?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
math: handle offset calculation better
[smatch.git] / smatch_db.c
blobad088bf20cff2e80e590cb0b5081b811de38cd52
1 /*
2 * Copyright (C) 2010 Dan Carpenter.
3 *
4 * This program is free software; you can redistribute it and/or
5 * modify it under the terms of the GNU General Public License
6 * as published by the Free Software Foundation; either version 2
7 * of the License, or (at your option) any later version.
8 *
9 * This program is distributed in the hope that it will be useful,
10 * but WITHOUT ANY WARRANTY; without even the implied warranty of
11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12 * GNU General Public License for more details.
13 *
14 * You should have received a copy of the GNU General Public License
15 * along with this program; if not, see http://www.gnu.org/copyleft/gpl.txt
16 */
17
18 #include <string.h>
19 #include <errno.h>
20 #include <sqlite3.h>
21 #include <unistd.h>
22 #include <ctype.h>
23 #include "smatch.h"
24 #include "smatch_slist.h"
25 #include "smatch_extra.h"
26
27 static sqlite3 *db;
28 static sqlite3 *mem_db;
29
30 static int return_id;
31
32 #define sql_insert(table, values...) \
33 do { \
34 if (!mem_db) \
35 break; \
36 if (__inline_fn) { \
37 char buf[1024]; \
38 char *err, *p = buf; \
39 int rc; \
40 \
41 p += snprintf(p, buf + sizeof(buf) - p, \
42 "insert into %s values (", #table); \
43 p += snprintf(p, buf + sizeof(buf) - p, values); \
44 p += snprintf(p, buf + sizeof(buf) - p, ");"); \
45 sm_debug("in-mem: %s\n", buf); \
46 rc = sqlite3_exec(mem_db, buf, NULL, NULL, &err); \
47 if (rc != SQLITE_OK) { \
48 fprintf(stderr, "SQL error #2: %s\n", err); \
49 fprintf(stderr, "SQL: '%s'\n", buf); \
50 parse_error = 1; \
51 } \
52 break; \
53 } \
54 if (option_info) { \
55 sm_prefix(); \
56 sm_printf("SQL: insert into " #table " values (" values); \
57 sm_printf(");\n"); \
58 } \
59 } while (0)
60
61 struct def_callback {
62 int hook_type;
63 void (*callback)(const char *name, struct symbol *sym, char *key, char *value);
64 };
65 ALLOCATOR(def_callback, "definition db hook callbacks");
66 DECLARE_PTR_LIST(callback_list, struct def_callback);
67 static struct callback_list *callbacks;
68
69 struct member_info_callback {
70 int owner;
71 void (*callback)(struct expression *call, int param, char *printed_name, struct sm_state *sm);
72 };
73 ALLOCATOR(member_info_callback, "caller_info callbacks");
74 DECLARE_PTR_LIST(member_info_cb_list, struct member_info_callback);
75 static struct member_info_cb_list *member_callbacks;
76
77 struct returned_state_callback {
78 void (*callback)(int return_id, char *return_ranges, struct expression *return_expr);
79 };
80 ALLOCATOR(returned_state_callback, "returned state callbacks");
81 DECLARE_PTR_LIST(returned_state_cb_list, struct returned_state_callback);
82 static struct returned_state_cb_list *returned_state_callbacks;
83
84 struct returned_member_callback {
85 int owner;
86 void (*callback)(int return_id, char *return_ranges, struct expression *expr, char *printed_name, struct smatch_state *state);
87 };
88 ALLOCATOR(returned_member_callback, "returned member callbacks");
89 DECLARE_PTR_LIST(returned_member_cb_list, struct returned_member_callback);
90 static struct returned_member_cb_list *returned_member_callbacks;
91
92 struct call_implies_callback {
93 int type;
94 void (*callback)(struct expression *arg, char *key, char *value);
95 };
96 ALLOCATOR(call_implies_callback, "call_implies callbacks");
97 DECLARE_PTR_LIST(call_implies_cb_list, struct call_implies_callback);
98 static struct call_implies_cb_list *call_implies_cb_list;
99
100 static int print_sql_output(void *unused, int argc, char **argv, char **azColName)
101 {
102 int i;
103
104 for (i = 0; i < argc; i++) {
105 if (i != 0)
106 printf(", ");
107 sm_printf("%s", argv[i]);
108 }
109 sm_printf("\n");
110 return 0;
111 }
112
113 void debug_sql(const char *sql)
114 {
115 if (!option_debug)
116 return;
117 sm_msg("%s", sql);
118 sql_exec(print_sql_output, NULL, sql);
119 }
120
121 void debug_mem_sql(const char *sql)
122 {
123 if (!option_debug)
124 return;
125 sm_msg("%s", sql);
126 sql_mem_exec(print_sql_output, NULL, sql);
127 }
128
129 void sql_exec(int (*callback)(void*, int, char**, char**), void *data, const char *sql)
130 {
131 char *err = NULL;
132 int rc;
133
134 if (option_no_db || !db)
135 return;
136
137 rc = sqlite3_exec(db, sql, callback, data, &err);
138 if (rc != SQLITE_OK && !parse_error) {
139 fprintf(stderr, "SQL error #2: %s\n", err);
140 fprintf(stderr, "SQL: '%s'\n", sql);
141 parse_error = 1;
142 }
143 }
144
145 void sql_mem_exec(int (*callback)(void*, int, char**, char**), void *data, const char *sql)
146 {
147 char *err = NULL;
148 int rc;
149
150 if (!mem_db)
151 return;
152
153 rc = sqlite3_exec(mem_db, sql, callback, data, &err);
154 if (rc != SQLITE_OK) {
155 fprintf(stderr, "SQL error #2: %s\n", err);
156 fprintf(stderr, "SQL: '%s'\n", sql);
157 parse_error = 1;
158 }
159 }
160
161 void sql_insert_return_states(int return_id, const char *return_ranges,
162 int type, int param, const char *key, const char *value)
163 {
164 if (key && strlen(key) >= 80)
165 return;
166 sql_insert(return_states, "'%s', '%s', %lu, %d, '%s', %d, %d, %d, '%s', '%s'",
167 get_base_file(), get_function(), (unsigned long)__inline_fn,
168 return_id, return_ranges, fn_static(), type, param, key, value);
169 }
170
171 static struct string_list *common_funcs;
172 static int is_common_function(const char *fn)
173 {
174 char *tmp;
175
176 if (strncmp(fn, "__builtin_", 10) == 0)
