type: handle strings better
[smatch.git] / smatch_buf_size.c
blob8a406b2b467539a746147a0a052c668dedb422c1
1 /*
2 * smatch/smatch_buf_size.c
4 * Copyright (C) 2010 Dan Carpenter.
6 * Licensed under the Open Software License version 1.1
8 */
10 #include <stdlib.h>
11 #include <errno.h>
12 #include "parse.h"
13 #include "smatch.h"
14 #include "smatch_slist.h"
15 #include "smatch_extra.h"
18 * This check has two smatch IDs.
19 * my_size_id - used to store the size of arrays.
20 * my_strlen_id - track the strlen() of buffers.
23 static int my_size_id;
24 static int my_strlen_id;
26 struct limiter {
27 int buf_arg;
28 int limit_arg;
30 static struct limiter b0_l2 = {0, 2};
32 static _Bool params_set[32];
34 static void set_undefined(struct sm_state *sm)
36 if (sm->state != &undefined)
37 set_state(sm->owner, sm->name, sm->sym, &undefined);
40 static struct smatch_state *merge_func(struct smatch_state *s1, struct smatch_state *s2)
42 if (PTR_INT(s1->data) == PTR_INT(s2->data))
43 return s1;
44 return &undefined;
47 void set_param_buf_size(const char *name, struct symbol *sym, char *key, char *value)
49 char fullname[256];
50 unsigned int size;
52 if (strncmp(key, "$$", 2))
53 return;
55 snprintf(fullname, 256, "%s%s", name, key + 2);
57 errno = 0;
58 size = strtoul(value, NULL, 10);
59 if (errno)
60 return;
62 set_state(my_size_id, fullname, sym, alloc_state_num(size));
65 static int bytes_per_element(struct expression *expr)
67 struct symbol *type;
68 int bpe;
70 if (expr->type == EXPR_STRING)
71 return 1;
72 type = get_type(expr);
73 if (!type)
74 return 0;
76 if (type->type != SYM_PTR && type->type != SYM_ARRAY)
77 return 0;
79 type = get_base_type(type);
80 bpe = bits_to_bytes(type->bit_size);
82 if (bpe == -1) /* void pointer */
83 bpe = 1;
85 return bpe;
88 static int bytes_to_elements(struct expression *expr, int bytes)
90 int bpe;
92 bpe = bytes_per_element(expr);
93 if (bpe == 0)
94 return 0;
95 return bytes / bpe;
98 static int elements_to_bytes(struct expression *expr, int elements)
100 int bpe;
102 bpe = bytes_per_element(expr);
103 return elements * bpe;
106 static int get_initializer_size(struct expression *expr)
108 switch (expr->type) {
109 case EXPR_STRING:
110 return expr->string->length;
111 case EXPR_INITIALIZER: {
112 struct expression *tmp;
113 int i = 0;
114 int max = 0;
116 FOR_EACH_PTR(expr->expr_list, tmp) {
117 if (tmp->type == EXPR_INDEX && tmp->idx_to > max)
118 max = tmp->idx_to;
119 i++;
120 } END_FOR_EACH_PTR(tmp);
121 if (max)
122 return max + 1;
123 return i;
125 case EXPR_SYMBOL:
126 return get_array_size(expr);
128 return 0;
131 static int db_size;
132 static int db_size_callback(void *unused, int argc, char **argv, char **azColName)
134 if (db_size == 0)
135 db_size = atoi(argv[0]);
136 else
137 db_size = -1;
138 return 0;
141 static int size_from_db(struct expression *expr)
143 int this_file_only = 0;
144 char *name;
146 if (!option_spammy)
147 return 0;
149 name = get_member_name(expr);
150 if (!name && is_static(expr)) {
151 name = expr_to_var(expr);
152 this_file_only = 1;
154 if (!name)
155 return 0;
157 db_size = 0;
158 run_sql(db_size_callback, "select size from type_size where type = '%s' and file = '%s'",
159 name, get_filename());
160 if (db_size == -1)
161 return 0;
162 if (db_size != 0)
163 return db_size;
164 if (this_file_only)
165 return 0;
167 run_sql(db_size_callback, "select size from type_size where type = '%s'",
