?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
kernel: ERR_PTR() basically only returns negatives and the occasional NULL
[smatch.git] / smatch_db.c
blob10751af516c652ab97df828ff3f06ba3f6ebd1e4
1 /*
2 * Copyright (C) 2010 Dan Carpenter.
3 *
4 * This program is free software; you can redistribute it and/or
5 * modify it under the terms of the GNU General Public License
6 * as published by the Free Software Foundation; either version 2
7 * of the License, or (at your option) any later version.
8 *
9 * This program is distributed in the hope that it will be useful,
10 * but WITHOUT ANY WARRANTY; without even the implied warranty of
11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12 * GNU General Public License for more details.
13 *
14 * You should have received a copy of the GNU General Public License
15 * along with this program; if not, see http://www.gnu.org/copyleft/gpl.txt
16 */
17
18 #include <string.h>
19 #include <errno.h>
20 #include <sqlite3.h>
21 #include <unistd.h>
22 #include <ctype.h>
23 #include "smatch.h"
24 #include "smatch_slist.h"
25 #include "smatch_extra.h"
26
27 static sqlite3 *db;
28 static sqlite3 *mem_db;
29
30 static int return_id;
31
32 #define sql_insert(table, values...) \
33 do { \
34 if (!mem_db) \
35 break; \
36 if (__inline_fn) { \
37 char buf[1024]; \
38 char *err, *p = buf; \
39 int rc; \
40 \
41 p += snprintf(p, buf + sizeof(buf) - p, \
42 "insert into %s values (", #table); \
43 p += snprintf(p, buf + sizeof(buf) - p, values); \
44 p += snprintf(p, buf + sizeof(buf) - p, ");"); \
45 sm_debug("in-mem: %s\n", buf); \
46 rc = sqlite3_exec(mem_db, buf, NULL, NULL, &err); \
47 if (rc != SQLITE_OK) { \
48 fprintf(stderr, "SQL error #2: %s\n", err); \
49 fprintf(stderr, "SQL: '%s'\n", buf); \
50 parse_error = 1; \
51 } \
52 break; \
53 } \
54 if (option_info) { \
55 sm_prefix(); \
56 sm_printf("SQL: insert into " #table " values (" values); \
57 sm_printf(");\n"); \
58 } \
59 } while (0)
60
61 struct def_callback {
62 int hook_type;
63 void (*callback)(const char *name, struct symbol *sym, char *key, char *value);
64 };
65 ALLOCATOR(def_callback, "definition db hook callbacks");
66 DECLARE_PTR_LIST(callback_list, struct def_callback);
67 static struct callback_list *callbacks;
68
69 struct member_info_callback {
70 int owner;
71 void (*callback)(struct expression *call, int param, char *printed_name, struct sm_state *sm);
72 };
73 ALLOCATOR(member_info_callback, "caller_info callbacks");
74 DECLARE_PTR_LIST(member_info_cb_list, struct member_info_callback);
75 static struct member_info_cb_list *member_callbacks;
76
77 struct returned_state_callback {
78 void (*callback)(int return_id, char *return_ranges, struct expression *return_expr);
79 };
80 ALLOCATOR(returned_state_callback, "returned state callbacks");
81 DECLARE_PTR_LIST(returned_state_cb_list, struct returned_state_callback);
82 static struct returned_state_cb_list *returned_state_callbacks;
83
84 struct returned_member_callback {
85 int owner;
86 void (*callback)(int return_id, char *return_ranges, struct expression *expr, char *printed_name, struct smatch_state *state);
87 };
88 ALLOCATOR(returned_member_callback, "returned member callbacks");
89 DECLARE_PTR_LIST(returned_member_cb_list, struct returned_member_callback);
90 static struct returned_member_cb_list *returned_member_callbacks;
91
92 struct call_implies_callback {
93 int type;
94 void (*callback)(struct expression *arg, char *key, char *value);
95 };
96 ALLOCATOR(call_implies_callback, "call_implies callbacks");
97 DECLARE_PTR_LIST(call_implies_cb_list, struct call_implies_callback);
98 static struct call_implies_cb_list *call_implies_cb_list;
99
100 static int print_sql_output(void *unused, int argc, char **argv, char **azColName)
101 {
102 int i;
103
104 for (i = 0; i < argc; i++) {
105 if (i != 0)
106 printf(", ");
107 sm_printf("%s", argv[i]);
108 }
109 sm_printf("\n");
110 return 0;
111 }
112
113 void debug_sql(const char *sql)
114 {
115 if (!option_debug)
116 return;
117 sm_msg("%s", sql);
118 sql_exec(print_sql_output, NULL, sql);
119 }
120
121 void debug_mem_sql(const char *sql)
122 {
123 if (!option_debug)
124 return;
125 sm_msg("%s", sql);
126 sql_mem_exec(print_sql_output, NULL, sql);
127 }
128
129 void sql_exec(int (*callback)(void*, int, char**, char**), void *data, const char *sql)
130 {
131 char *err = NULL;
132 int rc;
133
134 if (option_no_db || !db)
135 return;
136
137 rc = sqlite3_exec(db, sql, callback, data, &err);
138 if (rc != SQLITE_OK && !parse_error) {
139 fprintf(stderr, "SQL error #2: %s\n", err);
140 fprintf(stderr, "SQL: '%s'\n", sql);
141 parse_error = 1;
142 }
143 }
144
145 void sql_mem_exec(int (*callback)(void*, int, char**, char**), void *data, const char *sql)
146 {
147 char *err = NULL;
148 int rc;
149
150 if (!mem_db)
151 return;
152
153 rc = sqlite3_exec(mem_db, sql, callback, data, &err);
154 if (rc != SQLITE_OK) {
155 fprintf(stderr, "SQL error #2: %s\n", err);
156 fprintf(stderr, "SQL: '%s'\n", sql);
157 parse_error = 1;
158 }
159 }
160
161 void sql_insert_return_states(int return_id, const char *return_ranges,
162 int type, int param, const char *key, const char *value)
163 {
164 if (key && strlen(key) >= 80)
165 return;
166 sql_insert(return_states, "'%s', '%s', %lu, %d, '%s', %d, %d, %d, '%s', '%s'",
167 get_base_file(), get_function(), (unsigned long)__inline_fn,
168 return_id, return_ranges, fn_static(), type, param, key, value);
169 }
170
171 static struct string_list *common_funcs;
172 static int is_common_function(const char *fn)
173 {
174 char *tmp;
175
176 if (strncmp(fn, "__builtin_", 10) == 0)
177 return 1;
178
179 FOR_EACH_PTR(common_funcs, tmp) {
180 if (strcmp(tmp, fn) == 0)
181 return 1;
182 } END_FOR_EACH_PTR(tmp);
183
184 return 0;
185 }
186
187 void sql_insert_caller_info(struct expression *call, int type,
188 int param, const char *key, const char *value)
189 {
190 char *fn;
191
192 if (!option_info && !__inline_call)
193 return;
194
195 if (key && strlen(key) >= 80)
196 return;
197
198 fn = get_fnptr_name(call->fn);
199 if (!fn)
200 return;
201
202 if (__inline_call) {
203 mem_sql(NULL, NULL,
204 "insert into caller_info values ('%s', '%s', '%s', %lu, %d, %d, %d, '%s', '%s');",
205 get_base_file(), get_function(), fn, (unsigned long)call,
206 is_static(call->fn), type, param, key, value);
207 }
208
209 if (!option_info)
210 return;
211
212 if (is_common_function(fn))
213 return;
214
215 sm_msg("SQL_caller_info: insert into caller_info values ("