177 return 1;
178
179 FOR_EACH_PTR(common_funcs, tmp) {
180 if (strcmp(tmp, fn) == 0)
181 return 1;
182 } END_FOR_EACH_PTR(tmp);
183
184 return 0;
185 }
186
187 void sql_insert_caller_info(struct expression *call, int type,
188 int param, const char *key, const char *value)
189 {
190 char *fn;
191
192 if (!option_info && !__inline_call)
193 return;
194
195 if (key && strlen(key) >= 80)
196 return;
197
198 fn = get_fnptr_name(call->fn);
199 if (!fn)
200 return;
201
202 if (__inline_call) {
203 mem_sql(NULL, NULL,
204 "insert into caller_info values ('%s', '%s', '%s', %lu, %d, %d, %d, '%s', '%s');",
205 get_base_file(), get_function(), fn, (unsigned long)call,
206 is_static(call->fn), type, param, key, value);
207 }
208
209 if (!option_info)
210 return;
211
212 if (is_common_function(fn))
213 return;
214
215 sm_msg("SQL_caller_info: insert into caller_info values ("
216 "'%s', '%s', '%s', %%CALL_ID%%, %d, %d, %d, '%s', '%s');",
217 get_base_file(), get_function(), fn, is_static(call->fn),
218 type, param, key, value);
219
220 free_string(fn);
221 }
222
223 void sql_insert_function_ptr(const char *fn, const char *struct_name)
224 {
225 sql_insert(function_ptr, "'%s', '%s', '%s', 0", get_base_file(), fn,
226 struct_name);
227 }
228
229 void sql_insert_call_implies(int type, int param, const char *key, const char *value)
230 {
231 sql_insert(call_implies, "'%s', '%s', %lu, %d, %d, %d, '%s', %s", get_base_file(),
232 get_function(), (unsigned long)__inline_fn, fn_static(),
233 type, param, key, value);
234 }
235
236 void sql_insert_function_type_size(const char *member, const char *ranges)
237 {
238 sql_insert(function_type_size, "'%s', '%s', '%s', '%s'", get_base_file(), get_function(), member, ranges);
239 }
240
241 void sql_insert_local_values(const char *name, const char *value)
242 {
243 sql_insert(local_values, "'%s', '%s', '%s'", get_base_file(), name, value);
244 }
245
246 void sql_insert_function_type_value(const char *type, const char *value)
247 {
248 sql_insert(function_type_value, "'%s', '%s', '%s', '%s'", get_base_file(), get_function(), type, value);
249 }
250
251 void sql_insert_function_type(int param, const char *value)
252 {
253 sql_insert(function_type, "'%s', '%s', %d, %d, '%s'",
254 get_base_file(), get_function(), fn_static(), param, value);
255 }
256
257 void sql_insert_parameter_name(int param, const char *value)
258 {
259 sql_insert(parameter_name, "'%s', '%s', %d, %d, '%s'",
260 get_base_file(), get_function(), fn_static(), param, value);
261 }
262
263 void sql_insert_data_info(struct expression *data, int type, const char *value)
264 {
265 char *data_name;
266
267 data_name = get_data_info_name(data);
268 if (!data_name)
269 return;
270 sql_insert(data_info, "'%s', '%s', %d, '%s'",
271 is_static(data) ? get_base_file() : "extern",
272 data_name, type, value);
273 }
274
275 void sql_insert_data_info_var_sym(const char *var, struct symbol *sym, int type, const char *value)
276 {
277 sql_insert(data_info, "'%s', '%s', %d, '%s'",
278 (sym->ctype.modifiers & MOD_STATIC) ? get_base_file() : "extern",
279 var, type, value);
280 }
281
282 char *get_static_filter(struct symbol *sym)
283 {
284 static char sql_filter[1024];
285
286 /* This can only happen on buggy code. Return invalid SQL. */
287 if (!sym) {
288 sql_filter[0] = '\0';
289 return sql_filter;
290 }
291
292 if (sym->ctype.modifiers & MOD_STATIC) {
293 snprintf(sql_filter, sizeof(sql_filter),
294 "file = '%s' and function = '%s' and static = '1'",
295 get_base_file(), sym->ident->name);
296 } else {
297 snprintf(sql_filter, sizeof(sql_filter),
298 "function = '%s' and static = '0'", sym->ident->name);
299 }
300
301 return sql_filter;
302 }
303
304 static int get_row_count(void *_row_count, int argc, char **argv, char **azColName)
305 {
306 int *row_count = _row_count;
307
308 *row_count = 0;
309 if (argc != 1)
310 return 0;
311 *row_count = atoi(argv[0]);
312 return 0;
313 }
314
315 static void sql_select_return_states_pointer(const char *cols,
316 struct expression *call, int (*callback)(void*, int, char**, char**), void *info)
317 {
318 char *ptr;
319 int return_count = 0;
320
321 ptr = get_fnptr_name(call->fn);
322 if (!ptr)
323 return;
324
325 run_sql(get_row_count, &return_count,
326 "select count(*) from return_states join function_ptr "
327 "where return_states.function == function_ptr.function and "
328 "ptr = '%s' and searchable = 1 and type = %d;", ptr, INTERNAL);
329 /* The magic number 100 is just from testing on the kernel. */
330 if (return_count > 100)
331 return;
332
333 run_sql(callback, info,
334 "select %s from return_states join function_ptr where "
335 "return_states.function == function_ptr.function and ptr = '%s' "
336 "and searchable = 1 "
337 "order by function_ptr.file, return_states.file, return_id, type;",
338 cols, ptr);
339 }
340
341 static int is_local_symbol(struct expression *expr)
342 {
343 if (expr->type != EXPR_SYMBOL)
344 return 0;
345 if (expr->symbol->ctype.modifiers & (MOD_NONLOCAL | MOD_STATIC | MOD_ADDRESSABLE))
346 return 0;
347 return 1;
348 }
349
350 void sql_select_return_states(const char *cols, struct expression *call,
351 int (*callback)(void*, int, char**, char**), void *info)
352 {
353 int row_count = 0;
354
355 if (is_fake_call(call))
356 return;
357
358 if (call->fn->type != EXPR_SYMBOL || !call->fn->symbol || is_local_symbol(call->fn)) {
359 sql_select_return_states_pointer(cols, call, callback, info);
360 return;
361 }
362
363 if (inlinable(call->fn)) {
364 mem_sql(callback, info,
365 "select %s from return_states where call_id = '%lu' order by return_id, type;",
