2 * sparse/check_deference.c
4 * Copyright (C) 2006 Dan Carpenter.
6 * Licensed under the Open Software License version 1.1
16 static struct smatch_state
*alloc_state(int val
)
18 struct smatch_state
*state
;
20 state
= malloc(sizeof(*state
));
21 state
->name
= "value";
22 state
->data
= malloc(sizeof(int));
23 *(int *)state
->data
= val
;
27 static int malloc_size(struct expression
*expr
)
30 struct expression
*arg
;
35 if (expr
->type
== EXPR_CALL
) {
36 name
= get_variable_from_expr(expr
->fn
, NULL
);
37 if (name
&& !strcmp(name
, "kmalloc")) {
38 arg
= get_argument_from_call_expr(expr
->args
, 0);
40 return get_value(arg
);
43 } else if (expr
->type
== EXPR_STRING
&& expr
->string
) {
44 return expr
->string
->length
* 8;
49 static void match_declaration(struct symbol
*sym
)
51 struct symbol
*base_type
;
58 name
= sym
->ident
->name
;
59 base_type
= get_base_type(sym
);
61 if (base_type
->type
== SYM_ARRAY
&& base_type
->bit_size
> 0)
62 set_state(name
, my_id
, NULL
, alloc_state(base_type
->bit_size
/ 8));
64 size
= malloc_size(sym
->initializer
);
66 set_state(name
, my_id
, NULL
, alloc_state(size
));
70 static void match_assignment(struct expression
*expr
)
73 name
= get_variable_from_expr(expr
->left
, NULL
);
76 if (malloc_size(expr
->right
) > 0)
77 set_state(name
, my_id
, NULL
, alloc_state(malloc_size(expr
->right
)));
81 static void match_strcpy(struct expression
*expr
, void *unused
)
83 struct expression
*dest
;
84 struct expression
*data
;
85 char *dest_name
= NULL
;
86 char *data_name
= NULL
;
87 struct smatch_state
*dest_state
;
88 struct smatch_state
*data_state
;
90 dest
= get_argument_from_call_expr(expr
->args
, 0);
91 dest_name
= get_variable_from_expr(dest
, NULL
);
93 data
= get_argument_from_call_expr(expr
->args
, 1);
94 data_name
= get_variable_from_expr(data
, NULL
);
96 dest_state
= get_state(dest_name
, my_id
, NULL
);
97 if (!dest_state
|| !dest_state
->data
)
100 data_state
= get_state(data_name
, my_id
, NULL
);
101 if (!data_state
|| !data_state
->data
)
104 if (*(int *)dest_state
->data
< *(int *)data_state
->data
)
105 smatch_msg("error: %s (%d) too large for %s (%d)", data_name
,
106 *(int *)data_state
->data
,
107 dest_name
, *(int *)dest_state
->data
);
109 free_string(dest_name
);
110 free_string(data_name
);
113 static void match_strncpy(struct expression
*expr
, void *unused
)
115 struct expression
*dest
;
116 struct expression
*data
;
117 char *dest_name
= NULL
;
118 struct smatch_state
*state
;
122 dest
= get_argument_from_call_expr(expr
->args
, 0);
123 dest_name
= get_variable_from_expr(dest
, NULL
);
125 data
= get_argument_from_call_expr(expr
->args
, 2);
126 needed
= get_value(data
);
127 state
= get_state(dest_name
, my_id
, NULL
);
128 if (!state
|| !state
->data
)
130 has
= *(int *)state
->data
;
132 smatch_msg("error: %s too small for %d bytes.", dest_name
,
135 free_string(dest_name
);
138 void check_overflow(int id
)
141 add_hook(&match_declaration
, DECLARATION_HOOK
);
142 add_hook(&match_assignment
, ASSIGNMENT_HOOK
);
143 add_function_hook("strcpy", &match_strcpy
, NULL
);
144 add_function_hook("strncpy", &match_strncpy
, NULL
);