constraints_required: ignore fake assignments
[smatch.git] / check_off_by_one_relative.c
blob2249288e51beecb1cbe8093f66f792d4bdc0ebb4
1 /*
2 * Copyright (C) 2015 Oracle.
4 * This program is free software; you can redistribute it and/or
5 * modify it under the terms of the GNU General Public License
6 * as published by the Free Software Foundation; either version 2
7 * of the License, or (at your option) any later version.
9 * This program is distributed in the hope that it will be useful,
10 * but WITHOUT ANY WARRANTY; without even the implied warranty of
11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12 * GNU General Public License for more details.
14 * You should have received a copy of the GNU General Public License
15 * along with this program; if not, see http://www.gnu.org/copyleft/gpl.txt
19 * The point here is to store that a buffer has x bytes even if we don't know
20 * the value of x.
24 #include "smatch.h"
25 #include "smatch_slist.h"
26 #include "smatch_extra.h"
28 static int my_id;
30 static void array_check(struct expression *expr)
32 struct expression *array;
33 struct expression *size;
34 struct expression *offset;
35 char *array_str, *offset_str;
36 int limit_type;
38 expr = strip_expr(expr);
39 if (!is_array(expr))
40 return;
42 array = get_array_base(expr);
43 size = get_size_variable(array, &limit_type);
44 if (!size || limit_type != ELEM_COUNT)
45 return;
46 offset = get_array_offset(expr);
47 if (!possible_comparison(size, SPECIAL_EQUAL, offset))
48 return;
50 if (buf_comparison_index_ok(expr))
51 return;
53 array_str = expr_to_str(array);
54 offset_str = expr_to_str(offset);
55 sm_warning("potentially one past the end of array '%s[%s]'", array_str, offset_str);
56 free_string(array_str);
57 free_string(offset_str);
60 static int known_access_ok_numbers(struct expression *expr)
62 struct expression *array;
63 struct expression *offset;
64 sval_t max;
65 int size;
67 array = get_array_base(expr);
68 offset = get_array_offset(expr);
70 size = get_array_size(array);
71 if (size <= 0)
72 return 0;
74 get_absolute_max(offset, &max);
75 if (max.uvalue < size)
76 return 1;
77 return 0;
80 static void array_check_data_info(struct expression *expr)
82 struct expression *array;
83 struct expression *offset;
84 struct state_list *slist;
85 struct sm_state *sm;
86 struct compare_data *comp;
87 char *offset_name;
88 const char *equal_name = NULL;
90 expr = strip_expr(expr);
91 if (!is_array(expr))
92 return;
94 if (known_access_ok_numbers(expr))
95 return;
96 if (buf_comparison_index_ok(expr))
97 return;
99 array = get_array_base(expr);
100 offset = get_array_offset(expr);
101 offset_name = expr_to_var(offset);
102 if (!offset_name)
103 return;
104 slist = get_all_possible_equal_comparisons(offset);
105 if (!slist)
106 goto free;
108 FOR_EACH_PTR(slist, sm) {
109 comp = sm->state->data;
110 if (strcmp(comp->left_var, offset_name) == 0) {
111 if (db_var_is_array_limit(array, comp->right_var, comp->right_vsl)) {
112 equal_name = comp->right_var;
113 break;
115 } else if (strcmp(comp->right_var, offset_name) == 0) {
116 if (db_var_is_array_limit(array, comp->left_var, comp->left_vsl)) {
117 equal_name = comp->left_var;
118 break;
121 } END_FOR_EACH_PTR(sm);
123 if (equal_name) {
124 char *array_name = expr_to_str(array);
126 sm_warning("potential off by one '%s[]' limit '%s'", array_name, equal_name);
127 free_string(array_name);
130 free:
131 free_slist(&slist);
132 free_string(offset_name);
135 void check_off_by_one_relative(int id)
137 my_id = id;
139 add_hook(&array_check, OP_HOOK);
140 add_hook(&array_check_data_info, OP_HOOK);