366 cols, (unsigned long)call);
367 return;
368 }
369
370 run_sql(get_row_count, &row_count, "select count(*) from return_states where %s;",
371 get_static_filter(call->fn->symbol));
372 if (row_count > 3000)
373 return;
374
375 run_sql(callback, info, "select %s from return_states where %s order by file, return_id, type;",
376 cols, get_static_filter(call->fn->symbol));
377 }
378
379 void sql_select_call_implies(const char *cols, struct expression *call,
380 int (*callback)(void*, int, char**, char**))
381 {
382 if (call->fn->type != EXPR_SYMBOL || !call->fn->symbol)
383 return;
384
385 if (inlinable(call->fn)) {
386 mem_sql(callback, call,
387 "select %s from call_implies where call_id = '%lu';",
388 cols, (unsigned long)call);
389 return;
390 }
391
392 run_sql(callback, call, "select %s from call_implies where %s;",
393 cols, get_static_filter(call->fn->symbol));
394 }
395
396 void sql_select_caller_info(const char *cols, struct symbol *sym,
397 int (*callback)(void*, int, char**, char**))
398 {
399 if (__inline_fn) {
400 mem_sql(callback, NULL,
401 "select %s from caller_info where call_id = %lu;",
402 cols, (unsigned long)__inline_fn);
403 return;
404 }
405
406 run_sql(callback, NULL,
407 "select %s from caller_info where %s order by call_id;",
408 cols, get_static_filter(sym));
409 }
410
411 void select_caller_info_hook(void (*callback)(const char *name, struct symbol *sym, char *key, char *value), int type)
412 {
413 struct def_callback *def_callback = __alloc_def_callback(0);
414
415 def_callback->hook_type = type;
416 def_callback->callback = callback;
417 add_ptr_list(&callbacks, def_callback);
418 }
419
420 /*
421 * These call backs are used when the --info option is turned on to print struct
422 * member information. For example foo->bar could have a state in
423 * smatch_extra.c and also check_user.c.
424 */
425 void add_member_info_callback(int owner, void (*callback)(struct expression *call, int param, char *printed_name, struct sm_state *sm))
426 {
427 struct member_info_callback *member_callback = __alloc_member_info_callback(0);
428
429 member_callback->owner = owner;
430 member_callback->callback = callback;
431 add_ptr_list(&member_callbacks, member_callback);
432 }
433
434 void add_split_return_callback(void (*fn)(int return_id, char *return_ranges, struct expression *returned_expr))
435 {
436 struct returned_state_callback *callback = __alloc_returned_state_callback(0);
437
438 callback->callback = fn;
439 add_ptr_list(&returned_state_callbacks, callback);
440 }
441
442 void add_returned_member_callback(int owner, void (*callback)(int return_id, char *return_ranges, struct expression *expr, char *printed_name, struct smatch_state *state))
443 {
444 struct returned_member_callback *member_callback = __alloc_returned_member_callback(0);
445
446 member_callback->owner = owner;
447 member_callback->callback = callback;
448 add_ptr_list(&returned_member_callbacks, member_callback);
449 }
450
451 void select_call_implies_hook(int type, void (*callback)(struct expression *arg, char *key, char *value))
452 {
453 struct call_implies_callback *cb = __alloc_call_implies_callback(0);
454
455 cb->type = type;
456 cb->callback = callback;
457 add_ptr_list(&call_implies_cb_list, cb);
458 }
459
460 struct return_info {
461 struct expression *static_returns_call;
462 struct symbol *return_type;
463 struct range_list *return_range_list;
464 };
465
466 static int db_return_callback(void *_ret_info, int argc, char **argv, char **azColName)
467 {
468 struct return_info *ret_info = _ret_info;
469 struct range_list *rl;
470 struct expression *call_expr = ret_info->static_returns_call;
471
472 if (argc != 1)
473 return 0;
474 call_results_to_rl(call_expr, ret_info->return_type, argv[0], &rl);
475 ret_info->return_range_list = rl_union(ret_info->return_range_list, rl);
476 return 0;
477 }
478
479 struct range_list *db_return_vals(struct expression *expr)
480 {
481 struct return_info ret_info = {};
482 char buf[64];
483 struct sm_state *sm;
484
485 if (is_fake_call(expr))
486 return NULL;
487
488 snprintf(buf, sizeof(buf), "return %p", expr);
489 sm = get_sm_state(SMATCH_EXTRA, buf, NULL);
490 if (sm)
491 return clone_rl(estate_rl(sm->state));
492 ret_info.static_returns_call = expr;
493 ret_info.return_type = get_type(expr);
494 if (!ret_info.return_type)
495 return NULL;
496
497 if (expr->fn->type != EXPR_SYMBOL || !expr->fn->symbol)
498 return NULL;
499
500 ret_info.return_range_list = NULL;
501 if (inlinable(expr->fn)) {
502 mem_sql(db_return_callback, &ret_info,
503 "select distinct return from return_states where call_id = '%lu';",
504 (unsigned long)expr);
505 } else {
506 run_sql(db_return_callback, &ret_info,
507 "select distinct return from return_states where %s;",
508 get_static_filter(expr->fn->symbol));
509 }
510 return ret_info.return_range_list;
511 }
512
513 struct range_list *db_return_vals_from_str(const char *fn_name)
514 {
515 struct return_info ret_info;
516
517 ret_info.static_returns_call = NULL;
518 ret_info.return_type = &llong_ctype;
519 ret_info.return_range_list = NULL;
520
521 run_sql(db_return_callback, &ret_info,
522 "select distinct return from return_states where function = '%s';",
523 fn_name);
524 return ret_info.return_range_list;
525 }
526
527 static void match_call_marker(struct expression *expr)
528 {
529 /*
530 * we just want to record something in the database so that if we have
531 * two calls like: frob(4); frob(some_unkown); then on the receiving
532 * side we know that sometimes frob is called with unknown parameters.
