL;
 185         if (condition->type != EXPR_PREOP && condition->type != EXPR_POSTOP)
 186                 return NULL;
 187         if (condition->op != SPECIAL_DECREMENT)
 188                 return NULL;
 189
 190         iter_var = condition->unop;
 191         sm = get_sm_state_expr(SMATCH_EXTRA, iter_var);
 192         if (!sm)
 193                 return NULL;
 194         if (sval_cmp_val(estate_min(sm->state), 0) < 0)
 195                 return NULL;
 196         start = estate_max(sm->state);
 197         if  (sval_cmp_val(start, 0) <= 0)
 198                 return NULL;
 199         if (!sval_is_max(start))
 200                 start.value--;
 201
 202         if (condition->type == EXPR_PREOP) {
 203                 estate = alloc_estate_range(sval_type_val(start.type, 1), start);
 204                 if (estate_has_hard_max(sm->state))
 205                         estate_set_hard_max(estate);
 206                 set_extra_expr_mod(iter_var, estate);
 207         }
 208         if (condition->type == EXPR_POSTOP) {
 209                 estate = alloc_estate_range(sval_type_val(start.type, 0), start);
 210                 if (estate_has_hard_max(sm->state))
 211                         estate_set_hard_max(estate);
 212                 set_extra_expr_mod(iter_var, estate);
 213         }
 214         return get_sm_state_expr(SMATCH_EXTRA, iter_var);
 215 }
 216
 217 static struct sm_state *handle_canonical_for_inc(struct expression *iter_expr,
 218                                                 struct expression *condition)
 219 {
 220         struct expression *iter_var;
 221         struct sm_state *sm;
 222         struct smatch_state *estate;
 223         sval_t start, end, dummy;
 224
 225         iter_var = iter_expr->unop;
 226         sm = get_sm_state_expr(SMATCH_EXTRA, iter_var);
 227         if (!sm)
 228                 return NULL;
 229         if (!estate_get_single_value(sm->state, &start))
 230                 return NULL;
 231         if (get_implied_max(condition->right, &end))
 232                 end = sval_cast(get_type(iter_var), end);
 233         else
 234                 end = sval_type_max(get_type(iter_var));
 235
 236         if (get_sm_state_expr(SMATCH_EXTRA, condition->left) != sm)
 237                 return NULL;
 238
 239         switch (condition->op) {
 240         case SPECIAL_NOTEQUAL:
 241         case '<':
 242                 if (!sval_is_min(end))
 243                         end.value--;
 244                 break;
 245         case SPECIAL_LTE:
 246                 break;
 247         default:
 248                 return NULL;
 249         }
 250         if (sval_cmp(end, start) < 0)
 251                 return NULL;
 252         estate = alloc_estate_range(start, end);
 253         if (get_hard_max(condition->right, &dummy))
 254                 estate_set_hard_max(estate);
 255         set_extra_expr_mod(iter_var, estate);
 256         return get_sm_state_expr(SMATCH_EXTRA, iter_var);
 257 }
 258
 259 static struct sm_state *handle_canonical_for_dec(struct expression *iter_expr,
 260                                                 struct expression *condition)
 261 {
 262         struct expression *iter_var;
 263         struct sm_state *sm;
 264         struct smatch_state *estate;
 265         sval_t start, end;
 266
 267         iter_var = iter_expr->unop;
 268         sm = get_sm_state_expr(SMATCH_EXTRA, iter_var);
 269         if (!sm)
 270                 return NULL;
 271         if (!estate_get_single_value(sm->state, &start))
 272                 return NULL;
 273         if (!get_implied_min(condition->right, &end))
 274                 end = sval_type_min(get_type(iter_var));
 275         if (get_sm_state_expr(SMATCH_EXTRA, condition->left) != sm)
 276                 return NULL;
 277
 278         switch (condition->op) {
 279         case SPECIAL_NOTEQUAL:
 280         case '>':
 281                 if (!sval_is_min(end) && !sval_is_max(end))
 282                         end.value++;
 283                 break;
 284         case SPECIAL_GTE:
 285                 break;
 286         default:
 287                 return NULL;
 288         }
 289         if (sval_cmp(end, start) > 0)
 290                 return NULL;
 291         estate = alloc_estate_range(end, start);
 292         estate_set_hard_max(estate);
 293         set_extra_expr_mod(iter_var, estate);
 294         return get_sm_state_expr(SMATCH_EXTRA, iter_var);
 295 }
 296
 297 static struct sm_state *handle_canonical_for_loops(struct statement *loop)
 298 {
 299         struct expression *iter_expr;
 300         struct expression *condition;
 301
 302         if (!loop->iterator_post_statement)
 303                 return NULL;
 304         if (loop->iterator_post_statement->type != STMT_EXPRESSION)
 305                 return NULL;
 306         iter_expr = loop->iterator_post_statement->expression;
 307         if (!loop->iterator_pre_condition)
 308                 return NULL;
 309         if (loop->iterator_pre_condition->type != EXPR_COMPARE)
 310                 return NULL;
 311         condition = loop->iterator_pre_condition;
 312
 313         if (iter_expr->op == SPECIAL_INCREMENT)
 314                 return handle_canonical_for_inc(iter_expr, condition);
 315         if (iter_expr->op == SPECIAL_DECREMENT)
 316                 return handle_canonical_for_dec(iter_expr, condition);
 317         return NULL;
 318 }
 319
 320 struct sm_state *__extra_handle_canonical_loops(struct statement *loop, struct state_list **slist)
 321 {
 322         struct sm_state *ret;
 323
 324         __push_fake_cur_slist();
 325         if (!loop->iterator_post_statement)
 326                 ret = handle_canonical_while_count_down(loop);
 327         else
 328                 ret = handle_canonical_for_loops(loop);
 329         *slist = __pop_fake_cur_slist();
 330         return ret;
 331 }
 332
 333 int __iterator_unchanged(struct sm_state *sm)
 334 {
 335         if (!sm)
