4 * Copyright (C) 2010 Dan Carpenter.
6 * Licensed under the Open Software License version 1.1
12 #include "smatch_slist.h"
13 #include "smatch_extra.h"
15 static struct range_list
*_get_rl(struct expression
*expr
, int implied
);
16 static struct range_list
*handle_variable(struct expression
*expr
, int implied
);
18 static sval_t zero
= {.type
= &int_ctype
, {.value
= 0} };
19 static sval_t one
= {.type
= &int_ctype
, {.value
= 1} };
21 static struct range_list
*rl_zero(void)
23 return alloc_rl(zero
, zero
);
26 static struct range_list
*rl_one(void)
28 return alloc_rl(one
, one
);
39 static struct range_list
*last_stmt_rl(struct statement
*stmt
, int implied
)
44 stmt
= last_ptr_list((struct ptr_list
*)stmt
->stmts
);
45 if (stmt
->type
!= STMT_EXPRESSION
)
47 return _get_rl(stmt
->expression
, implied
);
50 static struct range_list
*handle_expression_statement_rl(struct expression
*expr
, int implied
)
52 return last_stmt_rl(get_expression_statement(expr
), implied
);
55 static struct range_list
*handle_ampersand_rl(int implied
)
57 if (implied
== RL_EXACT
|| implied
== RL_HARD
)
59 return alloc_rl(valid_ptr_min_sval
, valid_ptr_max_sval
);
62 static struct range_list
*handle_negate_rl(struct expression
*expr
, int implied
)
64 if (known_condition_true(expr
->unop
))
66 if (known_condition_false(expr
->unop
))
69 if (implied
== RL_EXACT
)
72 if (implied_condition_true(expr
->unop
))
74 if (implied_condition_false(expr
->unop
))
76 return alloc_rl(zero
, one
);
79 static struct range_list
*handle_bitwise_negate(struct expression
*expr
, int implied
)
81 struct range_list
*rl
;
84 rl
= _get_rl(expr
->unop
, implied
);
85 if (!rl_to_sval(rl
, &sval
))
87 sval
= sval_preop(sval
, '~');
88 sval_cast(get_type(expr
->unop
), sval
);
89 return alloc_rl(sval
, sval
);
92 static struct range_list
*handle_minus_preop(struct expression
*expr
, int implied
)
94 struct range_list
*rl
;
97 rl
= _get_rl(expr
->unop
, implied
);
98 if (!rl_to_sval(rl
, &sval
))
100 sval
= sval_preop(sval
, '-');
101 return alloc_rl(sval
, sval
);
104 static struct range_list
*handle_preop_rl(struct expression
*expr
, int implied
)
108 return handle_ampersand_rl(implied
);
110 return handle_negate_rl(expr
, implied
);
112 return handle_bitwise_negate(expr
, implied
);
114 return handle_minus_preop(expr
, implied
);
116 return handle_variable(expr
, implied
);
118 return handle_expression_statement_rl(expr
, implied
);
124 static struct range_list
*handle_divide_rl(struct expression
*expr
, int implied
)
126 struct range_list
*left_rl
, *right_rl
;
130 type
= get_type(expr
);
132 left_rl
= _get_rl(expr
->left
, implied
);
133 left_rl
= cast_rl(type
, left_rl
);
134 right_rl
= _get_rl(expr
->right
, implied
);
135 right_rl
= cast_rl(type
, right_rl
);
137 if (!left_rl
|| !right_rl
)
139 if (is_whole_rl(left_rl
) || is_whole_rl(right_rl
))
141 if (sval_is_negative(rl_min(left_rl
)) || sval_cmp_val(rl_min(right_rl
), 0) <= 0)
144 max
= rl_max(left_rl
);
145 if (!sval_is_max(max
))
146 max
= sval_binop(max
, '/', rl_min(right_rl
));
147 min
= sval_binop(rl_min(left_rl
), '/', rl_max(right_rl
));
148 return alloc_rl(min
, max
);
151 static struct range_list
*handle_subtract_rl(struct expression
*expr
, int implied
)
154 struct range_list
