2 * smatch/smatch_buf_size.c
4 * Copyright (C) 2010 Dan Carpenter.
6 * Licensed under the Open Software License version 1.1
14 #include "smatch_slist.h"
15 #include "smatch_extra.h"
18 * This check has two smatch IDs.
19 * my_size_id - used to store the size of arrays.
20 * my_strlen_id - track the strlen() of buffers.
23 static int my_size_id
;
24 static int my_strlen_id
;
30 static struct limiter b0_l2
= {0, 2};
32 static _Bool params_set
[32];
34 static void set_undefined(struct sm_state
*sm
)
36 if (sm
->state
!= &undefined
)
37 set_state(sm
->owner
, sm
->name
, sm
->sym
, &undefined
);
40 static struct smatch_state
*merge_func(struct smatch_state
*s1
, struct smatch_state
*s2
)
42 if (PTR_INT(s1
->data
) == PTR_INT(s2
->data
))
47 void set_param_buf_size(const char *name
, struct symbol
*sym
, char *key
, char *value
)
52 if (strncmp(key
, "$$", 2))
55 snprintf(fullname
, 256, "%s%s", name
, key
+ 2);
58 size
= strtoul(value
, NULL
, 10);
62 set_state(my_size_id
, fullname
, sym
, alloc_state_num(size
));
65 static int bytes_per_element(struct expression
*expr
)
70 if (expr
->type
== EXPR_STRING
)
72 type
= get_type(expr
);
76 if (type
->type
!= SYM_PTR
&& type
->type
!= SYM_ARRAY
)
79 type
= get_base_type(type
);
80 bpe
= bits_to_bytes(type
->bit_size
);
82 if (bpe
== -1) /* void pointer */
88 static int bytes_to_elements(struct expression
*expr
, int bytes
)
92 bpe
= bytes_per_element(expr
);
98 static int elements_to_bytes(struct expression
*expr
, int elements
)
102 bpe
= bytes_per_element(expr
);
103 return elements
* bpe
;
106 static int get_initializer_size(struct expression
*expr
)
108 switch (expr
->type
) {
110 return expr
->string
->length
;
111 case EXPR_INITIALIZER
: {
112 struct expression
*tmp
;
116 FOR_EACH_PTR(expr
->expr_list
, tmp
) {
117 if (tmp
->type
== EXPR_INDEX
&& tmp
->idx_to
> max
)
120 } END_FOR_EACH_PTR(tmp
);
126 return get_array_size(expr
);
132 static int db_size_callback(void *unused
, int argc
, char **argv
, char **azColName
)
135 db_size
= atoi(argv
[0]);
141 static int size_from_db(struct expression
*expr
)
143 int this_file_only
= 0;
149 name
= get_member_name(expr
);
150 if (!name
&& is_static(expr
)) {
151 name
= expr_to_var(expr
);
158 run_sql(db_size_callback
, "select size from type_size where type = '%s' and file = '%s'",
159 name
, get_filename());
167 run_sql(db_size_callback
, "select size from type_size where type = '%s'",
176 static void db_returns_buf_size(struct expression
*expr
, int param
, char *unused
, char *math
)
178 struct expression
*call
;
181 if (expr
->type
!= EXPR_ASSIGNMENT
)
183 call
= strip_expr(expr
->right
);
185 if (!parse_call_math(call
, math
, &sval
))
187 set_state_expr(my_size_id
, expr
->left
, alloc_state_num(sval
.value
));
190 static int get_real_array_size(struct expression
*expr
)
195 if (expr
->type
== EXPR_BINOP
) /* array elements foo[5] */
198 type
= get_type(expr
);
199 if (!type
|| type
->type
!= SYM_ARRAY
)
202 if (!get_implied_value(type
->array_size
, &sval
))
205 /* People put one element arrays on the end of structs */
212 static int get_size_from_initializer(struct expression
*expr
)
214 if (expr
->type
!= EXPR_SYMBOL
|| !expr
->symbol
->initializer
)
216 if (expr
->symbol
->initializer
== expr
) /* int a = a; */
218 return get_initializer_size(expr
->symbol
->initializer
);
221 static int get_stored_size_bytes(struct expression
*expr
)
223 struct smatch_state
*state
;
225 state
= get_state_expr(my_size_id
, expr
);
228 return PTR_INT(state
->data
);