533 */
534
535 sql_insert_caller_info(expr, INTERNAL, -1, "%call_marker%", "");
536 }
537
538 static void print_struct_members(struct expression *call, struct expression *expr, int param, struct stree *stree,
539 void (*callback)(struct expression *call, int param, char *printed_name, struct sm_state *sm))
540 {
541 struct sm_state *sm;
542 char *name;
543 struct symbol *sym;
544 int len;
545 char printed_name[256];
546 int is_address = 0;
547
548 expr = strip_expr(expr);
549 if (expr->type == EXPR_PREOP && expr->op == '&') {
550 expr = strip_expr(expr->unop);
551 is_address = 1;
552 }
553
554 name = expr_to_var_sym(expr, &sym);
555 if (!name || !sym)
556 goto free;
557
558 len = strlen(name);
559 FOR_EACH_SM(stree, sm) {
560 if (sm->sym != sym)
561 continue;
562 if (strcmp(name, sm->name) == 0) {
563 if (is_address)
564 snprintf(printed_name, sizeof(printed_name), "*$");
565 else /* these are already handled. fixme: handle them here */
566 continue;
567 } else if (sm->name[0] == '*' && strcmp(name, sm->name + 1) == 0) {
568 snprintf(printed_name, sizeof(printed_name), "*$");
569 } else if (strncmp(name, sm->name, len) == 0) {
570 if (isalnum(sm->name[len]))
571 continue;
572 if (is_address)
573 snprintf(printed_name, sizeof(printed_name), "$->%s", sm->name + len + 1);
574 else
575 snprintf(printed_name, sizeof(printed_name), "$%s", sm->name + len);
576 } else {
577 continue;
578 }
579 callback(call, param, printed_name, sm);
580 } END_FOR_EACH_SM(sm);
581 free:
582 free_string(name);
583 }
584
585 static void match_call_info(struct expression *call)
586 {
587 struct member_info_callback *cb;
588 struct expression *arg;
589 struct stree *stree;
590 char *name;
591 int i;
592
593 name = get_fnptr_name(call->fn);
594 if (!name)
595 return;
596
597 FOR_EACH_PTR(member_callbacks, cb) {
598 stree = get_all_states_stree(cb->owner);
599 i = 0;
600 FOR_EACH_PTR(call->args, arg) {
601 print_struct_members(call, arg, i, stree, cb->callback);
602 i++;
603 } END_FOR_EACH_PTR(arg);
604 free_stree(&stree);
605 } END_FOR_EACH_PTR(cb);
606
607 free_string(name);
608 }
609
610 static int get_param(int param, char **name, struct symbol **sym)
611 {
612 struct symbol *arg;
613 int i;
614
615 i = 0;
616 FOR_EACH_PTR(cur_func_sym->ctype.base_type->arguments, arg) {
617 /*
618 * this is a temporary hack to work around a bug (I think in sparse?)
619 * 2.6.37-rc1:fs/reiserfs/journal.o
620 * If there is a function definition without parameter name found
621 * after a function implementation then it causes a crash.
622 * int foo() {}
623 * int bar(char *);
624 */
625 if (arg->ident->name < (char *)100)
626 continue;
627 if (i == param) {
628 *name = arg->ident->name;
629 *sym = arg;
630 return TRUE;
631 }
632 i++;
633 } END_FOR_EACH_PTR(arg);
634
635 return FALSE;
636 }
637
638 static struct stree *final_states;
639 static int prev_func_id = -1;
640 static int caller_info_callback(void *unused, int argc, char **argv, char **azColName)
641 {
642 int func_id;
643 long type;
644 long param;
645 char *key;
646 char *value;
647 char *name = NULL;
648 struct symbol *sym = NULL;
649 struct def_callback *def_callback;
650 struct stree *stree;
651
652 if (argc != 5)
653 return 0;
654
655 func_id = atoi(argv[0]);
656 errno = 0;
657 type = strtol(argv[1], NULL, 10);
658 param = strtol(argv[2], NULL, 10);
659 if (errno)
660 return 0;
661 key = argv[3];
662 value = argv[4];
663
664
665 if (prev_func_id == -1)
666 prev_func_id = func_id;
667 if (func_id != prev_func_id) {
668 stree = __pop_fake_cur_stree();
669 merge_stree(&final_states, stree);
670 free_stree(&stree);
671 __push_fake_cur_stree();
672 __unnullify_path();
673 prev_func_id = func_id;
674 }
675
676 if (param >= 0 && !get_param(param, &name, &sym))
677 return 0;
678
679 FOR_EACH_PTR(callbacks, def_callback) {
680 if (def_callback->hook_type == type)
681 def_callback->callback(name, sym, key, value);
682 } END_FOR_EACH_PTR(def_callback);
683
684 return 0;
685 }
686
687 static void get_direct_callers(struct symbol *sym)
688 {
689 sql_select_caller_info("call_id, type, parameter, key, value", sym,
690 caller_info_callback);
691 }
692
693 static struct string_list *ptr_names_done;
694 static struct string_list *ptr_names;
695
696 static int get_ptr_name(void *unused, int argc, char **argv, char **azColName)
697 {
698 insert_string(&ptr_names, alloc_string(argv[0]));
699 return 0;
700 }
701
702 static char *get_next_ptr_name(void)
703 {
704 char *ptr;
705
706 FOR_EACH_PTR(ptr_names, ptr) {
707 if (list_has_string(ptr_names_done, ptr))
708 continue;
709 insert_string(&ptr_names_done, ptr);
710 return ptr;
711 } END_FOR_EACH_PTR(ptr);
712 return NULL;
713 }
714
715 static void get_ptr_names(const char *file, const char *name)
716 {
717 char sql_filter[1024];