168 name);
170 if (db_size == -1)
171 db_size = 0;
173 return db_size;
176 static void db_returns_buf_size(struct expression *expr, int param, char *unused, char *math)
178 struct expression *call;
179 sval_t sval;
181 if (expr->type != EXPR_ASSIGNMENT)
182 return;
183 call = strip_expr(expr->right);
185 if (!parse_call_math(call, math, &sval))
186 return;
187 set_state_expr(my_size_id, expr->left, alloc_state_num(sval.value));
190 static int get_real_array_size(struct expression *expr)
192 struct symbol *type;
193 sval_t sval;
195 if (expr->type == EXPR_BINOP) /* array elements foo[5] */
196 return 0;
198 type = get_type(expr);
199 if (!type || type->type != SYM_ARRAY)
200 return 0;
202 if (!get_implied_value(type->array_size, &sval))
203 return 0;
205 /* People put one element arrays on the end of structs */
206 if (sval.value == 1)
207 return 0;
209 return sval.value;
212 static int get_size_from_initializer(struct expression *expr)
214 if (expr->type != EXPR_SYMBOL || !expr->symbol->initializer)
215 return 0;
216 if (expr->symbol->initializer == expr) /* int a = a; */
217 return 0;
218 return get_initializer_size(expr->symbol->initializer);
221 static int get_stored_size_bytes(struct expression *expr)
223 struct smatch_state *state;
225 state = get_state_expr(my_size_id, expr);
226 if (!state)
227 return 0;
228 return PTR_INT(state->data);
231 static int get_stored_size_bytes_min(struct expression *expr)
233 struct sm_state *sm, *tmp;
234 int min = 0;
236 sm = get_sm_state_expr(my_size_id, expr);
237 if (!sm)
238 return 0;
239 FOR_EACH_PTR(sm->possible, tmp) {
240 if (PTR_INT(tmp->state->data) <= 0)
241 continue;
242 if (PTR_INT(tmp->state->data) < min)
243 min = PTR_INT(tmp->state->data);
244 } END_FOR_EACH_PTR(tmp);
246 return min;
249 static int get_bytes_from_address(struct expression *expr)
251 struct symbol *type;
252 int ret;
254 if (!option_spammy)
255 return 0;
256 if (expr->type != EXPR_PREOP || expr->op != '&')
257 return 0;
258 type = get_type(expr);
259 if (!type)
260 return 0;
262 if (type->type == SYM_PTR)
263 type = get_base_type(type);
265 ret = bits_to_bytes(type->bit_size);
266 if (ret == -1)
267 return 0;
268 if (ret == 1)
269 return 0; /* ignore char pointers */
271 return ret;
274 static int get_size_from_strlen(struct expression *expr)
276 struct smatch_state *state;
277 sval_t len;
279 state = get_state_expr(my_strlen_id, expr);
280 if (!state || !state->data)
281 return 0;
282 if (get_implied_max((struct expression *)state->data, &len))
283 return len.value + 1; /* add one because strlen doesn't include the NULL */
284 return 0;
287 static struct expression *remove_addr_fluff(struct expression *expr)
289 struct expression *tmp;
290 sval_t sval;
292 expr = strip_expr(expr);
294 /* remove '&' and '*' operations that cancel */
295 while (expr->type == EXPR_PREOP && expr->op == '&') {
296 tmp = strip_expr(expr->unop);
297 if (tmp->type != EXPR_PREOP)
298 break;
299 if (tmp->op != '*')
300 break;
301 expr = strip_expr(tmp->unop);
304 /* "foo + 0" is just "foo" */
305 if (expr->type == EXPR_BINOP && expr->op == '+' &&
306 get_value(expr->right, &sval) && sval.value == 0)
307 return expr->left;
309 return expr;
312 int get_array_size_bytes(struct expression *expr)
314 int size;
316 expr = remove_addr_fluff(expr);
317 if (!expr)
318 return 0;
320 /* strcpy(foo, "BAR"); */
321 if (expr->type == EXPR_STRING)