 336                 return 0;
 337         if (get_sm_state(my_id, sm->name, sm->sym) == sm)
 338                 return 1;
 339         return 0;
 340 }
 341
 342 static void while_count_down_after(struct sm_state *sm, struct expression *condition)
 343 {
 344         sval_t after_value;
 345
 346         /* paranoid checking.  prolly not needed */
 347         condition = strip_expr(condition);
 348         if (!condition)
 349                 return;
 350         if (condition->type != EXPR_PREOP && condition->type != EXPR_POSTOP)
 351                 return;
 352         if (condition->op != SPECIAL_DECREMENT)
 353                 return;
 354         after_value = estate_min(sm->state);
 355         after_value.value--;
 356         set_extra_mod(sm->name, sm->sym, alloc_estate_sval(after_value));
 357 }
 358
 359 void __extra_pre_loop_hook_after(struct sm_state *sm,
 360                                 struct statement *iterator,
 361                                 struct expression *condition)
 362 {
 363         struct expression *iter_expr;
 364         sval_t limit;
 365         struct smatch_state *state;
 366
 367         if (!iterator) {
 368                 while_count_down_after(sm, condition);
 369                 return;
 370         }
 371
 372         iter_expr = iterator->expression;
 373
 374         if (condition->type != EXPR_COMPARE)
 375                 return;
 376         if (iter_expr->op == SPECIAL_INCREMENT) {
 377                 limit = sval_binop(estate_max(sm->state), '+',
 378                                    sval_type_val(estate_type(sm->state), 1));
 379         } else {
 380                 limit = sval_binop(estate_min(sm->state), '-',
 381                                    sval_type_val(estate_type(sm->state), 1));
 382         }
 383         if (!estate_has_hard_max(sm->state) && !__has_breaks()) {
 384                 if (iter_expr->op == SPECIAL_INCREMENT)
 385                         state = alloc_estate_range(estate_min(sm->state), limit);
 386                 else
 387                         state = alloc_estate_range(limit, estate_max(sm->state));
 388         } else {
 389                 state = alloc_estate_sval(limit);
 390         }
 391         if (!estate_has_hard_max(sm->state))
 392                 estate_clear_hard_max(state);
 393         set_extra_mod(sm->name, sm->sym, state);
 394 }
 395
 396 static struct state_list *unmatched_slist;
 397 static struct smatch_state *unmatched_state(struct sm_state *sm)
 398 {
 399         struct smatch_state *state;
 400
 401         if (unmatched_slist) {
 402                 state = get_state_slist(unmatched_slist, SMATCH_EXTRA, sm->name, sm->sym);
 403                 if (state)
 404                         return state;
 405         }
 406         return alloc_estate_whole(estate_type(sm->state));
 407 }
 408
 409 static void clear_the_pointed_at(struct expression *expr, struct state_list *slist)
 410 {
 411         char *name;
 412         struct symbol *sym;
 413         struct sm_state *tmp;
 414
 415         name = expr_to_var_sym(expr, &sym);
 416         if (!name || !sym)
 417                 goto free;
 418
 419         FOR_EACH_PTR(slist, tmp) {
 420                 if (tmp->name[0] != '*')
 421                         continue;
 422                 if (tmp->sym != sym)
 423                         continue;
 424                 if (strcmp(tmp->name + 1, name) != 0)
 425                         continue;
 426                 set_extra_mod(tmp->name, tmp->sym, alloc_estate_whole(estate_type(tmp->state)));
 427         } END_FOR_EACH_PTR(tmp);
 428
 429 free:
 430         free_string(name);
 431 }
 432
 433 static void match_function_call(struct expression *expr)
 434 {
 435         struct expression *arg;
 436         struct expression *tmp;
 437         struct state_list *slist;
 438
 439         /* if we have the db this is handled in smatch_function_hooks.c */
 440         if (!option_no_db)
 441                 return;
 442         if (inlinable(expr->fn))
 443                 return;
 444
 445         slist = get_all_states(SMATCH_EXTRA);
 446
 447         FOR_EACH_PTR(expr->args, arg) {
 448                 tmp = strip_expr(arg);
 449                 if (tmp->type == EXPR_PREOP && tmp->op == '&')
 450                         set_extra_expr_mod(tmp->unop, alloc_estate_whole(get_type(tmp->unop)));
 451                 else
 452                         clear_the_pointed_at(tmp, slist);
 453         } END_FOR_EACH_PTR(arg);
 454
 455         free_slist(&slist);
 456 }
 457
 458 static int types_equiv_or_pointer(struct symbol *one, struct symbol *two)
 459 {
 460         if (!one || !two)
 461                 return 0;
 462         if (one->type == SYM_PTR && two->type == SYM_PTR)
 463                 return 1;
 464         return types_equiv(one, two);
 465 }
 466
 467 static void match_vanilla_assign(struct expression *left, struct expression *right)
 468 {
 469         struct range_list *rl = NULL;
 470         struct symbol *right_sym;
 471         struct symbol *left_type;
 472         struct symbol *right_type;
 473         char *right_name = NULL;
 474         struct symbol *sym;
 475         char *name;
 476         sval_t tmp;
 477         struct smatch_state *state;
 478
 479         name = expr_to_var_sym(left, &sym);
 480         if (!name)
 481                 return;
 482
 483         left_type = get_type(left);
 484         right_type = get_type(right);
 485
 486         right_name = expr_to_var_sym(right, &right_sym);
 487         if (right_name && right_sym &&
 488             types_equiv_or_pointer(left_type, right_type)) {
 489                 set_equiv(left, right);
 490                 goto free;
 491         }
 492
 493         if (get_implied_rl(right, &rl)) {
 494                 rl = cast_rl(left_type, rl);
 495                 state = alloc_estate_rl(rl);
 496                 if (get_hard_max(right, &tmp))
 497                         estate_set_hard_max(state);