216 "'%s', '%s', '%s', %%CALL_ID%%, %d, %d, %d, '%s', '%s');",
217 get_base_file(), get_function(), fn, is_static(call->fn),
218 type, param, key, value);
219
220 free_string(fn);
221 }
222
223 void sql_insert_function_ptr(const char *fn, const char *struct_name)
224 {
225 sql_insert(function_ptr, "'%s', '%s', '%s', 0", get_base_file(), fn,
226 struct_name);
227 }
228
229 void sql_insert_call_implies(int type, int param, const char *key, const char *value)
230 {
231 sql_insert(call_implies, "'%s', '%s', %lu, %d, %d, %d, '%s', %s", get_base_file(),
232 get_function(), (unsigned long)__inline_fn, fn_static(),
233 type, param, key, value);
234 }
235
236 void sql_insert_function_type_size(const char *member, const char *ranges)
237 {
238 sql_insert(function_type_size, "'%s', '%s', '%s', '%s'", get_base_file(), get_function(), member, ranges);
239 }
240
241 void sql_insert_local_values(const char *name, const char *value)
242 {
243 sql_insert(local_values, "'%s', '%s', '%s'", get_base_file(), name, value);
244 }
245
246 void sql_insert_function_type_value(const char *type, const char *value)
247 {
248 sql_insert(function_type_value, "'%s', '%s', '%s', '%s'", get_base_file(), get_function(), type, value);
249 }
250
251 void sql_insert_function_type(int param, const char *value)
252 {
253 sql_insert(function_type, "'%s', '%s', %d, %d, '%s'",
254 get_base_file(), get_function(), fn_static(), param, value);
255 }
256
257 void sql_insert_parameter_name(int param, const char *value)
258 {
259 sql_insert(parameter_name, "'%s', '%s', %d, %d, '%s'",
260 get_base_file(), get_function(), fn_static(), param, value);
261 }
262
263 void sql_insert_data_info(struct expression *data, int type, const char *value)
264 {
265 char *data_name;
266
267 data_name = get_data_info_name(data);
268 if (!data_name)
269 return;
270 sql_insert(data_info, "'%s', '%s', %d, '%s'",
271 is_static(data) ? get_base_file() : "extern",
272 data_name, type, value);
273 }
274
275 void sql_insert_data_info_var_sym(const char *var, struct symbol *sym, int type, const char *value)
276 {
277 sql_insert(data_info, "'%s', '%s', %d, '%s'",
278 (sym->ctype.modifiers & MOD_STATIC) ? get_base_file() : "extern",
279 var, type, value);
280 }
281
282 char *get_static_filter(struct symbol *sym)
283 {
284 static char sql_filter[1024];
285
286 /* This can only happen on buggy code. Return invalid SQL. */
287 if (!sym) {
288 sql_filter[0] = '\0';
289 return sql_filter;
290 }
291
292 if (sym->ctype.modifiers & MOD_STATIC) {
293 snprintf(sql_filter, sizeof(sql_filter),
294 "file = '%s' and function = '%s' and static = '1'",
295 get_base_file(), sym->ident->name);
296 } else {
297 snprintf(sql_filter, sizeof(sql_filter),
298 "function = '%s' and static = '0'", sym->ident->name);
299 }
300
301 return sql_filter;
302 }
303
304 static int get_row_count(void *_row_count, int argc, char **argv, char **azColName)
305 {
306 int *row_count = _row_count;
307
308 *row_count = 0;
309 if (argc != 1)
310 return 0;
311 *row_count = atoi(argv[0]);
312 return 0;
313 }
314
315 static void sql_select_return_states_pointer(const char *cols,
316 struct expression *call, int (*callback)(void*, int, char**, char**), void *info)
317 {
318 char *ptr;
319 int return_count;
320
321 ptr = get_fnptr_name(call->fn);
322 if (!ptr)
323 return;
324
325 run_sql(get_row_count, &return_count,
326 "select count(*) from return_states join function_ptr "
327 "where return_states.function == function_ptr.function and "
328 "ptr = '%s' and searchable = 1 and type = %d;", ptr, INTERNAL);
329 /* The magic number 100 is just from testing on the kernel. */
330 if (return_count > 100)
331 return;
332
333 run_sql(callback, info,
334 "select %s from return_states join function_ptr where "
335 "return_states.function == function_ptr.function and ptr = '%s' "
336 "and searchable = 1 "
337 "order by function_ptr.file, return_states.file, return_id, type;",
338 cols, ptr);
339 }
340
341 static int is_local_symbol(struct expression *expr)
342 {
343 if (expr->type != EXPR_SYMBOL)
344 return 0;
345 if (expr->symbol->ctype.modifiers & (MOD_NONLOCAL | MOD_STATIC | MOD_ADDRESSABLE))
346 return 0;
347 return 1;
348 }
349
350 void sql_select_return_states(const char *cols, struct expression *call,
351 int (*callback)(void*, int, char**, char**), void *info)
352 {
353 int row_count;
354
355 if (is_fake_call(call))
356 return;
357
358 if (call->fn->type != EXPR_SYMBOL || !call->fn->symbol || is_local_symbol(call->fn)) {
359 sql_select_return_states_pointer(cols, call, callback, info);
360 return;
361 }
362
363 if (inlinable(call->fn)) {
364 mem_sql(callback, info,
365 "select %s from return_states where call_id = '%lu' order by return_id, type;",
366 cols, (unsigned long)call);
367 return;
368 }
369
370 run_sql(get_row_count, &row_count, "select count(*) from return_states where %s;",
371 get_static_filter(call->fn->symbol));
372 if (row_count > 3000)
373 return;
374
375 run_sql(callback, info, "select %s from return_states where %s order by file, return_id, type;",
376 cols, get_static_filter(call->fn->symbol));
377 }
378
379 void sql_select_call_implies(const char *cols, struct expression *call,
380 int (*callback)(void*, int, char**, char**))
381 {
382 if (call->fn->type != EXPR_SYMBOL || !call->fn->symbol)
383 return;
384
385 if (inlinable(call->fn)) {
386 mem_sql(callback, call,
387 "select %s from call_implies where call_id = '%lu';",
388 cols, (unsigned long)call);
389 return;
390 }
391
392 run_sql(callback, call, "select %s from call_implies where %s;",
393 cols, get_static_filter(call->fn->symbol));
394 }
395
396 void sql_select_caller_info(const char *cols, struct symbol *sym,
397 int (*callback)(void*, int, char**, char**))
398 {
399 if (__inline_fn) {
400 mem_sql(callback, NULL,
401 "select %s from caller_info where call_id = %lu;",
402 cols, (unsigned long)__inline_fn);
403 return;
404 }
405
406 run_sql(callback, NULL,
407 "select %s from caller_info where %s order by call_id;",
408 cols, get_static_filter(sym));
409 }
410
411 void select_caller_info_hook(void (*callback)(const char *name, struct symbol *sym, char *key, char *value), int type)
412 {
413 struct def_callback *def_callback = __alloc_def_callback(0);
414
415 def_callback->hook_type = type;
416 def_callback->callback = callback;
417 add_ptr_list(&callbacks, def_callback);
418 }
419
420 /*
421 * These call backs are used when the --info option is turned on to print struct
422 * member information. For example foo->bar could have a state in
423 * smatch_extra.c and also check_user.c.