322 return expr->string->length;
324 /* buf[4] */
325 size = get_real_array_size(expr);
326 if (size)
327 return elements_to_bytes(expr, size);
329 /* buf = malloc(1024); */
330 size = get_stored_size_bytes(expr);
331 if (size)
332 return size;
334 /* char *foo = "BAR" */
335 size = get_size_from_initializer(expr);
336 if (size)
337 return elements_to_bytes(expr, size);
339 size = get_bytes_from_address(expr);
340 if (size)
341 return size;
343 /* if (strlen(foo) > 4) */
344 size = get_size_from_strlen(expr);
345 if (size)
346 return size;
348 return size_from_db(expr);
351 int get_array_size_bytes_min(struct expression *expr)
353 int size;
354 int tmp;
356 size = get_array_size_bytes(expr);
358 tmp = get_stored_size_bytes_min(expr);
359 if (size <= 0 || (tmp >= 1 && tmp < size))
360 size = tmp;
361 return size;
364 int get_array_size(struct expression *expr)
366 int bytes;
368 bytes = get_array_size_bytes(expr);
369 return bytes_to_elements(expr, bytes);
372 static void match_strlen_condition(struct expression *expr)
374 struct expression *left;
375 struct expression *right;
376 struct expression *str = NULL;
377 int strlen_left = 0;
378 int strlen_right = 0;
379 sval_t sval;
380 struct smatch_state *true_state = NULL;
381 struct smatch_state *false_state = NULL;
383 if (expr->type != EXPR_COMPARE)
384 return;
385 left = strip_expr(expr->left);
386 right = strip_expr(expr->right);
388 if (left->type == EXPR_CALL && sym_name_is("strlen", left->fn)) {
389 str = get_argument_from_call_expr(left->args, 0);
390 strlen_left = 1;
392 if (right->type == EXPR_CALL && sym_name_is("strlen", right->fn)) {
393 str = get_argument_from_call_expr(right->args, 0);
394 strlen_right = 1;
397 if (!strlen_left && !strlen_right)
398 return;
399 if (strlen_left && strlen_right)
400 return;
402 if (strlen_left) {
403 if (!get_value(right, &sval))
404 return;
406 if (strlen_right) {
407 if (!get_value(left, &sval))
408 return;
411 if (expr->op == SPECIAL_EQUAL) {
412 set_true_false_states_expr(my_size_id, str, alloc_state_num(sval.value + 1), NULL);
413 return;
415 if (expr->op == SPECIAL_NOTEQUAL) {
416 set_true_false_states_expr(my_size_id, str, NULL, alloc_state_num(sval.value + 1));
417 return;
420 switch (expr->op) {
421 case '<':
422 case SPECIAL_UNSIGNED_LT:
423 if (strlen_left)
424 true_state = alloc_state_num(sval.value);
425 else
426 false_state = alloc_state_num(sval.value + 1);
427 break;
428 case SPECIAL_LTE:
429 case SPECIAL_UNSIGNED_LTE:
430 if (strlen_left)
431 true_state = alloc_state_num(sval.value + 1);
432 else
433 false_state = alloc_state_num(sval.value);
434 break;
435 case SPECIAL_GTE:
436 case SPECIAL_UNSIGNED_GTE:
437 if (strlen_left)
438 false_state = alloc_state_num(sval.value);
439 else
440 true_state = alloc_state_num(sval.value + 1);
441 break;
442 case '>':
443 case SPECIAL_UNSIGNED_GT:
444 if (strlen_left)
445 false_state = alloc_state_num(sval.value + 1);
446 else
447 true_state = alloc_state_num(sval.value);
448 break;
450 set_true_false_states_expr(my_size_id, str, true_state, false_state);
453 static struct expression *strip_ampersands(struct expression *expr)
455 struct symbol *type;
457 if (expr->type != EXPR_PREOP)
458 return expr;
459 if (expr->op != '&')
460 return expr;
461 type = get_type(expr->unop);
462 if (!type || type->type != SYM_ARRAY)
463 return expr;
464 return expr->unop;