 498         } else {
 499                 rl = alloc_whole_rl(right_type);
 500                 rl = cast_rl(left_type, rl);
 501                 state = alloc_estate_rl(rl);
 502         }
 503         set_extra_mod(name, sym, state);
 504 free:
 505         free_string(right_name);
 506 }
 507
 508 static int op_remove_assign(int op)
 509 {
 510         switch (op) {
 511         case SPECIAL_ADD_ASSIGN:
 512                 return '+';
 513         case SPECIAL_SUB_ASSIGN:
 514                 return '-';
 515         case SPECIAL_MUL_ASSIGN:
 516                 return '*';
 517         case SPECIAL_DIV_ASSIGN:
 518                 return '/';
 519         case SPECIAL_MOD_ASSIGN:
 520                 return '%';
 521         case SPECIAL_AND_ASSIGN:
 522                 return '&';
 523         case SPECIAL_OR_ASSIGN:
 524                 return '|';
 525         case SPECIAL_XOR_ASSIGN:
 526                 return '^';
 527         case SPECIAL_SHL_ASSIGN:
 528                 return SPECIAL_LEFTSHIFT;
 529         case SPECIAL_SHR_ASSIGN:
 530                 return SPECIAL_RIGHTSHIFT;
 531         default:
 532                 return op;
 533         }
 534 }
 535
 536 static void match_assign(struct expression *expr)
 537 {
 538         struct range_list *rl = NULL;
 539         struct expression *left;
 540         struct expression *right;
 541         struct expression *binop_expr;
 542         struct symbol *left_type;
 543         struct symbol *right_type;
 544         struct symbol *sym;
 545         char *name;
 546         sval_t left_min, left_max;
 547         sval_t right_min, right_max;
 548         sval_t res_min, res_max;
 549
 550         left = strip_expr(expr->left);
 551
 552         right = strip_expr(expr->right);
 553         while (right->type == EXPR_ASSIGNMENT && right->op == '=')
 554                 right = strip_expr(right->left);
 555
 556         if (is_condition(expr->right))
 557                 return; /* handled in smatch_condition.c */
 558         if (expr->op == '=' && right->type == EXPR_CALL)
 559                 return; /* handled in smatch_function_hooks.c */
 560         if (expr->op == '=') {
 561                 match_vanilla_assign(left, right);
 562                 return;
 563         }
 564
 565         name = expr_to_var_sym(left, &sym);
 566         if (!name)
 567                 return;
 568
 569         left_type = get_type(left);
 570         right_type = get_type(right);
 571
 572         res_min = sval_type_min(right_type);
 573         res_max = sval_type_max(right_type);
 574
 575         switch (expr->op) {
 576         case SPECIAL_ADD_ASSIGN:
 577                 get_absolute_max(left, &left_max);
 578                 get_absolute_max(right, &right_max);
 579                 if (sval_binop_overflows(left_max, '+', right_max))
 580                         break;
 581                 if (get_implied_min(left, &left_min) &&
 582                     !sval_is_negative_min(left_min) &&
 583                     get_implied_min(right, &right_min) &&
 584                     !sval_is_negative_min(right_min)) {
 585                         res_min = sval_binop(left_min, '+', right_min);
 586                         res_min = sval_cast(right_type, res_min);
 587                 }
 588                 if (inside_loop())  /* we are assuming loops don't lead to wrapping */
 589                         break;
 590                 res_max = sval_binop(left_max, '+', right_max);
 591                 res_max = sval_cast(right_type, res_max);
 592                 break;
 593         case SPECIAL_SUB_ASSIGN:
 594                 if (get_implied_max(left, &left_max) &&
 595                     !sval_is_max(left_max) &&
 596                     get_implied_min(right, &right_min) &&
 597                     !sval_is_min(right_min)) {
 598                         res_max = sval_binop(left_max, '-', right_min);
 599                         res_max = sval_cast(right_type, res_max);
 600                 }
 601                 if (inside_loop())
 602                         break;
 603                 if (get_implied_min(left, &left_min) &&
 604                     !sval_is_min(left_min) &&
 605                     get_implied_max(right, &right_max) &&
 606                     !sval_is_max(right_max)) {
 607                         res_min = sval_binop(left_min, '-', right_max);
 608                         res_min = sval_cast(right_type, res_min);
 609                 }
 610                 break;
 611         case SPECIAL_AND_ASSIGN:
 612         case SPECIAL_MOD_ASSIGN:
 613                 binop_expr = binop_expression(expr->left,
 614                                               op_remove_assign(expr->op),
 615                                               expr->right);
 616                 if (get_implied_rl(binop_expr, &rl)) {
 617                         rl = cast_rl(left_type, rl);
 618                         set_extra_mod(name, sym, alloc_estate_rl(rl));
 619                         goto free;
 620                 }
 621         }
 622         rl = cast_rl(left_type, alloc_rl(res_min, res_max));
 623         set_extra_mod(name, sym, alloc_estate_rl(rl));
 624 free:
 625         free_string(name);
 626 }
 627
 628 static struct smatch_state *increment_state(struct smatch_state *state)
 629 {
 630         sval_t min = estate_min(state);
 631         sval_t max = estate_max(state);
 632
 633         if (!estate_rl(state))
 634                 return NULL;
 635
 636         if (inside_loop())
 637                 max = sval_type_max(max.type);
 638
 639         if (!sval_is_min(min) && !sval_is_max(min))
 640                 min.value++;
 641         if (!sval_is_min(max) && !sval_is_max(max))
 642                 max.value++;
 643         return alloc_estate_range(min, max);
 644 }
 645
 646 static struct smatch_state *decrement_state(struct smatch_state *state)
 647 {
 648         sval_t min = estate_min(state);
