smatch_buf_size.c

   1 /*
   2  * Copyright (C) 2010 Dan Carpenter.
   3  *
   4  * This program is free software; you can redistribute it and/or
   5  * modify it under the terms of the GNU General Public License
   6  * as published by the Free Software Foundation; either version 2
   7  * of the License, or (at your option) any later version.
   8  *
   9  * This program is distributed in the hope that it will be useful,
  10  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  11  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  12  * GNU General Public License for more details.
  13  *
  14  * You should have received a copy of the GNU General Public License
  15  * along with this program; if not, see http://www.gnu.org/copyleft/gpl.txt
  16  */
  17
  18 #include <stdlib.h>
  19 #include <errno.h>
  20 #include "parse.h"
  21 #include "smatch.h"
  22 #include "smatch_slist.h"
  23 #include "smatch_extra.h"
  24 #include "smatch_function_hashtable.h"
  25
  26 #define UNKNOWN_SIZE (-1)
  27
  28 static int my_size_id;
  29
  30 struct limiter {
  31         int buf_arg;
  32         int limit_arg;
  33 };
  34 static struct limiter b0_l2 = {0, 2};
  35
  36 static DEFINE_HASHTABLE_INSERT(insert_func, char, int);
  37 static DEFINE_HASHTABLE_SEARCH(search_func, char, int);
  38 static struct hashtable *allocation_funcs;
  39
  40 static char *get_fn_name(struct expression *expr)
  41 {
  42         if (expr->type != EXPR_CALL)
  43                 return NULL;
  44         if (expr->fn->type != EXPR_SYMBOL)
  45                 return NULL;
  46         return expr_to_var(expr->fn);
  47 }
  48
  49 static int is_allocation_function(struct expression *expr)
  50 {
  51         char *func;
  52         int ret = 0;
  53
  54         func = get_fn_name(expr);
  55         if (!func)
  56                 return 0;
  57         if (search_func(allocation_funcs, func))
  58                 ret = 1;
  59         free_string(func);
  60         return ret;
  61 }
  62
  63 static void add_allocation_function(const char *func, void *call_back, int param)
  64 {
  65         insert_func(allocation_funcs, (char *)func, (int *)1);
  66         add_function_assign_hook(func, call_back, INT_PTR(param));
  67 }
  68
  69 static int estate_to_size(struct smatch_state *state)
  70 {
  71         sval_t sval;
  72
  73         if (!state || !estate_rl(state))
  74                 return 0;
  75         sval = estate_max(state);
  76         return sval.value;
  77 }
  78
  79 static struct smatch_state *size_to_estate(int size)
  80 {
  81         sval_t sval;
  82
  83         sval.type = &int_ctype;
  84         sval.value = size;
  85
  86         return alloc_estate_sval(sval);
  87 }
  88
  89 static struct range_list *size_to_rl(int size)
  90 {
  91         sval_t sval;
  92
  93         sval.type = &int_ctype;
  94         sval.value = size;
  95
  96         return alloc_rl(sval, sval);
  97 }
  98
  99 static struct smatch_state *unmatched_size_state(struct sm_state *sm)
 100 {
 101         return size_to_estate(UNKNOWN_SIZE);
 102 }
 103
 104 static void set_size_undefined(struct sm_state *sm, struct expression *mod_expr)
 105 {
 106         set_state(sm->owner, sm->name, sm->sym, size_to_estate(UNKNOWN_SIZE));
 107 }
 108
 109 static struct smatch_state *merge_size_func(struct smatch_state *s1, struct smatch_state *s2)
 110 {
 111         return merge_estates(s1, s2);
 112 }
 113
 114 void set_param_buf_size(const char *name, struct symbol *sym, char *key, char *value)
 115 {
 116         struct range_list *rl = NULL;
 117         struct smatch_state *state;
 118         char fullname[256];
 119
 120         if (strncmp(key, "$$", 2) != 0)
 121                 return;
 122
 123         snprintf(fullname, 256, "%s%s", name, key + 2);
 124
 125         str_to_rl(&int_ctype, value, &rl);
 126         if (!rl || is_whole_rl(rl))
 127                 return;
 128         state = alloc_estate_rl(rl);
 129         set_state(my_size_id, fullname, sym, state);
 130 }
 131
 132 static int bytes_per_element(struct expression *expr)
 133 {
 134         struct symbol *type;
 135         int bpe;
 136
 137         if (expr->type == EXPR_STRING)
 138                 return 1;