718 int before, after;
719
720 if (file) {
721 snprintf(sql_filter, 1024, "file = '%s' and function = '%s';",
722 file, name);
723 } else {
724 snprintf(sql_filter, 1024, "function = '%s';", name);
725 }
726
727 before = ptr_list_size((struct ptr_list *)ptr_names);
728
729 run_sql(get_ptr_name, NULL,
730 "select distinct ptr from function_ptr where %s",
731 sql_filter);
732
733 after = ptr_list_size((struct ptr_list *)ptr_names);
734 if (before == after)
735 return;
736
737 while ((name = get_next_ptr_name()))
738 get_ptr_names(NULL, name);
739 }
740
741 static void match_data_from_db(struct symbol *sym)
742 {
743 struct sm_state *sm;
744 struct stree *stree;
745
746 if (!sym || !sym->ident)
747 return;
748
749 __push_fake_cur_stree();
750 __unnullify_path();
751 prev_func_id = -1;
752
753 if (!__inline_fn) {
754 char *ptr;
755
756 if (sym->ctype.modifiers & MOD_STATIC)
757 get_ptr_names(get_base_file(), sym->ident->name);
758 else
759 get_ptr_names(NULL, sym->ident->name);
760
761 if (ptr_list_size((struct ptr_list *)ptr_names) > 20) {
762 __free_ptr_list((struct ptr_list **)&ptr_names);
763 __free_ptr_list((struct ptr_list **)&ptr_names_done);
764 stree = __pop_fake_cur_stree();
765 free_stree(&stree);
766 return;
767 }
768
769 get_direct_callers(sym);
770
771 FOR_EACH_PTR(ptr_names, ptr) {
772 run_sql(caller_info_callback, NULL,
773 "select call_id, type, parameter, key, value"
774 " from caller_info where function = '%s' order by call_id",
775 ptr);
776 free_string(ptr);
777 } END_FOR_EACH_PTR(ptr);
778
779 __free_ptr_list((struct ptr_list **)&ptr_names);
780 __free_ptr_list((struct ptr_list **)&ptr_names_done);
781 } else {
782 get_direct_callers(sym);
783 }
784
785 stree = __pop_fake_cur_stree();
786 merge_stree(&final_states, stree);
787 free_stree(&stree);
788
789 FOR_EACH_SM(final_states, sm) {
790 __set_sm(sm);
791 } END_FOR_EACH_SM(sm);
792
793 free_stree(&final_states);
794 }
795
796 static int call_implies_callbacks(void *_call, int argc, char **argv, char **azColName)
797 {
798 struct expression *call_expr = _call;
799 struct call_implies_callback *cb;
800 struct expression *arg = NULL;
801 int type;
802 int param;
803
804 if (argc != 5)
805 return 0;
806
807 type = atoi(argv[1]);
808 param = atoi(argv[2]);
809
810 FOR_EACH_PTR(call_implies_cb_list, cb) {
811 if (cb->type != type)
812 continue;
813 if (param != -1) {
814 arg = get_argument_from_call_expr(call_expr->args, param);
815 if (!arg)
816 continue;
817 }
818 cb->callback(arg, argv[3], argv[4]);
819 } END_FOR_EACH_PTR(cb);
820
821 return 0;
822 }
823
824 static void match_call_implies(struct expression *expr)
825 {
826 sql_select_call_implies("function, type, parameter, key, value", expr,
827 call_implies_callbacks);
828 }
829
830 static void print_initializer_list(struct expression_list *expr_list,
831 struct symbol *struct_type)
832 {
833 struct expression *expr;
834 struct symbol *base_type;
835 char struct_name[256];
836
837 FOR_EACH_PTR(expr_list, expr) {
838 if (expr->type == EXPR_INDEX && expr->idx_expression && expr->idx_expression->type == EXPR_INITIALIZER) {
839 print_initializer_list(expr->idx_expression->expr_list, struct_type);
840 continue;
841 }
842 if (expr->type != EXPR_IDENTIFIER)
843 continue;
844 if (!expr->expr_ident)
845 continue;
846 if (!expr->ident_expression || !expr->ident_expression->symbol_name)
847 continue;
848 base_type = get_type(expr->ident_expression);
849 if (!base_type || base_type->type != SYM_FN)
850 continue;
851 snprintf(struct_name, sizeof(struct_name), "(struct %s)->%s",
852 struct_type->ident->name, expr->expr_ident->name);
853 sql_insert_function_ptr(expr->ident_expression->symbol_name->name,
854 struct_name);
855 } END_FOR_EACH_PTR(expr);
856 }
857
858 static void global_variable(struct symbol *sym)
859 {
860 struct symbol *struct_type;
861
862 if (!sym->ident)
863 return;
864 if (!sym->initializer || sym->initializer->type != EXPR_INITIALIZER)
865 return;
866 struct_type = get_base_type(sym);
867 if (!struct_type)
868 return;
869 if (struct_type->type == SYM_ARRAY) {
870 struct_type = get_base_type(struct_type);
871 if (!struct_type)
872 return;
873 }
874 if (struct_type->type != SYM_STRUCT || !struct_type->ident)
875 return;
876 print_initializer_list(sym->initializer->expr_list, struct_type);
877 }
878
879 static char *function_signature(void)
880 {
881 return type_to_str(get_real_base_type(cur_func_sym));
882 }
883
884 static void match_return_info(int return_id, char *return_ranges, struct expression *expr)
885 {
886 sql_insert_return_states(return_id, return_ranges, INTERNAL, -1, "", function_signature());
887 }
888
889 static void call_return_state_hooks_conditional(struct expression *expr)
890 {
891 struct returned_state_callback *cb;
892 struct range_list *rl;
