smatch_strlen.c

   1 /*
   2  * smatch/smatch_strlen.c
   3  *
   4  * Copyright (C) 2013 Oracle.
   5  *
   6  * Licensed under the Open Software License version 1.1
   7  *
   8  */
   9
  10 #include <stdlib.h>
  11 #include <errno.h>
  12 #include "parse.h"
  13 #include "smatch.h"
  14 #include "smatch_slist.h"
  15 #include "smatch_extra.h"
  16
  17 #define UNKNOWN_SIZE (-1)
  18
  19 static int my_strlen_id;
  20 /*
  21  * The trick with the my_equiv_id is that if we have:
  22  * foo = strlen(bar);
  23  * We don't know at that point what the strlen() is but we know it's equivalent
  24  * to "foo" so maybe we can find the value of "foo" later.
  25  */
  26 static int my_equiv_id;
  27
  28 static struct smatch_state *size_to_estate(int size)
  29 {
  30         sval_t sval;
  31
  32         sval.type = &int_ctype;
  33         sval.value = size;
  34
  35         return alloc_estate_sval(sval);
  36 }
  37
  38 static struct smatch_state *unmatched_strlen_state(struct sm_state *sm)
  39 {
  40         return size_to_estate(UNKNOWN_SIZE);
  41 }
  42
  43 static void set_strlen_undefined(struct sm_state *sm, struct expression *mod_expr)
  44 {
  45         set_state(sm->owner, sm->name, sm->sym, size_to_estate(UNKNOWN_SIZE));
  46 }
  47
  48 static void set_strlen_equiv_undefined(struct sm_state *sm, struct expression *mod_expr)
  49 {
  50         set_state(sm->owner, sm->name, sm->sym, &undefined);
  51 }
  52
  53 static void match_string_assignment(struct expression *expr)
  54 {
  55         struct range_list *rl;
  56
  57         if (expr->op != '=')
  58                 return;
  59         if (!get_implied_strlen(expr->right, &rl))
  60                 return;
  61         set_state_expr(my_strlen_id, expr->left, alloc_estate_rl(clone_rl(rl)));
  62 }
  63
  64 static void match_strlen(const char *fn, struct expression *expr, void *unused)
  65 {
  66         struct expression *right;
  67         struct expression *str;
  68         struct expression *len_expr;
  69         char *len_name;
  70         struct smatch_state *state;
  71
  72         right = strip_expr(expr->right);
  73         str = get_argument_from_call_expr(right->args, 0);
  74         len_expr = strip_expr(expr->left);
  75
  76         len_name = expr_to_var(len_expr);
  77         if (!len_name)
  78                 return;
  79
  80         state = __alloc_smatch_state(0);
  81         state->name = len_name;
  82         state->data = len_expr;
  83
  84         set_state_expr(my_equiv_id, str, state);
  85 }
  86
  87 static int get_strlen_from_string(struct expression *expr, struct range_list **rl)
  88 {
  89         sval_t sval;
  90         int len;
  91
  92         len = expr->string->length;
  93         sval = sval_type_val(&int_ctype, len - 1);
  94         *rl = alloc_rl(sval, sval);
  95         return 1;
  96 }
  97
  98
  99 static int get_strlen_from_state(struct expression *expr, struct range_list **rl)
 100 {
 101         struct smatch_state *state;
 102
 103         state = get_state_expr(my_strlen_id, expr);
 104         if (!state)
 105                 return 0;
 106         *rl = estate_rl(state);
 107         return 1;
 108
 109
 110 }
 111
 112 static int get_strlen_from_equiv(struct expression *expr, struct range_list **rl)
 113 {
 114         struct smatch_state *state;
 115
 116         state = get_state_expr(my_equiv_id, expr);
 117         if (!state || !state->data)
 118                 return 0;
 119         if (!get_implied_rl((struct expression *)state->data, rl))
 120                 return 0;
 121         return 1;
 122 }
 123
 124 int get_implied_strlen(struct expression *expr, struct range_list **rl)
 125 {
 126
 127         *rl = NULL;
 128
 129         switch (expr->type) {
 130         case EXPR_STRING:
 131                 return get_strlen_from_string(expr, rl);
 132         }
 133
 134         if (get_strlen_from_state(expr, rl))
 135                 return 1;
 136         if (get_strlen_from_equiv(expr, rl))
 137                 return 1;
 138         return 0;
 139 }
 140
 141 int get_size_from_strlen(struct expression *expr)
 142 {
 143         struct range_list *rl;
 144         sval_t max;
 145
 146         if (!get_implied_strlen(expr, &rl))
 147                 return 0;
 148         max = rl_max(rl);
 149         if (sval_is_negative(max) || sval_is_max(max))
 150                 return 0;
 151
 152         return max.value + 1; /* add one because strlen doesn't include the NULL */
 153 }
 154
 155 void set_param_strlen(const char *name, struct symbol *sym, char *key, char *value)
 156 {
 157         struct range_list *rl = NULL;
 158         struct smatch_state *state;
 159         char fullname[256];
 160
 161         if (strncmp(key, "$$", 2) != 0)
 162                 return;
 163
 164         snprintf(fullname, 256, "%s%s", name, key + 2);
 165
 166         str_to_rl(&int_ctype, value, &rl);
 167         if (!rl || is_whole_rl(rl))
 168                 return;
 169         state = alloc_estate_rl(rl);
 170         set_state(my_strlen_id, fullname, sym, state);
 171 }
 172
 173 static void match_call(struct expression *expr)
 174 {
 175         struct expression *arg;
 176         struct range_list *rl;
 177         int i;
 178
 179         i = 0;
 180         FOR_EACH_PTR(expr->args, arg) {
 181                 if (!get_implied_strlen(arg, &rl))
 182                         continue;
 183                 if (!is_whole_rl(rl))
 184                         sql_insert_caller_info(expr, STR_LEN, i, "$$", show_rl(rl));
 185                 i++;
 186         } END_FOR_EACH_PTR(arg);
 187 }
 188
 189 static void struct_member_callback(struct expression *call, int param, char *printed_name, struct smatch_state *state)
 190 {
 191         if (state == &merged)
 192                 return;
 193         sql_insert_caller_info(call, STR_LEN, param, printed_name, state->name);
 194 }
 195
 196 void register_strlen(int id)
 197 {
 198         my_strlen_id = id;
 199
 200         add_unmatched_state_hook(my_strlen_id, &unmatched_strlen_state);
 201
 202         select_caller_info_hook(set_param_strlen, STR_LEN);
 203         add_hook(&match_string_assignment, ASSIGNMENT_HOOK);
 204
 205         add_modification_hook(my_strlen_id, &set_strlen_undefined);
 206         add_merge_hook(my_strlen_id, &merge_estates);
 207         add_hook(&match_call, FUNCTION_CALL_HOOK);
 208         add_member_info_callback(my_strlen_id, struct_member_callback);
 209 }
 210
 211 void register_strlen_equiv(int id)
 212 {
 213         my_equiv_id = id;
 214         add_function_assign_hook("strlen", &match_strlen, NULL);
 215         add_modification_hook(my_equiv_id, &set_strlen_equiv_undefined);
 216 }
 217