4 * Copyright (C) 2010 Dan Carpenter.
6 * Licensed under the Open Software License version 1.1
11 #include "smatch_slist.h"
12 #include "smatch_extra.h"
14 static sval_t
_get_value(struct expression
*expr
, int *undefined
, int implied
);
15 static sval_t
_get_implied_value(struct expression
*expr
, int *undefined
, int implied
);
19 static sval_t zero
= {.type
= &int_ctype
, .value
= 0};
20 static sval_t one
= {.type
= &int_ctype
, .value
= 1};
21 static sval_t bogus
= {.type
= &int_ctype
, .value
= BOGUS
};
29 #define ABSOLUTE_MIN 6
30 #define ABSOLUTE_MAX 7
32 static int opposite_implied(int implied
)
34 if (implied
== IMPLIED_MIN
)
36 if (implied
== IMPLIED_MAX
)
38 if (implied
== ABSOLUTE_MIN
)
40 if (implied
== ABSOLUTE_MAX
)
45 static int last_stmt_sval(struct statement
*stmt
, sval_t
*sval
)
47 struct expression
*expr
;
52 stmt
= last_ptr_list((struct ptr_list
*)stmt
->stmts
);
53 if (stmt
->type
!= STMT_EXPRESSION
)
55 expr
= stmt
->expression
;
56 if (!get_value_sval(expr
, sval
))
61 static sval_t
handle_expression_statement(struct expression
*expr
, int *undefined
, int implied
)
63 struct statement
*stmt
;
66 stmt
= get_expression_statement(expr
);
67 if (!last_stmt_sval(stmt
, &ret
)) {
75 static sval_t
handle_ampersand(int *undefined
, int implied
)
79 ret
.type
= &ptr_ctype
;
82 if (implied
== IMPLIED_MIN
|| implied
== FUZZYMIN
|| implied
== ABSOLUTE_MIN
)
83 return valid_ptr_min_sval
;
84 if (implied
== IMPLIED_MAX
|| implied
== FUZZYMAX
|| implied
== ABSOLUTE_MAX
)
85 return valid_ptr_max_sval
;
91 static sval_t
handle_preop(struct expression
*expr
, int *undefined
, int implied
)
97 ret
= handle_ampersand(undefined
, implied
);
100 ret
= _get_value(expr
->unop
, undefined
, implied
);
101 ret
= sval_preop(ret
, '!');
104 ret
= _get_value(expr
->unop
, undefined
, implied
);
105 ret
= sval_preop(ret
, '~');
106 ret
= sval_cast(ret
, get_type(expr
->unop
));
109 ret
= _get_value(expr
->unop
, undefined
, implied
);
110 ret
= sval_preop(ret
, '-');
113 ret
= _get_implied_value(expr
, undefined
, implied
);
116 ret
= handle_expression_statement(expr
, undefined
, implied
);
120 ret
= sval_blank(expr
);
122 ret
= sval_cast(ret
, get_type(expr
));
126 static sval_t
handle_divide(struct expression
*expr
, int *undefined
, int implied
)
130 left
= _get_value(expr
->left
, undefined
, implied
);
131 right
= _get_value(expr
->right
, undefined
, opposite_implied(implied
));
133 if (right
.value
== 0) {
138 return sval_binop(left
, '/', right
);
141 static sval_t
handle_subtract(struct expression
*expr
, int *undefined
, int implied
)
145 left
= _get_value(expr
->left
, undefined
, implied
);
146 right
= _get_value(expr
->right
, undefined
, opposite_implied(implied
));
148 return sval_binop(left
, '-', right
);
151 static sval_t
handle_binop(struct expression
*expr
, int *undefined
, int implied
)
154 sval_t ret
= {.type
= &int_ctype
, .value
= 123456};
159 left
= _get_value(expr
->left
, &local_undef
, implied
);
161 if (implied
== ABSOLUTE_MIN
) {
162 ret
= sval_blank(expr
->left
);
166 if (implied
!= ABSOLUTE_MAX
)
168 if (!get_absolute_max_sval(expr
->left
, &left
))
171 right
= _get_value(expr
->right
, undefined
, implied
);
172 if (right
.value
== 0)
176 return sval_binop(left
, '%', right
);
179 left