 649         sval_t max = estate_max(state);
 650
 651         if (!estate_rl(state))
 652                 return NULL;
 653
 654         if (inside_loop())
 655                 min = sval_type_min(min.type);
 656
 657         if (!sval_is_min(min) && !sval_is_max(min))
 658                 min.value--;
 659         if (!sval_is_min(max) && !sval_is_max(max))
 660                 max.value--;
 661         return alloc_estate_range(min, max);
 662 }
 663
 664 static void unop_expr(struct expression *expr)
 665 {
 666         struct smatch_state *state;
 667
 668         if (expr->smatch_flags & Handled)
 669                 return;
 670
 671         switch (expr->op) {
 672         case SPECIAL_INCREMENT:
 673                 state = get_state_expr(SMATCH_EXTRA, expr->unop);
 674                 state = increment_state(state);
 675                 if (!state)
 676                         state = alloc_estate_whole(get_type(expr));
 677                 set_extra_expr_mod(expr->unop, state);
 678                 break;
 679         case SPECIAL_DECREMENT:
 680                 state = get_state_expr(SMATCH_EXTRA, expr->unop);
 681                 state = decrement_state(state);
 682                 if (!state)
 683                         state = alloc_estate_whole(get_type(expr));
 684                 set_extra_expr_mod(expr->unop, state);
 685                 break;
 686         default:
 687                 return;
 688         }
 689 }
 690
 691 static void asm_expr(struct statement *stmt)
 692 {
 693
 694         struct expression *expr;
 695         struct symbol *type;
 696         int state = 0;
 697
 698         FOR_EACH_PTR(stmt->asm_outputs, expr) {
 699                 switch (state) {
 700                 case 0: /* identifier */
 701                 case 1: /* constraint */
 702                         state++;
 703                         continue;
 704                 case 2: /* expression */
 705                         state = 0;
 706                         type = get_type(strip_expr(expr));
 707                         set_extra_expr_mod(expr, alloc_estate_whole(type));
 708                         continue;
 709                 }
 710         } END_FOR_EACH_PTR(expr);
 711 }
 712
 713 static void delete_state_tracker(struct tracker *t)
 714 {
 715         remove_from_equiv(t->name, t->sym);
 716         delete_state(t->owner, t->name, t->sym);
 717 }
 718
 719 static void scoped_state_extra(const char *name, struct symbol *sym)
 720 {
 721         struct tracker *t;
 722
 723         t = alloc_tracker(SMATCH_EXTRA, name, sym);
 724         add_scope_hook((scope_hook *)&delete_state_tracker, t);
 725 }
 726
 727 static void match_declarations(struct symbol *sym)
 728 {
 729         const char *name;
 730
 731         if (sym->ident) {
 732                 name = sym->ident->name;
 733                 if (!sym->initializer) {
 734                         set_state(SMATCH_EXTRA, name, sym, alloc_estate_whole(get_real_base_type(sym)));
 735                         scoped_state_extra(name, sym);
 736                 }
 737         }
 738 }
 739
 740 static void check_dereference(struct expression *expr)
 741 {
 742         if (outside_of_function())
 743                 return;
 744         set_extra_expr_nomod(expr, alloc_estate_range(valid_ptr_min_sval, valid_ptr_max_sval));
 745 }
 746
 747 static void match_dereferences(struct expression *expr)
 748 {
 749         if (expr->type != EXPR_PREOP)
 750                 return;
 751         check_dereference(expr->unop);
 752 }
 753
 754 static void match_pointer_as_array(struct expression *expr)
 755 {
 756         if (!is_array(expr))
 757                 return;
 758         check_dereference(expr->unop->left);
 759 }
 760
 761 static void set_param_dereferenced(struct expression *arg, char *unused)
 762 {
 763         check_dereference(arg);
 764 }
 765
 766 static void match_function_def(struct symbol *sym)
 767 {
 768         struct symbol *arg;
 769
 770         FOR_EACH_PTR(sym->ctype.base_type->arguments, arg) {
 771                 if (!arg->ident)
 772                         continue;
 773                 set_state(my_id, arg->ident->name, arg, alloc_estate_whole(get_real_base_type(arg)));
 774         } END_FOR_EACH_PTR(arg);
 775 }
 776
 777 static sval_t add_one(sval_t sval)
 778 {
 779         sval.value++;
 780         return sval;
 781 }
 782
 783 static sval_t sub_one(sval_t sval)
 784 {
 785         sval.value--;
 786         return sval;
 787 }
 788
 789 static void handle_comparison(struct symbol *type, struct expression *left, int op, struct expression *right)
 790 {
 791         struct range_list *left_orig;
 792         struct range_list *left_true;
 793         struct range_list *left_false;
 794         struct range_list *right_orig;
 795         struct range_list *right_true;
 796         struct range_list *right_false;
 797         struct smatch_state *left_true_state;
 798         struct smatch_state *left_false_state;
 799         struct smatch_state *right_true_state;
 800         struct smatch_state *right_false_state;
 801         sval_t min, max, dummy;
 802         int left_postop = 0;
 803         int right_postop = 0;
 804
 805         if (left->op == SPECIAL_INCREMENT || left->op == SPECIAL_DECREMENT) {
 806                 if (left->type == EXPR_POSTOP) {
 807                         left->smatch_flags |= Handled;
 808                         left_postop = left->op;
 809                 }
 810                 left = strip_expr(left->unop);
 811         }
 812         while (left->type == EXPR_ASSIGNMENT)
 813                 left = strip_expr(left->left);
 814
 815         if (right->op == SPECIAL_INCREMENT || right->op == SPECIAL_DECREMENT) {
 816                 if (right->type == EXPR_POSTOP) {
 817                         right->smatch_flags |= Handled;
 818                         right_postop = right->op;
 819                 }
 820                 right = strip_expr(right->unop);
 821         }