231 static int get_stored_size_bytes_min(struct expression
*expr
)
233 struct sm_state
*sm
, *tmp
;
236 sm
= get_sm_state_expr(my_size_id
, expr
);
239 FOR_EACH_PTR(sm
->possible
, tmp
) {
240 if (PTR_INT(tmp
->state
->data
) <= 0)
242 if (PTR_INT(tmp
->state
->data
) < min
)
243 min
= PTR_INT(tmp
->state
->data
);
244 } END_FOR_EACH_PTR(tmp
);
249 static int get_bytes_from_address(struct expression
*expr
)
256 if (expr
->type
!= EXPR_PREOP
|| expr
->op
!= '&')
258 type
= get_type(expr
);
262 if (type
->type
== SYM_PTR
)
263 type
= get_base_type(type
);
265 ret
= bits_to_bytes(type
->bit_size
);
269 return 0; /* ignore char pointers */
274 static int get_size_from_strlen(struct expression
*expr
)
276 struct smatch_state
*state
;
279 state
= get_state_expr(my_strlen_id
, expr
);
280 if (!state
|| !state
->data
)
282 if (get_implied_max((struct expression
*)state
->data
, &len
))
283 return len
.value
+ 1; /* add one because strlen doesn't include the NULL */
287 static struct expression
*remove_addr_fluff(struct expression
*expr
)
289 struct expression
*tmp
;
292 expr
= strip_expr(expr
);
294 /* remove '&' and '*' operations that cancel */
295 while (expr
->type
== EXPR_PREOP
&& expr
->op
== '&') {
296 tmp
= strip_expr(expr
->unop
);
297 if (tmp
->type
!= EXPR_PREOP
)
301 expr
= strip_expr(tmp
->unop
);
304 /* "foo + 0" is just "foo" */
305 if (expr
->type
== EXPR_BINOP
&& expr
->op
== '+' &&
306 get_value(expr
->right
, &sval
) && sval
.value
== 0)
312 int get_array_size_bytes(struct expression
*expr
)
316 expr
= remove_addr_fluff(expr
);
320 /* strcpy(foo, "BAR"); */
321 if (expr
->type
== EXPR_STRING
)
322 return expr
->string
->length
;
325 size
= get_real_array_size(expr
);
327 return elements_to_bytes(expr
, size
);
329 /* buf = malloc(1024); */
330 size
= get_stored_size_bytes(expr
);
334 /* char *foo = "BAR" */
335 size
= get_size_from_initializer(expr
);
337 return elements_to_bytes(expr
, size
);
339 size
= get_bytes_from_address(expr
);
343 /* if (strlen(foo) > 4) */
344 size
= get_size_from_strlen(expr
);
348 return size_from_db(expr
);
351 int get_array_size_bytes_min(struct expression
*expr
)
356 size
= get_array_size_bytes(expr
);
358 tmp
= get_stored_size_bytes_min(expr
);
359 if (size
<= 0 || (tmp
>= 1 && tmp
< size
))
364 int get_array_size(struct expression
*expr
)
368 bytes
= get_array_size_bytes(expr
);
369 return bytes_to_elements(expr
, bytes
);
372 static void match_strlen_condition(struct expression
*expr
)
374 struct expression
*left
;
375 struct expression
*right
;
376 struct expression
*str
= NULL
;
378 int strlen_right
= 0;
380 struct smatch_state
*true_state
= NULL
;
381 struct smatch_state
*false_state
= NULL
;
383 if (expr
->type
!= EXPR_COMPARE
)
385 left
= strip_expr(expr
->left
);
386 right
= strip_expr(expr
->right
);
388 if (left
->type
== EXPR_CALL
&& sym_name_is("strlen", left
->fn
)) {
389 str
= get_argument_from_call_expr(left
->args
, 0);
392 if (right
->type
== EXPR_CALL
&& sym_name_is("strlen", right
->fn
)) {
393 str
= get_argument_from_call_expr(right
->args
, 0);
397 if (!strlen_left
&& !strlen_right
)
399 if (strlen_left
&& strlen_right
)
403 if (!get_value(right
, &sval
))
407 if (!get_value(left
, &sval
))
411 if (expr
->op
== SPECIAL_EQUAL
) {
412 set_true_false_states_expr(my_size_id
, str
, alloc_state_num(sval
.value
+ 1), NULL
);
415 if (expr
->op
== SPECIAL_NOTEQUAL
) {
416 set_true_false_states_expr(my_size_id
, str
, NULL
, alloc_state_num(sval
.value
+ 1));
422 case SPECIAL_UNSIGNED_LT
:
424 true_state
= alloc_state_num(sval
.value
);
426 false_state