 139         type = get_type(expr);
 140         if (!type)
 141                 return 0;
 142
 143         if (type->type != SYM_PTR && type->type != SYM_ARRAY)
 144                 return 0;
 145
 146         type = get_base_type(type);
 147         bpe = bits_to_bytes(type->bit_size);
 148
 149         if (bpe == -1) /* void pointer */
 150                 bpe = 1;
 151
 152         return bpe;
 153 }
 154
 155 static int bytes_to_elements(struct expression *expr, int bytes)
 156 {
 157         int bpe;
 158
 159         bpe = bytes_per_element(expr);
 160         if (bpe == 0)
 161                 return 0;
 162         return bytes / bpe;
 163 }
 164
 165 static int elements_to_bytes(struct expression *expr, int elements)
 166 {
 167         int bpe;
 168
 169         bpe = bytes_per_element(expr);
 170         return elements * bpe;
 171 }
 172
 173 static int get_initializer_size(struct expression *expr)
 174 {
 175         switch (expr->type) {
 176         case EXPR_STRING:
 177                 return expr->string->length;
 178         case EXPR_INITIALIZER: {
 179                 struct expression *tmp;
 180                 int i = 0;
 181
 182                 FOR_EACH_PTR(expr->expr_list, tmp) {
 183                         if (tmp->type == EXPR_INDEX) {
 184                                 if (tmp->idx_to >= i)
 185                                         i = tmp->idx_to;
 186                                 else
 187                                         continue;
 188                         }
 189
 190                         i++;
 191                 } END_FOR_EACH_PTR(tmp);
 192                 return i;
 193         }
 194         case EXPR_SYMBOL:
 195                 return get_array_size(expr);
 196         }
 197         return 0;
 198 }
 199
 200 static struct range_list *db_size_rl;
 201 static int db_size_callback(void *unused, int argc, char **argv, char **azColName)
 202 {
 203         struct range_list *tmp = NULL;
 204
 205         if (!db_size_rl) {
 206                 str_to_rl(&int_ctype, argv[0], &db_size_rl);
 207         } else {
 208                 str_to_rl(&int_ctype, argv[0], &tmp);
 209                 db_size_rl = rl_union(db_size_rl, tmp);
 210         }
 211         return 0;
 212 }
 213
 214 static struct range_list *size_from_db(struct expression *expr)
 215 {
 216         int this_file_only = 0;
 217         char *name;
 218
 219         name = get_member_name(expr);
 220         if (!name && is_static(expr)) {
 221                 name = expr_to_var(expr);
 222                 this_file_only = 1;
 223         }
 224         if (!name)
 225                 return 0;
 226
 227         if (this_file_only) {
 228                 db_size_rl = NULL;
 229                 run_sql(db_size_callback, "select size from function_type_size where type = '%s' and file = '%s';",
 230                                 name, get_filename());
 231                 if (db_size_rl)
 232                         return db_size_rl;
 233                 return 0;
 234         }
 235
 236         db_size_rl = NULL;
 237         run_sql(db_size_callback, "select size from type_size where type = '%s';",
 238                         name);
 239         return db_size_rl;
 240 }
 241
 242 static void db_returns_buf_size(struct expression *expr, int param, char *unused, char *math)
 243 {
 244         struct expression *call;
 245         sval_t sval;
 246
 247         if (expr->type != EXPR_ASSIGNMENT)
 248                 return;
 249         call = strip_expr(expr->right);
 250
 251         if (!parse_call_math(call, math, &sval))
 252                 return;
 253         set_state_expr(my_size_id, expr->left, size_to_estate(sval.value));
 254 }
 255
 256 int get_real_array_size(struct expression *expr)
 257 {
 258         struct symbol *type;
 259         sval_t sval;
 260
 261         if (expr->type == EXPR_BINOP) /* array elements foo[5] */
 262                 return 0;
 263
 264         type = get_type(expr);
 265         if (!type)
 266                 return 0;
 267         if (!type || type->type != SYM_ARRAY)
 268                 return 0;
 269
 270         if (!get_implied_value(type->array_size, &sval))
 271                 return 0;