 822
 823         if (get_implied_rl(left, &left_orig)) {
 824                 left_orig = cast_rl(type, left_orig);
 825         } else {
 826                 min = sval_type_min(get_type(left));
 827                 max = sval_type_max(get_type(left));
 828                 left_orig = cast_rl(type, alloc_rl(min, max));
 829         }
 830
 831         if (get_implied_rl(right, &right_orig)) {
 832                 right_orig = cast_rl(type, right_orig);
 833         } else {
 834                 min = sval_type_min(get_type(right));
 835                 max = sval_type_max(get_type(right));
 836                 right_orig = cast_rl(type, alloc_rl(min, max));
 837         }
 838         min = sval_type_min(type);
 839         max = sval_type_max(type);
 840
 841         left_true = clone_rl(left_orig);
 842         left_false = clone_rl(left_orig);
 843         right_true = clone_rl(right_orig);
 844         right_false = clone_rl(right_orig);
 845
 846         switch (op) {
 847         case '<':
 848         case SPECIAL_UNSIGNED_LT:
 849                 left_true = remove_range(left_orig, rl_max(right_orig), max);
 850                 if (!sval_is_min(rl_min(right_orig))) {
 851                         left_false = remove_range(left_orig, min, sub_one(rl_min(right_orig)));
 852                 }
 853
 854                 right_true = remove_range(right_orig, min, rl_min(left_orig));
 855                 if (!sval_is_max(rl_max(left_orig)))
 856                         right_false = remove_range(right_orig, add_one(rl_max(left_orig)), max);
 857                 break;
 858         case SPECIAL_UNSIGNED_LTE:
 859         case SPECIAL_LTE:
 860                 if (!sval_is_max(rl_max(right_orig)))
 861                         left_true = remove_range(left_orig, add_one(rl_max(right_orig)), max);
 862                 left_false = remove_range(left_orig, min, rl_min(right_orig));
 863
 864                 if (!sval_is_min(rl_min(left_orig)))
 865                         right_true = remove_range(right_orig, min, sub_one(rl_min(left_orig)));
 866                 right_false = remove_range(right_orig, rl_max(left_orig), max);
 867
 868                 if (sval_cmp(rl_min(left_orig), rl_min(right_orig)) == 0)
 869                         left_false = remove_range(left_false, rl_min(left_orig), rl_min(left_orig));
 870                 if (sval_cmp(rl_max(left_orig), rl_max(right_orig)) == 0)
 871                         right_false = remove_range(right_false, rl_max(left_orig), rl_max(left_orig));
 872                 break;
 873         case SPECIAL_EQUAL:
 874                 if (!sval_is_max(rl_max(right_orig))) {
 875                         left_true = remove_range(left_true, add_one(rl_max(right_orig)), max);
 876                 }
 877                 if (!sval_is_min(rl_min(right_orig))) {
 878                         left_true = remove_range(left_true, min, sub_one(rl_min(right_orig)));
 879                 }
 880                 if (sval_cmp(rl_min(right_orig), rl_max(right_orig)) == 0)
 881                         left_false = remove_range(left_orig, rl_min(right_orig), rl_min(right_orig));
 882
 883                 if (!sval_is_max(rl_max(left_orig)))
 884                         right_true = remove_range(right_true, add_one(rl_max(left_orig)), max);
 885                 if (!sval_is_min(rl_min(left_orig)))
 886                         right_true = remove_range(right_true, min, sub_one(rl_min(left_orig)));
 887                 if (sval_cmp(rl_min(left_orig), rl_max(left_orig)) == 0)
 888                         right_false = remove_range(right_orig, rl_min(left_orig), rl_min(left_orig));
 889                 break;
 890         case SPECIAL_UNSIGNED_GTE:
 891         case SPECIAL_GTE:
 892                 if (!sval_is_min(rl_min(right_orig)))
 893                         left_true = remove_range(left_orig, min, sub_one(rl_min(right_orig)));
 894                 left_false = remove_range(left_orig, rl_max(right_orig), max);
 895
 896                 if (!sval_is_max(rl_max(left_orig)))
 897                         right_true = remove_range(right_orig, add_one(rl_max(left_orig)), max);
 898                 right_false = remove_range(right_orig, min, rl_min(left_orig));
 899
 900                 if (sval_cmp(rl_min(left_orig), rl_min(right_orig)) == 0)
 901                         right_false = remove_range(right_false, rl_min(left_orig), rl_min(left_orig));
 902                 if (sval_cmp(rl_max(left_orig), rl_max(right_orig)) == 0)
 903                         left_false = remove_range(left_false, rl_max(left_orig), rl_max(left_orig));
 904                 break;
 905         case '>':
 906         case SPECIAL_UNSIGNED_GT:
 907                 left_true = remove_range(left_orig, min, rl_min(right_orig));
 908                 if (!sval_is_max(rl_max(right_orig)))
 909                         left_false = remove_range(left_orig, add_one(rl_max(right_orig)), max);
 910
 911                 right_true = remove_range(right_orig, rl_max(left_orig), max);
 912                 if (!sval_is_min(rl_min(left_orig)))
 913                         right_false = remove_range(right_orig, min, sub_one(rl_min(left_orig)));
 914                 break;
 915         case SPECIAL_NOTEQUAL:
 916                 if (!sval_is_max(rl_max(right_orig)))
 917                         left_false = remove_range(left_false, add_one(rl_max(right_orig)), max);
 918                 if (!sval_is_min(rl_min(right_orig)))
 919                         left_false = remove_range(left_false, min, sub_one(rl_min(right_orig)));
 920                 if (sval_cmp(rl_min(right_orig), rl_max(right_orig)) == 0)
 921                         left_true = remove_range(left_orig, rl_min(right_orig), rl_min(right_orig));
 922
 923                 if (!sval_is_max(rl_max(left_orig)))
 924                         right_false = remove_range(right_false, add_one(rl_max(left_orig)), max);
 925                 if (!sval_is_min(rl_min(left_orig)))