893 char *return_ranges;
894 int final_pass_orig = final_pass;
895
896 __push_fake_cur_stree();
897
898 final_pass = 0;
899 __split_whole_condition(expr->conditional);
900 final_pass = final_pass_orig;
901
902 if (get_implied_rl(expr->cond_true, &rl))
903 rl = cast_rl(cur_func_return_type(), rl);
904 else
905 rl = cast_rl(cur_func_return_type(), alloc_whole_rl(get_type(expr->cond_true)));
906 return_ranges = show_rl(rl);
907 set_state(RETURN_ID, "return_ranges", NULL, alloc_estate_rl(rl));
908
909 return_id++;
910 FOR_EACH_PTR(returned_state_callbacks, cb) {
911 cb->callback(return_id, return_ranges, expr);
912 } END_FOR_EACH_PTR(cb);
913
914 __push_true_states();
915 __use_false_states();
916
917 if (get_implied_rl(expr->cond_false, &rl))
918 rl = cast_rl(cur_func_return_type(), rl);
919 else
920 rl = cast_rl(cur_func_return_type(), alloc_whole_rl(get_type(expr->cond_false)));
921 return_ranges = show_rl(rl);
922 set_state(RETURN_ID, "return_ranges", NULL, alloc_estate_rl(rl));
923
924 return_id++;
925 FOR_EACH_PTR(returned_state_callbacks, cb) {
926 cb->callback(return_id, return_ranges, expr);
927 } END_FOR_EACH_PTR(cb);
928
929 __merge_true_states();
930 __free_fake_cur_stree();
931 }
932
933 static void call_return_state_hooks_compare(struct expression *expr)
934 {
935 struct returned_state_callback *cb;
936 char *return_ranges;
937 int final_pass_orig = final_pass;
938 sval_t sval = { .type = &int_ctype };
939 sval_t ret;
940
941 if (!get_implied_value(expr, &ret))
942 ret.value = -1;
943
944 __push_fake_cur_stree();
945
946 final_pass = 0;
947 __split_whole_condition(expr);
948 final_pass = final_pass_orig;
949
950 if (ret.value != 0) {
951 return_ranges = alloc_sname("1");
952 sval.value = 1;
953 set_state(RETURN_ID, "return_ranges", NULL, alloc_estate_sval(sval));
954
955 return_id++;
956 FOR_EACH_PTR(returned_state_callbacks, cb) {
957 cb->callback(return_id, return_ranges, expr);
958 } END_FOR_EACH_PTR(cb);
959 }
960
961 __push_true_states();
962 __use_false_states();
963
964 if (ret.value != 1) {
965 return_ranges = alloc_sname("0");
966 sval.value = 0;
967 set_state(RETURN_ID, "return_ranges", NULL, alloc_estate_sval(sval));
968
969 return_id++;
970 FOR_EACH_PTR(returned_state_callbacks, cb) {
971 cb->callback(return_id, return_ranges, expr);
972 } END_FOR_EACH_PTR(cb);
973 }
974
975 __merge_true_states();
976 __free_fake_cur_stree();
977 }
978
979 static int ptr_in_list(struct sm_state *sm, struct state_list *slist)
980 {
981 struct sm_state *tmp;
982
983 FOR_EACH_PTR(slist, tmp) {
984 if (strcmp(tmp->state->name, sm->state->name) == 0)
985 return 1;
986 } END_FOR_EACH_PTR(tmp);
987
988 return 0;
989 }
990
991 static int split_possible_helper(struct sm_state *sm, struct expression *expr)
992 {
993 struct returned_state_callback *cb;
994 struct range_list *rl;
995 char *return_ranges;
996 struct sm_state *tmp;
997 int ret = 0;
998 int nr_possible, nr_states;
999 char *compare_str = NULL;
1000 char buf[128];
1001 struct state_list *already_handled = NULL;
1002
1003 if (!sm || !sm->merged)
1004 return 0;
1005
1006 if (too_many_possible(sm))
1007 return 0;
1008
1009 /* bail if it gets too complicated */
1010 nr_possible = ptr_list_size((struct ptr_list *)sm->possible);
1011 nr_states = stree_count(__get_cur_stree());
1012 if (nr_states * nr_possible >= 2000)
1013 return 0;
1014
1015 FOR_EACH_PTR(sm->possible, tmp) {
1016 if (tmp->merged)
1017 continue;
1018 if (ptr_in_list(tmp, already_handled))
1019 continue;
1020 add_ptr_list(&already_handled, tmp);
1021
1022 ret = 1;
1023 __push_fake_cur_stree();
1024
1025 overwrite_states_using_pool(sm, tmp);
1026
1027 rl = cast_rl(cur_func_return_type(), estate_rl(tmp->state));
1028 return_ranges = show_rl(rl);
1029 set_state(RETURN_ID, "return_ranges", NULL, alloc_estate_rl(clone_rl(rl)));
1030 compare_str = expr_lte_to_param(expr, -1);
1031 if (compare_str) {
1032 snprintf(buf, sizeof(buf), "%s%s", return_ranges, compare_str);
1033 return_ranges = alloc_sname(buf);
1034 }
1035
1036 return_id++;
1037 FOR_EACH_PTR(returned_state_callbacks, cb) {
1038 cb->callback(return_id, return_ranges, expr);
1039 } END_FOR_EACH_PTR(cb);
1040
1041 __free_fake_cur_stree();
1042 } END_FOR_EACH_PTR(tmp);
1043
1044 free_slist(&already_handled);
1045
1046 return ret;
1047 }
1048
1049 static int call_return_state_hooks_split_possible(struct expression *expr)
1050 {
1051 struct sm_state *sm;
1052
1053 if (!expr || expr_equal_to_param(expr, -1))
1054 return 0;
1055
1056 sm = get_sm_state_expr(SMATCH_EXTRA, expr);
1057 return split_possible_helper(sm, expr);
1058 }
1059
1060 static const char *get_return_ranges_str(struct expression *expr, struct range_list **rl_p)
1061 {
1062 struct range_list *rl;
1063 char *return_ranges;
1064 sval_t sval;
1065 char *compare_str;