467 static void match_array_assignment(struct expression *expr)
469 struct expression *left;
470 struct expression *right;
471 int array_size;
473 if (expr->op != '=')
474 return;
475 left = strip_expr(expr->left);
476 right = strip_expr(expr->right);
477 right = strip_ampersands(right);
478 array_size = get_array_size_bytes(right);
479 if (array_size)
480 set_state_expr(my_size_id, left, alloc_state_num(array_size));
483 static void info_record_alloction(struct expression *buffer, struct expression *size)
485 char *name;
486 sval_t sval;
488 if (!option_info)
489 return;
491 name = get_member_name(buffer);
492 if (!name && is_static(buffer))
493 name = expr_to_var(buffer);
494 if (!name)
495 return;
496 if (get_implied_value(size, &sval))
497 sm_msg("info: '%s' allocated_buf_size %s", name, sval_to_str(sval));
498 else
499 sm_msg("info: '%s' allocated_buf_size -1", name);
500 free_string(name);
503 static void match_alloc(const char *fn, struct expression *expr, void *_size_arg)
505 int size_arg = PTR_INT(_size_arg);
506 struct expression *right;
507 struct expression *arg;
508 sval_t bytes;
510 right = strip_expr(expr->right);
511 arg = get_argument_from_call_expr(right->args, size_arg);
513 info_record_alloction(expr->left, arg);
515 if (!get_implied_value(arg, &bytes))
516 return;
517 set_state_expr(my_size_id, expr->left, alloc_state_num(bytes.value));
520 static void match_calloc(const char *fn, struct expression *expr, void *unused)
522 struct expression *right;
523 struct expression *arg;
524 sval_t elements;
525 sval_t size;
527 right = strip_expr(expr->right);
528 arg = get_argument_from_call_expr(right->args, 0);
529 if (!get_implied_value(arg, &elements))
530 return;
531 arg = get_argument_from_call_expr(right->args, 1);
532 if (!get_implied_value(arg, &size))
533 return;
534 set_state_expr(my_size_id, expr->left, alloc_state_num(elements.value * size.value));
537 static void match_strlen(const char *fn, struct expression *expr, void *unused)
539 struct expression *right;
540 struct expression *str;
541 struct expression *len_expr;
542 char *len_name;
543 struct smatch_state *state;
545 right = strip_expr(expr->right);
546 str = get_argument_from_call_expr(right->args, 0);
547 len_expr = strip_expr(expr->left);
549 len_name = expr_to_var(len_expr);
550 if (!len_name)
551 return;
553 state = __alloc_smatch_state(0);
554 state->name = len_name;
555 state->data = len_expr;
556 set_state_expr(my_strlen_id, str, state);
559 static void match_limited(const char *fn, struct expression *expr, void *_limiter)
561 struct limiter *limiter = (struct limiter *)_limiter;
562 struct expression *dest;
563 struct expression *size_expr;
564 sval_t size;
566 dest = get_argument_from_call_expr(expr->args, limiter->buf_arg);
567 size_expr = get_argument_from_call_expr(expr->args, limiter->limit_arg);
568 if (!get_implied_max(size_expr, &size))
569 return;
570 set_state_expr(my_size_id, dest, alloc_state_num(size.value));
573 static void match_strcpy(const char *fn, struct expression *expr, void *unused)
575 struct expression fake_assign;
577 fake_assign.op = '=';
578 fake_assign.left = get_argument_from_call_expr(expr->args, 0);
579 fake_assign.right = get_argument_from_call_expr(expr->args, 1);
580 match_array_assignment(&fake_assign);
583 static void match_strndup(const char *fn, struct expression *expr, void *unused)
585 struct expression *fn_expr;