424 */
425 void add_member_info_callback(int owner, void (*callback)(struct expression *call, int param, char *printed_name, struct sm_state *sm))
426 {
427 struct member_info_callback *member_callback = __alloc_member_info_callback(0);
428
429 member_callback->owner = owner;
430 member_callback->callback = callback;
431 add_ptr_list(&member_callbacks, member_callback);
432 }
433
434 void add_split_return_callback(void (*fn)(int return_id, char *return_ranges, struct expression *returned_expr))
435 {
436 struct returned_state_callback *callback = __alloc_returned_state_callback(0);
437
438 callback->callback = fn;
439 add_ptr_list(&returned_state_callbacks, callback);
440 }
441
442 void add_returned_member_callback(int owner, void (*callback)(int return_id, char *return_ranges, struct expression *expr, char *printed_name, struct smatch_state *state))
443 {
444 struct returned_member_callback *member_callback = __alloc_returned_member_callback(0);
445
446 member_callback->owner = owner;
447 member_callback->callback = callback;
448 add_ptr_list(&returned_member_callbacks, member_callback);
449 }
450
451 void select_call_implies_hook(int type, void (*callback)(struct expression *arg, char *key, char *value))
452 {
453 struct call_implies_callback *cb = __alloc_call_implies_callback(0);
454
455 cb->type = type;
456 cb->callback = callback;
457 add_ptr_list(&call_implies_cb_list, cb);
458 }
459
460 struct return_info {
461 struct expression *static_returns_call;
462 struct symbol *return_type;
463 struct range_list *return_range_list;
464 };
465
466 static int db_return_callback(void *_ret_info, int argc, char **argv, char **azColName)
467 {
468 struct return_info *ret_info = _ret_info;
469 struct range_list *rl;
470 struct expression *call_expr = ret_info->static_returns_call;
471
472 if (argc != 1)
473 return 0;
474 call_results_to_rl(call_expr, ret_info->return_type, argv[0], &rl);
475 ret_info->return_range_list = rl_union(ret_info->return_range_list, rl);
476 return 0;
477 }
478
479 struct range_list *db_return_vals(struct expression *expr)
480 {
481 struct return_info ret_info = {};
482 char buf[64];
483 struct sm_state *sm;
484
485 if (is_fake_call(expr))
486 return NULL;
487
488 snprintf(buf, sizeof(buf), "return %p", expr);
489 sm = get_sm_state(SMATCH_EXTRA, buf, NULL);
490 if (sm)
491 return clone_rl(estate_rl(sm->state));
492 ret_info.static_returns_call = expr;
493 ret_info.return_type = get_type(expr);
494 if (!ret_info.return_type)
495 return NULL;
496
497 if (expr->fn->type != EXPR_SYMBOL || !expr->fn->symbol)
498 return NULL;
499
500 ret_info.return_range_list = NULL;
501 if (inlinable(expr->fn)) {
502 mem_sql(db_return_callback, &ret_info,
503 "select distinct return from return_states where call_id = '%lu';",
504 (unsigned long)expr);
505 } else {
506 run_sql(db_return_callback, &ret_info,
507 "select distinct return from return_states where %s;",
508 get_static_filter(expr->fn->symbol));
509 }
510 return ret_info.return_range_list;
511 }
512
513 struct range_list *db_return_vals_from_str(const char *fn_name)
514 {
515 struct return_info ret_info;
516
517 ret_info.static_returns_call = NULL;
518 ret_info.return_type = &llong_ctype;
519 ret_info.return_range_list = NULL;
520
521 run_sql(db_return_callback, &ret_info,
522 "select distinct return from return_states where function = '%s';",
523 fn_name);
524 return ret_info.return_range_list;
525 }
526
527 static void match_call_marker(struct expression *expr)
528 {
529 /*
530 * we just want to record something in the database so that if we have
531 * two calls like: frob(4); frob(some_unkown); then on the receiving
532 * side we know that sometimes frob is called with unknown parameters.
533 */
534
535 sql_insert_caller_info(expr, INTERNAL, -1, "%call_marker%", "");
536 }
537
538 static void print_struct_members(struct expression *call, struct expression *expr, int param, struct stree *stree,
539 void (*callback)(struct expression *call, int param, char *printed_name, struct sm_state *sm))
540 {
541 struct sm_state *sm;
542 char *name;
543 struct symbol *sym;
544 int len;
545 char printed_name[256];
546 int is_address = 0;
547
548 expr = strip_expr(expr);
549 if (expr->type == EXPR_PREOP && expr->op == '&') {
550 expr = strip_expr(expr->unop);
551 is_address = 1;
552 }
553
554 name = expr_to_var_sym(expr, &sym);
555 if (!name || !sym)
556 goto free;
557
558 len = strlen(name);
559 FOR_EACH_SM(stree, sm) {
560 if (sm->sym != sym)
561 continue;
562 if (strcmp(name, sm->name) == 0) {
563 if (is_address)
564 snprintf(printed_name, sizeof(printed_name), "*$");
565 else /* these are already handled. fixme: handle them here */
566 continue;
567 } else if (sm->name[0] == '*' && strcmp(name, sm->name + 1) == 0) {
568 snprintf(printed_name, sizeof(printed_name), "*$");
569 } else if (strncmp(name, sm->name, len) == 0) {
570 if (isalnum(sm->name[len]))
571 continue;
572 if (is_address)
573 snprintf(printed_name, sizeof(printed_name), "$->%s", sm->name + len + 1);
574 else
575 snprintf(printed_name, sizeof(printed_name), "$%s", sm->name + len);
576 } else {
577 continue;
578 }
579 callback(call, param, printed_name, sm);
580 } END_FOR_EACH_SM(sm);
581 free:
582 free_string(name);
583 }
584
585 static void match_call_info(struct expression *call)
586 {
587 struct member_info_callback *cb;
588 struct expression *arg;
589 struct stree *stree;
590 char *name;
591 int i;
592
593 name = get_fnptr_name(call->fn);
594 if (!name)
595 return;
596
597 FOR_EACH_PTR(member_callbacks, cb) {
598 stree = get_all_states_stree(cb->owner);
599 i = 0;
600 FOR_EACH_PTR(call->args, arg) {
601 print_struct_members(call, arg, i, stree, cb->callback);
602 i++;
603 } END_FOR_EACH_PTR(arg);
604 free_stree(&stree);
605 } END_FOR_EACH_PTR(cb);
606
607 free_string(name);
608 }
609
610 static int get_param(int param, char **name, struct symbol **sym)
611 {
612 struct symbol *arg;
613 int i;
614
615 i = 0;
616 FOR_EACH_PTR(cur_func_sym->ctype.base_type->arguments, arg) {
617 /*
618 * this is a temporary hack to work around a bug (I think in sparse?)
619 * 2.6.37-rc1:fs/reiserfs/journal.o
620 * If there is a function definition without parameter name found
621 * after a function implementation then it causes a crash.
