1 /* Helper class for handling a call with specific arguments.
2 Copyright (C) 2020-2023 Free Software Foundation, Inc.
3 Contributed by David Malcolm <dmalcolm@redhat.com>.
5 This file is part of GCC.
7 GCC is free software; you can redistribute it and/or modify it
8 under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 3, or (at your option)
12 GCC is distributed in the hope that it will be useful, but
13 WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
15 General Public License for more details.
17 You should have received a copy of the GNU General Public License
18 along with GCC; see the file COPYING3. If not see
19 <http://www.gnu.org/licenses/>. */
22 #define INCLUDE_MEMORY
24 #include "coretypes.h"
27 #include "basic-block.h"
29 #include "diagnostic-core.h"
30 #include "analyzer/analyzer.h"
31 #include "analyzer/analyzer-logging.h"
32 #include "diagnostic.h"
33 #include "tree-diagnostic.h" /* for default_tree_printer. */
34 #include "gimple-pretty-print.h"
35 #include "analyzer/region-model.h"
36 #include "analyzer/call-details.h"
37 #include "analyzer/ranges.h"
38 #include "stringpool.h"
40 #include "make-unique.h"
46 /* class call_details. */
48 /* call_details's ctor. */
50 call_details::call_details (const gcall
*call
, region_model
*model
,
51 region_model_context
*ctxt
)
52 : m_call (call
), m_model (model
), m_ctxt (ctxt
),
53 m_lhs_type (NULL_TREE
), m_lhs_region (NULL
)
55 m_lhs_type
= NULL_TREE
;
56 if (tree lhs
= gimple_call_lhs (call
))
58 m_lhs_region
= model
->get_lvalue (lhs
, ctxt
);
59 m_lhs_type
= TREE_TYPE (lhs
);
63 /* call_details's ctor: copy CD, but override the context,
64 using CTXT instead. */
66 call_details::call_details (const call_details
&cd
,
67 region_model_context
*ctxt
)
73 /* Get the manager from m_model. */
75 region_model_manager
*
76 call_details::get_manager () const
78 return m_model
->get_manager ();
81 /* Get any logger associated with this object. */
84 call_details::get_logger () const
87 return m_ctxt
->get_logger ();
92 /* Get any uncertainty_t associated with the region_model_context. */
95 call_details::get_uncertainty () const
98 return m_ctxt
->get_uncertainty ();
103 /* If the callsite has a left-hand-side region, set it to RESULT
105 Otherwise do nothing and return false. */
108 call_details::maybe_set_lhs (const svalue
*result
) const
113 m_model
->set_value (m_lhs_region
, result
, m_ctxt
);
120 /* Return true if CD is known to be a call to a function with
121 __attribute__((const)). */
124 const_fn_p (const call_details
&cd
)
126 tree fndecl
= cd
.get_fndecl_for_call ();
129 gcc_assert (DECL_P (fndecl
));
130 return TREE_READONLY (fndecl
);
133 /* If this CD is known to be a call to a function with
134 __attribute__((const)), attempt to get a const_fn_result_svalue
135 based on the arguments, or return NULL otherwise. */
137 static const svalue
*
138 maybe_get_const_fn_result (const call_details
&cd
)
140 if (!const_fn_p (cd
))
143 unsigned num_args
= cd
.num_args ();
144 if (num_args
> const_fn_result_svalue::MAX_INPUTS
)
145 /* Too many arguments. */
148 auto_vec
<const svalue
*> inputs (num_args
);
149 for (unsigned arg_idx
= 0; arg_idx
< num_args
; arg_idx
++)
151 const svalue
*arg_sval
= cd
.get_arg_svalue (arg_idx
);
152 if (!arg_sval
->can_have_associated_state_p ())
154 inputs
.quick_push (arg_sval
);
157 region_model_manager
*mgr
= cd
.get_manager ();
159 = mgr
->get_or_create_const_fn_result_svalue (cd
.get_lhs_type (),
160 cd
.get_fndecl_for_call (),
165 /* Look for attribute "alloc_size" on the called function and, if found,
166 return a symbolic value of type size_type_node for the allocation size
167 based on the call's parameters.
