?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
modification_hooks: handle PARAM_SET earlier
[smatch.git] / smatch_db.c
bloba467b2fb45f9a0b1b103cc6cfbffe9ff078eef42
1 /*
2 * Copyright (C) 2010 Dan Carpenter.
3 *
4 * This program is free software; you can redistribute it and/or
5 * modify it under the terms of the GNU General Public License
6 * as published by the Free Software Foundation; either version 2
7 * of the License, or (at your option) any later version.
8 *
9 * This program is distributed in the hope that it will be useful,
10 * but WITHOUT ANY WARRANTY; without even the implied warranty of
11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12 * GNU General Public License for more details.
13 *
14 * You should have received a copy of the GNU General Public License
15 * along with this program; if not, see http://www.gnu.org/copyleft/gpl.txt
16 */
17
18 #include <string.h>
19 #include <errno.h>
20 #include <sqlite3.h>
21 #include <unistd.h>
22 #include <ctype.h>
23 #include "smatch.h"
24 #include "smatch_slist.h"
25 #include "smatch_extra.h"
26
27 static sqlite3 *db;
28 static sqlite3 *mem_db;
29
30 static int return_id;
31
32 #define sql_insert_helper(table, ignore, values...) \
33 do { \
34 if (__inline_fn) { \
35 char buf[1024]; \
36 char *err, *p = buf; \
37 int rc; \
38 \
39 if (!mem_db) \
40 break; \
41 \
42 p += snprintf(p, buf + sizeof(buf) - p, \
43 "insert %sinto %s values (", \
44 ignore ? "or ignore " : "", #table); \
45 p += snprintf(p, buf + sizeof(buf) - p, values); \
46 p += snprintf(p, buf + sizeof(buf) - p, ");"); \
47 sm_debug("in-mem: %s\n", buf); \
48 rc = sqlite3_exec(mem_db, buf, NULL, NULL, &err); \
49 if (rc != SQLITE_OK) { \
50 fprintf(stderr, "SQL error #2: %s\n", err); \
51 fprintf(stderr, "SQL: '%s'\n", buf); \
52 parse_error = 1; \
53 } \
54 break; \
55 } \
56 if (option_info) { \
57 FILE *tmp_fd = sm_outfd; \
58 sm_outfd = sql_outfd; \
59 sm_prefix(); \
60 sm_printf("SQL: insert %sinto " #table " values(", \
61 ignore ? "or ignore " : ""); \
62 sm_printf(values); \
63 sm_printf(");\n"); \
64 sm_outfd = tmp_fd; \
65 } \
66 } while (0)
67
68 #define sql_insert(table, values...) sql_insert_helper(table, 0, values);
69 #define sql_insert_or_ignore(table, values...) sql_insert_helper(table, 1, values);
70
71 struct def_callback {
72 int hook_type;
73 void (*callback)(const char *name, struct symbol *sym, char *key, char *value);
74 };
75 ALLOCATOR(def_callback, "definition db hook callbacks");
76 DECLARE_PTR_LIST(callback_list, struct def_callback);
77 static struct callback_list *select_caller_info_callbacks;
78
79 struct member_info_callback {
80 int owner;
81 void (*callback)(struct expression *call, int param, char *printed_name, struct sm_state *sm);
82 };
83 ALLOCATOR(member_info_callback, "caller_info callbacks");
84 DECLARE_PTR_LIST(member_info_cb_list, struct member_info_callback);
85 static struct member_info_cb_list *member_callbacks;
86
87 struct returned_state_callback {
88 void (*callback)(int return_id, char *return_ranges, struct expression *return_expr);
89 };
90 ALLOCATOR(returned_state_callback, "returned state callbacks");
91 DECLARE_PTR_LIST(returned_state_cb_list, struct returned_state_callback);
92 static struct returned_state_cb_list *returned_state_callbacks;
93
94 struct returned_member_callback {
95 int owner;
96 void (*callback)(int return_id, char *return_ranges, struct expression *expr, char *printed_name, struct smatch_state *state);
97 };
98 ALLOCATOR(returned_member_callback, "returned member callbacks");
99 DECLARE_PTR_LIST(returned_member_cb_list, struct returned_member_callback);
100 static struct returned_member_cb_list *returned_member_callbacks;
101
102 struct call_implies_callback {
103 int type;
104 void (*callback)(struct expression *call, struct expression *arg, char *key, char *value);
105 };
106 ALLOCATOR(call_implies_callback, "call_implies callbacks");
107 DECLARE_PTR_LIST(call_implies_cb_list, struct call_implies_callback);
108 static struct call_implies_cb_list *call_implies_cb_list;
109
110 static int print_sql_output(void *unused, int argc, char **argv, char **azColName)
111 {
112 int i;
113
114 for (i = 0; i < argc; i++) {
115 if (i != 0)
116 printf(", ");
117 sm_printf("%s", argv[i]);
118 }
119 sm_printf("\n");
120 return 0;
121 }
122
123 void debug_sql(const char *sql)
124 {
125 if (!option_debug)
126 return;
127 sm_msg("%s", sql);
128 sql_exec(print_sql_output, NULL, sql);
129 }
130
131 void debug_mem_sql(const char *sql)
132 {
133 if (!option_debug)
134 return;
135 sm_msg("%s", sql);
136 sql_mem_exec(print_sql_output, NULL, sql);
137 }
138
139 void sql_exec(int (*callback)(void*, int, char**, char**), void *data, const char *sql)
140 {
141 char *err = NULL;
142 int rc;
143
144 if (option_no_db || !db)
145 return;
146
147 rc = sqlite3_exec(db, sql, callback, data, &err);
148 if (rc != SQLITE_OK && !parse_error) {
149 fprintf(stderr, "SQL error #2: %s\n", err);
150 fprintf(stderr, "SQL: '%s'\n", sql);
151 parse_error = 1;
152 }
153 }
154
155 void sql_mem_exec(int (*callback)(void*, int, char**, char**), void *data, const char *sql)
156 {
157 char *err = NULL;
158 int rc;
159
160 if (!mem_db)
161 return;
162
163 rc = sqlite3_exec(mem_db, sql, callback, data, &err);
164 if (rc != SQLITE_OK) {
165 fprintf(stderr, "SQL error #2: %s\n", err);
166 fprintf(stderr, "SQL: '%s'\n", sql);
167 parse_error = 1;
168 }
169 }
170
171 static int replace_count;
172 static char **replace_table;
173 static const char *replace_return_ranges(const char *return_ranges)
174 {
175 int i;
176
177 if (!get_function()) {
178 /* I have no idea why EXPORT_SYMBOL() is here */
179 return return_ranges;
180 }
181 for (i = 0; i < replace_count; i += 3) {
182 if (strcmp(replace_table[i + 0], get_function()) == 0) {
183 if (strcmp(replace_table[i + 1], return_ranges) == 0)
184 return replace_table[i + 2];
185 }
186 }
187 return return_ranges;
188 }
189
190 void sql_insert_return_states(int return_id, const char *return_ranges,
191 int type, int param, const char *key, const char *value)
192 {
193 if (key && strlen(key) >= 80)
194 return;
195 return_ranges = replace_return_ranges(return_ranges);
196 sql_insert(return_states, "'%s', '%s', %lu, %d, '%s', %d, %d, %d, '%s', '%s'",
197 get_base_file(), get_function(), (unsigned long)__inline_fn,
198 return_id, return_ranges, fn_static(), type, param, key, value);
199 }
200
201 static struct string_list *common_funcs;
202 static int is_common_function(const char *fn)
203 {
204 char *tmp;
205
206 if (!fn)
207 return 0;
208
209 if (strncmp(fn, "__builtin_", 10) == 0)
210 return 1;
211
212 FOR_EACH_PTR(common_funcs, tmp) {
213 if (strcmp(tmp, fn) == 0)
214 return 1;
215 } END_FOR_EACH_PTR(tmp);
216
217 return 0;
218 }
219
220 static char *function_signature(void)
221 {
222 return type_to_str(get_real_base_type(cur_func_sym));
223 }
224
225 void sql_insert_caller_info(struct expression *call, int type,
226 int param, const char *key, const char *value)
227 {
228 FILE *tmp_fd = sm_outfd;
229 char *fn;
230
231 if (!option_info && !__inline_call)
232 return;
233
234 if (key && strlen(key) >= 80)
235 return;
236
237 fn = get_fnptr_name(call->fn);
238 if (!fn)
239 return;
240
241 if (__inline_call) {
242 mem_sql(NULL, NULL,
243 "insert into caller_info values ('%s', '%s', '%s', %lu, %d, %d, %d, '%s', '%s');",
244 get_base_file(), get_function(), fn, (unsigned long)call,
245 is_static(call->fn), type, param, key, value);
246 }
247
248 if (!option_info)
249 return;
250
251 if (strncmp(fn, "__builtin_", 10) == 0)
252 return;
253 if (type != INTERNAL && is_common_function(fn))
254 return;
255
256 sm_outfd = caller_info_fd;
257 sm_msg("SQL_caller_info: insert into caller_info values ("
258 "'%s', '%s', '%s', %%CALL_ID%%, %d, %d, %d, '%s', '%s');",
259 get_base_file(), get_function(), fn, is_static(call->fn),
260 type, param, key, value);
261 sm_outfd = tmp_fd;
262
263 free_string(fn);
264 }
265
266 void sql_insert_function_ptr(const char *fn, const char *struct_name)