622 * int foo() {}
623 * int bar(char *);
624 */
625 if (arg->ident->name < (char *)100)
626 continue;
627 if (i == param) {
628 *name = arg->ident->name;
629 *sym = arg;
630 return TRUE;
631 }
632 i++;
633 } END_FOR_EACH_PTR(arg);
634
635 return FALSE;
636 }
637
638 static struct stree *final_states;
639 static int prev_func_id = -1;
640 static int caller_info_callback(void *unused, int argc, char **argv, char **azColName)
641 {
642 int func_id;
643 long type;
644 long param;
645 char *key;
646 char *value;
647 char *name = NULL;
648 struct symbol *sym = NULL;
649 struct def_callback *def_callback;
650 struct stree *stree;
651
652 if (argc != 5)
653 return 0;
654
655 func_id = atoi(argv[0]);
656 errno = 0;
657 type = strtol(argv[1], NULL, 10);
658 param = strtol(argv[2], NULL, 10);
659 if (errno)
660 return 0;
661 key = argv[3];
662 value = argv[4];
663
664
665 if (prev_func_id == -1)
666 prev_func_id = func_id;
667 if (func_id != prev_func_id) {
668 stree = __pop_fake_cur_stree();
669 merge_stree(&final_states, stree);
670 free_stree(&stree);
671 __push_fake_cur_stree();
672 __unnullify_path();
673 prev_func_id = func_id;
674 }
675
676 if (param >= 0 && !get_param(param, &name, &sym))
677 return 0;
678
679 FOR_EACH_PTR(callbacks, def_callback) {
680 if (def_callback->hook_type == type)
681 def_callback->callback(name, sym, key, value);
682 } END_FOR_EACH_PTR(def_callback);
683
684 return 0;
685 }
686
687 static void get_direct_callers(struct symbol *sym)
688 {
689 sql_select_caller_info("call_id, type, parameter, key, value", sym,
690 caller_info_callback);
691 }
692
693 static struct string_list *ptr_names_done;
694 static struct string_list *ptr_names;
695
696 static int get_ptr_name(void *unused, int argc, char **argv, char **azColName)
697 {
698 insert_string(&ptr_names, alloc_string(argv[0]));
699 return 0;
700 }
701
702 static char *get_next_ptr_name(void)
703 {
704 char *ptr;
705
706 FOR_EACH_PTR(ptr_names, ptr) {
707 if (list_has_string(ptr_names_done, ptr))
708 continue;
709 insert_string(&ptr_names_done, ptr);
710 return ptr;
711 } END_FOR_EACH_PTR(ptr);
712 return NULL;
713 }
714
715 static void get_ptr_names(const char *file, const char *name)
716 {
717 char sql_filter[1024];
718 int before, after;
719
720 if (file) {
721 snprintf(sql_filter, 1024, "file = '%s' and function = '%s';",
722 file, name);
723 } else {
724 snprintf(sql_filter, 1024, "function = '%s';", name);
725 }
726
727 before = ptr_list_size((struct ptr_list *)ptr_names);
728
729 run_sql(get_ptr_name, NULL,
730 "select distinct ptr from function_ptr where %s",
731 sql_filter);
732
733 after = ptr_list_size((struct ptr_list *)ptr_names);
734 if (before == after)
735 return;
736
737 while ((name = get_next_ptr_name()))
738 get_ptr_names(NULL, name);
739 }
740
741 static void match_data_from_db(struct symbol *sym)
742 {
743 struct sm_state *sm;
744 struct stree *stree;
745
746 if (!sym || !sym->ident)
747 return;
748
749 __push_fake_cur_stree();
750 __unnullify_path();
751 prev_func_id = -1;
752
753 if (!__inline_fn) {
754 char *ptr;
755
756 if (sym->ctype.modifiers & MOD_STATIC)
757 get_ptr_names(get_base_file(), sym->ident->name);
758 else
759 get_ptr_names(NULL, sym->ident->name);
760
761 if (ptr_list_size((struct ptr_list *)ptr_names) > 20) {
762 __free_ptr_list((struct ptr_list **)&ptr_names);
763 __free_ptr_list((struct ptr_list **)&ptr_names_done);
764 stree = __pop_fake_cur_stree();
765 free_stree(&stree);
766 return;
767 }
768
769 get_direct_callers(sym);
770
771 FOR_EACH_PTR(ptr_names, ptr) {
772 run_sql(caller_info_callback, NULL,
773 "select call_id, type, parameter, key, value"
774 " from caller_info where function = '%s' order by call_id",
775 ptr);
776 free_string(ptr);
777 } END_FOR_EACH_PTR(ptr);
778
779 __free_ptr_list((struct ptr_list **)&ptr_names);
780 __free_ptr_list((struct ptr_list **)&ptr_names_done);
781 } else {
782 get_direct_callers(sym);
783 }
784
785 stree = __pop_fake_cur_stree();
786 merge_stree(&final_states, stree);
787 free_stree(&stree);
788
789 FOR_EACH_SM(final_states, sm) {
790 __set_sm(sm);
791 } END_FOR_EACH_SM(sm);
792
793 free_stree(&final_states);
794 }
795
796 static int call_implies_callbacks(void *_call, int argc, char **argv, char **azColName)
797 {
798 struct expression *call_expr = _call;
799 struct call_implies_callback *cb;
800 struct expression *arg = NULL;
801 int type;
802 int param;
803
804 if (argc != 5)
805 return 0;
806
807 type = atoi(argv[1]);
808 param = atoi(argv[2]);
809
810 FOR_EACH_PTR(call_implies_cb_list, cb) {
811 if (cb->type != type)
812 continue;
813 if (param != -1) {
814 arg = get_argument_from_call_expr(call_expr->args, param);
815 if (!arg)
816 continue;
817 }
818 cb->callback(arg, argv[3], argv[4]);
819 } END_FOR_EACH_PTR(cb);
820
821 return 0;
822 }
823
824 static void match_call_implies(struct expression *expr)
825 {
826 sql_select_call_implies("function, type, parameter, key, value", expr,
827 call_implies_callbacks);
828 }
829
830 static void print_initializer_list(struct expression_list *expr_list,
831 struct symbol *struct_type)
832 {
833 struct expression *expr;
834 struct symbol *base_type;
835 char struct_name[256];
836
837 FOR_EACH_PTR(expr_list, expr) {
838 if (expr->type == EXPR_INDEX && expr->idx_expression && expr->idx_expression->type == EXPR_INITIALIZER) {
839 print_initializer_list(expr->idx_expression->expr_list, struct_type);
840 continue;
841 }
842 if (expr->type != EXPR_IDENTIFIER)
843 continue;
844 if (!expr->expr_ident)
845 continue;
846 if (!expr->ident_expression || !expr->ident_expression->symbol_name)
847 continue;
848 base_type = get_type(expr->ident_expression);
849 if (!base_type || base_type->type != SYM_FN)
850 continue;
851 snprintf(struct_name, sizeof(struct_name), "(struct %s)->%s",
852 struct_type->ident->name, expr->expr_ident->name);
853 sql_insert_function_ptr(expr->ident_expression->symbol_name->name,
854 struct_name);
855 } END_FOR_EACH_PTR(expr);
856 }
857
858 static void global_variable(struct symbol *sym)
859 {
860 struct symbol *struct_type;
861
862 if (!sym->ident)
863 return;
864 if (!sym->initializer || sym->initializer->type != EXPR_INITIALIZER)
865 return;
866 struct_type = get_base_type(sym);
867 if (!struct_type)
868 return;
869 if (struct_type->type == SYM_ARRAY) {
870 struct_type = get_base_type(struct_type);
871 if (!struct_type)
872 return;
873 }
874 if (struct_type->type != SYM_STRUCT || !struct_type->ident)
875 return;
876 print_initializer_list(sym->initializer->expr_list, struct_type);
877 }
878
879 static char *function_signature(void)
880 {
881 return type_to_str(get_real_base_type(cur_func_sym));
882 }
883
884 static void match_return_info(int return_id, char *return_ranges, struct expression *expr)
885 {