168 Otherwise, return null. */
170 static const svalue
*
171 get_result_size_in_bytes (const call_details
&cd
)
173 const tree attr
= cd
.lookup_function_attribute ("alloc_size");
177 const tree atval_1
= TREE_VALUE (attr
);
181 unsigned argidx1
= TREE_INT_CST_LOW (TREE_VALUE (atval_1
)) - 1;
182 if (cd
.num_args () <= argidx1
)
185 const svalue
*sval_arg1
= cd
.get_arg_svalue (argidx1
);
187 if (const tree atval_2
= TREE_CHAIN (atval_1
))
190 unsigned argidx2
= TREE_INT_CST_LOW (TREE_VALUE (atval_2
)) - 1;
191 if (cd
.num_args () <= argidx2
)
193 const svalue
*sval_arg2
= cd
.get_arg_svalue (argidx2
);
194 /* TODO: ideally we shouldn't need this cast here;
195 see PR analyzer/110902. */
196 return cd
.get_manager ()->get_or_create_cast
198 cd
.get_manager ()->get_or_create_binop (size_type_node
,
200 sval_arg1
, sval_arg2
));
203 /* Single argument. */
204 return cd
.get_manager ()->get_or_create_cast (size_type_node
, sval_arg1
);
207 /* If this call has an LHS, assign a value to it based on attributes
209 - if __attribute__((const)), use a const_fn_result_svalue,
210 - if __attribute__((malloc)), use a heap-allocated region with
212 - otherwise, use a conjured_svalue.
214 If __attribute__((alloc_size), set the dynamic extents on the region
218 call_details::set_any_lhs_with_defaults () const
223 const svalue
*sval
= maybe_get_const_fn_result (*this);
226 region_model_manager
*mgr
= get_manager ();
227 if (lookup_function_attribute ("malloc"))
229 const region
*new_reg
230 = m_model
->get_or_create_region_for_heap_alloc (NULL
, m_ctxt
);
231 m_model
->mark_region_as_unknown (new_reg
, NULL
);
232 sval
= mgr
->get_ptr_svalue (get_lhs_type (), new_reg
);
235 /* For the common case of functions without __attribute__((const)),
236 use a conjured value, and purge any prior state involving that
237 value (in case this is in a loop). */
238 sval
= get_or_create_conjured_svalue (m_lhs_region
);
239 if (const svalue
*size_in_bytes
= get_result_size_in_bytes (*this))
242 = m_model
->deref_rvalue (sval
, NULL_TREE
, m_ctxt
, false);
243 m_model
->set_dynamic_extents (reg
, size_in_bytes
, m_ctxt
);
246 maybe_set_lhs (sval
);
249 /* Return the number of arguments used by the call statement. */
252 call_details::num_args () const
254 return gimple_call_num_args (m_call
);
257 /* Return true if argument IDX is a size_t (or compatible with it). */
260 call_details::arg_is_size_p (unsigned idx
) const
262 return types_compatible_p (get_arg_type (idx
), size_type_node
);
265 /* Get the location of the call statement. */
268 call_details::get_location () const
270 return m_call
->location
;
273 /* Get argument IDX at the callsite as a tree. */
276 call_details::get_arg_tree (unsigned idx
) const
278 return gimple_call_arg (m_call
, idx
);
281 /* Get the type of argument IDX. */
284 call_details::get_arg_type (unsigned idx
) const
286 return TREE_TYPE (gimple_call_arg (m_call
, idx
));
289 /* Get argument IDX at the callsite as an svalue. */
292 call_details::get_arg_svalue (unsigned idx
) const
294 tree arg
= get_arg_tree (idx
);
295 return m_model
->get_rvalue (arg
, m_ctxt
);
298 /* If argument IDX's svalue at the callsite is of pointer type,
299 return the region it points to.
300 Otherwise return NULL. */
303 call_details::deref_ptr_arg (unsigned idx
) const
305 const svalue
*ptr_sval
= get_arg_svalue (idx
);
306 return m_model
->deref_rvalue (ptr_sval
, get_arg_tree (idx
), m_ctxt
);
309 /* Attempt to get the string literal for argument IDX, or return NULL
311 For use when implementing "__analyzer_*" functions that take
315 call_details::get_arg_string_literal (unsigned idx
) const
317 const svalue
*str_arg
= get_arg_svalue (idx
);
318 if (const region
*pointee
= str_arg
->maybe_get_region ())
319 if (const string_region
*string_reg
= pointee
->dyn_cast_string_region ())
321 tree string_cst
= string_reg
->get_string_cst ();
322 return TREE_STRING_POINTER (string_cst
);
327 /* Attempt to get the fndecl used at this call, if known, or NULL_TREE
331 call_details::get_fndecl_for_call () const
333 return m_model
->get_fndecl_for_call (m_call
, m_ctxt
);
336 /* Dump a multiline representation of this call to PP. */
339 call_details::dump_to_pp (pretty_printer
*pp
, bool simple
) const
341 pp_string (pp
, "gcall: ");
342 pp_gimple_stmt_1 (pp
, m_call
, 0 /* spc */, TDF_NONE
/* flags */);
344 pp_string (pp
, "return region: ");
346 m_lhs_region
->dump_to_pp (pp
, simple
);
348 pp_string (pp
, "NULL");
350 for (unsigned i
= 0; i
< gimple_call_num_args (m_call
); i
++)
352 const svalue
*arg_sval
= get_arg_svalue (i
);
353 pp_printf (pp
, "arg %i: ", i
);
354 arg_sval
->dump_to_pp (pp
, simple
);
359 /* Dump a multiline representation of this call to stderr. */
362 call_details::dump (bool simple
) const
365 pp_format_decoder (&pp
) = default_tree_printer
;
366 pp_show_color (&pp
) = pp_show_color (global_dc
->printer
);
367 pp
.buffer
->stream
= stderr
;
368 dump_to_pp (&pp
, simple
);
372 /* Get a conjured_svalue for this call for REG,
373 and purge any state already relating to that conjured_svalue. */
376 call_details::get_or_create_conjured_svalue (const region
*reg
) const
378 region_model_manager
*mgr
= m_model
->get_manager ();
379 return mgr
->get_or_create_conjured_svalue (reg
->get_type (), m_call
, reg
,
380 conjured_purge (m_model
, m_ctxt
));
383 /* Look for a function attribute with name ATTR_NAME on the called
384 function (or on its type).