1066 char *math_str;
1067 char buf[128];
1068
1069 *rl_p = NULL;
1070
1071 if (!expr)
1072 return alloc_sname("");
1073
1074 if (get_implied_value(expr, &sval)) {
1075 sval = sval_cast(cur_func_return_type(), sval);
1076 *rl_p = alloc_rl(sval, sval);
1077 return sval_to_str(sval);
1078 }
1079
1080 compare_str = expr_equal_to_param(expr, -1);
1081 math_str = get_value_in_terms_of_parameter_math(expr);
1082
1083 if (get_implied_rl(expr, &rl)) {
1084 rl = cast_rl(cur_func_return_type(), rl);
1085 return_ranges = show_rl(rl);
1086 } else if (get_imaginary_absolute(expr, &rl)){
1087 rl = cast_rl(cur_func_return_type(), rl);
1088 return alloc_sname(show_rl(rl));
1089 } else {
1090 rl = cast_rl(cur_func_return_type(), alloc_whole_rl(get_type(expr)));
1091 return_ranges = show_rl(rl);
1092 }
1093 *rl_p = rl;
1094
1095 if (compare_str) {
1096 snprintf(buf, sizeof(buf), "%s%s", return_ranges, compare_str);
1097 return alloc_sname(buf);
1098 }
1099
1100 if (math_str) {
1101 snprintf(buf, sizeof(buf), "%s[%s]", return_ranges, math_str);
1102 return alloc_sname(buf);
1103 }
1104
1105 compare_str = expr_lte_to_param(expr, -1);
1106 if (compare_str) {
1107 snprintf(buf, sizeof(buf), "%s%s", return_ranges, compare_str);
1108 return alloc_sname(buf);
1109 }
1110 return return_ranges;
1111 }
1112
1113 static int split_positive_from_negative(struct expression *expr)
1114 {
1115 struct returned_state_callback *cb;
1116 struct range_list *rl;
1117 const char *return_ranges;
1118 struct range_list *ret_rl;
1119 int undo;
1120
1121 /* We're going to print the states 3 times */
1122 if (stree_count(__get_cur_stree()) > 10000 / 3)
1123 return 0;
1124
1125 if (!get_implied_rl(expr, &rl) || !rl)
1126 return 0;
1127 if (is_whole_rl(rl) || is_whole_rl_non_zero(rl))
1128 return 0;
1129 /* Forget about INT_MAX and larger */
1130 if (rl_max(rl).value <= 0)
1131 return 0;
1132 if (!sval_is_negative(rl_min(rl)))
1133 return 0;
1134
1135 if (!assume(compare_expression(expr, '>', zero_expr())))
1136 return 0;
1137
1138 return_id++;
1139 return_ranges = get_return_ranges_str(expr, &ret_rl);
1140 set_state(RETURN_ID, "return_ranges", NULL, alloc_estate_rl(ret_rl));
1141 FOR_EACH_PTR(returned_state_callbacks, cb) {
1142 cb->callback(return_id, (char *)return_ranges, expr);
1143 } END_FOR_EACH_PTR(cb);
1144
1145 end_assume();
1146
1147 if (rl_has_sval(rl, sval_type_val(rl_type(rl), 0))) {
1148 undo = assume(compare_expression(expr, SPECIAL_EQUAL, zero_expr()));
1149
1150 return_id++;
1151 return_ranges = get_return_ranges_str(expr, &ret_rl);
1152 set_state(RETURN_ID, "return_ranges", NULL, alloc_estate_rl(ret_rl));
1153 FOR_EACH_PTR(returned_state_callbacks, cb) {
1154 cb->callback(return_id, (char *)return_ranges, expr);
1155 } END_FOR_EACH_PTR(cb);
1156
1157 if (undo)
1158 end_assume();
1159 }
1160
1161 undo = assume(compare_expression(expr, '<', zero_expr()));
1162
1163 return_id++;
1164 return_ranges = get_return_ranges_str(expr, &ret_rl);
1165 set_state(RETURN_ID, "return_ranges", NULL, alloc_estate_rl(ret_rl));
1166 FOR_EACH_PTR(returned_state_callbacks, cb) {
1167 cb->callback(return_id, (char *)return_ranges, expr);
1168 } END_FOR_EACH_PTR(cb);
1169
1170 if (undo)
1171 end_assume();
1172
1173 return 1;
1174 }
1175
1176 static int call_return_state_hooks_split_null_non_null(struct expression *expr)
1177 {
1178 struct returned_state_callback *cb;
1179 struct range_list *rl;
1180 struct range_list *nonnull_rl;
1181 sval_t null_sval;
1182 struct range_list *null_rl = NULL;
1183 char *return_ranges;
1184 struct sm_state *sm;
1185 struct smatch_state *state;
1186 int nr_states;
1187 int final_pass_orig = final_pass;
1188
1189 if (!expr || expr_equal_to_param(expr, -1))
1190 return 0;
1191 if (expr->type == EXPR_CALL)
1192 return 0;
1193 if (!is_pointer(expr))
1194 return 0;
1195
1196 sm = get_sm_state_expr(SMATCH_EXTRA, expr);
1197 if (!sm)
1198 return 0;
1199 if (ptr_list_size((struct ptr_list *)sm->possible) == 1)
1200 return 0;
1201 state = sm->state;
1202 if (!estate_rl(state))
1203 return 0;
1204 if (estate_min(state).value == 0 && estate_max(state).value == 0)
1205 return 0;
1206 if (!rl_has_sval(estate_rl(state), sval_type_val(estate_type(state), 0)))
1207 return 0;
1208
1209 nr_states = stree_count(__get_cur_stree());
1210 if (option_info && nr_states >= 1500)
1211 return 0;
1212
1213 rl = estate_rl(state);
1214
1215 __push_fake_cur_stree();
1216
1217 final_pass = 0;
1218 __split_whole_condition(expr);
1219 final_pass = final_pass_orig;
1220
1221 nonnull_rl = rl_filter(rl, rl_zero());
1222 return_ranges = show_rl(nonnull_rl);
1223 set_state(RETURN_ID, "return_ranges", NULL, alloc_estate_rl(nonnull_rl));
1224
1225 return_id++;
1226 FOR_EACH_PTR(returned_state_callbacks, cb) {
1227 cb->callback(return_id, return_ranges, expr);