*left_rl
, *right_rl
;
155 sval_t max
, min
, tmp
;
158 type
= get_type(expr
);
159 comparison
= get_comparison(expr
->left
, expr
->right
);
161 left_rl
= _get_rl(expr
->left
, implied
);
162 left_rl
= cast_rl(type
, left_rl
);
163 right_rl
= _get_rl(expr
->right
, implied
);
164 right_rl
= cast_rl(type
, right_rl
);
166 if ((!left_rl
|| !right_rl
) &&
167 (implied
== RL_EXACT
|| implied
== RL_HARD
|| implied
== RL_FUZZY
))
171 left_rl
= alloc_whole_rl(type
);
173 right_rl
= alloc_whole_rl(type
);
175 /* negative values complicate everything fix this later */
176 if (sval_is_negative(rl_min(right_rl
)))
178 max
= rl_max(left_rl
);
180 switch (comparison
) {
182 case SPECIAL_UNSIGNED_GT
:
183 min
= sval_type_val(type
, 1);
184 max
= rl_max(left_rl
);
187 case SPECIAL_UNSIGNED_GTE
:
188 min
= sval_type_val(type
, 0);
189 max
= rl_max(left_rl
);
192 if (sval_binop_overflows(rl_min(left_rl
), '-', rl_max(right_rl
)))
194 min
= sval_type_min(type
);
197 if (!sval_binop_overflows(rl_min(left_rl
), '-', rl_max(right_rl
))) {
198 tmp
= sval_binop(rl_min(left_rl
), '-', rl_max(right_rl
));
199 if (sval_cmp(tmp
, min
) > 0)
203 if (!sval_is_max(rl_max(left_rl
))) {
204 tmp
= sval_binop(rl_max(left_rl
), '-', rl_min(right_rl
));
205 if (sval_cmp(tmp
, max
) < 0)
209 if (sval_is_min(min
) && sval_is_max(max
))
212 return cast_rl(type
, alloc_rl(min
, max
));
215 static struct range_list
*handle_mod_rl(struct expression
*expr
, int implied
)
217 struct range_list
*rl
;
218 sval_t left
, right
, sval
;
220 if (implied
== RL_EXACT
) {
221 if (!get_value(expr
->right
, &right
))
223 if (!get_value(expr
->left
, &left
))
225 sval
= sval_binop(left
, '%', right
);
226 return alloc_rl(sval
, sval
);
228 /* if we can't figure out the right side it's probably hopeless */
229 if (!get_implied_value(expr
->right
, &right
))
232 right
= sval_cast(get_type(expr
), right
);
235 rl
= _get_rl(expr
->left
, implied
);
236 if (rl
&& rl_max(rl
).uvalue
< right
.uvalue
)
237 right
.uvalue
= rl_max(rl
).uvalue
;
239 return alloc_rl(zero
, right
);
242 static sval_t
sval_lowest_set_bit(sval_t sval
)
247 for (i
= 0; i
< 64; i
++) {
248 if (sval
.uvalue
& 1ULL << i
) {
251 sval
.uvalue
&= ~(1ULL << i
);
257 static struct range_list
*handle_bitwise_AND(struct expression
*expr
, int implied
)
260 struct range_list
*left_rl
, *right_rl
;
263 if (implied
!= RL_IMPLIED
&& implied
!= RL_ABSOLUTE
)
266 type
= get_type(expr
);
268 if (get_implied_value(expr
->left
, &known
)) {
271 min
= sval_lowest_set_bit(known
);
272 left_rl
= alloc_rl(min
, known
);
273 left_rl
= cast_rl(type
, left_rl
);
274 add_range(&left_rl
, sval_type_val(type
, 0), sval_type_val(type
, 0));
276 left_rl
= _get_rl(expr
->left
, implied
);
278 left_rl
= cast_rl(type
, left_rl
);
279 left_rl
= alloc_rl(sval_type_val(type
, 0), rl_max(left_rl
));
281 if (implied
== RL_HARD
)
283 left_rl
= alloc_whole_rl(type
);
287 if (get_implied_value(expr
->right
, &known
)) {
290 min
= sval_lowest_set_bit(known
);
291 right_rl
= alloc_rl(min
, known
);
292 right_rl
= cast_rl(type
, right_rl
);
293 add_range(&right_rl
, sval_type_val(type
, 0), sval_type_val(type
, 0));
295 right_rl
= _get_rl(expr
->right
, implied
);
297 right_rl
= cast_rl(type
, right_rl
);
298 right_rl