385 Return the attribute if one is found, otherwise return NULL_TREE. */
388 call_details::lookup_function_attribute (const char *attr_name
) const
391 if (tree fndecl
= get_fndecl_for_call ())
392 allocfntype
= TREE_TYPE (fndecl
);
394 allocfntype
= gimple_call_fntype (m_call
);
399 return lookup_attribute (attr_name
, TYPE_ATTRIBUTES (allocfntype
));
403 call_details::check_for_null_terminated_string_arg (unsigned arg_idx
) const
405 check_for_null_terminated_string_arg (arg_idx
, false, nullptr);
410 check_for_null_terminated_string_arg (unsigned arg_idx
,
411 bool include_terminator
,
412 const svalue
**out_sval
) const
414 region_model
*model
= get_model ();
415 return model
->check_for_null_terminated_string_arg (*this,
421 /* A subclass of pending_diagnostic for complaining about overlapping
424 class overlapping_buffers
425 : public pending_diagnostic_subclass
<overlapping_buffers
>
428 overlapping_buffers (tree fndecl
)
433 const char *get_kind () const final override
435 return "overlapping_buffers";
438 bool operator== (const overlapping_buffers
&other
) const
440 return m_fndecl
== other
.m_fndecl
;
443 int get_controlling_option () const final override
445 return OPT_Wanalyzer_overlapping_buffers
;
448 bool emit (rich_location
*rich_loc
, logger
*) final override
450 auto_diagnostic_group d
;
453 warned
= warning_at (rich_loc
, get_controlling_option (),
454 "overlapping buffers passed as arguments to %qD",
457 // TODO: draw a picture?
460 inform (DECL_SOURCE_LOCATION (m_fndecl
),
461 "the behavior of %qD is undefined for overlapping buffers",
467 label_text
describe_final_event (const evdesc::final_event
&ev
) final override
469 return ev
.formatted_print
470 ("overlapping buffers passed as arguments to %qD",
479 /* Check if the buffers pointed to by arguments ARG_IDX_A and ARG_IDX_B
480 (zero-based) overlap, when considering them both to be of size
483 If they do overlap, complain to the context. */
486 call_details::complain_about_overlap (unsigned arg_idx_a
,
488 const svalue
*num_bytes_read_sval
) const
490 region_model_context
*ctxt
= get_ctxt ();
494 region_model
*model
= get_model ();
495 region_model_manager
*mgr
= model
->get_manager ();
497 const svalue
*arg_a_ptr_sval
= get_arg_svalue (arg_idx_a
);
498 if (arg_a_ptr_sval
->get_kind () == SK_UNKNOWN
)
500 const region
*arg_a_reg
= model
->deref_rvalue (arg_a_ptr_sval
,
501 get_arg_tree (arg_idx_a
),
503 const svalue
*arg_b_ptr_sval
= get_arg_svalue (arg_idx_b
);
504 if (arg_b_ptr_sval
->get_kind () == SK_UNKNOWN
)
506 const region
*arg_b_reg
= model
->deref_rvalue (arg_b_ptr_sval
,
507 get_arg_tree (arg_idx_b
),
509 if (arg_a_reg
->get_base_region () != arg_b_reg
->get_base_region ())
512 /* Are they within NUM_BYTES_READ_SVAL of each other? */
513 symbolic_byte_range
byte_range_a (arg_a_reg
->get_offset (mgr
),
516 symbolic_byte_range
byte_range_b (arg_b_reg
->get_offset (mgr
),
519 if (!byte_range_a
.intersection (byte_range_b
, *model
).is_true ())
522 ctxt
->warn (make_unique
<overlapping_buffers
> (get_fndecl_for_call ()));
527 #endif /* #if ENABLE_ANALYZER */