 926                         right_false = remove_range(right_false, min, sub_one(rl_min(left_orig)));
 927                 if (sval_cmp(rl_min(left_orig), rl_max(left_orig)) == 0)
 928                         right_true = remove_range(right_orig, rl_min(left_orig), rl_min(left_orig));
 929                 break;
 930         default:
 931                 return;
 932         }
 933
 934         left_true = rl_truncate_cast(get_type(left), left_true);
 935         left_false = rl_truncate_cast(get_type(left), left_false);
 936         right_true = rl_truncate_cast(get_type(right), right_true);
 937         right_false = rl_truncate_cast(get_type(right), right_false);
 938
 939         left_true_state = alloc_estate_rl(left_true);
 940         left_false_state = alloc_estate_rl(left_false);
 941         right_true_state = alloc_estate_rl(right_true);
 942         right_false_state = alloc_estate_rl(right_false);
 943
 944         switch (op) {
 945         case '<':
 946         case SPECIAL_UNSIGNED_LT:
 947         case SPECIAL_UNSIGNED_LTE:
 948         case SPECIAL_LTE:
 949                 if (get_hard_max(right, &dummy))
 950                         estate_set_hard_max(left_true_state);
 951                 if (get_hard_max(left, &dummy))
 952                         estate_set_hard_max(right_false_state);
 953                 break;
 954         case '>':
 955         case SPECIAL_UNSIGNED_GT:
 956         case SPECIAL_UNSIGNED_GTE:
 957         case SPECIAL_GTE:
 958                 if (get_hard_max(left, &dummy))
 959                         estate_set_hard_max(right_true_state);
 960                 if (get_hard_max(right, &dummy))
 961                         estate_set_hard_max(left_false_state);
 962                 break;
 963         }
 964
 965         if (get_hard_max(left, &dummy)) {
 966                 estate_set_hard_max(left_true_state);
 967                 estate_set_hard_max(left_false_state);
 968         }
 969         if (get_hard_max(right, &dummy)) {
 970                 estate_set_hard_max(right_true_state);
 971                 estate_set_hard_max(right_false_state);
 972         }
 973
 974         if (left_postop == SPECIAL_INCREMENT) {
 975                 left_true_state = increment_state(left_true_state);
 976                 left_false_state = increment_state(left_false_state);
 977         }
 978         if (left_postop == SPECIAL_DECREMENT) {
 979                 left_true_state = decrement_state(left_true_state);
 980                 left_false_state = decrement_state(left_false_state);
 981         }
 982         if (right_postop == SPECIAL_INCREMENT) {
 983                 right_true_state = increment_state(right_true_state);
 984                 right_false_state = increment_state(right_false_state);
 985         }
 986         if (right_postop == SPECIAL_DECREMENT) {
 987                 right_true_state = decrement_state(right_true_state);
 988                 right_false_state = decrement_state(right_false_state);
 989         }
 990
 991         set_extra_expr_true_false(left, left_true_state, left_false_state);
 992         set_extra_expr_true_false(right, right_true_state, right_false_state);
 993 }
 994
 995 static int opposite_op(int op)
 996 {
 997         switch (op) {
 998         case '+':
 999                 return '-';
1000         case '-':
1001                 return '+';
1002         }
1003         return 0;
1004 }
1005
1006 static int is_simple_math(struct expression *expr)
1007 {
1008         if (!expr)
1009                 return 0;
1010         if (expr->type != EXPR_BINOP)
1011                 return 0;
1012         if (!opposite_op(expr->op))
1013                 return 0;
1014         return 1;
1015 }
1016
1017 static void move_known_values(struct expression **left_p, struct expression **right_p)
1018 {
1019         struct expression *left = *left_p;
1020         struct expression *right = *right_p;
1021         sval_t sval;
1022
1023         if (get_implied_value(left, &sval)) {
1024                 if (!is_simple_math(right))
1025                         return;
1026                 if (right->op == '+' && get_value(right->left, &sval)) {
1027                         *left_p = binop_expression(left, opposite_op(right->op), right->left);
1028                         *right_p = right->right;
1029                         return;
1030                 }
1031                 if (get_value(right->right, &sval)) {
1032                         *left_p = binop_expression(left, opposite_op(right->op), right->right);
1033                         *right_p = right->left;
1034                         return;
1035                 }
1036                 return;
1037         }
1038         if (get_implied_value(right, &sval)) {
1039                 if (!is_simple_math(left))
1040                         return;
1041                 if (left->op == '+' && get_value(left->left, &sval)) {
1042                         *right_p = binop_expression(right, opposite_op(left->op), left->left);
1043                         *left_p = left->right;
1044                         return;
1045                 }
1046
1047                 if (get_value(left->right, &sval)) {
1048                         *right_p = binop_expression(right, opposite_op(left->op), left->right);
1049                         *left_p = left->left;
1050                         return;
1051                 }
1052                 return;
1053         }
1054 }
1055
1056 static int match_func_comparison(struct expression *expr)
1057 {
1058         struct expression *left = strip_expr(expr->left);
1059         struct expression *right = strip_expr(expr->right);
1060         sval_t sval;
1061
1062         /*
1063          * fixme: think about this harder. We should always be trying to limit
1064          * the non-call side as well.  If we can't determine the limitter does
1065          * that mean we aren't querying the database and are missing important
1066          * information?