= alloc_rl(sval_type_val(type
, 0), rl_max(right_rl
));
300 if (implied
== RL_HARD
)
302 right_rl
= alloc_whole_rl(type
);
306 return rl_intersection(left_rl
, right_rl
);
309 static struct range_list
*handle_right_shift(struct expression
*expr
, int implied
)
311 struct range_list
*left_rl
;
315 if (implied
== RL_EXACT
|| implied
== RL_HARD
)
317 /* this is hopeless without the right side */
318 if (!get_implied_value(expr
->right
, &right
))
320 left_rl
= _get_rl(expr
->left
, implied
);
322 max
= rl_max(left_rl
);
323 min
= rl_min(left_rl
);
325 if (implied
== RL_FUZZY
)
327 if (implied
== RL_HARD
)
329 max
= sval_type_max(get_type(expr
->left
));
330 min
= sval_type_val(get_type(expr
->left
), 0);
333 max
= sval_binop(max
, SPECIAL_RIGHTSHIFT
, right
);
334 min
= sval_binop(min
, SPECIAL_RIGHTSHIFT
, right
);
335 return alloc_rl(min
, max
);
338 static struct range_list
*handle_known_binop(struct expression
*expr
)
342 if (!get_value(expr
->left
, &left
))
344 if (!get_value(expr
->right
, &right
))
346 left
= sval_binop(left
, expr
->op
, right
);
347 return alloc_rl(left
, left
);
350 static struct range_list
*handle_binop_rl(struct expression
*expr
, int implied
)
353 struct range_list
*left_rl
, *right_rl
, *rl
;
356 rl
= handle_known_binop(expr
);
359 if (implied
== RL_EXACT
)
364 return handle_mod_rl(expr
, implied
);
366 return handle_bitwise_AND(expr
, implied
);
367 case SPECIAL_RIGHTSHIFT
:
368 return handle_right_shift(expr
, implied
);
370 return handle_subtract_rl(expr
, implied
);
372 return handle_divide_rl(expr
, implied
);
375 type
= get_type(expr
);
376 left_rl
= _get_rl(expr
->left
, implied
);
377 left_rl
= cast_rl(type
, left_rl
);
378 right_rl
= _get_rl(expr
->right
, implied
);
379 right_rl
= cast_rl(type
, right_rl
);
381 if (!left_rl
|| !right_rl
)
384 if (sval_binop_overflows(rl_min(left_rl
), expr
->op
, rl_min(right_rl
)))
386 min
= sval_binop(rl_min(left_rl
), expr
->op
, rl_min(right_rl
));
388 if (sval_binop_overflows(rl_max(left_rl
), expr
->op
, rl_max(right_rl
))) {
394 max
= sval_type_max(get_type(expr
));
397 max
= sval_binop(rl_max(left_rl
), expr
->op
, rl_max(right_rl
));
400 return alloc_rl(min
, max
);
403 static int do_comparison(struct expression
*expr
)
405 struct range_list
*left_ranges
= NULL
;
406 struct range_list
*right_ranges
= NULL
;
407 int poss_true
, poss_false
;
410 type
= get_type(expr
);
412 get_implied_rl(expr
->left
, &left_ranges
);
413 get_implied_rl(expr
->right
, &right_ranges
);
414 left_ranges
= cast_rl(type
, left_ranges
);
415 right_ranges
= cast_rl(type
, right_ranges
);
417 poss_true
= possibly_true_rl(left_ranges
, expr
->op
, right_ranges
);
418 poss_false
= possibly_false_rl(left_ranges
, expr
->op
, right_ranges
);
420 free_rl(&left_ranges
);
421 free_rl(&right_ranges
);
423 if (!poss_true
&& !poss_false
)
425 if (poss_true
&& !poss_false
)
427 if (!poss_true
&& poss_false
)
432 static struct range_list
*handle_comparison_rl(struct expression
*expr
, int implied
)
437 if (get_value(expr
->left
, &left
) && get_value(expr
->right
, &right
)) {
438 struct data_range tmp_left
, tmp_right
;
442 tmp_right
.min
= right
;
443 tmp_right
.max
= right
;
444 if (true_comparison_range(&tmp_left
, expr
->op
, &tmp_right
))