= alloc_state_num(sval
.value
+ 1);
429 case SPECIAL_UNSIGNED_LTE
:
431 true_state
= alloc_state_num(sval
.value
+ 1);
433 false_state
= alloc_state_num(sval
.value
);
436 case SPECIAL_UNSIGNED_GTE
:
438 false_state
= alloc_state_num(sval
.value
);
440 true_state
= alloc_state_num(sval
.value
+ 1);
443 case SPECIAL_UNSIGNED_GT
:
445 false_state
= alloc_state_num(sval
.value
+ 1);
447 true_state
= alloc_state_num(sval
.value
);
450 set_true_false_states_expr(my_size_id
, str
, true_state
, false_state
);
453 static struct expression
*strip_ampersands(struct expression
*expr
)
457 if (expr
->type
!= EXPR_PREOP
)
461 type
= get_type(expr
->unop
);
462 if (!type
|| type
->type
!= SYM_ARRAY
)
467 static void match_array_assignment(struct expression
*expr
)
469 struct expression
*left
;
470 struct expression
*right
;
475 left
= strip_expr(expr
->left
);
476 right
= strip_expr(expr
->right
);
477 right
= strip_ampersands(right
);
478 array_size
= get_array_size_bytes(right
);
480 set_state_expr(my_size_id
, left
, alloc_state_num(array_size
));
483 static void info_record_alloction(struct expression
*buffer
, struct expression
*size
)
491 name
= get_member_name(buffer
);
492 if (!name
&& is_static(buffer
))
493 name
= expr_to_var(buffer
);
496 if (get_implied_value(size
, &sval
))
497 sm_msg("info: '%s' allocated_buf_size %s", name
, sval_to_str(sval
));
499 sm_msg("info: '%s' allocated_buf_size -1", name
);
503 static void match_alloc(const char *fn
, struct expression
*expr
, void *_size_arg
)
505 int size_arg
= PTR_INT(_size_arg
);
506 struct expression
*right
;
507 struct expression
*arg
;
510 right
= strip_expr(expr
->right
);
511 arg
= get_argument_from_call_expr(right
->args
, size_arg
);
513 info_record_alloction(expr
->left
, arg
);
515 if (!get_implied_value(arg
, &bytes
))
517 set_state_expr(my_size_id
, expr
->left
, alloc_state_num(bytes
.value
));
520 static void match_calloc(const char *fn
, struct expression
*expr
, void *unused
)
522 struct expression
*right
;
523 struct expression
*arg
;
527 right
= strip_expr(expr
->right
);
528 arg
= get_argument_from_call_expr(right
->args
, 0);
529 if (!get_implied_value(arg
, &elements
))
531 arg
= get_argument_from_call_expr(right
->args
, 1);
532 if (!get_implied_value(arg
, &size
))
534 set_state_expr(my_size_id
, expr
->left
, alloc_state_num(elements
.value
* size
.value
));
537 static void match_strlen(const char *fn
, struct expression
*expr
, void *unused
)
539 struct expression
*right
;
540 struct expression
*str
;
541 struct expression
*len_expr
;
543 struct smatch_state
*state
;
545 right
= strip_expr(expr
->right
);
546 str
= get_argument_from_call_expr(right
->args
, 0);
547 len_expr
= strip_expr(expr
->left
);
549 len_name
= expr_to_var(len_expr
);
553 state
= __alloc_smatch_state(0);
554 state
->name
= len_name
;
555 state
->data
= len_expr
;
556 set_state_expr(my_strlen_id
, str
, state
);
559 static void match_limited(const char *fn
, struct expression
*expr
, void *_limiter
)
561 struct limiter
*limiter
= (struct limiter
*)_limiter
;
562 struct expression
*dest
;
563 struct expression
*size_expr
;
566 dest
= get_argument_from_call_expr(expr
->args
, limiter
->buf_arg
);
567 size_expr
= get_argument_from_call_expr(expr
->args
, limiter
->limit_arg
);
568 if (!get_implied_max(size_expr
, &size
))
570 set_state_expr(my_size_id
, dest
, alloc_state_num(size
.value
));
573 static void match_strcpy(const char *fn
, struct expression
*expr
, void *unused
)
575 struct expression fake_assign
;
577 fake_assign
.op