267 {
268 sql_insert(function_ptr, "'%s', '%s', '%s', 0", get_base_file(), fn,
269 struct_name);
270 }
271
272 void sql_insert_call_implies(int type, int param, const char *key, const char *value)
273 {
274 sql_insert(call_implies, "'%s', '%s', %lu, %d, %d, %d, '%s', '%s'", get_base_file(),
275 get_function(), (unsigned long)__inline_fn, fn_static(),
276 type, param, key, value);
277 }
278
279 void sql_insert_function_type_size(const char *member, const char *ranges)
280 {
281 sql_insert(function_type_size, "'%s', '%s', '%s', '%s'", get_base_file(), get_function(), member, ranges);
282 }
283
284 void sql_insert_local_values(const char *name, const char *value)
285 {
286 sql_insert(local_values, "'%s', '%s', '%s'", get_base_file(), name, value);
287 }
288
289 void sql_insert_function_type_value(const char *type, const char *value)
290 {
291 sql_insert(function_type_value, "'%s', '%s', '%s', '%s'", get_base_file(), get_function(), type, value);
292 }
293
294 void sql_insert_function_type(int param, const char *value)
295 {
296 sql_insert(function_type, "'%s', '%s', %d, %d, '%s'",
297 get_base_file(), get_function(), fn_static(), param, value);
298 }
299
300 void sql_insert_parameter_name(int param, const char *value)
301 {
302 sql_insert(parameter_name, "'%s', '%s', %d, %d, '%s'",
303 get_base_file(), get_function(), fn_static(), param, value);
304 }
305
306 void sql_insert_data_info(struct expression *data, int type, const char *value)
307 {
308 char *data_name;
309
310 data_name = get_data_info_name(data);
311 if (!data_name)
312 return;
313 sql_insert(data_info, "'%s', '%s', %d, '%s'",
314 is_static(data) ? get_base_file() : "extern",
315 data_name, type, value);
316 }
317
318 void sql_insert_data_info_var_sym(const char *var, struct symbol *sym, int type, const char *value)
319 {
320 sql_insert(data_info, "'%s', '%s', %d, '%s'",
321 (sym->ctype.modifiers & MOD_STATIC) ? get_base_file() : "extern",
322 var, type, value);
323 }
324
325 void sql_save_constraint(const char *con)
326 {
327 if (!option_info)
328 return;
329
330 sm_msg("SQL: insert or ignore into constraints (str) values('%s');", con);
331 }
332
333 void sql_save_constraint_required(const char *data, int op, const char *limit)
334 {
335 sql_insert_or_ignore(constraints_required, "'%s', '%s', '%s'", data, show_special(op), limit);
336 }
337
338 void sql_insert_fn_ptr_data_link(const char *ptr, const char *data)
339 {
340 sql_insert(fn_ptr_data_link, "'%s', '%s'", ptr, data);
341 }
342
343 void sql_insert_fn_data_link(struct expression *fn, int type, int param, const char *key, const char *value)
344 {
345 if (fn->type != EXPR_SYMBOL || !fn->symbol->ident)
346 return;
347
348 sql_insert(fn_data_link, "'%s', '%s', %d, %d, %d, '%s', '%s'",
349 (fn->symbol->ctype.modifiers & MOD_STATIC) ? get_base_file() : "extern",
350 fn->symbol->ident->name,
351 !!(fn->symbol->ctype.modifiers & MOD_STATIC),
352 type, param, key, value);
353 }
354
355 char *get_static_filter(struct symbol *sym)
356 {
357 static char sql_filter[1024];
358
359 /* This can only happen on buggy code. Return invalid SQL. */
360 if (!sym) {
361 sql_filter[0] = '\0';
362 return sql_filter;
363 }
364
365 if (sym->ctype.modifiers & MOD_STATIC) {
366 snprintf(sql_filter, sizeof(sql_filter),
367 "file = '%s' and function = '%s' and static = '1'",
368 get_base_file(), sym->ident->name);
369 } else {
370 snprintf(sql_filter, sizeof(sql_filter),
371 "function = '%s' and static = '0'", sym->ident->name);
372 }
373
374 return sql_filter;
375 }
376
377 static int get_row_count(void *_row_count, int argc, char **argv, char **azColName)
378 {
379 int *row_count = _row_count;
380
381 *row_count = 0;
382 if (argc != 1)
383 return 0;
384 *row_count = atoi(argv[0]);
385 return 0;
386 }
387
388 static void mark_params_untracked(struct expression *call)
389 {
390 struct expression *arg;
391 int i = 0;
392
393 FOR_EACH_PTR(call->args, arg) {
394 mark_untracked(call, i++, "$", NULL);
395 } END_FOR_EACH_PTR(arg);
396 }
397
398 static void sql_select_return_states_pointer(const char *cols,
399 struct expression *call, int (*callback)(void*, int, char**, char**), void *info)
400 {
401 char *ptr;
402 int return_count = 0;
403
404 ptr = get_fnptr_name(call->fn);
405 if (!ptr)
406 return;
407
408 run_sql(get_row_count, &return_count,
409 "select count(*) from return_states join function_ptr "
410 "where return_states.function == function_ptr.function and "
411 "ptr = '%s' and searchable = 1 and type = %d;", ptr, INTERNAL);
412 /* The magic number 100 is just from testing on the kernel. */
413 if (return_count > 100) {
414 mark_params_untracked(call);
415 return;
416 }
417
418 run_sql(callback, info,
419 "select %s from return_states join function_ptr where "
420 "return_states.function == function_ptr.function and ptr = '%s' "
421 "and searchable = 1 "
422 "order by function_ptr.file, return_states.file, return_id, type;",
423 cols, ptr);
424 }
425
426 static int is_local_symbol(struct expression *expr)
427 {
428 if (expr->type != EXPR_SYMBOL)
429 return 0;
430 if (expr->symbol->ctype.modifiers & (MOD_NONLOCAL | MOD_STATIC | MOD_ADDRESSABLE))
431 return 0;
432 return 1;
433 }
434
435 void sql_select_return_states(const char *cols, struct expression *call,
436 int (*callback)(void*, int, char**, char**), void *info)
437 {
438 int row_count = 0;
439
440 if (is_fake_call(call))
441 return;
442
443 if (call->fn->type != EXPR_SYMBOL || !call->fn->symbol || is_local_symbol(call->fn)) {
444 sql_select_return_states_pointer(cols, call, callback, info);
445 return;
446 }
447
448 if (inlinable(call->fn)) {
449 mem_sql(callback, info,
450 "select %s from return_states where call_id = '%lu' order by return_id, type;",
451 cols, (unsigned long)call);
452 return;
453 }
454
455 run_sql(get_row_count, &row_count, "select count(*) from return_states where %s;",
456 get_static_filter(call->fn->symbol));
457 if (row_count > 3000)
458 return;
459
460 run_sql(callback, info, "select %s from return_states where %s order by file, return_id, type;",
461 cols, get_static_filter(call->fn->symbol));
462 }
463
464 void sql_select_call_implies(const char *cols, struct expression *call,
465 int (*callback)(void*, int, char**, char**))
466 {
467 if (call->fn->type != EXPR_SYMBOL || !call->fn->symbol)
468 return;
469
470 if (inlinable(call->fn)) {
471 mem_sql(callback, call,
472 "select %s from call_implies where call_id = '%lu';",
473 cols, (unsigned long)call);
474 return;
475 }
476
477 run_sql(callback, call, "select %s from call_implies where %s;",
478 cols, get_static_filter(call->fn->symbol));
479 }
480
481 struct select_caller_info_data {
482 struct stree *final_states;
483 int prev_func_id;
484 int ignore;
485 int results;
486 };
487
488 static void sql_select_caller_info(struct select_caller_info_data *data,
489 const char *cols, struct symbol *sym,
490 int (*callback)(void*, int, char**, char**))
491 {
492 if (__inline_fn) {
493 mem_sql(callback, data,
494 "select %s from caller_info where call_id = %lu;",
495 cols, (unsigned long)__inline_fn);
496 return;
497 }
498
499 if (sym->ident->name && is_common_function(sym->ident->name))
500 return;
501 run_sql(callback, data,
502 "select %s from common_caller_info where %s order by call_id;",
503 cols, get_static_filter(sym));
504 if (data->results)
505 return;
506
507 run_sql(callback, data,
508 "select %s from caller_info where %s order by call_id;",
509 cols, get_static_filter(sym));
510 }
511
512 void select_caller_info_hook(void (*callback)(const char *name, struct symbol *sym, char *key, char *value), int type)
513 {
514 struct def_callback *def_callback = __alloc_def_callback(0);
515
516 def_callback->hook_type = type;
517 def_callback->callback = callback;
518 add_ptr_list(&select_caller_info_callbacks, def_callback);
519 }
520
521 /*
522 * These call backs are used when the --info option is turned on to print struct
523 * member information. For example foo->bar could have a state in
524 * smatch_extra.c and also check_user.c.