886 sql_insert_return_states(return_id, return_ranges, INTERNAL, -1, "", function_signature());
887 }
888
889 static void call_return_state_hooks_conditional(struct expression *expr)
890 {
891 struct returned_state_callback *cb;
892 struct range_list *rl;
893 char *return_ranges;
894 int final_pass_orig = final_pass;
895
896 __push_fake_cur_stree();
897
898 final_pass = 0;
899 __split_whole_condition(expr->conditional);
900 final_pass = final_pass_orig;
901
902 if (get_implied_rl(expr->cond_true, &rl))
903 rl = cast_rl(cur_func_return_type(), rl);
904 else
905 rl = cast_rl(cur_func_return_type(), alloc_whole_rl(get_type(expr->cond_true)));
906 return_ranges = show_rl(rl);
907 set_state(RETURN_ID, "return_ranges", NULL, alloc_estate_rl(rl));
908
909 return_id++;
910 FOR_EACH_PTR(returned_state_callbacks, cb) {
911 cb->callback(return_id, return_ranges, expr);
912 } END_FOR_EACH_PTR(cb);
913
914 __push_true_states();
915 __use_false_states();
916
917 if (get_implied_rl(expr->cond_false, &rl))
918 rl = cast_rl(cur_func_return_type(), rl);
919 else
920 rl = cast_rl(cur_func_return_type(), alloc_whole_rl(get_type(expr->cond_false)));
921 return_ranges = show_rl(rl);
922 set_state(RETURN_ID, "return_ranges", NULL, alloc_estate_rl(rl));
923
924 return_id++;
925 FOR_EACH_PTR(returned_state_callbacks, cb) {
926 cb->callback(return_id, return_ranges, expr);
927 } END_FOR_EACH_PTR(cb);
928
929 __merge_true_states();
930 __free_fake_cur_stree();
931 }
932
933 static void call_return_state_hooks_compare(struct expression *expr)
934 {
935 struct returned_state_callback *cb;
936 char *return_ranges;
937 int final_pass_orig = final_pass;
938 sval_t sval = { .type = &int_ctype };
939 sval_t ret;
940
941 if (!get_implied_value(expr, &ret))
942 ret.value = -1;
943
944 __push_fake_cur_stree();
945
946 final_pass = 0;
947 __split_whole_condition(expr);
948 final_pass = final_pass_orig;
949
950 if (ret.value != 0) {
951 return_ranges = alloc_sname("1");
952 sval.value = 1;
953 set_state(RETURN_ID, "return_ranges", NULL, alloc_estate_sval(sval));
954
955 return_id++;
956 FOR_EACH_PTR(returned_state_callbacks, cb) {
957 cb->callback(return_id, return_ranges, expr);
958 } END_FOR_EACH_PTR(cb);
959 }
960
961 __push_true_states();
962 __use_false_states();
963
964 if (ret.value != 1) {
965 return_ranges = alloc_sname("0");
966 sval.value = 0;
967 set_state(RETURN_ID, "return_ranges", NULL, alloc_estate_sval(sval));
968
969 return_id++;
970 FOR_EACH_PTR(returned_state_callbacks, cb) {
971 cb->callback(return_id, return_ranges, expr);
972 } END_FOR_EACH_PTR(cb);
973 }
974
975 __merge_true_states();
976 __free_fake_cur_stree();
977 }
978
979 static int ptr_in_list(struct sm_state *sm, struct state_list *slist)
980 {
981 struct sm_state *tmp;
982
983 FOR_EACH_PTR(slist, tmp) {
984 if (strcmp(tmp->state->name, sm->state->name) == 0)
985 return 1;
986 } END_FOR_EACH_PTR(tmp);
987
988 return 0;
989 }
990
991 static int split_possible_helper(struct sm_state *sm, struct expression *expr)
992 {
993 struct returned_state_callback *cb;
994 struct range_list *rl;
995 char *return_ranges;
996 struct sm_state *tmp;
997 int ret = 0;
998 int nr_possible, nr_states;
999 char *compare_str = NULL;
1000 char buf[128];
1001 struct state_list *already_handled = NULL;
1002
1003 if (!sm || !sm->merged)
1004 return 0;
1005
1006 if (too_many_possible(sm))
1007 return 0;
1008
1009 /* bail if it gets too complicated */
1010 nr_possible = ptr_list_size((struct ptr_list *)sm->possible);
1011 nr_states = stree_count(__get_cur_stree());
1012 if (nr_states * nr_possible >= 2000)
1013 return 0;
1014
1015 FOR_EACH_PTR(sm->possible, tmp) {
1016 if (tmp->merged)
1017 continue;
1018 if (ptr_in_list(tmp, already_handled))
1019 continue;
1020 add_ptr_list(&already_handled, tmp);
1021
1022 ret = 1;
1023 __push_fake_cur_stree();
1024
1025 overwrite_states_using_pool(sm, tmp);
1026
1027 rl = cast_rl(cur_func_return_type(), estate_rl(tmp->state));
1028 return_ranges = show_rl(rl);
1029 set_state(RETURN_ID, "return_ranges", NULL, alloc_estate_rl(clone_rl(rl)));
1030 compare_str = expr_lte_to_param(expr, -1);
1031 if (compare_str) {
1032 snprintf(buf, sizeof(buf), "%s%s", return_ranges, compare_str);
1033 return_ranges = alloc_sname(buf);
1034 }
1035
1036 return_id++;
1037 FOR_EACH_PTR(returned_state_callbacks, cb) {
1038 cb->callback(return_id, return_ranges, expr);
1039 } END_FOR_EACH_PTR(cb);
1040
1041 __free_fake_cur_stree();
1042 } END_FOR_EACH_PTR(tmp);
1043
1044 free_slist(&already_handled);
1045
1046 return ret;
1047 }
1048
1049 static int call_return_state_hooks_split_possible(struct expression *expr)
1050 {
1051 struct sm_state *sm;
1052
1053 if (!expr || expr_equal_to_param(expr, -1))
1054 return 0;
1055
1056 sm = get_sm_state_expr(SMATCH_EXTRA, expr);
1057 return split_possible_helper(sm, expr);
1058 }
1059
1060 static const char *get_return_ranges_str(struct expression *expr, struct range_list **rl_p)
1061 {
1062 struct range_list *rl;
1063 char *return_ranges;
1064 sval_t sval;
1065 char *compare_str;
1066 char *math_str;
1067 char buf[128];
1068
1069 *rl_p = NULL;
1070
1071 if (!expr)
1072 return alloc_sname("");
1073
1074 if (get_implied_value(expr, &sval)) {
1075 sval = sval_cast(cur_func_return_type(), sval);
1076 *rl_p = alloc_rl(sval, sval);
1077 return sval_to_str(sval);
1078 }
1079
1080 compare_str = expr_equal_to_param(expr, -1);
1081 math_str = get_value_in_terms_of_parameter_math(expr);
1082
1083 if (get_implied_rl(expr, &rl)) {
1084 rl = cast_rl(cur_func_return_type(), rl);
1085 return_ranges = show_rl(rl);
1086 } else if (get_imaginary_absolute(expr, &rl)){
1087 rl = cast_rl(cur_func_return_type(), rl);
1088 return alloc_sname(show_rl(rl));
1089 } else {
1090 rl = cast_rl(cur_func_return_type(), alloc_whole_rl(get_type(expr)));
1091 return_ranges = show_rl(rl);
1092 }
1093 *rl_p = rl;
1094
1095 if (compare_str) {
1096 snprintf(buf, sizeof(buf), "%s%s", return_ranges, compare_str);
1097 return alloc_sname(buf);
1098 }
1099
1100 if (math_str) {
1101 snprintf(buf, sizeof(buf), "%s[%s]", return_ranges, math_str);
1102 return alloc_sname(buf);
1103 }
1104
1105 compare_str = expr_lte_to_param(expr, -1);
1106 if (compare_str) {
1107 snprintf(buf, sizeof(buf), "%s%s", return_ranges, compare_str);
1108 return alloc_sname(buf);
1109 }
1110 return return_ranges;
1111 }
1112
1113 static int split_positive_from_negative(struct expression *expr)
1114 {
1115 struct returned_state_callback *cb;
1116 struct range_list *rl;
1117 const char *return_ranges;
1118 struct range_list *ret_rl;
1119 int undo;
1120
1121 /* We're going to print the states 3 times */
1122 if (stree_count(__get_cur_stree()) > 10000 / 3)
1123 return 0;
1124
1125 if (!get_implied_rl(expr, &rl) || !rl)