449 if (implied
== RL_EXACT
)
452 res
= do_comparison(expr
);
458 return alloc_rl(zero
, one
);
461 static struct range_list
*handle_logical_rl(struct expression
*expr
, int implied
)
467 if (implied
== RL_EXACT
) {
468 if (get_value(expr
->left
, &left
))
470 if (get_value(expr
->right
, &right
))
473 if (get_implied_value(expr
->left
, &left
))
475 if (get_implied_value(expr
->right
, &right
))
480 case SPECIAL_LOGICAL_OR
:
481 if (left_known
&& left
.value
)
483 if (right_known
&& right
.value
)
485 if (left_known
&& right_known
)
488 case SPECIAL_LOGICAL_AND
:
489 if (left_known
&& right_known
) {
490 if (left
.value
&& right
.value
)
499 if (implied
== RL_EXACT
)
502 return alloc_rl(zero
, one
);
505 static struct range_list
*handle_conditional_rl(struct expression
*expr
, int implied
)
507 struct range_list
*true_rl
, *false_rl
;
509 int final_pass_orig
= final_pass
;
511 if (known_condition_true(expr
->conditional
))
512 return _get_rl(expr
->cond_true
, implied
);
513 if (known_condition_false(expr
->conditional
))
514 return _get_rl(expr
->cond_false
, implied
);
516 if (implied
== RL_EXACT
)
519 if (implied_condition_true(expr
->conditional
))
520 return _get_rl(expr
->cond_true
, implied
);
521 if (implied_condition_false(expr
->conditional
))
522 return _get_rl(expr
->cond_false
, implied
);
525 /* this becomes a problem with deeply nested conditional statements */
529 type
= get_type(expr
);
531 __push_fake_cur_slist();
533 __split_whole_condition(expr
->conditional
);
534 true_rl
= _get_rl(expr
->cond_true
, implied
);
535 __push_true_states();
536 __use_false_states();
537 false_rl
= _get_rl(expr
->cond_false
, implied
);
538 __merge_true_states();
539 __free_fake_cur_slist();
540 final_pass
= final_pass_orig
;
542 if (!true_rl
|| !false_rl
)
544 true_rl
= cast_rl(type
, true_rl
);
545 false_rl
= cast_rl(type
, false_rl
);
547 return rl_union(true_rl
, false_rl
);
550 static int get_fuzzy_max_helper(struct expression
*expr
, sval_t
*max
)
553 struct sm_state
*tmp
;
556 if (get_hard_max(expr
, &sval
)) {
561 sm
= get_sm_state_expr(SMATCH_EXTRA
, expr
);
565 sval
= sval_type_min(estate_type(sm
->state
));
566 FOR_EACH_PTR(sm
->possible
, tmp
) {
569 new_min
= estate_min(tmp
->state
);
570 if (sval_cmp(new_min
, sval
) > 0)
572 } END_FOR_EACH_PTR(tmp
);
574 if (sval_is_min(sval
))
576 if (sval
.value
== sval_type_min(sval
.type
).value
+ 1) /* it's common to be on off */
579 *max
= sval_cast(get_type(expr
), sval
);
583 static int get_fuzzy_min_helper(struct expression
*expr
, sval_t
*min
)
586 struct sm_state
*tmp
;
589 sm
= get_sm_state_expr(SMATCH_EXTRA
, expr
);
593 if (!sval_is_min(estate_min(sm
->state
))) {
594 *min
= estate_min(sm
->state
);
598 sval
= sval_type_max(estate_type(sm
->state
));
599 FOR_EACH_PTR(sm
->possible
, tmp
) {
602 new_max
= estate_max(tmp
->state
);
603 if (sval_cmp(new_max
, sval
) < 0)
605 } END_FOR_EACH_PTR(tmp
);
607 if (sval_is_max(sval
))
609 *min
= sval_cast(get_type(expr
), sval
);
613 static int get_const_value(struct expression
*expr
, sval_t
*sval
)
618 if (expr
->type
!= EXPR_SYMBOL
|| !expr
->symbol
)
621 if (!(sym
->ctype
.modifiers
& MOD_CONST
))
623 if (get_value(sym
->initializer
, &right
)) {
624 *sval
= sval_cast(get_type(expr