= '=';
578 fake_assign
.left
= get_argument_from_call_expr(expr
->args
, 0);
579 fake_assign
.right
= get_argument_from_call_expr(expr
->args
, 1);
580 match_array_assignment(&fake_assign
);
583 static void match_strndup(const char *fn
, struct expression
*expr
, void *unused
)
585 struct expression
*fn_expr
;
586 struct expression
*size_expr
;
589 fn_expr
= strip_expr(expr
->right
);
590 size_expr
= get_argument_from_call_expr(fn_expr
->args
, 1);
591 if (!get_implied_max(size_expr
, &size
))
594 /* It's easy to forget space for the NUL char */
596 set_state_expr(my_size_id
, expr
->left
, alloc_state_num(size
.value
));
599 static void match_call(struct expression
*expr
)
602 struct expression
*arg
;
606 name
= get_fnptr_name(expr
->fn
);
611 FOR_EACH_PTR(expr
->args
, arg
) {
612 bytes
= get_array_size_bytes(arg
);
614 sm_msg("info: passes_buffer '%s' %d '$$' %d %s",
616 is_static(expr
->fn
) ? "static" : "global");
618 } END_FOR_EACH_PTR(arg
);
623 static void struct_member_callback(char *fn
, char *global_static
, int param
, char *printed_name
, struct smatch_state
*state
)
625 if (state
== &merged
)
627 sm_msg("info: passes_buffer '%s' %d '%s' %s %s", fn
, param
, printed_name
, state
->name
, global_static
);
630 static void match_func_end(struct symbol
*sym
)
632 memset(params_set
, 0, sizeof(params_set
));
635 void register_buf_size(int id
)
639 add_definition_db_callback(set_param_buf_size
, BUF_SIZE
);
640 add_db_return_states_callback(BUF_SIZE
, &db_returns_buf_size
);
642 add_function_assign_hook("malloc", &match_alloc
, INT_PTR(0));
643 add_function_assign_hook("calloc", &match_calloc
, NULL
);
644 add_function_assign_hook("memdup", &match_alloc
, INT_PTR(1));
645 if (option_project
== PROJ_KERNEL
) {
646 add_function_assign_hook("kmalloc", &match_alloc
, INT_PTR(0));
647 add_function_assign_hook("kzalloc", &match_alloc
, INT_PTR(0));
648 add_function_assign_hook("vmalloc", &match_alloc
, INT_PTR(0));
649 add_function_assign_hook("__vmalloc", &match_alloc
, INT_PTR(0));
650 add_function_assign_hook("kcalloc", &match_calloc
, NULL
);
651 add_function_assign_hook("kmalloc_array", &match_calloc
, NULL
);
652 add_function_assign_hook("drm_malloc_ab", &match_calloc
, NULL
);
653 add_function_assign_hook("drm_calloc_large", &match_calloc
, NULL
);
654 add_function_assign_hook("sock_kmalloc", &match_alloc
, INT_PTR(1));
655 add_function_assign_hook("kmemdup", &match_alloc
, INT_PTR(1));
656 add_function_assign_hook("kmemdup_user", &match_alloc
, INT_PTR(1));
658 add_hook(&match_array_assignment
, ASSIGNMENT_HOOK
);
659 add_hook(&match_strlen_condition
, CONDITION_HOOK
);
660 add_function_assign_hook("strlen", &match_strlen
, NULL
);
662 add_function_assign_hook("strndup", match_strndup
, NULL
);
663 if (option_project
== PROJ_KERNEL
)
664 add_function_assign_hook("kstrndup", match_strndup
, NULL
);
666 add_hook(&match_func_end
, END_FUNC_HOOK
);
667 add_modification_hook(my_size_id
, &set_undefined
);
669 add_merge_hook(my_size_id
, &merge_func
);
672 void register_strlen(int id
)
675 add_modification_hook(my_strlen_id
, &set_undefined
);
676 add_merge_hook(my_strlen_id
, &merge_func
);
679 void register_buf_size_late(int id
)
681 add_function_hook("strlcpy", &match_limited
, &b0_l2
);
682 add_function_hook("strlcat", &match_limited
, &b0_l2
);
683 add_function_hook("memscan", &match_limited
, &b0_l2
);
685 add_function_hook("strcpy", &match_strcpy
, NULL
);
688 add_hook(&match_call
, FUNCTION_CALL_HOOK
);
689 add_member_info_callback(my_size_id
, struct_member_callback
);