1126 return 0;
1127 if (is_whole_rl(rl) || is_whole_rl_non_zero(rl))
1128 return 0;
1129 /* Forget about INT_MAX and larger */
1130 if (rl_max(rl).value <= 0)
1131 return 0;
1132 if (!sval_is_negative(rl_min(rl)))
1133 return 0;
1134
1135 if (!assume(compare_expression(expr, '>', zero_expr())))
1136 return 0;
1137
1138 return_id++;
1139 return_ranges = get_return_ranges_str(expr, &ret_rl);
1140 set_state(RETURN_ID, "return_ranges", NULL, alloc_estate_rl(ret_rl));
1141 FOR_EACH_PTR(returned_state_callbacks, cb) {
1142 cb->callback(return_id, (char *)return_ranges, expr);
1143 } END_FOR_EACH_PTR(cb);
1144
1145 end_assume();
1146
1147 if (rl_has_sval(rl, sval_type_val(rl_type(rl), 0))) {
1148 undo = assume(compare_expression(expr, SPECIAL_EQUAL, zero_expr()));
1149
1150 return_id++;
1151 return_ranges = get_return_ranges_str(expr, &ret_rl);
1152 set_state(RETURN_ID, "return_ranges", NULL, alloc_estate_rl(ret_rl));
1153 FOR_EACH_PTR(returned_state_callbacks, cb) {
1154 cb->callback(return_id, (char *)return_ranges, expr);
1155 } END_FOR_EACH_PTR(cb);
1156
1157 if (undo)
1158 end_assume();
1159 }
1160
1161 undo = assume(compare_expression(expr, '<', zero_expr()));
1162
1163 return_id++;
1164 return_ranges = get_return_ranges_str(expr, &ret_rl);
1165 set_state(RETURN_ID, "return_ranges", NULL, alloc_estate_rl(ret_rl));
1166 FOR_EACH_PTR(returned_state_callbacks, cb) {
1167 cb->callback(return_id, (char *)return_ranges, expr);
1168 } END_FOR_EACH_PTR(cb);
1169
1170 if (undo)
1171 end_assume();
1172
1173 return 1;
1174 }
1175
1176 static int call_return_state_hooks_split_null_non_null(struct expression *expr)
1177 {
1178 struct returned_state_callback *cb;
1179 struct range_list *rl;
1180 struct range_list *nonnull_rl;
1181 sval_t null_sval;
1182 struct range_list *null_rl = NULL;
1183 char *return_ranges;
1184 struct smatch_state *state;
1185 int nr_states;
1186 int final_pass_orig = final_pass;
1187
1188 if (!expr || expr_equal_to_param(expr, -1))
1189 return 0;
1190 if (expr->type == EXPR_CALL)
1191 return 0;
1192 if (!is_pointer(expr))
1193 return 0;
1194
1195 state = get_state_expr(SMATCH_EXTRA, expr);
1196 if (!state || !estate_rl(state))
1197 return 0;
1198 if (estate_min(state).value == 0 && estate_max(state).value == 0)
1199 return 0;
1200 if (!rl_has_sval(estate_rl(state), sval_type_val(estate_type(state), 0)))
1201 return 0;
1202
1203 nr_states = stree_count(__get_cur_stree());
1204 if (option_info && nr_states >= 1500)
1205 return 0;
1206
1207 rl = estate_rl(state);
1208
1209 __push_fake_cur_stree();
1210
1211 final_pass = 0;
1212 __split_whole_condition(expr);
1213 final_pass = final_pass_orig;
1214
1215 nonnull_rl = rl_filter(rl, rl_zero());
1216 return_ranges = show_rl(nonnull_rl);
1217 set_state(RETURN_ID, "return_ranges", NULL, alloc_estate_rl(nonnull_rl));
1218
1219 return_id++;
1220 FOR_EACH_PTR(returned_state_callbacks, cb) {
1221 cb->callback(return_id, return_ranges, expr);
1222 } END_FOR_EACH_PTR(cb);
1223
1224 __push_true_states();
1225 __use_false_states();
1226
1227 return_ranges = alloc_sname("0");
1228 null_sval = sval_type_val(rl_type(rl), 0);
1229 add_range(&null_rl, null_sval, null_sval);
1230 set_state(RETURN_ID, "return_ranges", NULL, alloc_estate_rl(null_rl));
1231 return_id++;
1232 FOR_EACH_PTR(returned_state_callbacks, cb) {
1233 cb->callback(return_id, return_ranges, expr);
1234 } END_FOR_EACH_PTR(cb);
1235
1236 __merge_true_states();
1237 __free_fake_cur_stree();
1238
1239 return 1;
1240 }
1241
1242 static int call_return_state_hooks_split_success_fail(struct expression *expr)
1243 {
1244 struct range_list *rl;
1245 struct range_list *nonzero_rl;
1246 sval_t zero_sval;
1247 struct range_list *zero_rl = NULL;
1248 int nr_states;
1249 struct returned_state_callback *cb;
1250 char *return_ranges;
1251 int final_pass_orig = final_pass;
1252 sval_t val;
1253
1254 if (option_project != PROJ_KERNEL)
1255 return 0;
1256
1257 nr_states = stree_count(__get_cur_stree());
1258 if (nr_states > 1500)
1259 return 0;
1260
1261 if (get_value(expr, &val))
1262 return 0;
1263 if (!get_implied_rl(expr, &rl))
1264 return 0;
1265 if (rl_min(rl).value < -4095 || rl_min(rl).value >= 0)
1266 return 0;
1267 if (rl_max(rl).value != 0)
1268 return 0;
1269
1270 __push_fake_cur_stree();
1271
1272 final_pass = 0;
1273 __split_whole_condition(expr);
1274 final_pass = final_pass_orig;
1275
1276 nonzero_rl = rl_filter(rl, rl_zero());
1277 return_ranges = show_rl(nonzero_rl);
1278 set_state(RETURN_ID, "return_ranges", NULL, alloc_estate_rl(nonzero_rl));
1279
1280 return_id++;
1281 FOR_EACH_PTR(returned_state_callbacks, cb) {
1282 cb->callback(return_id, return_ranges, expr);
1283 } END_FOR_EACH_PTR(cb);
1284
1285 __push_true_states();
1286 __use_false_states();
1287
1288 return_ranges = alloc_sname("0");
1289 zero_sval = sval_type_val(rl_type(rl), 0);
1290 add_range(&zero_rl, zero_sval, zero_sval);
1291 set_state(RETURN_ID, "return_ranges", NULL, alloc_estate_rl(zero_rl));
1292 return_id++;
1293 FOR_EACH_PTR(returned_state_callbacks, cb) {
1294 cb->callback(return_id, return_ranges, expr);
1295 } END_FOR_EACH_PTR(cb);
1296
1297 __merge_true_states();
1298 __free_fake_cur_stree();
1299
1300 return 1;
1301 }
1302
1303 static int is_boolean(struct expression *expr)
1304 {
1305 struct range_list *rl;
1306
1307 if (!get_implied_rl(expr, &rl))
1308 return 0;
1309 if (rl_min(rl).value == 0 && rl_max(rl).value == 1)
1310 return 1;
1311 return 0;
1312 }
1313
1314 static int is_conditional(struct expression *expr)
1315 {
1316 if (!expr)
1317 return 0;
1318 if (expr->type == EXPR_CONDITIONAL || expr->type == EXPR_SELECT)
1319 return 1;
1320 return 0;
1321 }
1322
1323 static int splitable_function_call(struct expression *expr)
1324 {
1325 struct sm_state *sm;
1326 char buf[64];
1327
1328 if (!expr || expr->type != EXPR_CALL)
1329 return 0;
1330 snprintf(buf, sizeof(buf), "return %p", expr);
1331 sm = get_sm_state(SMATCH_EXTRA, buf, NULL);
1332 return split_possible_helper(sm, expr);
1333 }
1334
1335 static struct sm_state *find_bool_param(void)
1336 {
1337 struct stree *start_states;
1338 struct symbol *arg;
1339 struct sm_state *sm, *tmp;
1340 sval_t sval;
1341
1342 start_states = get_start_states();
1343
1344 FOR_EACH_PTR_REVERSE(cur_func_sym->ctype.base_type->arguments, arg) {
1345 if (!arg->ident)
1346 continue;
1347 sm = get_sm_state_stree(start_states, SMATCH_EXTRA, arg->ident->name, arg);
1348 if (!sm)
1349 continue;
1350 if (rl_min(estate_rl(sm->state)).value != 0 ||
1351 rl_max(estate_rl(sm->state)).value != 1)
1352 continue;
1353 goto found;
1354 } END_FOR_EACH_PTR_REVERSE(arg);
1355
1356 return NULL;
1357
1358 found:
1359 /*
1360 * Check if it's splitable. If not, then splitting it up is likely not
1361 * useful for the callers.