= _get_value(expr
->left
, &local_undef
, implied
);
181 if (implied
== ABSOLUTE_MIN
) {
182 ret
= sval_blank(expr
->left
);
186 if (implied
!= ABSOLUTE_MAX
)
188 if (!get_absolute_max_sval(expr
->left
, &left
))
191 right
= _get_value(expr
->right
, undefined
, implied
);
194 return sval_binop(left
, '&', right
);
196 case SPECIAL_RIGHTSHIFT
:
197 left
= _get_value(expr
->left
, &local_undef
, implied
);
199 if (implied
== ABSOLUTE_MIN
) {
200 ret
= sval_blank(expr
->left
);
204 if (implied
!= ABSOLUTE_MAX
)
206 if (!get_absolute_max_sval(expr
->left
, &left
))
209 right
= _get_value(expr
->right
, undefined
, implied
);
212 return sval_binop(left
, SPECIAL_RIGHTSHIFT
, right
);
215 left
= _get_value(expr
->left
, undefined
, implied
);
216 right
= _get_value(expr
->right
, undefined
, implied
);
223 return handle_divide(expr
, undefined
, implied
);
225 if (right
.value
== 0) {
229 return sval_binop(left
, '%', right
);
232 ret
= handle_subtract(expr
, undefined
, implied
);
235 ret
= sval_binop(left
, expr
->op
, right
);
240 static int do_comparison(struct expression
*expr
)
242 struct range_list_sval
*left_ranges
= NULL
;
243 struct range_list_sval
*right_ranges
= NULL
;
244 int poss_true
, poss_false
;
246 get_implied_range_list_sval(expr
->left
, &left_ranges
);
247 get_implied_range_list_sval(expr
->right
, &right_ranges
);
249 poss_true
= possibly_true_range_lists_sval(left_ranges
, expr
->op
, right_ranges
);
250 poss_false
= possibly_false_range_lists_sval(left_ranges
, expr
->op
, right_ranges
);
252 free_range_list_sval(&left_ranges
);
253 free_range_list_sval(&right_ranges
);
255 if (!poss_true
&& !poss_false
)
257 if (poss_true
&& !poss_false
)
259 if (!poss_true
&& poss_false
)
264 static sval_t
handle_comparison(struct expression
*expr
, int *undefined
, int implied
)
269 if (get_value_sval(expr
->left
, &left
) && get_value_sval(expr
->right
, &right
)) {
270 struct data_range_sval tmp_left
, tmp_right
;
274 tmp_right
.min
= right
;
275 tmp_right
.max
= right
;
276 if (true_comparison_range_sval(&tmp_left
, expr
->op
, &tmp_right
))
281 if (implied
== NOTIMPLIED
) {
286 res
= do_comparison(expr
);
292 if (implied
== IMPLIED_MIN
|| implied
== FUZZYMIN
|| implied
== ABSOLUTE_MIN
)
294 if (implied
== IMPLIED_MAX
|| implied
== FUZZYMAX
|| implied
== ABSOLUTE_MAX
)
301 static sval_t
handle_logical(struct expression
*expr
, int *undefined
, int implied
)
305 if ((implied
== NOTIMPLIED
&& get_value_sval(expr
->left
, &left
) &&
306 get_value_sval(expr
->right
, &right
)) ||
307 (implied
!= NOTIMPLIED
&& get_implied_value_sval(expr
->left
, &left
) &&
308 get_implied_value_sval(expr
->right
, &right
))) {
310 case SPECIAL_LOGICAL_OR
:
311 if (left
.value
|| right
.value
)
314 case SPECIAL_LOGICAL_AND
:
315 if (left
.value
&& right
.value
)
324 if (implied
== IMPLIED_MIN
|| implied
== FUZZYMIN
|| implied
== ABSOLUTE_MIN
)
326 if (implied
== IMPLIED_MAX
|| implied
== FUZZYMAX
|| implied
== ABSOLUTE_MAX
)
333 static sval_t
handle_conditional(struct expression
*expr
, int *undefined
, int implied
)
335 if (known_condition_true(expr
->conditional
))
336 return _get_value(expr
->cond_true
, undefined
, implied
);
337 if (known_condition_false(expr
->conditional
))
338 return _get_value(expr
->cond_false
, undefined
, implied