 272
 273         /* People put one element arrays on the end of structs */
 274         if (sval.value == 1)
 275                 return 0;
 276
 277         return sval.value;
 278 }
 279
 280 static int get_size_from_initializer(struct expression *expr)
 281 {
 282         if (expr->type != EXPR_SYMBOL || !expr->symbol || !expr->symbol->initializer)
 283                 return 0;
 284         if (expr->symbol->initializer == expr) /* int a = a; */
 285                 return 0;
 286         return get_initializer_size(expr->symbol->initializer);
 287 }
 288
 289 static struct range_list *get_stored_size_bytes(struct expression *expr)
 290 {
 291         struct smatch_state *state;
 292
 293         state = get_state_expr(my_size_id, expr);
 294         if (!state)
 295                 return NULL;
 296         return estate_rl(state);
 297 }
 298
 299 static int get_bytes_from_address(struct expression *expr)
 300 {
 301         struct symbol *type;
 302         int ret;
 303
 304         if (!option_spammy)
 305                 return 0;
 306         if (expr->type != EXPR_PREOP || expr->op != '&')
 307                 return 0;
 308         type = get_type(expr);
 309         if (!type)
 310                 return 0;
 311
 312         if (type->type == SYM_PTR)
 313                 type = get_base_type(type);
 314
 315         ret = bits_to_bytes(type->bit_size);
 316         if (ret == -1)
 317                 return 0;
 318         if (ret == 1)
 319                 return 0;  /* ignore char pointers */
 320
 321         return ret;
 322 }
 323
 324 static struct expression *remove_addr_fluff(struct expression *expr)
 325 {
 326         struct expression *tmp;
 327         sval_t sval;
 328
 329         expr = strip_expr(expr);
 330
 331         /* remove '&' and '*' operations that cancel */
 332         while (expr && expr->type == EXPR_PREOP && expr->op == '&') {
 333                 tmp = strip_expr(expr->unop);
 334                 if (tmp->type != EXPR_PREOP)
 335                         break;
 336                 if (tmp->op != '*')
 337                         break;
 338                 expr = strip_expr(tmp->unop);
 339         }
 340
 341         if (!expr)
 342                 return NULL;
 343
 344         /* "foo + 0" is just "foo" */
 345         if (expr->type == EXPR_BINOP && expr->op == '+' &&
 346             get_value(expr->right, &sval) && sval.value == 0)
 347                 return expr->left;
 348
 349         return expr;
 350 }
 351
 352 static int is_last_member_of_struct(struct symbol *sym, struct ident *member)
 353 {
 354         struct symbol *tmp;
 355         int i;
 356
 357         i = 0;
 358         FOR_EACH_PTR_REVERSE(sym->symbol_list, tmp) {
 359                 if (i++ || !tmp->ident)
 360                         return 0;
 361                 if (tmp->ident == member)
 362                         return 1;
 363                 return 0;
 364         } END_FOR_EACH_PTR_REVERSE(tmp);
 365
 366         return 0;
 367 }
 368
 369 static int get_stored_size_end_struct_bytes(struct expression *expr)
 370 {
 371         struct symbol *type;
 372         char *name;
 373         struct symbol *sym;
 374         struct smatch_state *state;
 375         sval_t sval;
 376
 377         if (expr->type == EXPR_BINOP) /* array elements foo[5] */
 378                 return 0;
 379
 380         type = get_type(expr);
 381         if (!type || type->type != SYM_ARRAY)
 382                 return 0;
 383
 384         if (!get_implied_value(type->array_size, &sval))
 385                 return 0;
 386
 387         if (sval.value != 0 && sval.value != 1)
 388                 return 0;
 389
 390         name = expr_to_var_sym(expr, &sym);
 391         free_string(name);
 392         if (!sym || !sym->ident || !sym->ident->name)
 393                 return 0;
 394         if (!sym->bit_size)
 395                 return 0;
 396
 397         if (sym->type != SYM_NODE)
 398                 return 0;
 399
 400         state = get_state(my_size_id, sym->ident->name, sym);
 401         if (!estate_to_size(state))
 402                 return 0;
 403
 404         sym = get_real_base_type(sym);
 405         if (!sym || sym->type != SYM_PTR)