525 */
526 void add_member_info_callback(int owner, void (*callback)(struct expression *call, int param, char *printed_name, struct sm_state *sm))
527 {
528 struct member_info_callback *member_callback = __alloc_member_info_callback(0);
529
530 member_callback->owner = owner;
531 member_callback->callback = callback;
532 add_ptr_list(&member_callbacks, member_callback);
533 }
534
535 void add_split_return_callback(void (*fn)(int return_id, char *return_ranges, struct expression *returned_expr))
536 {
537 struct returned_state_callback *callback = __alloc_returned_state_callback(0);
538
539 callback->callback = fn;
540 add_ptr_list(&returned_state_callbacks, callback);
541 }
542
543 void add_returned_member_callback(int owner, void (*callback)(int return_id, char *return_ranges, struct expression *expr, char *printed_name, struct smatch_state *state))
544 {
545 struct returned_member_callback *member_callback = __alloc_returned_member_callback(0);
546
547 member_callback->owner = owner;
548 member_callback->callback = callback;
549 add_ptr_list(&returned_member_callbacks, member_callback);
550 }
551
552 void select_call_implies_hook(int type, void (*callback)(struct expression *call, struct expression *arg, char *key, char *value))
553 {
554 struct call_implies_callback *cb = __alloc_call_implies_callback(0);
555
556 cb->type = type;
557 cb->callback = callback;
558 add_ptr_list(&call_implies_cb_list, cb);
559 }
560
561 struct return_info {
562 struct expression *static_returns_call;
563 struct symbol *return_type;
564 struct range_list *return_range_list;
565 };
566
567 static int db_return_callback(void *_ret_info, int argc, char **argv, char **azColName)
568 {
569 struct return_info *ret_info = _ret_info;
570 struct range_list *rl;
571 struct expression *call_expr = ret_info->static_returns_call;
572
573 if (argc != 1)
574 return 0;
575 call_results_to_rl(call_expr, ret_info->return_type, argv[0], &rl);
576 ret_info->return_range_list = rl_union(ret_info->return_range_list, rl);
577 return 0;
578 }
579
580 struct range_list *db_return_vals(struct expression *expr)
581 {
582 struct return_info ret_info = {};
583 char buf[64];
584 struct sm_state *sm;
585
586 if (is_fake_call(expr))
587 return NULL;
588
589 snprintf(buf, sizeof(buf), "return %p", expr);
590 sm = get_sm_state(SMATCH_EXTRA, buf, NULL);
591 if (sm)
592 return clone_rl(estate_rl(sm->state));
593 ret_info.static_returns_call = expr;
594 ret_info.return_type = get_type(expr);
595 if (!ret_info.return_type)
596 return NULL;
597
598 if (expr->fn->type != EXPR_SYMBOL || !expr->fn->symbol)
599 return NULL;
600
601 ret_info.return_range_list = NULL;
602 if (inlinable(expr->fn)) {
603 mem_sql(db_return_callback, &ret_info,
604 "select distinct return from return_states where call_id = '%lu';",
605 (unsigned long)expr);
606 } else {
607 run_sql(db_return_callback, &ret_info,
608 "select distinct return from return_states where %s;",
609 get_static_filter(expr->fn->symbol));
610 }
611 return ret_info.return_range_list;
612 }
613
614 struct range_list *db_return_vals_from_str(const char *fn_name)
615 {
616 struct return_info ret_info;
617
618 ret_info.static_returns_call = NULL;
619 ret_info.return_type = &llong_ctype;
620 ret_info.return_range_list = NULL;
621
622 run_sql(db_return_callback, &ret_info,
623 "select distinct return from return_states where function = '%s';",
624 fn_name);
625 return ret_info.return_range_list;
626 }
627
628 static void match_call_marker(struct expression *expr)
629 {
630 struct symbol *type;
631
632 type = get_type(expr->fn);
633 if (type && type->type == SYM_PTR)
634 type = get_real_base_type(type);
635
636 /*
637 * we just want to record something in the database so that if we have
638 * two calls like: frob(4); frob(some_unkown); then on the receiving
639 * side we know that sometimes frob is called with unknown parameters.
640 */
641
642 sql_insert_caller_info(expr, INTERNAL, -1, "%call_marker%", type_to_str(type));
643 }
644
645 static char *show_offset(int offset)
646 {
647 static char buf[64];
648
649 buf[0] = '\0';
650 if (offset != -1)
651 snprintf(buf, sizeof(buf), "(-%d)", offset);
652 return buf;
653 }
654
655 static void print_struct_members(struct expression *call, struct expression *expr, int param, int offset, struct stree *stree,
656 void (*callback)(struct expression *call, int param, char *printed_name, struct sm_state *sm))
657 {
658 struct sm_state *sm;
659 char *name;
660 struct symbol *sym;
661 int len;
662 char printed_name[256];
663 int is_address = 0;
664
665 expr = strip_expr(expr);
666 if (expr->type == EXPR_PREOP && expr->op == '&') {
667 expr = strip_expr(expr->unop);
668 is_address = 1;
669 }
670
671 name = expr_to_var_sym(expr, &sym);
672 if (!name || !sym)
673 goto free;
674
675 len = strlen(name);
676 FOR_EACH_SM(stree, sm) {
677 if (sm->sym != sym)
678 continue;
679 if (strcmp(name, sm->name) == 0) {
680 if (is_address)
681 snprintf(printed_name, sizeof(printed_name), "*$%s", show_offset(offset));
682 else /* these are already handled. fixme: handle them here */
683 continue;
684 } else if (sm->name[0] == '*' && strcmp(name, sm->name + 1) == 0) {
685 snprintf(printed_name, sizeof(printed_name), "*$%s", show_offset(offset));
686 } else if (strncmp(name, sm->name, len) == 0) {
687 if (isalnum(sm->name[len]))
688 continue;
689 if (is_address)
690 snprintf(printed_name, sizeof(printed_name), "$%s->%s", show_offset(offset), sm->name + len + 1);
691 else
692 snprintf(printed_name, sizeof(printed_name), "$%s%s", show_offset(offset), sm->name + len);
693 } else {
694 continue;
695 }
696 callback(call, param, printed_name, sm);
697 } END_FOR_EACH_SM(sm);
698 free:
699 free_string(name);
700 }
701
702 static int param_used_callback(void *_container, int argc, char **argv, char **azColName)
703 {
704 char **container = _container;
705 static char buf[256];
706
707 snprintf(buf, sizeof(buf), "%s", argv[0]);
708 *container = buf;
709 return 0;
710 }
711
712 static void print_container_struct_members(struct expression *call, struct expression *expr, int param, struct stree *stree,
713 void (*callback)(struct expression *call, int param, char *printed_name, struct sm_state *sm))
714 {
715 struct expression *tmp;
716 char *container = NULL;
717 int offset;
718 int holder_offset;
719 char *p;
720
721 if (!call->fn || call->fn->type != EXPR_SYMBOL)
722 return;
723
724 /*
725 * We can't use the in-mem DB because we have to parse the function
726 * first, then we know if it takes a container, then we know to pass it
727 * the container data.
728 *
729 */
730 run_sql(&param_used_callback, &container,
731 "select key from call_implies where %s and type = %d and key like '%%$(%%' and parameter = %d limit 1;",
732 get_static_filter(call->fn->symbol), CONTAINER, param);
733 if (!container)
734 return;
735
736 p = strchr(container, '-');
737 if (!p)
738 return;
739 offset = atoi(p);
740 p = strchr(p, ')');
741 if (!p)
742 return;
743 p++;
744
745 tmp = get_assigned_expr(expr);
746 if (tmp)
747 expr = tmp;
748
749 if (expr->type != EXPR_PREOP || expr->op != '&')
750 return;
751 expr = strip_expr(expr->unop);
752 holder_offset = get_member_offset_from_deref(expr);
753 if (-holder_offset != offset)
754 return;
755
756 expr = strip_expr(expr->deref);
757 if (expr->type == EXPR_PREOP && expr->op == '*')
758 expr = strip_expr(expr->unop);
759
760 print_struct_members(call, expr, param, holder_offset, stree, callback);
761 }
762
763 static void match_call_info(struct expression *call)
764 {
765 struct member_info_callback *cb;
766 struct expression *arg;
767 struct stree *stree;
768 char *name;
769 int i;
770
771 name = get_fnptr_name(call->fn);
772 if (!name)
773 return;
774
775 FOR_EACH_PTR(member_callbacks, cb) {
776 stree = get_all_states_stree(cb->owner);
777 i = 0;
778 FOR_EACH_PTR(call->args, arg) {
779 print_struct_members(call, arg, i, -1, stree, cb->callback);
780 print_container_struct_members(call, arg, i, stree, cb->callback);
781 i++;
782 } END_FOR_EACH_PTR(arg);
783 free_stree(&stree);
784 } END_FOR_EACH_PTR(cb);
785
786 free_string(name);
787 }
788
789 static int get_param(int param, char **name, struct symbol **sym)
790 {
791 struct symbol *arg;
792 int i;
793
794 i = 0;
795 FOR_EACH_PTR(cur_func_sym->ctype.base_type->arguments, arg) {
796 /*
797 * this is a temporary hack to work around a bug (I think in sparse?)
798 * 2.6.37-rc1:fs/reiserfs/journal.o
799 * If there is a function definition without parameter name found
800 * after a function implementation then it causes a crash.