);
340 if (implied
== NOTIMPLIED
) {
345 if (implied_condition_true(expr
->conditional
))
346 return _get_value(expr
->cond_true
, undefined
, implied
);
347 if (implied_condition_false(expr
->conditional
))
348 return _get_value(expr
->cond_false
, undefined
, implied
);
354 static int get_implied_value_helper(struct expression
*expr
, sval_t
*sval
, int implied
)
356 struct smatch_state
*state
;
360 /* fixme: this should return the casted value */
362 expr
= strip_expr(expr
);
364 if (get_value_sval(expr
, sval
))
367 name
= get_variable_from_expr(expr
, &sym
);
370 *sval
= sval_blank(expr
);
371 state
= get_state(SMATCH_EXTRA
, name
, sym
);
373 if (!state
|| !state
->data
)
375 if (implied
== IMPLIED
) {
376 if (estate_get_single_value_sval(state
, sval
))
380 if (implied
== IMPLIED_MAX
|| implied
== ABSOLUTE_MAX
) {
381 *sval
= estate_max_sval(state
);
382 if (sval_is_max(*sval
)) /* this means just guessing. fixme. not really */
386 *sval
= estate_min_sval(state
);
387 if (sval_is_min(*sval
)) /* fixme */
392 static int is_some_kind_of_max(sval_t sval
)
394 switch (sval
.uvalue
) {
407 static int get_fuzzy_max_helper(struct expression
*expr
, sval_t
*max
)
410 struct sm_state
*tmp
;
413 if (get_implied_max_sval(expr
, &sval
) && !is_some_kind_of_max(sval
)) {
418 sm
= get_sm_state_expr(SMATCH_EXTRA
, expr
);
422 sval
= sval_type_min(estate_type(sm
->state
));
423 FOR_EACH_PTR(sm
->possible
, tmp
) {
426 new_min
= estate_min_sval(tmp
->state
);
427 if (sval_cmp(new_min
, sval
) > 0)
429 } END_FOR_EACH_PTR(tmp
);
431 if (sval_is_min(sval
))
434 *max
= sval_cast(sval
, get_type(expr
));
438 static int get_fuzzy_min_helper(struct expression
*expr
, sval_t
*min
)
441 struct sm_state
*tmp
;
444 if (get_implied_min_sval(expr
, min
))
447 sm
= get_sm_state_expr(SMATCH_EXTRA
, expr
);
451 sval
= sval_type_max(estate_type(sm
->state
));
452 FOR_EACH_PTR(sm
->possible
, tmp
) {
455 new_max
= estate_max_sval(tmp
->state
);
456 if (sval_cmp(new_max
, sval
) < 0)
458 } END_FOR_EACH_PTR(tmp
);
460 if (sval_is_max(sval
))
462 *min
= sval_cast(sval
, get_type(expr
));
466 static sval_t
_get_implied_value(struct expression
*expr
, int *undefined
, int implied
)
470 ret
= sval_blank(expr
);
476 if (!get_implied_value_helper(expr
, &ret
, implied
))
480 if (!get_absolute_min_helper(expr
, &ret
))
484 if (!get_absolute_max_helper(expr
, &ret
))
488 if (!get_fuzzy_max_helper(expr
, &ret
))
492 if (!get_fuzzy_min_helper(expr
, &ret
))
501 static int get_const_value(struct expression
*expr
, sval_t
*sval
)
506 if (expr
->type
!= EXPR_SYMBOL
|| !expr
->symbol
)
509 if (!(sym
->ctype
.modifiers
& MOD_CONST
))
511 if (get_value_sval(sym
->initializer
, &right
)) {
512 *sval
= sval_cast(right
, get_type(expr
));
518 static sval_t
_get_value(struct expression
*expr
, int *undefined
, int implied
)
529 expr
= strip_parens(expr
);
531 switch (expr
->type
) {
533 tmp_ret
= sval_from_val(expr
, expr
->value
);
536 tmp_ret
= handle_preop(expr
, undefined
, implied
);
539 tmp_ret
= _get_value(expr
->unop
, undefined
, implied
);
542 case EXPR_FORCE_CAST
:
543 case EXPR_IMPLIED_CAST
:
544 tmp_ret
= _get_value(expr
->cast_expression
, undefined
, implied
);
545 tmp_ret
= sval_cast(tmp_ret
, get_type(expr
));
548 tmp_ret
= handle_binop(expr
, undefined