1362 */
1363 FOR_EACH_PTR(sm->possible, tmp) {
1364 if (is_merged(tmp))
1365 continue;
1366 if (!estate_get_single_value(tmp->state, &sval))
1367 return NULL;
1368 } END_FOR_EACH_PTR(tmp);
1369
1370 return sm;
1371 }
1372
1373 static int split_on_bool_sm(struct sm_state *sm, struct expression *expr)
1374 {
1375 struct returned_state_callback *cb;
1376 struct range_list *ret_rl;
1377 const char *return_ranges;
1378 struct sm_state *tmp;
1379 int ret = 0;
1380 int nr_possible, nr_states;
1381 char *compare_str = NULL;
1382 char buf[128];
1383 struct state_list *already_handled = NULL;
1384
1385 if (!sm || !sm->merged)
1386 return 0;
1387
1388 if (too_many_possible(sm))
1389 return 0;
1390
1391 /* bail if it gets too complicated */
1392 nr_possible = ptr_list_size((struct ptr_list *)sm->possible);
1393 nr_states = stree_count(__get_cur_stree());
1394 if (nr_states * nr_possible >= 2000)
1395 return 0;
1396
1397 FOR_EACH_PTR(sm->possible, tmp) {
1398 if (tmp->merged)
1399 continue;
1400 if (ptr_in_list(tmp, already_handled))
1401 continue;
1402 add_ptr_list(&already_handled, tmp);
1403
1404 ret = 1;
1405 __push_fake_cur_stree();
1406
1407 overwrite_states_using_pool(sm, tmp);
1408
1409 return_ranges = get_return_ranges_str(expr, &ret_rl);
1410 set_state(RETURN_ID, "return_ranges", NULL, alloc_estate_rl(ret_rl));
1411 compare_str = expr_lte_to_param(expr, -1);
1412 if (compare_str) {
1413 snprintf(buf, sizeof(buf), "%s%s", return_ranges, compare_str);
1414 return_ranges = alloc_sname(buf);
1415 }
1416
1417 return_id++;
1418 FOR_EACH_PTR(returned_state_callbacks, cb) {
1419 cb->callback(return_id, (char *)return_ranges, expr);
1420 } END_FOR_EACH_PTR(cb);
1421
1422 __free_fake_cur_stree();
1423 } END_FOR_EACH_PTR(tmp);
1424
1425 free_slist(&already_handled);
1426
1427 return ret;
1428 }
1429
1430 static int split_by_bool_param(struct expression *expr)
1431 {
1432 struct sm_state *start_sm, *sm;
1433 sval_t sval;
1434
1435 start_sm = find_bool_param();
1436 if (!start_sm)
1437 return 0;
1438 sm = get_sm_state(SMATCH_EXTRA, start_sm->name, start_sm->sym);
1439 if (!sm || estate_get_single_value(sm->state, &sval))
1440 return 0;
1441 return split_on_bool_sm(sm, expr);
1442 }
1443
1444 static int split_by_null_nonnull_param(struct expression *expr)
1445 {
1446 struct symbol *arg;
1447 struct sm_state *sm;
1448
1449 /* function must only take one pointer */
1450 if (ptr_list_size((struct ptr_list *)cur_func_sym->ctype.base_type->arguments) != 1)
1451 return 0;
1452 arg = first_ptr_list((struct ptr_list *)cur_func_sym->ctype.base_type->arguments);
1453 if (!arg->ident)
1454 return 0;
1455 if (get_real_base_type(arg)->type != SYM_PTR)
1456 return 0;
1457
1458 if (param_was_set_var_sym(arg->ident->name, arg))
1459 return 0;
1460 sm = get_sm_state(SMATCH_EXTRA, arg->ident->name, arg);
1461 if (!sm)
1462 return 0;
1463
1464 return split_on_bool_sm(sm, expr);
1465 }
1466
1467 static void call_return_state_hooks(struct expression *expr)
1468 {
1469 struct returned_state_callback *cb;
1470 struct range_list *ret_rl;
1471 const char *return_ranges;
1472 int nr_states;
1473 sval_t sval;
1474
1475 if (__path_is_null())
1476 return;
1477
1478 expr = strip_expr(expr);
1479
1480 if (is_impossible_path())
1481 goto vanilla;
1482
1483 if (expr && (expr->type == EXPR_COMPARE ||
1484 !get_implied_value(expr, &sval)) &&
1485 (is_condition(expr) || is_boolean(expr))) {
1486 call_return_state_hooks_compare(expr);
1487 return;
1488 } else if (is_conditional(expr)) {
1489 call_return_state_hooks_conditional(expr);
1490 return;
1491 } else if (call_return_state_hooks_split_possible(expr)) {
1492 return;
1493 } else if (call_return_state_hooks_split_null_non_null(expr)) {
1494 return;
1495 } else if (call_return_state_hooks_split_success_fail(expr)) {
1496 return;
1497 } else if (splitable_function_call(expr)) {
1498 return;
1499 } else if (split_positive_from_negative(expr)) {
1500 return;
1501 } else if (split_by_bool_param(expr)) {
1502 } else if (split_by_null_nonnull_param(expr)) {
1503 return;
1504 }
1505
1506 vanilla:
1507 return_ranges = get_return_ranges_str(expr, &ret_rl);
1508 set_state(RETURN_ID, "return_ranges", NULL, alloc_estate_rl(ret_rl));
1509
1510 return_id++;
1511 nr_states = stree_count(__get_cur_stree());
1512 if (nr_states >= 10000) {
1513 match_return_info(return_id, (char *)return_ranges, expr);
1514 return;
1515 }
1516 FOR_EACH_PTR(returned_state_callbacks, cb) {
1517 cb->callback(return_id, (char *)return_ranges, expr);
1518 } END_FOR_EACH_PTR(cb);
1519 }
1520
1521 static void print_returned_struct_members(int return_id, char *return_ranges, struct expression *expr)
1522 {
1523 struct returned_member_callback *cb;
1524 struct stree *stree;
1525 struct sm_state *sm;
1526 struct symbol *type;
1527 char *name;
1528 char member_name[256];
1529 int len;
1530
1531 type = get_type(expr);
1532 if (!type || type->type != SYM_PTR)
1533 return;
1534 name = expr_to_var(expr);
1535 if (!name)
1536 return;
1537
1538 member_name[sizeof(member_name) - 1] = '\0';
1539 strcpy(member_name, "$");
1540
1541 len = strlen(name);
1542 FOR_EACH_PTR(returned_member_callbacks, cb) {
1543 stree = __get_cur_stree();
1544 FOR_EACH_MY_SM(cb->owner, stree, sm) {
1545 if (sm->name[0] == '*' && strcmp(sm->name + 1, name) == 0) {
1546 strcpy(member_name, "*$");
1547 cb->callback(return_id, return_ranges, expr, member_name, sm->state);
1548 continue;
1549 }
1550 if (strncmp(sm->name, name, len) != 0)
1551 continue;
1552 if (strncmp(sm->name + len, "->", 2) != 0)
1553 continue;
1554 snprintf(member_name, sizeof(member_name), "$%s", sm->name + len);
1555 cb->callback(return_id, return_ranges, expr, member_name, sm->state);
1556 } END_FOR_EACH_SM(sm);
1557 } END_FOR_EACH_PTR(cb);
1558
1559 free_string(name);
1560 }
1561
1562 static void reset_memdb(struct symbol *sym)
1563 {
1564 mem_sql(NULL, NULL, "delete from caller_info;");
1565 mem_sql(NULL, NULL, "delete from return_states;");
1566 mem_sql(NULL, NULL, "delete from call_implies;");
1567 }
1568
1569 static void match_end_func_info(struct symbol *sym)
1570 {
1571 if (__path_is_null())
1572 return;
1573 call_return_state_hooks(NULL);
1574 }
1575
1576 static void match_after_func(struct symbol *sym)
1577 {
1578 if (!__inline_fn)
1579 reset_memdb(sym);
1580 }
1581
1582 static void init_memdb(void)
1583 {
1584 char *err = NULL;
1585 int rc;
1586 const char *schema_files[] = {
1587 "db/db.schema",
1588 "db/caller_info.schema",
1589 "db/return_states.schema",
1590 "db/function_type_size.schema",
1591 "db/type_size.schema",
1592 "db/call_implies.schema",
1593 "db/function_ptr.schema",