1067          */
1068
1069         if (left->type == EXPR_CALL) {
1070                 if (get_implied_value(left, &sval)) {
1071                         handle_comparison(get_type(expr), left, expr->op, right);
1072                         return 1;
1073                 }
1074                 if (!get_implied_value(right, &sval))
1075                         return 1;
1076                 function_comparison(expr->op, left, sval, 1);
1077                 return 1;
1078         }
1079
1080         if (right->type == EXPR_CALL) {
1081                 if (get_implied_value(right, &sval)) {
1082                         handle_comparison(get_type(expr), left, expr->op, right);
1083                         return 1;
1084                 }
1085                 if (!get_implied_value(left, &sval))
1086                         return 1;
1087                 function_comparison(expr->op, right, sval, 0);
1088                 return 1;
1089         }
1090
1091         return 0;
1092 }
1093
1094 static void match_comparison(struct expression *expr)
1095 {
1096         struct expression *left_orig = strip_expr(expr->left);
1097         struct expression *right_orig = strip_expr(expr->right);
1098         struct expression *left, *right;
1099         struct expression *prev;
1100         struct symbol *type;
1101
1102         if (match_func_comparison(expr))
1103                 return;
1104
1105         type = get_type(expr);
1106         if (!type)
1107                 type = &llong_ctype;
1108
1109         left = left_orig;
1110         right = right_orig;
1111         move_known_values(&left, &right);
1112         handle_comparison(type, left, expr->op, right);
1113
1114         prev = get_assigned_expr(left_orig);
1115         if (is_simple_math(prev) && has_variable(prev, left_orig) == 0) {
1116                 left = prev;
1117                 right = right_orig;
1118                 move_known_values(&left, &right);
1119                 handle_comparison(type, left, expr->op, right);
1120         }
1121
1122         prev = get_assigned_expr(right_orig);
1123         if (is_simple_math(prev) && has_variable(prev, right_orig) == 0) {
1124                 left = left_orig;
1125                 right = prev;
1126                 move_known_values(&left, &right);
1127                 handle_comparison(type, left, expr->op, right);
1128         }
1129 }
1130
1131 static void handle_AND_condition(struct expression *expr)
1132 {
1133         struct range_list *rl = NULL;
1134         sval_t known;
1135
1136         if (get_implied_value(expr->left, &known) && known.value > 0) {
1137                 known.value--;
1138                 get_absolute_rl(expr->right, &rl);
1139                 rl = remove_range(rl, sval_type_val(known.type, 0), known);
1140                 set_extra_expr_true_false(expr->right, alloc_estate_rl(rl), NULL);
1141                 return;
1142         }
1143
1144         if (get_implied_value(expr->right, &known) && known.value > 0) {
1145                 known.value--;
1146                 get_absolute_rl(expr->left, &rl);
1147                 rl = remove_range(rl, sval_type_val(known.type, 0), known);
1148                 set_extra_expr_true_false(expr->left, alloc_estate_rl(rl), NULL);
1149                 return;
1150         }
1151 }
1152
1153 /* this is actually hooked from smatch_implied.c...  it's hacky, yes */
1154 void __extra_match_condition(struct expression *expr)
1155 {
1156         struct symbol *sym;
1157         char *name;
1158         struct smatch_state *pre_state;
1159         struct smatch_state *true_state;
1160         struct smatch_state *false_state;
1161
1162         expr = strip_expr(expr);
1163         switch (expr->type) {
1164         case EXPR_CALL:
1165                 function_comparison(SPECIAL_NOTEQUAL, expr, ll_to_sval(0), 1);
1166                 return;
1167         case EXPR_PREOP:
1168         case EXPR_SYMBOL:
1169         case EXPR_DEREF: {
1170                 sval_t zero;
1171
1172                 zero = sval_blank(expr);
1173                 zero.value = 0;
1174
1175                 name = expr_to_var_sym(expr, &sym);
1176                 if (!name)
1177                         return;
1178                 pre_state = get_state(my_id, name, sym);
1179                 true_state = estate_filter_sval(pre_state, zero);
1180                 if (possibly_true(expr, SPECIAL_EQUAL, zero_expr()))
1181                         false_state = alloc_estate_sval(zero);
1182                 else
1183                         false_state = alloc_estate_empty();
1184                 set_extra_true_false(name, sym, true_state, false_state);
1185                 free_string(name);
1186                 return;
1187         }
1188         case EXPR_COMPARE:
1189                 match_comparison(expr);
1190                 return;
1191         case EXPR_ASSIGNMENT:
1192                 __extra_match_condition(expr->left);
1193                 return;
1194         case EXPR_BINOP:
1195                 if (expr->op == '&')
1196                         handle_AND_condition(expr);
1197                 return;
1198         }
1199 }
1200
1201 /* returns 1 if it is not possible for expr to be value, otherwise returns 0 */
1202 int implied_not_equal(struct expression *expr, long long val)
1203 {
1204         return !possibly_false(expr, SPECIAL_NOTEQUAL, value_expr(val));
1205 }
1206
1207 static void struct_member_callback(struct expression *call, int param, char *printed_name, struct smatch_state *state)
1208 {
1209         if (estate_is_whole(state))
1210                 return;
1211         sql_insert_caller_info(call, PARAM_VALUE, param, printed_name, state->name);
1212 }
1213
1214 static void db_limited_before(void)
1215 {
1216         unmatched_slist = clone_slist(__get_cur_slist());
1217 }
1218
1219 static void db_limited_after(void)
1220 {
1221         free_slist(&unmatched_slist);
1222 }
1223
1224 static void db_param_limit_filter(struct expression *expr, int param, char *key, char *value, int mod)
1225 {
1226         struct expression *arg;
1227         char *name;
1228         struct symbol *sym;
1229         struct sm_state *sm;
1230         struct symbol *type;
1231         struct range_list *rl;
1232         struct range_list *limit;
1233         struct range_list *new;
1234
1235         while (expr->type == EXPR_ASSIGNMENT)
1236                 expr = strip_expr(expr->right);
1237         if (expr->type != EXPR_CALL)
1238                 return;
1239
1240         arg = get_argument_from_call_expr(expr->args, param);
1241         if (!arg)
1242                 return;
1243
1244         name = get_variable_from_key(arg, key, &sym);
1245         if (!name || !sym)