, implied
);
551 tmp_ret
= handle_comparison(expr
, undefined
, implied
);
554 tmp_ret
= handle_logical(expr
, undefined
, implied
);
558 tmp_ret
= sval_blank(expr
);
559 tmp_ret
.value
= get_expression_value_nomod(expr
);
562 if (get_const_value(expr
, &tmp_ret
)) {
565 tmp_ret
= _get_implied_value(expr
, undefined
, implied
);
568 case EXPR_CONDITIONAL
:
569 tmp_ret
= handle_conditional(expr
, undefined
, implied
);
572 tmp_ret
= _get_implied_value(expr
, undefined
, implied
);
579 /* returns 1 if it can get a value literal or else returns 0 */
580 int get_value_sval(struct expression
*expr
, sval_t
*sval
)
585 ret
= _get_value(expr
, &undefined
, NOTIMPLIED
);
592 int get_implied_value_sval(struct expression
*expr
, sval_t
*sval
)
597 ret
= _get_value(expr
, &undefined
, IMPLIED
);
604 int get_implied_min_sval(struct expression
*expr
, sval_t
*sval
)
609 ret
= _get_value(expr
, &undefined
, IMPLIED_MIN
);
616 int get_implied_max_sval(struct expression
*expr
, sval_t
*sval
)
621 ret
= _get_value(expr
, &undefined
, IMPLIED_MAX
);
628 int get_fuzzy_min_sval(struct expression
*expr
, sval_t
*sval
)
633 ret
= _get_value(expr
, &undefined
, FUZZYMIN
);
640 int get_fuzzy_max_sval(struct expression
*expr
, sval_t
*sval
)
645 ret
= _get_value(expr
, &undefined
, FUZZYMAX
);
652 int get_absolute_min_sval(struct expression
*expr
, sval_t
*sval
)
657 type
= get_type(expr
);
659 type
= &llong_ctype
; // FIXME: this is wrong but places assume get type can't fail.
660 *sval
= _get_value(expr
, &undefined
, ABSOLUTE_MIN
);
662 *sval
= sval_type_min(type
);
666 if (sval_cmp(*sval
, sval_type_min(type
)) < 0)
667 *sval
= sval_type_min(type
);
671 int get_absolute_max_sval(struct expression
*expr
, sval_t
*sval
)
676 type
= get_type(expr
);
679 *sval
= _get_value(expr
, &undefined
, ABSOLUTE_MAX
);
681 *sval
= sval_type_max(type
);
685 if (sval_cmp(sval_type_max(type
), *sval
) < 0)
686 *sval
= sval_type_max(type
);
690 int known_condition_true(struct expression
*expr
)
697 if (get_value_sval(expr
, &tmp
) && tmp
.value
)
703 int known_condition_false(struct expression
*expr
)
711 if (expr
->type
== EXPR_CALL
) {
712 if (sym_name_is("__builtin_constant_p", expr
->fn
))
718 int implied_condition_true(struct expression
*expr
)
725 if (known_condition_true(expr
))
727 if (get_implied_value_sval(expr
, &tmp
) && tmp
.value
)
730 if (expr
->type
== EXPR_POSTOP
)
731 return implied_condition_true(expr
->unop
);
733 if (expr
->type
== EXPR_PREOP
&& expr
->op
== SPECIAL_DECREMENT
)
734 return implied_not_equal(expr
->unop
, 1);
735 if (expr
->type
== EXPR_PREOP
&& expr
->op
== SPECIAL_INCREMENT
)
736 return implied_not_equal(expr
->unop
, -1);
738 expr
= strip_expr(expr
);
739 switch (expr
->type
) {
741 if (do_comparison(expr
) == 1)
745 if (expr
->op
== '!') {
746 if (implied_condition_false(expr
->unop
))
752 if (implied_not_equal(expr
, 0) == 1)
759 int implied_condition_false(struct expression
*expr
)
761 struct expression
*tmp
;
767 if (known_condition_false(expr
))
770 switch (expr
->type
) {
772 if (do_comparison(expr
) == 2)
775 if (expr
->op
== '!') {
776 if (implied_condition_true(expr
->unop
))
780 tmp
= strip_expr(expr
);
782 return implied_condition_false(tmp
);
785 if (get_implied_value_sval(expr
, &sval
) && sval
.value
== 0)