801 * int foo() {}
802 * int bar(char *);
803 */
804 if (arg->ident->name < (char *)100)
805 continue;
806 if (i == param) {
807 *name = arg->ident->name;
808 *sym = arg;
809 return TRUE;
810 }
811 i++;
812 } END_FOR_EACH_PTR(arg);
813
814 return FALSE;
815 }
816
817 static int function_signature_matches(const char *sig)
818 {
819 char *my_sig;
820
821 my_sig = function_signature();
822 if (!sig || !my_sig)
823 return 1; /* default to matching */
824 if (strcmp(my_sig, sig) == 0)
825 return 1;
826 return 0;
827 }
828
829 static int caller_info_callback(void *_data, int argc, char **argv, char **azColName)
830 {
831 struct select_caller_info_data *data = _data;
832 int func_id;
833 long type;
834 long param;
835 char *key;
836 char *value;
837 char *name = NULL;
838 struct symbol *sym = NULL;
839 struct def_callback *def_callback;
840 struct stree *stree;
841
842 data->results = 1;
843
844 if (argc != 5)
845 return 0;
846
847 func_id = atoi(argv[0]);
848 errno = 0;
849 type = strtol(argv[1], NULL, 10);
850 param = strtol(argv[2], NULL, 10);
851 if (errno)
852 return 0;
853 key = argv[3];
854 value = argv[4];
855
856 if (data->prev_func_id == -1)
857 data->prev_func_id = func_id;
858 if (func_id != data->prev_func_id) {
859 stree = __pop_fake_cur_stree();
860 if (!data->ignore)
861 merge_stree(&data->final_states, stree);
862 free_stree(&stree);
863 __push_fake_cur_stree();
864 __unnullify_path();
865 data->prev_func_id = func_id;
866 data->ignore = 0;
867 }
868
869 if (data->ignore)
870 return 0;
871 if (type == INTERNAL &&
872 !function_signature_matches(value)) {
873 data->ignore = 1;
874 return 0;
875 }
876
877 if (param >= 0 && !get_param(param, &name, &sym))
878 return 0;
879
880 FOR_EACH_PTR(select_caller_info_callbacks, def_callback) {
881 if (def_callback->hook_type == type)
882 def_callback->callback(name, sym, key, value);
883 } END_FOR_EACH_PTR(def_callback);
884
885 return 0;
886 }
887
888 static void get_direct_callers(struct select_caller_info_data *data, struct symbol *sym)
889 {
890 sql_select_caller_info(data,
891 "call_id, type, parameter, key, value", sym,
892 caller_info_callback);
893 }
894
895 static struct string_list *ptr_names_done;
896 static struct string_list *ptr_names;
897
898 static int get_ptr_name(void *unused, int argc, char **argv, char **azColName)
899 {
900 insert_string(&ptr_names, alloc_string(argv[0]));
901 return 0;
902 }
903
904 static char *get_next_ptr_name(void)
905 {
906 char *ptr;
907
908 FOR_EACH_PTR(ptr_names, ptr) {
909 if (list_has_string(ptr_names_done, ptr))
910 continue;
911 insert_string(&ptr_names_done, ptr);
912 return ptr;
913 } END_FOR_EACH_PTR(ptr);
914 return NULL;
915 }
916
917 static void get_ptr_names(const char *file, const char *name)
918 {
919 char sql_filter[1024];
920 int before, after;
921
922 if (file) {
923 snprintf(sql_filter, 1024, "file = '%s' and function = '%s';",
924 file, name);
925 } else {
926 snprintf(sql_filter, 1024, "function = '%s';", name);
927 }
928
929 before = ptr_list_size((struct ptr_list *)ptr_names);
930
931 run_sql(get_ptr_name, NULL,
932 "select distinct ptr from function_ptr where %s",
933 sql_filter);
934
935 after = ptr_list_size((struct ptr_list *)ptr_names);
936 if (before == after)
937 return;
938
939 while ((name = get_next_ptr_name()))
940 get_ptr_names(NULL, name);
941 }
942
943 static void match_data_from_db(struct symbol *sym)
944 {
945 struct select_caller_info_data data = { .prev_func_id = -1 };
946 struct sm_state *sm;
947 struct stree *stree;
948
949 if (!sym || !sym->ident)
950 return;
951
952 __push_fake_cur_stree();
953 __unnullify_path();
954
955 if (!__inline_fn) {
956 char *ptr;
957
958 if (sym->ctype.modifiers & MOD_STATIC)
959 get_ptr_names(get_base_file(), sym->ident->name);
960 else
961 get_ptr_names(NULL, sym->ident->name);
962
963 if (ptr_list_size((struct ptr_list *)ptr_names) > 20) {
964 __free_ptr_list((struct ptr_list **)&ptr_names);
965 __free_ptr_list((struct ptr_list **)&ptr_names_done);
966 stree = __pop_fake_cur_stree();
967 free_stree(&stree);
968 return;
969 }
970
971 get_direct_callers(&data, sym);
972
973 stree = __pop_fake_cur_stree();
974 if (!data.ignore)
975 merge_stree(&data.final_states, stree);
976 free_stree(&stree);
977 __push_fake_cur_stree();
978 __unnullify_path();
979 data.prev_func_id = -1;
980 data.ignore = 0;
981
982 FOR_EACH_PTR(ptr_names, ptr) {
983 run_sql(caller_info_callback, &data,
984 "select call_id, type, parameter, key, value"
985 " from common_caller_info where function = '%s' order by call_id",
986 ptr);
987 } END_FOR_EACH_PTR(ptr);
988
989 if (data.results) {
990 FOR_EACH_PTR(ptr_names, ptr) {
991 free_string(ptr);
992 } END_FOR_EACH_PTR(ptr);
993 goto free_ptr_names;
994 }
995
996 FOR_EACH_PTR(ptr_names, ptr) {
997 run_sql(caller_info_callback, &data,
998 "select call_id, type, parameter, key, value"
999 " from caller_info where function = '%s' order by call_id",
1000 ptr);
1001 free_string(ptr);
1002 } END_FOR_EACH_PTR(ptr);
1003
1004 free_ptr_names:
1005 __free_ptr_list((struct ptr_list **)&ptr_names);
1006 __free_ptr_list((struct ptr_list **)&ptr_names_done);
1007 } else {
1008 get_direct_callers(&data, sym);
1009 }
1010
1011 stree = __pop_fake_cur_stree();
1012 if (!data.ignore)
1013 merge_stree(&data.final_states, stree);
1014 free_stree(&stree);
1015
1016 FOR_EACH_SM(data.final_states, sm) {
1017 __set_sm(sm);
1018 } END_FOR_EACH_SM(sm);
1019
1020 free_stree(&data.final_states);
1021 }
1022
1023 static int call_implies_callbacks(void *_call, int argc, char **argv, char **azColName)
1024 {
1025 struct expression *call_expr = _call;
1026 struct call_implies_callback *cb;
1027 struct expression *arg = NULL;
1028 int type;
1029 int param;
1030
1031 if (argc != 5)
1032 return 0;
1033
1034 type = atoi(argv[1]);
1035 param = atoi(argv[2]);
1036
1037 FOR_EACH_PTR(call_implies_cb_list, cb) {
1038 if (cb->type != type)
1039 continue;
1040 if (param != -1) {
1041 arg = get_argument_from_call_expr(call_expr->args, param);
1042 if (!arg)
1043 continue;
1044 }
1045 cb->callback(call_expr, arg, argv[3], argv[4]);
1046 } END_FOR_EACH_PTR(cb);
1047
1048 return 0;
1049 }
1050
1051 static void match_call_implies(struct expression *expr)
1052 {
1053 sql_select_call_implies("function, type, parameter, key, value", expr,
1054 call_implies_callbacks);
1055 }
1056
1057 static void print_initializer_list(struct expression_list *expr_list,
1058 struct symbol *struct_type)
1059 {
1060 struct expression *expr;
1061 struct symbol *base_type;
1062 char struct_name[256];
1063
1064 FOR_EACH_PTR(expr_list, expr) {
1065 if (expr->type == EXPR_INDEX && expr->idx_expression && expr->idx_expression->type == EXPR_INITIALIZER) {
1066 print_initializer_list(expr->idx_expression->expr_list, struct_type);
1067 continue;
1068 }
1069 if (expr->type != EXPR_IDENTIFIER)
1070 continue;
1071 if (!expr->expr_ident)
1072 continue;
1073 if (!expr->ident_expression || !expr->ident_expression->symbol_name)
1074 continue;
1075 base_type = get_type(expr->ident_expression);
1076 if (!base_type || base_type->type != SYM_FN)
1077 continue;
1078 snprintf(struct_name, sizeof(struct_name), "(struct %s)->%s",
1079 struct_type->ident->name, expr->expr_ident->name);
1080 sql_insert_function_ptr(expr->ident_expression->symbol_name->name,
1081 struct_name);
1082 } END_FOR_EACH_PTR(expr);
1083 }
1084
1085 static void global_variable(struct symbol *sym)
1086 {
1087 struct symbol *struct_type;
1088
1089 if (!sym->ident)
1090 return;