1246                 goto free;
1247
1248         sm = get_sm_state(SMATCH_EXTRA, name, sym);
1249         type = get_member_type_from_key(arg, key);
1250         if (sm)
1251                 rl = estate_rl(sm->state);
1252         else
1253                 rl = alloc_whole_rl(type);
1254
1255         call_results_to_rl(expr, type, value, &limit);
1256         new = rl_intersection(rl, limit);
1257
1258         /* We want to preserve the implications here */
1259         if (sm && rl_equiv(estate_rl(sm->state), new)) {
1260                 __set_sm(sm);
1261         } else {
1262                 if (mod)
1263                         set_extra_mod(name, sym, alloc_estate_rl(new));
1264                 else
1265                         set_extra_nomod(name, sym, alloc_estate_rl(new));
1266         }
1267
1268 free:
1269         free_string(name);
1270 }
1271
1272 static void db_param_limit(struct expression *expr, int param, char *key, char *value)
1273 {
1274         db_param_limit_filter(expr, param, key, value, 0);
1275 }
1276
1277 static void db_param_filter(struct expression *expr, int param, char *key, char *value)
1278 {
1279         db_param_limit_filter(expr, param, key, value, 1);
1280 }
1281
1282 static void db_param_add(struct expression *expr, int param, char *key, char *value)
1283 {
1284         struct expression *arg;
1285         char *name;
1286         struct symbol *sym;
1287         struct symbol *type;
1288         struct smatch_state *state;
1289         struct range_list *added = NULL;
1290         struct range_list *new;
1291
1292         while (expr->type == EXPR_ASSIGNMENT)
1293                 expr = strip_expr(expr->right);
1294         if (expr->type != EXPR_CALL)
1295                 return;
1296
1297         arg = get_argument_from_call_expr(expr->args, param);
1298         if (!arg)
1299                 return;
1300         name = get_variable_from_key(arg, key, &sym);
1301         if (!name || !sym)
1302                 goto free;
1303
1304         type = get_member_type_from_key(arg, key);
1305         state = get_state(SMATCH_EXTRA, name, sym);
1306         if (state) {
1307                 call_results_to_rl(expr, type, value, &added);
1308                 new = rl_union(estate_rl(state), added);
1309         } else {
1310                 new = alloc_whole_rl(type);
1311         }
1312
1313         set_extra_mod(name, sym, alloc_estate_rl(new));
1314 free:
1315         free_string(name);
1316 }
1317
1318 static void db_returned_member_info(struct expression *expr, int param, char *key, char *value)
1319 {
1320         struct symbol *type;
1321         struct symbol *sym;
1322         char *name;
1323         struct range_list *rl;
1324
1325         if (expr->type != EXPR_ASSIGNMENT)
1326                 return;
1327
1328         name = return_state_to_var_sym(expr, param, key, &sym);
1329         if (!name || !sym)
1330                 goto free;
1331         type = get_member_type_from_key(expr->left, key);
1332         if (!type)
1333                 return;
1334         call_results_to_rl(expr->right, type, value, &rl);
1335         set_extra_mod(name, sym, alloc_estate_rl(rl));
1336
1337 free:
1338         free_string(name);
1339 }
1340
1341 static void returned_member_callback(int return_id, char *return_ranges, char *printed_name, struct smatch_state *state)
1342 {
1343         if (estate_is_whole(state))
1344                 return;
1345
1346         /* these are handled in smatch_param_filter/set/limit.c */
1347         if (printed_name[0] != '*' &&
1348             !strchr(printed_name, '.') && !strchr(printed_name, '-'))
1349                 return;
1350
1351         sql_insert_return_states(return_id, return_ranges, RETURN_VALUE, -1,
1352                         printed_name, state->name);
1353 }
1354
1355 static void match_call_info(struct expression *expr)
1356 {
1357         struct range_list *rl = NULL;
1358         struct expression *arg;
1359         struct symbol *type;
1360         int i = 0;
1361
1362         FOR_EACH_PTR(expr->args, arg) {
1363                 type = get_arg_type(expr->fn, i);
1364
1365                 if (get_implied_rl(arg, &rl))
1366                         rl = cast_rl(type, rl);
1367                 else
1368                         rl = cast_rl(type, alloc_whole_rl(get_type(arg)));
1369
1370                 sql_insert_caller_info(expr, PARAM_VALUE, i, "$$", show_rl(rl));
1371                 i++;
1372         } END_FOR_EACH_PTR(arg);
1373 }
1374
1375 static void set_param_value(const char *name, struct symbol *sym, char *key, char *value)
1376 {
1377         struct range_list *rl = NULL;
1378         struct smatch_state *state;
1379         struct symbol *type;
1380         char fullname[256];
1381
1382         if (strcmp(key, "*$$") == 0)
1383                 snprintf(fullname, sizeof(fullname), "*%s", name);
1384         else if (strncmp(key, "$$", 2) == 0)
1385                 snprintf(fullname, 256, "%s%s", name, key + 2);
1386         else
1387                 return;
1388
1389         type = get_member_type_from_key(symbol_expression(sym), key);
1390         str_to_rl(type, value, &rl);
1391         state = alloc_estate_rl(rl);
1392         set_state(SMATCH_EXTRA, fullname, sym, state);
1393 }
1394
1395 void register_smatch_extra(int id)
1396 {
1397         my_id = id;
1398
1399         add_merge_hook(my_id, &merge_estates);
1400         add_unmatched_state_hook(my_id, &unmatched_state);
1401         add_hook(&match_function_def, FUNC_DEF_HOOK);
1402         add_hook(&match_declarations, DECLARATION_HOOK);
1403         select_caller_info_hook(set_param_value, PARAM_VALUE);
1404         select_return_states_hook(RETURN_VALUE, &db_returned_member_info);
1405         select_return_states_before(&db_limited_before);
1406         select_return_states_hook(LIMITED_VALUE, &db_param_limit);
1407         select_return_states_hook(FILTER_VALUE, &db_param_filter);
1408         select_return_states_hook(ADDED_VALUE, &db_param_add);
1409         select_return_states_after(&db_limited_after);
1410 }
1411
1412 void register_smatch_extra_late(int id)
1413 {
1414         add_hook(&match_dereferences, DEREF_HOOK);
1415         add_hook(&match_pointer_as_array, OP_HOOK);
1416         select_call_implies_hook(DEREFERENCE, &set_param_dereferenced);
1417         add_hook(&match_function_call, FUNCTION_CALL_HOOK);
1418         add_hook(&match_assign, ASSIGNMENT_HOOK);
1419         add_hook(&unop_expr, OP_HOOK);
1420         add_hook(&asm_expr, ASM_HOOK);
1421
1422         add_hook(&match_call_info, FUNCTION_CALL_HOOK);
1423         add_member_info_callback(my_id, struct_member_callback);
1424         add_returned_member_callback(my_id, returned_member_callback);
1425 }