 406                 return 0;
 407         sym = get_real_base_type(sym);
 408         if (!sym || sym->type != SYM_STRUCT)
 409                 return 0;
 410         if (!is_last_member_of_struct(sym, expr->member))
 411                 return 0;
 412
 413         return estate_to_size(state) - bits_to_bytes(sym->bit_size) +
 414                 bits_to_bytes(type->bit_size);
 415 }
 416
 417 static struct range_list *alloc_int_rl(int value)
 418 {
 419         sval_t sval = {
 420                 .type = &int_ctype,
 421                 {.value = value},
 422         };
 423
 424         return alloc_rl(sval, sval);
 425 }
 426
 427 struct range_list *get_array_size_bytes_rl(struct expression *expr)
 428 {
 429         int declared_size = 0;
 430         struct range_list *ret = NULL;
 431         int size;
 432
 433         expr = remove_addr_fluff(expr);
 434         if (!expr)
 435                 return NULL;
 436
 437         /* "BAR" */
 438         if (expr->type == EXPR_STRING)
 439                 return alloc_int_rl(expr->string->length);
 440
 441         /* buf[4] */
 442         size = get_real_array_size(expr);
 443         if (size)
 444                 declared_size = elements_to_bytes(expr, size);
 445
 446         /* buf = malloc(1024); */
 447         ret = get_stored_size_bytes(expr);
 448         if (ret) {
 449                 if (declared_size)
 450                         return rl_union(ret, alloc_int_rl(size));
 451                 return ret;
 452         }
 453         if (declared_size)
 454                 return alloc_int_rl(declared_size);
 455
 456         size = get_stored_size_end_struct_bytes(expr);
 457         if (size)
 458                 return alloc_int_rl(size);
 459
 460         /* char *foo = "BAR" */
 461         size = get_size_from_initializer(expr);
 462         if (size)
 463                 return alloc_int_rl(elements_to_bytes(expr, size));
 464
 465         size = get_bytes_from_address(expr);
 466         if (size)
 467                 return alloc_int_rl(size);
 468
 469         /* if (strlen(foo) > 4) */
 470         size = get_size_from_strlen(expr);
 471         if (size)
 472                 return alloc_int_rl(size);
 473
 474         ret = size_from_db(expr);
 475         if (ret)
 476                 return ret;
 477
 478         return NULL;
 479 }
 480
 481 int get_array_size_bytes(struct expression *expr)
 482 {
 483         struct range_list *rl;
 484         sval_t sval;
 485
 486         rl = get_array_size_bytes_rl(expr);
 487         if (!rl_to_sval(rl, &sval))
 488                 return 0;
 489         if (sval.uvalue >= INT_MAX)
 490                 return 0;
 491         return sval.value;
 492 }
 493
 494 int get_array_size_bytes_max(struct expression *expr)
 495 {
 496         struct range_list *rl;
 497         sval_t bytes;
 498
 499         rl = get_array_size_bytes_rl(expr);
 500         if (!rl)
 501                 return 0;
 502         bytes = rl_min(rl);
 503         if (bytes.value < 0)
 504                 return 0;
 505         bytes = rl_max(rl);
 506         if (bytes.uvalue >= INT_MAX)
 507                 return 0;
 508         return bytes.value;
 509 }
 510
 511 int get_array_size_bytes_min(struct expression *expr)
 512 {
 513         struct range_list *rl;
 514         struct data_range *range;
 515
 516         rl = get_array_size_bytes_rl(expr);
 517         if (!rl)
 518                 return 0;
 519
 520         FOR_EACH_PTR(rl, range) {
 521                 if (range->min.value <= 0)
 522                         return 0;
 523                 if (range->max.value <= 0)
 524                         return 0;
 525                 if (range->min.uvalue >= INT_MAX)
 526                         return 0;
 527                 return range->min.value;
 528         } END_FOR_EACH_PTR(range);
 529
 530         return 0;
 531 }
 532
 533 int get_array_size(struct expression *expr)
 534 {
 535         return bytes_to_elements(expr, get_array_size_bytes_max(expr));
 536 }
 537
 538 static void match_strlen_condition(struct expression *expr)
 539 {
 540         struct expression *left;
 541         struct expression *right;
 542         struct expression *str = NULL;