586 struct expression *size_expr;
587 sval_t size;
589 fn_expr = strip_expr(expr->right);
590 size_expr = get_argument_from_call_expr(fn_expr->args, 1);
591 if (!get_implied_max(size_expr, &size))
592 return;
594 /* It's easy to forget space for the NUL char */
595 size.value++;
596 set_state_expr(my_size_id, expr->left, alloc_state_num(size.value));
599 static void match_call(struct expression *expr)
601 char *name;
602 struct expression *arg;
603 int bytes;
604 int i;
606 name = get_fnptr_name(expr->fn);
607 if (!name)
608 return;
610 i = 0;
611 FOR_EACH_PTR(expr->args, arg) {
612 bytes = get_array_size_bytes(arg);
613 if (bytes > 1)
614 sm_msg("info: passes_buffer '%s' %d '$$' %d %s",
615 name, i, bytes,
616 is_static(expr->fn) ? "static" : "global");
617 i++;
618 } END_FOR_EACH_PTR(arg);
620 free_string(name);
623 static void struct_member_callback(char *fn, char *global_static, int param, char *printed_name, struct smatch_state *state)
625 if (state == &merged)
626 return;
627 sm_msg("info: passes_buffer '%s' %d '%s' %s %s", fn, param, printed_name, state->name, global_static);
630 static void match_func_end(struct symbol *sym)
632 memset(params_set, 0, sizeof(params_set));
635 void register_buf_size(int id)
637 my_size_id = id;
639 add_definition_db_callback(set_param_buf_size, BUF_SIZE);
640 add_db_return_states_callback(BUF_SIZE, &db_returns_buf_size);
642 add_function_assign_hook("malloc", &match_alloc, INT_PTR(0));
643 add_function_assign_hook("calloc", &match_calloc, NULL);
644 add_function_assign_hook("memdup", &match_alloc, INT_PTR(1));
645 if (option_project == PROJ_KERNEL) {
646 add_function_assign_hook("kmalloc", &match_alloc, INT_PTR(0));
647 add_function_assign_hook("kzalloc", &match_alloc, INT_PTR(0));
648 add_function_assign_hook("vmalloc", &match_alloc, INT_PTR(0));
649 add_function_assign_hook("__vmalloc", &match_alloc, INT_PTR(0));
650 add_function_assign_hook("kcalloc", &match_calloc, NULL);
651 add_function_assign_hook("kmalloc_array", &match_calloc, NULL);
652 add_function_assign_hook("drm_malloc_ab", &match_calloc, NULL);
653 add_function_assign_hook("drm_calloc_large", &match_calloc, NULL);
654 add_function_assign_hook("sock_kmalloc", &match_alloc, INT_PTR(1));
655 add_function_assign_hook("kmemdup", &match_alloc, INT_PTR(1));
656 add_function_assign_hook("kmemdup_user", &match_alloc, INT_PTR(1));
658 add_hook(&match_array_assignment, ASSIGNMENT_HOOK);
659 add_hook(&match_strlen_condition, CONDITION_HOOK);
660 add_function_assign_hook("strlen", &match_strlen, NULL);
662 add_function_assign_hook("strndup", match_strndup, NULL);
663 if (option_project == PROJ_KERNEL)
664 add_function_assign_hook("kstrndup", match_strndup, NULL);
666 add_hook(&match_func_end, END_FUNC_HOOK);
667 add_modification_hook(my_size_id, &set_undefined);
669 add_merge_hook(my_size_id, &merge_func);
672 void register_strlen(int id)
674 my_strlen_id = id;
675 add_modification_hook(my_strlen_id, &set_undefined);
676 add_merge_hook(my_strlen_id, &merge_func);
679 void register_buf_size_late(int id)
681 add_function_hook("strlcpy", &match_limited, &b0_l2);
682 add_function_hook("strlcat", &match_limited, &b0_l2);
683 add_function_hook("memscan", &match_limited, &b0_l2);
685 add_function_hook("strcpy", &match_strcpy, NULL);
687 if (option_info) {
688 add_hook(&match_call, FUNCTION_CALL_HOOK);
689 add_member_info_callback(my_size_id, struct_member_callback);