1091 if (!sym->initializer || sym->initializer->type != EXPR_INITIALIZER)
1092 return;
1093 struct_type = get_base_type(sym);
1094 if (!struct_type)
1095 return;
1096 if (struct_type->type == SYM_ARRAY) {
1097 struct_type = get_base_type(struct_type);
1098 if (!struct_type)
1099 return;
1100 }
1101 if (struct_type->type != SYM_STRUCT || !struct_type->ident)
1102 return;
1103 print_initializer_list(sym->initializer->expr_list, struct_type);
1104 }
1105
1106 static void match_return_info(int return_id, char *return_ranges, struct expression *expr)
1107 {
1108 sql_insert_return_states(return_id, return_ranges, INTERNAL, -1, "", function_signature());
1109 }
1110
1111 static void call_return_state_hooks_conditional(struct expression *expr)
1112 {
1113 struct returned_state_callback *cb;
1114 struct range_list *rl;
1115 char *return_ranges;
1116 int final_pass_orig = final_pass;
1117
1118 __push_fake_cur_stree();
1119
1120 final_pass = 0;
1121 __split_whole_condition(expr->conditional);
1122 final_pass = final_pass_orig;
1123
1124 if (get_implied_rl(expr->cond_true, &rl))
1125 rl = cast_rl(cur_func_return_type(), rl);
1126 else
1127 rl = cast_rl(cur_func_return_type(), alloc_whole_rl(get_type(expr->cond_true)));
1128 return_ranges = show_rl(rl);
1129 set_state(RETURN_ID, "return_ranges", NULL, alloc_estate_rl(rl));
1130
1131 return_id++;
1132 FOR_EACH_PTR(returned_state_callbacks, cb) {
1133 cb->callback(return_id, return_ranges, expr->cond_true);
1134 } END_FOR_EACH_PTR(cb);
1135
1136 __push_true_states();
1137 __use_false_states();
1138
1139 if (get_implied_rl(expr->cond_false, &rl))
1140 rl = cast_rl(cur_func_return_type(), rl);
1141 else
1142 rl = cast_rl(cur_func_return_type(), alloc_whole_rl(get_type(expr->cond_false)));
1143 return_ranges = show_rl(rl);
1144 set_state(RETURN_ID, "return_ranges", NULL, alloc_estate_rl(rl));
1145
1146 return_id++;
1147 FOR_EACH_PTR(returned_state_callbacks, cb) {
1148 cb->callback(return_id, return_ranges, expr->cond_false);
1149 } END_FOR_EACH_PTR(cb);
1150
1151 __merge_true_states();
1152 __free_fake_cur_stree();
1153 }
1154
1155 static void call_return_state_hooks_compare(struct expression *expr)
1156 {
1157 struct returned_state_callback *cb;
1158 char *return_ranges;
1159 int final_pass_orig = final_pass;
1160 sval_t sval = { .type = &int_ctype };
1161 sval_t ret;
1162
1163 if (!get_implied_value(expr, &ret))
1164 ret.value = -1;
1165
1166 __push_fake_cur_stree();
1167
1168 final_pass = 0;
1169 __split_whole_condition(expr);
1170 final_pass = final_pass_orig;
1171
1172 if (ret.value != 0) {
1173 return_ranges = alloc_sname("1");
1174 sval.value = 1;
1175 set_state(RETURN_ID, "return_ranges", NULL, alloc_estate_sval(sval));
1176
1177 return_id++;
1178 FOR_EACH_PTR(returned_state_callbacks, cb) {
1179 cb->callback(return_id, return_ranges, expr);
1180 } END_FOR_EACH_PTR(cb);
1181 }
1182
1183 __push_true_states();
1184 __use_false_states();
1185
1186 if (ret.value != 1) {
1187 return_ranges = alloc_sname("0");
1188 sval.value = 0;
1189 set_state(RETURN_ID, "return_ranges", NULL, alloc_estate_sval(sval));
1190
1191 return_id++;
1192 FOR_EACH_PTR(returned_state_callbacks, cb) {
1193 cb->callback(return_id, return_ranges, expr);
1194 } END_FOR_EACH_PTR(cb);
1195 }
1196
1197 __merge_true_states();
1198 __free_fake_cur_stree();
1199 }
1200
1201 static int ptr_in_list(struct sm_state *sm, struct state_list *slist)
1202 {
1203 struct sm_state *tmp;
1204
1205 FOR_EACH_PTR(slist, tmp) {
1206 if (strcmp(tmp->state->name, sm->state->name) == 0)
1207 return 1;
1208 } END_FOR_EACH_PTR(tmp);
1209
1210 return 0;
1211 }
1212
1213 static char *get_return_compare_str(struct expression *expr)
1214 {
1215 char *compare_str;
1216 char *var;
1217 char buf[256];
1218 int comparison;
1219 int param;
1220
1221 compare_str = expr_lte_to_param(expr, -1);
1222 if (compare_str)
1223 return compare_str;
1224 param = get_param_num(expr);
1225 if (param < 0)
1226 return NULL;
1227
1228 var = expr_to_var(expr);
1229 if (!var)
1230 return NULL;
1231 snprintf(buf, sizeof(buf), "%s orig", var);
1232 comparison = get_comparison_strings(var, buf);
1233 free_string(var);
1234
1235 if (!comparison)
1236 return NULL;
1237
1238 snprintf(buf, sizeof(buf), "[%s$%d]", show_special(comparison), param);
1239 return alloc_sname(buf);
1240 }
1241
1242 static int split_possible_helper(struct sm_state *sm, struct expression *expr)
1243 {
1244 struct returned_state_callback *cb;
1245 struct range_list *rl;
1246 char *return_ranges;
1247 struct sm_state *tmp;
1248 int ret = 0;
1249 int nr_possible, nr_states;
1250 char *compare_str = NULL;
1251 char buf[128];
1252 struct state_list *already_handled = NULL;
1253
1254 if (!sm || !sm->merged)
1255 return 0;
1256
1257 if (too_many_possible(sm))
1258 return 0;
1259
1260 /* bail if it gets too complicated */
1261 nr_possible = ptr_list_size((struct ptr_list *)sm->possible);
1262 nr_states = stree_count(__get_cur_stree());
1263 if (nr_states * nr_possible >= 2000)
1264 return 0;
1265
1266 FOR_EACH_PTR(sm->possible, tmp) {
1267 if (tmp->merged)
1268 continue;
1269 if (ptr_in_list(tmp, already_handled))
1270 continue;
1271 add_ptr_list(&already_handled, tmp);
1272
1273 ret = 1;
1274 __push_fake_cur_stree();
1275
1276 overwrite_states_using_pool(sm, tmp);
1277
1278 rl = cast_rl(cur_func_return_type(), estate_rl(tmp->state));
1279 return_ranges = show_rl(rl);
1280 set_state(RETURN_ID, "return_ranges", NULL, alloc_estate_rl(clone_rl(rl)));
1281 compare_str = get_return_compare_str(expr);
1282 if (compare_str) {
1283 snprintf(buf, sizeof(buf), "%s%s", return_ranges, compare_str);
1284 return_ranges = alloc_sname(buf);
1285 }
1286
1287 return_id++;
1288 FOR_EACH_PTR(returned_state_callbacks, cb) {
1289 cb->callback(return_id, return_ranges, expr);
1290 } END_FOR_EACH_PTR(cb);
1291
1292 __free_fake_cur_stree();
1293 } END_FOR_EACH_PTR(tmp);
1294
1295 free_slist(&already_handled);
1296
1297 return ret;
1298 }
1299
1300 static int call_return_state_hooks_split_possible(struct expression *expr)
1301 {
1302 struct sm_state *sm;
1303
1304 if (!expr || expr_equal_to_param(expr, -1))
1305 return 0;
1306
1307 sm = get_sm_state_expr(SMATCH_EXTRA, expr);
1308 return split_possible_helper(sm, expr);
1309 }
1310
1311 static const char *get_return_ranges_str(struct expression *expr, struct range_list **rl_p)
1312 {
1313 struct range_list *rl;
1314 char *return_ranges;
1315 sval_t sval;
1316 char *compare_str;
1317 char *math_str;
1318 char buf[128];
1319
1320 *rl_p = NULL;
1321
1322 if (!expr)
1323 return alloc_sname("");
1324
1325 if (get_implied_value(expr, &sval)) {
1326 sval = sval_cast(cur_func_return_type(), sval);
1327 *rl_p = alloc_rl(sval, sval);
1328 return sval_to_str(sval);
1329 }
1330
1331 compare_str = expr_equal_to_param(expr, -1);
1332 math_str = get_value_in_terms_of_parameter_math(expr);
1333
1334 if (get_implied_rl(expr, &rl)) {
1335 rl = cast_rl(cur_func_return_type(), rl);
1336 return_ranges = show_rl(rl);
1337 } else if (get_imaginary_absolute(expr, &rl)){
1338 rl = cast_rl(cur_func_return_type(), rl);
1339 return alloc_sname(show_rl(rl));
1340 } else {
1341 rl = cast_rl(cur_func_return_type(), alloc_whole_rl(get_type(expr)));
1342 return_ranges = show_rl(rl);
1343 }
1344 *rl_p = rl;
1345
1346 if (compare_str) {
1347 snprintf(buf, sizeof(buf), "%s%s", return_ranges, compare_str);
1348 return alloc_sname(buf);
1349 }
1350 if (math_str) {
1351 snprintf(buf, sizeof(buf), "%s[%s]", return_ranges, math_str);
1352 return alloc_sname(buf);
1353 }