 543         int strlen_left = 0;
 544         int strlen_right = 0;
 545         sval_t sval;
 546         struct smatch_state *true_state = NULL;
 547         struct smatch_state *false_state = NULL;
 548
 549         if (expr->type != EXPR_COMPARE)
 550                 return;
 551         left = strip_expr(expr->left);
 552         right = strip_expr(expr->right);
 553
 554         if (left->type == EXPR_CALL && sym_name_is("strlen", left->fn)) {
 555                 str = get_argument_from_call_expr(left->args, 0);
 556                 strlen_left = 1;
 557         }
 558         if (right->type == EXPR_CALL && sym_name_is("strlen", right->fn)) {
 559                 str = get_argument_from_call_expr(right->args, 0);
 560                 strlen_right = 1;
 561         }
 562
 563         if (!strlen_left && !strlen_right)
 564                 return;
 565         if (strlen_left && strlen_right)
 566                 return;
 567
 568         if (strlen_left) {
 569                 if (!get_value(right, &sval))
 570                         return;
 571         }
 572         if (strlen_right) {
 573                 if (!get_value(left, &sval))
 574                         return;
 575         }
 576
 577         /* FIXME:  why are we using my_size_id here instead of my_strlen_id */
 578
 579         if (expr->op == SPECIAL_EQUAL) {
 580                 set_true_false_states_expr(my_size_id, str, size_to_estate(sval.value + 1), NULL);
 581                 return;
 582         }
 583         if (expr->op == SPECIAL_NOTEQUAL) {
 584                 set_true_false_states_expr(my_size_id, str, NULL, size_to_estate(sval.value + 1));
 585                 return;
 586         }
 587
 588         switch (expr->op) {
 589         case '<':
 590         case SPECIAL_UNSIGNED_LT:
 591                 if (strlen_left)
 592                         true_state = size_to_estate(sval.value);
 593                 else
 594                         false_state = size_to_estate(sval.value + 1);
 595                 break;
 596         case SPECIAL_LTE:
 597         case SPECIAL_UNSIGNED_LTE:
 598                 if (strlen_left)
 599                         true_state = size_to_estate(sval.value + 1);
 600                 else
 601                         false_state = size_to_estate(sval.value);
 602                 break;
 603         case SPECIAL_GTE:
 604         case SPECIAL_UNSIGNED_GTE:
 605                 if (strlen_left)
 606                         false_state = size_to_estate(sval.value);
 607                 else
 608                         true_state = size_to_estate(sval.value + 1);
 609                 break;
 610         case '>':
 611         case SPECIAL_UNSIGNED_GT:
 612                 if (strlen_left)
 613                         false_state = size_to_estate(sval.value + 1);
 614                 else
 615                         true_state = size_to_estate(sval.value);
 616                 break;
 617         }
 618         set_true_false_states_expr(my_size_id, str, true_state, false_state);
 619 }
 620
 621 static struct expression *strip_ampersands(struct expression *expr)
 622 {
 623         struct symbol *type;
 624
 625         if (expr->type != EXPR_PREOP)
 626                 return expr;
 627         if (expr->op != '&')
 628                 return expr;
 629         type = get_type(expr->unop);
 630         if (!type || type->type != SYM_ARRAY)
 631                 return expr;
 632         return expr->unop;
 633 }
 634
 635 static void info_record_alloction(struct expression *buffer, struct range_list *rl)
 636 {
 637         char *name;
 638
 639         if (!option_info)
 640                 return;
 641
 642         name = get_member_name(buffer);
 643         if (!name && is_static(buffer))
 644                 name = expr_to_var(buffer);
 645         if (!name)
 646                 return;
 647         if (rl && !is_whole_rl(rl))
 648                 sql_insert_function_type_size(name, show_rl(rl));
 649         else
 650                 sql_insert_function_type_size(name, "(-1)");
 651
 652         free_string(name);
 653 }
 654
 655 static void store_alloc(struct expression *expr, struct range_list *rl)
 656 {
 657         rl = clone_rl(rl); // FIXME!!!