), right
);
630 static struct range_list
*handle_variable(struct expression
*expr
, int implied
)
632 struct smatch_state
*state
;
633 struct range_list
*rl
;
634 sval_t sval
, min
, max
;
636 if (get_const_value(expr
, &sval
))
637 return alloc_rl(sval
, sval
);
645 state
= get_state_expr(SMATCH_EXTRA
, expr
);
646 if (!state
|| !state
->data
) {
647 if (implied
== RL_HARD
)
649 if (get_local_rl(expr
, &rl
))
653 if (implied
== RL_HARD
&& !estate_has_hard_max(state
))
655 return clone_rl(estate_rl(state
));
657 if (!get_fuzzy_min_helper(expr
, &min
))
658 min
= sval_type_min(get_type(expr
));
659 if (!get_fuzzy_max_helper(expr
, &max
))
661 /* fuzzy ranges are often inverted */
662 if (sval_cmp(min
, max
) > 0) {
667 return alloc_rl(min
, max
);
672 static sval_t
handle_sizeof(struct expression
*expr
)
677 ret
= sval_blank(expr
);
678 sym
= expr
->cast_type
;
680 sym
= evaluate_expression(expr
->cast_expression
);
682 * Expressions of restricted types will possibly get
683 * promoted - check that here
685 if (is_restricted_type(sym
)) {
686 if (sym
->bit_size
< bits_in_int
)
688 } else if (is_fouled_type(sym
)) {
692 examine_symbol_type(sym
);
694 ret
.type
= size_t_ctype
;
695 if (sym
->bit_size
<= 0) /* sizeof(void) */ {
696 if (get_real_base_type(sym
) == &void_ctype
)
701 ret
.value
= bits_to_bytes(sym
->bit_size
);
706 static struct range_list
*handle_call_rl(struct expression
*expr
, int implied
)
708 struct range_list
*rl
;
710 if (implied
== RL_EXACT
|| implied
== RL_HARD
|| implied
== RL_FUZZY
)
713 if (get_implied_return(expr
, &rl
))
715 return db_return_vals(expr
);
718 static struct range_list
*handle_cast(struct expression
*expr
, int implied
)
720 struct range_list
*rl
;
723 type
= get_type(expr
);
724 rl
= _get_rl(expr
->cast_expression
, implied
);
726 return cast_rl(type
, rl
);
727 if (implied
== RL_ABSOLUTE
)
728 return alloc_whole_rl(type
);
729 if (implied
== RL_IMPLIED
&& type
&&
730 type
->bit_size
> 0 && type
->bit_size
< 32)
731 return alloc_whole_rl(type
);
735 static struct range_list
*_get_rl(struct expression
*expr
, int implied
)
737 struct range_list
*rl
;
741 expr
= strip_parens(expr
);
744 type
= get_type(expr
);
746 switch (expr
->type
) {
748 sval
= sval_from_val(expr
, expr
->value
);
749 rl
= alloc_rl(sval
, sval
);
752 rl
= handle_preop_rl(expr
, implied
);
755 rl
= _get_rl(expr
->unop
, implied
);
758 case EXPR_FORCE_CAST
:
759 case EXPR_IMPLIED_CAST
:
760 rl
= handle_cast(expr
, implied
);
763 rl
= handle_binop_rl(expr
, implied
);
766 rl
= handle_comparison_rl(expr
, implied
);
769 rl
= handle_logical_rl(expr
, implied
);
773 sval
= handle_sizeof(expr
);
774 rl
= alloc_rl(sval
, sval
);
777 case EXPR_CONDITIONAL
:
778 rl
= handle_conditional_rl(expr
, implied
);
781 rl
= handle_call_rl(expr
, implied
);
784 rl
= handle_variable(expr
, implied
);
789 if (type
&& implied
== RL_ABSOLUTE
)
790 return alloc_whole_rl(type
);
794 /* returns 1 if it can get a value literal or else returns 0 */
795 int get_value(struct expression
*expr
, sval_t
*sval
)
797 struct range_list
*rl
;
799 rl
= _get_rl(expr
, RL_EXACT
);
800 if (!rl_to_sval(rl
, sval
))
805 int get_implied_value(struct expression
*expr
, sval_t
*sval
)
807 struct range_list
*rl
;
809 rl
= _get_rl(expr