1354 compare_str = get_return_compare_str(expr);
1355 if (compare_str) {
1356 snprintf(buf, sizeof(buf), "%s%s", return_ranges, compare_str);
1357 return alloc_sname(buf);
1358 }
1359
1360 return return_ranges;
1361 }
1362
1363 static int split_positive_from_negative(struct expression *expr)
1364 {
1365 struct returned_state_callback *cb;
1366 struct range_list *rl;
1367 const char *return_ranges;
1368 struct range_list *ret_rl;
1369 int undo;
1370
1371 /* We're going to print the states 3 times */
1372 if (stree_count(__get_cur_stree()) > 10000 / 3)
1373 return 0;
1374
1375 if (!get_implied_rl(expr, &rl) || !rl)
1376 return 0;
1377 if (is_whole_rl(rl) || is_whole_rl_non_zero(rl))
1378 return 0;
1379 /* Forget about INT_MAX and larger */
1380 if (rl_max(rl).value <= 0)
1381 return 0;
1382 if (!sval_is_negative(rl_min(rl)))
1383 return 0;
1384
1385 if (!assume(compare_expression(expr, '>', zero_expr())))
1386 return 0;
1387
1388 return_id++;
1389 return_ranges = get_return_ranges_str(expr, &ret_rl);
1390 set_state(RETURN_ID, "return_ranges", NULL, alloc_estate_rl(ret_rl));
1391 FOR_EACH_PTR(returned_state_callbacks, cb) {
1392 cb->callback(return_id, (char *)return_ranges, expr);
1393 } END_FOR_EACH_PTR(cb);
1394
1395 end_assume();
1396
1397 if (rl_has_sval(rl, sval_type_val(rl_type(rl), 0))) {
1398 undo = assume(compare_expression(expr, SPECIAL_EQUAL, zero_expr()));
1399
1400 return_id++;
1401 return_ranges = get_return_ranges_str(expr, &ret_rl);
1402 set_state(RETURN_ID, "return_ranges", NULL, alloc_estate_rl(ret_rl));
1403 FOR_EACH_PTR(returned_state_callbacks, cb) {
1404 cb->callback(return_id, (char *)return_ranges, expr);
1405 } END_FOR_EACH_PTR(cb);
1406
1407 if (undo)
1408 end_assume();
1409 }
1410
1411 undo = assume(compare_expression(expr, '<', zero_expr()));
1412
1413 return_id++;
1414 return_ranges = get_return_ranges_str(expr, &ret_rl);
1415 set_state(RETURN_ID, "return_ranges", NULL, alloc_estate_rl(ret_rl));
1416 FOR_EACH_PTR(returned_state_callbacks, cb) {
1417 cb->callback(return_id, (char *)return_ranges, expr);
1418 } END_FOR_EACH_PTR(cb);
1419
1420 if (undo)
1421 end_assume();
1422
1423 return 1;
1424 }
1425
1426 static int call_return_state_hooks_split_null_non_null(struct expression *expr)
1427 {
1428 struct returned_state_callback *cb;
1429 struct range_list *rl;
1430 struct range_list *nonnull_rl;
1431 sval_t null_sval;
1432 struct range_list *null_rl = NULL;
1433 char *return_ranges;
1434 struct sm_state *sm;
1435 struct smatch_state *state;
1436 int nr_states;
1437 int final_pass_orig = final_pass;
1438
1439 if (!expr || expr_equal_to_param(expr, -1))
1440 return 0;
1441 if (expr->type == EXPR_CALL)
1442 return 0;
1443 if (!is_pointer(expr))
1444 return 0;
1445
1446 sm = get_sm_state_expr(SMATCH_EXTRA, expr);
1447 if (!sm)
1448 return 0;
1449 if (ptr_list_size((struct ptr_list *)sm->possible) == 1)
1450 return 0;
1451 state = sm->state;
1452 if (!estate_rl(state))
1453 return 0;
1454 if (estate_min(state).value == 0 && estate_max(state).value == 0)
1455 return 0;
1456 if (!rl_has_sval(estate_rl(state), sval_type_val(estate_type(state), 0)))
1457 return 0;
1458
1459 nr_states = stree_count(__get_cur_stree());
1460 if (option_info && nr_states >= 1500)
1461 return 0;
1462
1463 rl = estate_rl(state);
1464
1465 __push_fake_cur_stree();
1466
1467 final_pass = 0;
1468 __split_whole_condition(expr);
1469 final_pass = final_pass_orig;
1470
1471 nonnull_rl = rl_filter(rl, rl_zero());
1472 return_ranges = show_rl(nonnull_rl);
1473 set_state(RETURN_ID, "return_ranges", NULL, alloc_estate_rl(nonnull_rl));
1474
1475 return_id++;
1476 FOR_EACH_PTR(returned_state_callbacks, cb) {
1477 cb->callback(return_id, return_ranges, expr);
1478 } END_FOR_EACH_PTR(cb);
1479
1480 __push_true_states();
1481 __use_false_states();
1482
1483 return_ranges = alloc_sname("0");
1484 null_sval = sval_type_val(rl_type(rl), 0);
1485 add_range(&null_rl, null_sval, null_sval);
1486 set_state(RETURN_ID, "return_ranges", NULL, alloc_estate_rl(null_rl));
1487 return_id++;
1488 FOR_EACH_PTR(returned_state_callbacks, cb) {
1489 cb->callback(return_id, return_ranges, expr);
1490 } END_FOR_EACH_PTR(cb);
1491
1492 __merge_true_states();
1493 __free_fake_cur_stree();
1494
1495 return 1;
1496 }
1497
1498 static int call_return_state_hooks_split_success_fail(struct expression *expr)
1499 {
1500 struct range_list *rl;
1501 struct range_list *nonzero_rl;
1502 sval_t zero_sval;
1503 struct range_list *zero_rl = NULL;
1504 int nr_states;
1505 struct returned_state_callback *cb;
1506 char *return_ranges;
1507 int final_pass_orig = final_pass;
1508 sval_t val;
1509
1510 if (option_project != PROJ_KERNEL)
1511 return 0;
1512
1513 nr_states = stree_count(__get_cur_stree());
1514 if (nr_states > 1500)
1515 return 0;
1516
1517 if (get_value(expr, &val))
1518 return 0;
1519 if (!get_implied_rl(expr, &rl))
1520 return 0;
1521 if (rl_min(rl).value < -4095 || rl_min(rl).value >= 0)
1522 return 0;
1523 if (rl_max(rl).value != 0)
1524 return 0;
1525
1526 __push_fake_cur_stree();
1527
1528 final_pass = 0;
1529 __split_whole_condition(expr);
1530 final_pass = final_pass_orig;
1531
1532 nonzero_rl = rl_filter(rl, rl_zero());
1533 return_ranges = show_rl(nonzero_rl);
1534 set_state(RETURN_ID, "return_ranges", NULL, alloc_estate_rl(nonzero_rl));
1535
1536 return_id++;
1537 FOR_EACH_PTR(returned_state_callbacks, cb) {
1538 cb->callback(return_id, return_ranges, expr);
1539 } END_FOR_EACH_PTR(cb);
1540
1541 __push_true_states();
1542 __use_false_states();
1543
1544 return_ranges = alloc_sname("0");
1545 zero_sval = sval_type_val(rl_type(rl), 0);
1546 add_range(&zero_rl, zero_sval, zero_sval);
1547 set_state(RETURN_ID, "return_ranges", NULL, alloc_estate_rl(zero_rl));
1548 return_id++;
1549 FOR_EACH_PTR(returned_state_callbacks, cb) {
1550 cb->callback(return_id, return_ranges, expr);
1551 } END_FOR_EACH_PTR(cb);
1552
1553 __merge_true_states();
1554 __free_fake_cur_stree();
1555
1556 return 1;
1557 }
1558
1559 static int is_boolean(struct expression *expr)
1560 {
1561 struct range_list *rl;
1562
1563 if (!get_implied_rl(expr, &rl))
1564 return 0;
1565 if (rl_min(rl).value == 0 && rl_max(rl).value == 1)
1566 return 1;
1567 return 0;
1568 }
1569
1570 static int is_conditional(struct expression *expr)
1571 {
1572 if (!expr)
1573 return 0;
1574 if (expr->type == EXPR_CONDITIONAL || expr->type == EXPR_SELECT)
1575 return 1;
1576 return 0;
1577 }
1578
1579 static int splitable_function_call(struct expression *expr)
1580 {
1581 struct sm_state *sm;
1582 char buf[64];
1583
1584 if (!expr || expr->type != EXPR_CALL)
1585 return 0;
1586 snprintf(buf, sizeof(buf), "return %p", expr);
1587 sm = get_sm_state(SMATCH_EXTRA, buf, NULL);
1588 return split_possible_helper(sm, expr);
1589 }
1590
1591 static struct sm_state *find_bool_param(void)
1592 {
1593 struct stree *start_states;
1594 struct symbol *arg;
1595 struct sm_state *sm, *tmp;
1596 sval_t sval;
1597
1598 start_states = get_start_states();
1599
1600 FOR_EACH_PTR_REVERSE(cur_func_sym->ctype.base_type->arguments, arg) {
1601 if (!arg->ident)
1602 continue;
1603 sm = get_sm_state_stree(start_states, SMATCH_EXTRA, arg->ident->name, arg);
1604 if (!sm)
1605 continue;
1606 if (rl_min(estate_rl(sm->state)).value != 0 ||
1607 rl_max(estate_rl(sm->state)).value != 1)
1608 continue;
1609 goto found;
1610 } END_FOR_EACH_PTR_REVERSE(arg);
1611
1612 return NULL;
1613
1614 found:
1615 /*
1616 * Check if it's splitable. If not, then splitting it up is likely not
1617 * useful for the callers.