1594 "db/local_values.schema",
1595 "db/function_type_value.schema",
1596 "db/type_value.schema",
1597 "db/function_type.schema",
1598 "db/data_info.schema",
1599 "db/parameter_name.schema",
1600 };
1601 static char buf[4096];
1602 int fd;
1603 int ret;
1604 int i;
1605
1606 rc = sqlite3_open(":memory:", &mem_db);
1607 if (rc != SQLITE_OK) {
1608 printf("Error starting In-Memory database.");
1609 return;
1610 }
1611
1612 for (i = 0; i < ARRAY_SIZE(schema_files); i++) {
1613 fd = open_data_file(schema_files[i]);
1614 if (fd < 0) {
1615 mem_db = NULL;
1616 return;
1617 }
1618 ret = read(fd, buf, sizeof(buf));
1619 if (ret == sizeof(buf)) {
1620 printf("Schema file too large: %s (limit %zd bytes)",
1621 schema_files[i], sizeof(buf));
1622 }
1623 buf[ret] = '\0';
1624 rc = sqlite3_exec(mem_db, buf, NULL, NULL, &err);
1625 if (rc != SQLITE_OK) {
1626 fprintf(stderr, "SQL error #2: %s\n", err);
1627 fprintf(stderr, "%s\n", buf);
1628 }
1629 }
1630 }
1631
1632 void open_smatch_db(void)
1633 {
1634 int rc;
1635
1636 if (option_no_db)
1637 return;
1638
1639 init_memdb();
1640
1641 rc = sqlite3_open_v2("smatch_db.sqlite", &db, SQLITE_OPEN_READONLY, NULL);
1642 if (rc != SQLITE_OK) {
1643 option_no_db = 1;
1644 return;
1645 }
1646 return;
1647 }
1648
1649 static void register_common_funcs(void)
1650 {
1651 struct token *token;
1652 char *func;
1653 char filename[256];
1654
1655 if (option_project == PROJ_NONE)
1656 strcpy(filename, "common_functions");
1657 else
1658 snprintf(filename, 256, "%s.common_functions", option_project_str);
1659
1660 token = get_tokens_file(filename);
1661 if (!token)
1662 return;
1663 if (token_type(token) != TOKEN_STREAMBEGIN)
1664 return;
1665 token = token->next;
1666 while (token_type(token) != TOKEN_STREAMEND) {
1667 if (token_type(token) != TOKEN_IDENT)
1668 return;
1669 func = alloc_string(show_ident(token->ident));
1670 add_ptr_list(&common_funcs, func);
1671 token = token->next;
1672 }
1673 clear_token_alloc();
1674 }
1675
1676
1677 void register_definition_db_callbacks(int id)
1678 {
1679 add_hook(&match_call_info, FUNCTION_CALL_HOOK);
1680 add_hook(&global_variable, BASE_HOOK);
1681 add_hook(&global_variable, DECLARATION_HOOK);
1682 add_split_return_callback(match_return_info);
1683 add_split_return_callback(print_returned_struct_members);
1684 add_hook(&call_return_state_hooks, RETURN_HOOK);
1685 add_hook(&match_end_func_info, END_FUNC_HOOK);
1686 add_hook(&match_after_func, AFTER_FUNC_HOOK);
1687
1688 add_hook(&match_data_from_db, FUNC_DEF_HOOK);
1689 add_hook(&match_call_implies, CALL_HOOK_AFTER_INLINE);
1690
1691 register_common_funcs();
1692 }
1693
1694 void register_db_call_marker(int id)
1695 {
1696 add_hook(&match_call_marker, FUNCTION_CALL_HOOK);
1697 }
1698
1699 char *return_state_to_var_sym(struct expression *expr, int param, const char *key, struct symbol **sym)
1700 {
1701 struct expression *arg;
1702 char *name = NULL;
1703 char member_name[256];
1704
1705 *sym = NULL;
1706
1707 if (param == -1) {
1708 const char *star = "";
1709
1710 if (expr->type != EXPR_ASSIGNMENT)
1711 return NULL;
1712 name = expr_to_var_sym(expr->left, sym);
1713 if (!name)
1714 return NULL;
1715 if (key[0] == '*') {
1716 star = "*";
1717 key++;
1718 }
1719 if (strncmp(key, "$", 1) != 0)
1720 return name;
1721 snprintf(member_name, sizeof(member_name), "%s%s%s", star, name, key + 1);
1722 free_string(name);
1723 return alloc_string(member_name);
1724 }
1725
1726 while (expr->type == EXPR_ASSIGNMENT)
1727 expr = strip_expr(expr->right);
1728 if (expr->type != EXPR_CALL)
1729 return NULL;
1730
1731 arg = get_argument_from_call_expr(expr->args, param);
1732 if (!arg)
1733 return NULL;
1734
1735 return get_variable_from_key(arg, key, sym);
1736 }
1737
1738 char *get_variable_from_key(struct expression *arg, const char *key, struct symbol **sym)
1739 {
1740 char buf[256];
1741 char *tmp;
1742
1743 if (!arg)
1744 return NULL;
1745
1746 arg = strip_expr(arg);
1747
1748 if (strcmp(key, "$") == 0)
1749 return expr_to_var_sym(arg, sym);
1750
1751 if (strcmp(key, "*$") == 0) {
1752 if (arg->type == EXPR_PREOP && arg->op == '&') {
1753 arg = strip_expr(arg->unop);
1754 return expr_to_var_sym(arg, sym);
1755 } else {
1756 tmp = expr_to_var_sym(arg, sym);
1757 if (!tmp)
1758 return NULL;
1759 snprintf(buf, sizeof(buf), "*%s", tmp);
1760 free_string(tmp);
1761 return alloc_string(buf);
1762 }
1763 }
1764
1765 if (arg->type == EXPR_PREOP && arg->op == '&') {
1766 arg = strip_expr(arg->unop);
1767 tmp = expr_to_var_sym(arg, sym);
1768 if (!tmp)
1769 return NULL;
1770 snprintf(buf, sizeof(buf), "%s.%s", tmp, key + 3);
1771 return alloc_string(buf);
1772 }
1773
1774 tmp = expr_to_var_sym(arg, sym);
1775 if (!tmp)
1776 return NULL;
1777 snprintf(buf, sizeof(buf), "%s%s", tmp, key + 1);
1778 free_string(tmp);
1779 return alloc_string(buf);
1780 }
1781
1782 char *get_chunk_from_key(struct expression *arg, char *key, struct symbol **sym, struct var_sym_list **vsl)
1783 {
1784 *vsl = NULL;
1785
1786 if (strcmp("$", key) == 0)
1787 return expr_to_chunk_sym_vsl(arg, sym, vsl);
1788 return get_variable_from_key(arg, key, sym);
1789 }
1790
1791 const char *get_param_name_var_sym(const char *name, struct symbol *sym)
1792 {
1793 char *param_name;
1794 int name_len;
1795 static char buf[256];
1796
1797 if (!sym || !sym->ident)
1798 return NULL;
1799
1800 param_name = sym->ident->name;
1801 name_len = strlen(param_name);
1802
1803 if (strcmp(name, param_name) == 0) {
1804 return "$";
1805 } else if (name[name_len] == '-' && /* check for '-' from "->" */
1806 strncmp(name, param_name, name_len) == 0) {
1807 snprintf(buf, sizeof(buf), "$%s", name + name_len);
1808 return buf;
1809 } else if (name[0] == '*' && strcmp(name + 1, param_name) == 0) {
1810 return "*$";
1811 }
1812 return NULL;
1813 }
1814
1815 const char *get_param_name(struct sm_state *sm)
1816 {
1817 return get_param_name_var_sym(sm->name, sm->sym);
1818 }
1819
1820 char *get_data_info_name(struct expression *expr)
1821 {
1822 struct symbol *sym;
1823 char *name;
1824 char buf[256];
1825 char *ret = NULL;
1826
1827 expr = strip_expr(expr);
1828 name = get_member_name(expr);
1829 if (name)
1830 return name;
1831 name = expr_to_var_sym(expr, &sym);
1832 if (!name || !sym)
1833 goto free;
1834 if (!(sym->ctype.modifiers & MOD_TOPLEVEL))
1835 goto free;
1836 if (sym->ctype.modifiers & MOD_STATIC)
1837 snprintf(buf, sizeof(buf), "static %s", name);
1838 else
1839 snprintf(buf, sizeof(buf), "global %s", name);
1840 ret = alloc_sname(buf);
1841 free:
1842 free_string(name);
1843 return ret;
1844 }
Static analysis for C