, RL_IMPLIED
);
810 if (!rl_to_sval(rl
, sval
))
815 int get_implied_min(struct expression
*expr
, sval_t
*sval
)
817 struct range_list
*rl
;
819 rl
= _get_rl(expr
, RL_IMPLIED
);
826 int get_implied_max(struct expression
*expr
, sval_t
*sval
)
828 struct range_list
*rl
;
830 rl
= _get_rl(expr
, RL_IMPLIED
);
837 int get_implied_rl(struct expression
*expr
, struct range_list
**rl
)
839 *rl
= _get_rl(expr
, RL_IMPLIED
);
845 int get_absolute_rl(struct expression
*expr
, struct range_list
**rl
)
847 *rl
= _get_rl(expr
, RL_ABSOLUTE
);
849 *rl
= alloc_whole_rl(get_type(expr
));
853 int get_implied_rl_var_sym(const char *var
, struct symbol
*sym
, struct range_list
**rl
)
855 struct smatch_state
*state
;
857 state
= get_state(SMATCH_EXTRA
, var
, sym
);
858 *rl
= estate_rl(state
);
864 int get_hard_max(struct expression
*expr
, sval_t
*sval
)
866 struct range_list
*rl
;
868 rl
= _get_rl(expr
, RL_HARD
);
875 int get_fuzzy_min(struct expression
*expr
, sval_t
*sval
)
877 struct range_list
*rl
;
880 rl
= _get_rl(expr
, RL_FUZZY
);
884 if (sval_is_negative(tmp
) && sval_is_min(tmp
))
890 int get_fuzzy_max(struct expression
*expr
, sval_t
*sval
)
892 struct range_list
*rl
;
895 rl
= _get_rl(expr
, RL_FUZZY
);
899 if (max
.uvalue
> INT_MAX
- 10000)
905 int get_absolute_min(struct expression
*expr
, sval_t
*sval
)
907 struct range_list
*rl
;
910 type
= get_type(expr
);
912 type
= &llong_ctype
; // FIXME: this is wrong but places assume get type can't fail.
913 rl
= _get_rl(expr
, RL_ABSOLUTE
);
917 *sval
= sval_type_min(type
);
919 if (sval_cmp(*sval
, sval_type_min(type
)) < 0)
920 *sval
= sval_type_min(type
);
924 int get_absolute_max(struct expression
*expr
, sval_t
*sval
)
926 struct range_list
*rl
;
929 type
= get_type(expr
);
932 rl
= _get_rl(expr
, RL_ABSOLUTE
);
936 *sval
= sval_type_max(type
);
938 if (sval_cmp(sval_type_max(type
), *sval
) < 0)
939 *sval
= sval_type_max(type
);
943 int known_condition_true(struct expression
*expr
)
950 if (get_value(expr
, &tmp
) && tmp
.value
)
956 int known_condition_false(struct expression
*expr
)
964 if (expr
->type
== EXPR_CALL
) {
965 if (sym_name_is("__builtin_constant_p", expr
->fn
))
971 int implied_condition_true(struct expression
*expr
)
978 if (known_condition_true(expr
))
980 if (get_implied_value(expr
, &tmp
) && tmp
.value
)
983 if (expr
->type
== EXPR_POSTOP
)
984 return implied_condition_true(expr
->unop
);
986 if (expr
->type
== EXPR_PREOP
&& expr
->op
== SPECIAL_DECREMENT
)
987 return implied_not_equal(expr
->unop
, 1);
988 if (expr
->type
== EXPR_PREOP
&& expr
->op
== SPECIAL_INCREMENT
)
989 return implied_not_equal(expr
->unop
, -1);
991 expr
= strip_expr(expr
);
992 switch (expr
->type
) {
994 if (do_comparison(expr
) == 1)
998 if (expr
->op
== '!') {
999 if (implied_condition_false(expr
->unop
))
1005 if (implied_not_equal(expr
, 0) == 1)
1012 int implied_condition_false(struct expression
*expr
)
1014 struct expression
*tmp
;
1020 if (known_condition_false(expr
))
1023 switch (expr
->type
) {
1025 if (do_comparison(expr
) == 2)
1028 if (expr
->op
== '!') {
1029 if (implied_condition_true(expr
->unop
))
1033 tmp
= strip_expr(expr
);
1035 return implied_condition_false(tmp
);
1038 if (get_implied_value(expr
, &sval
) && sval
.value
== 0)