1618 */
1619 FOR_EACH_PTR(sm->possible, tmp) {
1620 if (is_merged(tmp))
1621 continue;
1622 if (!estate_get_single_value(tmp->state, &sval))
1623 return NULL;
1624 } END_FOR_EACH_PTR(tmp);
1625
1626 return sm;
1627 }
1628
1629 static int split_on_bool_sm(struct sm_state *sm, struct expression *expr)
1630 {
1631 struct returned_state_callback *cb;
1632 struct range_list *ret_rl;
1633 const char *return_ranges;
1634 struct sm_state *tmp;
1635 int ret = 0;
1636 int nr_possible, nr_states;
1637 char *compare_str = NULL;
1638 char buf[128];
1639 struct state_list *already_handled = NULL;
1640
1641 if (!sm || !sm->merged)
1642 return 0;
1643
1644 if (too_many_possible(sm))
1645 return 0;
1646
1647 /* bail if it gets too complicated */
1648 nr_possible = ptr_list_size((struct ptr_list *)sm->possible);
1649 nr_states = stree_count(__get_cur_stree());
1650 if (nr_states * nr_possible >= 2000)
1651 return 0;
1652
1653 FOR_EACH_PTR(sm->possible, tmp) {
1654 if (tmp->merged)
1655 continue;
1656 if (ptr_in_list(tmp, already_handled))
1657 continue;
1658 add_ptr_list(&already_handled, tmp);
1659
1660 ret = 1;
1661 __push_fake_cur_stree();
1662
1663 overwrite_states_using_pool(sm, tmp);
1664
1665 return_ranges = get_return_ranges_str(expr, &ret_rl);
1666 set_state(RETURN_ID, "return_ranges", NULL, alloc_estate_rl(ret_rl));
1667 compare_str = get_return_compare_str(expr);
1668 if (compare_str) {
1669 snprintf(buf, sizeof(buf), "%s%s", return_ranges, compare_str);
1670 return_ranges = alloc_sname(buf);
1671 }
1672
1673 return_id++;
1674 FOR_EACH_PTR(returned_state_callbacks, cb) {
1675 cb->callback(return_id, (char *)return_ranges, expr);
1676 } END_FOR_EACH_PTR(cb);
1677
1678 __free_fake_cur_stree();
1679 } END_FOR_EACH_PTR(tmp);
1680
1681 free_slist(&already_handled);
1682
1683 return ret;
1684 }
1685
1686 static int split_by_bool_param(struct expression *expr)
1687 {
1688 struct sm_state *start_sm, *sm;
1689 sval_t sval;
1690
1691 start_sm = find_bool_param();
1692 if (!start_sm)
1693 return 0;
1694 sm = get_sm_state(SMATCH_EXTRA, start_sm->name, start_sm->sym);
1695 if (!sm || estate_get_single_value(sm->state, &sval))
1696 return 0;
1697 return split_on_bool_sm(sm, expr);
1698 }
1699
1700 static int split_by_null_nonnull_param(struct expression *expr)
1701 {
1702 struct symbol *arg;
1703 struct sm_state *sm;
1704
1705 /* function must only take one pointer */
1706 if (ptr_list_size((struct ptr_list *)cur_func_sym->ctype.base_type->arguments) != 1)
1707 return 0;
1708 arg = first_ptr_list((struct ptr_list *)cur_func_sym->ctype.base_type->arguments);
1709 if (!arg->ident)
1710 return 0;
1711 if (get_real_base_type(arg)->type != SYM_PTR)
1712 return 0;
1713
1714 if (param_was_set_var_sym(arg->ident->name, arg))
1715 return 0;
1716 sm = get_sm_state(SMATCH_EXTRA, arg->ident->name, arg);
1717 if (!sm)
1718 return 0;
1719
1720 return split_on_bool_sm(sm, expr);
1721 }
1722
1723 struct expression *strip_expr_statement(struct expression *expr)
1724 {
1725 struct expression *orig = expr;
1726 struct statement *stmt, *last_stmt;
1727
1728 if (!expr)
1729 return NULL;
1730 if (expr->type == EXPR_PREOP && expr->op == '(')
1731 expr = expr->unop;
1732 if (expr->type != EXPR_STATEMENT)
1733 return orig;
1734 stmt = expr->statement;
1735 if (!stmt || stmt->type != STMT_COMPOUND)
1736 return orig;
1737
1738 last_stmt = last_ptr_list((struct ptr_list *)stmt->stmts);
1739 if (!last_stmt || last_stmt->type == STMT_LABEL)
1740 last_stmt = last_stmt->label_statement;
1741 if (!last_stmt || last_stmt->type != STMT_EXPRESSION)
1742 return orig;
1743 return strip_expr(last_stmt->expression);
1744 }
1745
1746 static void call_return_state_hooks(struct expression *expr)
1747 {
1748 struct returned_state_callback *cb;
1749 struct range_list *ret_rl;
1750 const char *return_ranges;
1751 int nr_states;
1752 sval_t sval;
1753
1754 if (__path_is_null())
1755 return;
1756
1757 expr = strip_expr(expr);
1758 expr = strip_expr_statement(expr);
1759
1760 if (is_impossible_path())
1761 goto vanilla;
1762
1763 if (expr && (expr->type == EXPR_COMPARE ||
1764 !get_implied_value(expr, &sval)) &&
1765 (is_condition(expr) || is_boolean(expr))) {
1766 call_return_state_hooks_compare(expr);
1767 return;
1768 } else if (is_conditional(expr)) {
1769 call_return_state_hooks_conditional(expr);
1770 return;
1771 } else if (call_return_state_hooks_split_possible(expr)) {
1772 return;
1773 } else if (call_return_state_hooks_split_null_non_null(expr)) {
1774 return;
1775 } else if (call_return_state_hooks_split_success_fail(expr)) {
1776 return;
1777 } else if (splitable_function_call(expr)) {
1778 return;
1779 } else if (split_positive_from_negative(expr)) {
1780 return;
1781 } else if (split_by_bool_param(expr)) {
1782 } else if (split_by_null_nonnull_param(expr)) {
1783 return;
1784 }
1785
1786 vanilla:
1787 return_ranges = get_return_ranges_str(expr, &ret_rl);
1788 set_state(RETURN_ID, "return_ranges", NULL, alloc_estate_rl(ret_rl));
1789
1790 return_id++;
1791 nr_states = stree_count(__get_cur_stree());
1792 if (nr_states >= 10000) {
1793 match_return_info(return_id, (char *)return_ranges, expr);
1794 return;
1795 }
1796 FOR_EACH_PTR(returned_state_callbacks, cb) {
1797 cb->callback(return_id, (char *)return_ranges, expr);
1798 } END_FOR_EACH_PTR(cb);
1799 }
1800
1801 static void print_returned_struct_members(int return_id, char *return_ranges, struct expression *expr)
1802 {
1803 struct returned_member_callback *cb;
1804 struct stree *stree;
1805 struct sm_state *sm;
1806 struct symbol *type;
1807 char *name;
1808 char member_name[256];
1809 int len;
1810
1811 type = get_type(expr);
1812 if (!type || type->type != SYM_PTR)
1813 return;
1814 name = expr_to_var(expr);
1815 if (!name)
1816 return;
1817
1818 member_name[sizeof(member_name) - 1] = '\0';
1819 strcpy(member_name, "$");
1820
1821 len = strlen(name);
1822 FOR_EACH_PTR(returned_member_callbacks, cb) {
1823 stree = __get_cur_stree();
1824 FOR_EACH_MY_SM(cb->owner, stree, sm) {
1825 if (sm->name[0] == '*' && strcmp(sm->name + 1, name) == 0) {
1826 strcpy(member_name, "*$");
1827 cb->callback(return_id, return_ranges, expr, member_name, sm->state);
1828 continue;
1829 }
1830 if (strncmp(sm->name, name, len) != 0)
1831 continue;
1832 if (strncmp(sm->name + len, "->", 2) != 0)
1833 continue;
1834 snprintf(member_name, sizeof(member_name), "$%s", sm->name + len);
1835 cb->callback(return_id, return_ranges, expr, member_name, sm->state);
1836 } END_FOR_EACH_SM(sm);
1837 } END_FOR_EACH_PTR(cb);
1838
1839 free_string(name);
1840 }
1841
1842 static void reset_memdb(struct symbol *sym)
1843 {
1844 mem_sql(NULL, NULL, "delete from caller_info;");
1845 mem_sql(NULL, NULL, "delete from return_states;");
1846 mem_sql(NULL, NULL, "delete from call_implies;");
1847 }
1848
1849 static void match_end_func_info(struct symbol *sym)
1850 {
1851 if (__path_is_null())
1852 return;
1853 call_return_state_hooks(NULL);
1854 }
1855
1856 static void match_after_func(struct symbol *sym)
1857 {
1858 if (!__inline_fn)
1859 reset_memdb(sym);
1860 }
1861
1862 static void init_memdb(void)
1863 {
1864 char *err = NULL;
1865 int rc;
1866 const char *schema_files[] = {
1867 "db/db.schema",
1868 "db/caller_info.schema",
1869 "db/return_states.schema",
1870 "db/function_type_size.schema",
1871 "db/type_size.schema",
1872 "db/call_implies.schema",
1873 "db/function_ptr.schema",
1874 "db/local_values.schema",
1875 "db/function_type_value.schema",
1876 "db/type_value.schema",
1877 "db/function_type.schema",
1878 "db/data_info.schema",
1879 "db/parameter_name.schema",
1880 "db/constraints.schema",
1881 "db/constraints_required.schema",
1882 "db/fn_ptr_data_link.schema",
1883 "db/fn_data_link.schema",
1884 };
1885 static char buf[4096];
1886 int fd;
1887 int ret;
1888 int i;
1889
1890 rc = sqlite3_open(":memory:", &mem_db);
1891 if (rc != SQLITE_OK) {
1892 printf("Error starting In-Memory database.");
1893 return;
1894 }
1895
1896 for (i = 0; i < ARRAY_SIZE(schema_files); i++) {
1897 fd = open_data_file(schema_files[i]);
1898 if (fd < 0) {