 658         info_record_alloction(expr, rl);
 659         set_state_expr(my_size_id, expr, alloc_estate_rl(rl));
 660 }
 661
 662 static void match_array_assignment(struct expression *expr)
 663 {
 664         struct expression *left;
 665         struct expression *right;
 666         struct range_list *rl;
 667         sval_t sval;
 668
 669         if (expr->op != '=')
 670                 return;
 671         left = strip_expr(expr->left);
 672         right = strip_expr(expr->right);
 673         right = strip_ampersands(right);
 674
 675         if (is_allocation_function(right))
 676                 return;
 677
 678         if (get_implied_value(right, &sval) && sval.value == 0) {
 679                 rl = alloc_int_rl(0);
 680                 goto store;
 681         }
 682
 683         rl = get_array_size_bytes_rl(right);
 684
 685 store:
 686         store_alloc(left, rl);
 687 }
 688
 689 static void match_alloc(const char *fn, struct expression *expr, void *_size_arg)
 690 {
 691         int size_arg = PTR_INT(_size_arg);
 692         struct expression *right;
 693         struct expression *arg;
 694         struct range_list *rl;
 695
 696         right = strip_expr(expr->right);
 697         arg = get_argument_from_call_expr(right->args, size_arg);
 698         get_absolute_rl(arg, &rl);
 699         rl = cast_rl(&int_ctype, rl);
 700         store_alloc(expr->left, rl);
 701 }
 702
 703 static void match_calloc(const char *fn, struct expression *expr, void *unused)
 704 {
 705         struct expression *right;
 706         struct expression *arg;
 707         sval_t elements;
 708         sval_t size;
 709
 710         right = strip_expr(expr->right);
 711         arg = get_argument_from_call_expr(right->args, 0);
 712         if (!get_implied_value(arg, &elements))
 713                 return; // FIXME!!!
 714         arg = get_argument_from_call_expr(right->args, 1);
 715         if (get_implied_value(arg, &size))
 716                 store_alloc(expr->left, size_to_rl(elements.value * size.value));
 717         else
 718                 store_alloc(expr->left, size_to_rl(-1));
 719 }
 720
 721 static void match_limited(const char *fn, struct expression *expr, void *_limiter)
 722 {
 723         struct limiter *limiter = (struct limiter *)_limiter;
 724         struct expression *dest;
 725         struct expression *size_expr;
 726         sval_t size;
 727
 728         dest = get_argument_from_call_expr(expr->args, limiter->buf_arg);
 729         size_expr = get_argument_from_call_expr(expr->args, limiter->limit_arg);
 730         if (!get_implied_max(size_expr, &size))
 731                 return;
 732         set_state_expr(my_size_id, dest, size_to_estate(size.value));
 733 }
 734
 735 static void match_strcpy(const char *fn, struct expression *expr, void *unused)
 736 {
 737         struct expression fake_assign;
 738
 739         fake_assign.op = '=';
 740         fake_assign.left = get_argument_from_call_expr(expr->args, 0);
 741         fake_assign.right = get_argument_from_call_expr(expr->args, 1);
 742         match_array_assignment(&fake_assign);
 743 }
 744
 745 static void match_strndup(const char *fn, struct expression *expr, void *unused)
 746 {
 747         struct expression *fn_expr;
 748         struct expression *size_expr;
 749         sval_t size;
 750
 751         fn_expr = strip_expr(expr->right);
 752         size_expr = get_argument_from_call_expr(fn_expr->args, 1);
 753         if (get_implied_max(size_expr, &size)) {
 754                 size.value++;
 755                 store_alloc(expr->left, size_to_rl(size.value));
 756         } else {
 757                 store_alloc(expr->left, size_to_rl(-1));