1899 printf("failed to open: %s\n", schema_files[i]);
1900 continue;
1901 }
1902 ret = read(fd, buf, sizeof(buf));
1903 if (ret < 0) {
1904 printf("failed to read: %s\n", schema_files[i]);
1905 continue;
1906 }
1907 close(fd);
1908 if (ret == sizeof(buf)) {
1909 printf("Schema file too large: %s (limit %zd bytes)",
1910 schema_files[i], sizeof(buf));
1911 continue;
1912 }
1913 buf[ret] = '\0';
1914 rc = sqlite3_exec(mem_db, buf, NULL, NULL, &err);
1915 if (rc != SQLITE_OK) {
1916 fprintf(stderr, "SQL error #2: %s\n", err);
1917 fprintf(stderr, "%s\n", buf);
1918 }
1919 }
1920 }
1921
1922 void open_smatch_db(void)
1923 {
1924 int rc;
1925
1926 if (option_no_db)
1927 return;
1928
1929 init_memdb();
1930
1931 rc = sqlite3_open_v2("smatch_db.sqlite", &db, SQLITE_OPEN_READONLY, NULL);
1932 if (rc != SQLITE_OK) {
1933 option_no_db = 1;
1934 return;
1935 }
1936 return;
1937 }
1938
1939 static void register_common_funcs(void)
1940 {
1941 struct token *token;
1942 char *func;
1943 char filename[256];
1944
1945 if (option_project == PROJ_NONE)
1946 strcpy(filename, "common_functions");
1947 else
1948 snprintf(filename, 256, "%s.common_functions", option_project_str);
1949
1950 token = get_tokens_file(filename);
1951 if (!token)
1952 return;
1953 if (token_type(token) != TOKEN_STREAMBEGIN)
1954 return;
1955 token = token->next;
1956 while (token_type(token) != TOKEN_STREAMEND) {
1957 if (token_type(token) != TOKEN_IDENT)
1958 return;
1959 func = alloc_string(show_ident(token->ident));
1960 add_ptr_list(&common_funcs, func);
1961 token = token->next;
1962 }
1963 clear_token_alloc();
1964 }
1965
1966 static char *get_next_string(char **str)
1967 {
1968 static char string[256];
1969 char *start;
1970 char *p = *str;
1971 int len;
1972
1973 if (*p == '\0')
1974 return NULL;
1975 start = p;
1976
1977 while (*p != '\0' && *p != ' ' && *p != '\n')
1978 p++;
1979
1980 len = p - start;
1981 if (len > 256) {
1982 memcpy(string, start, 255);
1983 string[255] = '\0';
1984 printf("return_fix: '%s' too long", string);
1985 **str = '\0';
1986 return NULL;
1987 }
1988 memcpy(string, start, len);
1989 string[len] = '\0';
1990 if (*p != '\0')
1991 p++;
1992 *str = p;
1993 return string;
1994 }
1995
1996 static void register_return_replacements(void)
1997 {
1998 char *func, *orig, *new;
1999 char filename[256];
2000 char buf[4096];
2001 int fd, ret, i;
2002 char *p;
2003
2004 snprintf(filename, 256, "db/%s.return_fixes", option_project_str);
2005 fd = open_data_file(filename);
2006 if (fd < 0)
2007 return;
2008 ret = read(fd, buf, sizeof(buf));
2009 close(fd);
2010 if (ret < 0)
2011 return;
2012 if (ret == sizeof(buf)) {
2013 printf("file too large: %s (limit %zd bytes)",
2014 filename, sizeof(buf));
2015 return;
2016 }
2017 buf[ret] = '\0';
2018
2019 p = buf;
2020 while (*p) {
2021 get_next_string(&p);
2022 replace_count++;
2023 }
2024 if (replace_count == 0 || replace_count % 3 != 0) {
2025 replace_count = 0;
2026 return;
2027 }
2028 replace_table = malloc(replace_count * sizeof(char *));
2029
2030 p = buf;
2031 i = 0;
2032 while (*p) {
2033 func = alloc_string(get_next_string(&p));
2034 orig = alloc_string(get_next_string(&p));
2035 new = alloc_string(get_next_string(&p));
2036
2037 replace_table[i++] = func;
2038 replace_table[i++] = orig;
2039 replace_table[i++] = new;
2040 }
2041 }
2042
2043 void register_definition_db_callbacks(int id)
2044 {
2045 add_hook(&match_call_info, FUNCTION_CALL_HOOK);
2046 add_hook(&global_variable, BASE_HOOK);
2047 add_hook(&global_variable, DECLARATION_HOOK);
2048 add_split_return_callback(match_return_info);
2049 add_split_return_callback(print_returned_struct_members);
2050 add_hook(&call_return_state_hooks, RETURN_HOOK);
2051 add_hook(&match_end_func_info, END_FUNC_HOOK);
2052 add_hook(&match_after_func, AFTER_FUNC_HOOK);
2053
2054 add_hook(&match_data_from_db, FUNC_DEF_HOOK);
2055 add_hook(&match_call_implies, CALL_HOOK_AFTER_INLINE);
2056
2057 register_common_funcs();
2058 register_return_replacements();
2059 }
2060
2061 void register_db_call_marker(int id)
2062 {
2063 add_hook(&match_call_marker, FUNCTION_CALL_HOOK);
2064 }
2065
2066 char *return_state_to_var_sym(struct expression *expr, int param, const char *key, struct symbol **sym)
2067 {
2068 struct expression *arg;
2069 char *name = NULL;
2070 char member_name[256];
2071
2072 *sym = NULL;
2073
2074 if (param == -1) {
2075 const char *star = "";
2076
2077 if (expr->type != EXPR_ASSIGNMENT)
2078 return NULL;
2079 name = expr_to_var_sym(expr->left, sym);
2080 if (!name)
2081 return NULL;
2082 if (key[0] == '*') {
2083 star = "*";
2084 key++;
2085 }
2086 if (strncmp(key, "$", 1) != 0)
2087 return name;
2088 snprintf(member_name, sizeof(member_name), "%s%s%s", star, name, key + 1);
2089 free_string(name);
2090 return alloc_string(member_name);
2091 }
2092
2093 while (expr->type == EXPR_ASSIGNMENT)
2094 expr = strip_expr(expr->right);
2095 if (expr->type != EXPR_CALL)
2096 return NULL;
2097
2098 arg = get_argument_from_call_expr(expr->args, param);
2099 if (!arg)
2100 return NULL;
2101
2102 return get_variable_from_key(arg, key, sym);
2103 }
2104
2105 char *get_variable_from_key(struct expression *arg, const char *key, struct symbol **sym)
2106 {
2107 char buf[256];
2108 char *tmp;
2109
2110 if (!arg)
2111 return NULL;
2112
2113 arg = strip_expr(arg);
2114
2115 if (strcmp(key, "$") == 0)
2116 return expr_to_var_sym(arg, sym);
2117
2118 if (strcmp(key, "*$") == 0) {
2119 if (arg->type == EXPR_PREOP && arg->op == '&') {
2120 arg = strip_expr(arg->unop);
2121 return expr_to_var_sym(arg, sym);
2122 } else {
2123 tmp = expr_to_var_sym(arg, sym);
2124 if (!tmp)
2125 return NULL;
2126 snprintf(buf, sizeof(buf), "*%s", tmp);
2127 free_string(tmp);
2128 return alloc_string(buf);
2129 }
2130 }
2131
2132 if (arg->type == EXPR_PREOP && arg->op == '&') {
2133 arg = strip_expr(arg->unop);
2134 tmp = expr_to_var_sym(arg, sym);
2135 if (!tmp)
2136 return NULL;
2137 snprintf(buf, sizeof(buf), "%s.%s", tmp, key + 3);
2138 return alloc_string(buf);
2139 }
2140
2141 tmp = expr_to_var_sym(arg, sym);
2142 if (!tmp)
2143 return NULL;
2144 snprintf(buf, sizeof(buf), "%s%s", tmp, key + 1);
2145 free_string(tmp);
2146 return alloc_string(buf);
2147 }
2148
2149 char *get_chunk_from_key(struct expression *arg, char *key, struct symbol **sym, struct var_sym_list **vsl)
2150 {
2151 *vsl = NULL;
2152
2153 if (strcmp("$", key) == 0)
2154 return expr_to_chunk_sym_vsl(arg, sym, vsl);
2155 return get_variable_from_key(arg, key, sym);
2156 }
2157
2158 const char *state_name_to_param_name(const char *state_name, const char *param_name)
2159 {
2160 int name_len;
2161 static char buf[256];
2162
2163 name_len = strlen(param_name);
2164
2165 if (strcmp(state_name, param_name) == 0) {
2166 return "$";
2167 } else if (state_name[name_len] == '-' && /* check for '-' from "->" */
2168 strncmp(state_name, param_name, name_len) == 0) {
2169 snprintf(buf, sizeof(buf), "$%s", state_name + name_len);
2170 return buf;
2171 } else if (state_name[0] == '*' && strcmp(state_name + 1, param_name) == 0) {
2172 return "*$";
2173 }
2174 return NULL;
2175 }
2176
2177 const char *get_param_name_var_sym(const char *name, struct symbol *sym)
2178 {
2179 if (!sym || !sym->ident)
2180 return NULL;
2181
2182 return state_name_to_param_name(name, sym->ident->name);
2183 }
2184
2185 const char *get_param_name(struct sm_state *sm)
2186 {
2187 return get_param_name_var_sym(sm->name, sm->sym);
2188 }
2189
2190 char *get_data_info_name(struct expression *expr)
2191 {
2192 struct symbol *sym;
2193 char *name;
2194 char buf[256];
2195 char *ret = NULL;
2196
2197 expr = strip_expr(expr);
2198 name = get_member_name(expr);
2199 if (name)
2200 return name;
2201 name = expr_to_var_sym(expr, &sym);
2202 if (!name || !sym)
2203 goto free;
2204 if (!(sym->ctype.modifiers & MOD_TOPLEVEL))
2205 goto free;
2206 if (sym->ctype.modifiers & MOD_STATIC)
2207 snprintf(buf, sizeof(buf), "static %s", name);
2208 else
2209 snprintf(buf, sizeof(buf), "global %s", name);
2210 ret = alloc_sname(buf);
2211 free:
2212 free_string(name);
2213 return ret;
2214 }
Static analysis for C