 758         }
 759
 760 }
 761
 762 static void match_call(struct expression *expr)
 763 {
 764         struct expression *arg;
 765         struct range_list *rl;
 766         int i;
 767
 768         i = 0;
 769         FOR_EACH_PTR(expr->args, arg) {
 770                 rl = get_array_size_bytes_rl(arg);
 771                 if (rl && !is_whole_rl(rl))
 772                         sql_insert_caller_info(expr, BUF_SIZE, i, "$$", show_rl(rl));
 773                 i++;
 774         } END_FOR_EACH_PTR(arg);
 775 }
 776
 777 static void struct_member_callback(struct expression *call, int param, char *printed_name, struct smatch_state *state)
 778 {
 779         if (state == &merged)
 780                 return;
 781         sql_insert_caller_info(call, BUF_SIZE, param, printed_name, state->name);
 782 }
 783
 784 void register_buf_size(int id)
 785 {
 786         my_size_id = id;
 787
 788         add_unmatched_state_hook(my_size_id, &unmatched_size_state);
 789
 790         select_caller_info_hook(set_param_buf_size, BUF_SIZE);
 791         select_return_states_hook(BUF_SIZE, &db_returns_buf_size);
 792
 793         allocation_funcs = create_function_hashtable(100);
 794         add_allocation_function("malloc", &match_alloc, 0);
 795         add_allocation_function("calloc", &match_calloc, 0);
 796         add_allocation_function("memdup", &match_alloc, 1);
 797         if (option_project == PROJ_KERNEL) {
 798                 add_allocation_function("kmalloc", &match_alloc, 0);
 799                 add_allocation_function("kzalloc", &match_alloc, 0);
 800                 add_allocation_function("vmalloc", &match_alloc, 0);
 801                 add_allocation_function("__vmalloc", &match_alloc, 0);
 802                 add_allocation_function("kcalloc", &match_calloc, 0);
 803                 add_allocation_function("kmalloc_array", &match_calloc, 0);
 804                 add_allocation_function("drm_malloc_ab", &match_calloc, 0);
 805                 add_allocation_function("drm_calloc_large", &match_calloc, 0);
 806                 add_allocation_function("sock_kmalloc", &match_alloc, 1);
 807                 add_allocation_function("kmemdup", &match_alloc, 1);
 808                 add_allocation_function("kmemdup_user", &match_alloc, 1);
 809                 add_allocation_function("dma_alloc_attrs", &match_alloc, 1);
 810                 add_allocation_function("pci_alloc_consistent", &match_alloc, 1);
 811                 add_allocation_function("pci_alloc_coherent", &match_alloc, 1);
 812                 add_allocation_function("devm_kmalloc", &match_alloc, 1);
 813                 add_allocation_function("devm_kzalloc", &match_alloc, 1);
 814         }
 815         add_hook(&match_strlen_condition, CONDITION_HOOK);
 816
 817         add_allocation_function("strndup", match_strndup, 0);
 818         if (option_project == PROJ_KERNEL)
 819                 add_allocation_function("kstrndup", match_strndup, 0);
 820
 821         add_modification_hook(my_size_id, &set_size_undefined);
 822
 823         add_merge_hook(my_size_id, &merge_size_func);
 824 }
 825
 826 void register_buf_size_late(int id)
 827 {
 828         /* has to happen after match_alloc() */
 829         add_hook(&match_array_assignment, ASSIGNMENT_HOOK);
 830
 831         add_function_hook("strlcpy", &match_limited, &b0_l2);
 832         add_function_hook("strlcat", &match_limited, &b0_l2);
 833         add_function_hook("memscan", &match_limited, &b0_l2);
 834
 835         add_function_hook("strcpy", &match_strcpy, NULL);
 836
 837         add_hook(&match_call, FUNCTION_CALL_HOOK);
 838         add_member_info_callback(my_size_id, struct_member_callback);
 839 }