1228 } END_FOR_EACH_PTR(cb);
1229
1230 __push_true_states();
1231 __use_false_states();
1232
1233 return_ranges = alloc_sname("0");
1234 null_sval = sval_type_val(rl_type(rl), 0);
1235 add_range(&null_rl, null_sval, null_sval);
1236 set_state(RETURN_ID, "return_ranges", NULL, alloc_estate_rl(null_rl));
1237 return_id++;
1238 FOR_EACH_PTR(returned_state_callbacks, cb) {
1239 cb->callback(return_id, return_ranges, expr);
1240 } END_FOR_EACH_PTR(cb);
1241
1242 __merge_true_states();
1243 __free_fake_cur_stree();
1244
1245 return 1;
1246 }
1247
1248 static int call_return_state_hooks_split_success_fail(struct expression *expr)
1249 {
1250 struct range_list *rl;
1251 struct range_list *nonzero_rl;
1252 sval_t zero_sval;
1253 struct range_list *zero_rl = NULL;
1254 int nr_states;
1255 struct returned_state_callback *cb;
1256 char *return_ranges;
1257 int final_pass_orig = final_pass;
1258 sval_t val;
1259
1260 if (option_project != PROJ_KERNEL)
1261 return 0;
1262
1263 nr_states = stree_count(__get_cur_stree());
1264 if (nr_states > 1500)
1265 return 0;
1266
1267 if (get_value(expr, &val))
1268 return 0;
1269 if (!get_implied_rl(expr, &rl))
1270 return 0;
1271 if (rl_min(rl).value < -4095 || rl_min(rl).value >= 0)
1272 return 0;
1273 if (rl_max(rl).value != 0)
1274 return 0;
1275
1276 __push_fake_cur_stree();
1277
1278 final_pass = 0;
1279 __split_whole_condition(expr);
1280 final_pass = final_pass_orig;
1281
1282 nonzero_rl = rl_filter(rl, rl_zero());
1283 return_ranges = show_rl(nonzero_rl);
1284 set_state(RETURN_ID, "return_ranges", NULL, alloc_estate_rl(nonzero_rl));
1285
1286 return_id++;
1287 FOR_EACH_PTR(returned_state_callbacks, cb) {
1288 cb->callback(return_id, return_ranges, expr);
1289 } END_FOR_EACH_PTR(cb);
1290
1291 __push_true_states();
1292 __use_false_states();
1293
1294 return_ranges = alloc_sname("0");
1295 zero_sval = sval_type_val(rl_type(rl), 0);
1296 add_range(&zero_rl, zero_sval, zero_sval);
1297 set_state(RETURN_ID, "return_ranges", NULL, alloc_estate_rl(zero_rl));
1298 return_id++;
1299 FOR_EACH_PTR(returned_state_callbacks, cb) {
1300 cb->callback(return_id, return_ranges, expr);
1301 } END_FOR_EACH_PTR(cb);
1302
1303 __merge_true_states();
1304 __free_fake_cur_stree();
1305
1306 return 1;
1307 }
1308
1309 static int is_boolean(struct expression *expr)
1310 {
1311 struct range_list *rl;
1312
1313 if (!get_implied_rl(expr, &rl))
1314 return 0;
1315 if (rl_min(rl).value == 0 && rl_max(rl).value == 1)
1316 return 1;
1317 return 0;
1318 }
1319
1320 static int is_conditional(struct expression *expr)
1321 {
1322 if (!expr)
1323 return 0;
1324 if (expr->type == EXPR_CONDITIONAL || expr->type == EXPR_SELECT)
1325 return 1;
1326 return 0;
1327 }
1328
1329 static int splitable_function_call(struct expression *expr)
1330 {
1331 struct sm_state *sm;
1332 char buf[64];
1333
1334 if (!expr || expr->type != EXPR_CALL)
1335 return 0;
1336 snprintf(buf, sizeof(buf), "return %p", expr);
1337 sm = get_sm_state(SMATCH_EXTRA, buf, NULL);
1338 return split_possible_helper(sm, expr);
1339 }
1340
1341 static struct sm_state *find_bool_param(void)
1342 {
1343 struct stree *start_states;
1344 struct symbol *arg;
1345 struct sm_state *sm, *tmp;
1346 sval_t sval;
1347
1348 start_states = get_start_states();
1349
1350 FOR_EACH_PTR_REVERSE(cur_func_sym->ctype.base_type->arguments, arg) {
1351 if (!arg->ident)
1352 continue;
1353 sm = get_sm_state_stree(start_states, SMATCH_EXTRA, arg->ident->name, arg);
1354 if (!sm)
1355 continue;
1356 if (rl_min(estate_rl(sm->state)).value != 0 ||
1357 rl_max(estate_rl(sm->state)).value != 1)
1358 continue;
1359 goto found;
1360 } END_FOR_EACH_PTR_REVERSE(arg);
1361
1362 return NULL;
1363
1364 found:
1365 /*
1366 * Check if it's splitable. If not, then splitting it up is likely not
1367 * useful for the callers.
1368 */
1369 FOR_EACH_PTR(sm->possible, tmp) {
1370 if (is_merged(tmp))
1371 continue;
1372 if (!estate_get_single_value(tmp->state, &sval))
1373 return NULL;
1374 } END_FOR_EACH_PTR(tmp);
1375
1376 return sm;
1377 }
1378
1379 static int split_on_bool_sm(struct sm_state *sm, struct expression *expr)
1380 {
1381 struct returned_state_callback *cb;
1382 struct range_list *ret_rl;
1383 const char *return_ranges;
1384 struct sm_state *tmp;
1385 int ret = 0;
1386 int nr_possible, nr_states;
1387 char *compare_str = NULL;
1388 char buf[128];
1389 struct state_list *already_handled = NULL;
1390
1391 if (!sm || !sm->merged)
1392 return 0;
1393
1394 if (too_many_possible(sm))
1395 return 0;
1396
1397 /* bail if it gets too complicated */
1398 nr_possible = ptr_list_size((struct ptr_list *)sm->possible);
1399 nr_states = stree_count(__get_cur_stree());
1400 if (nr_states * nr_possible >= 2000)
1401 return 0;
1402
1403 FOR_EACH_PTR(sm->possible, tmp) {
1404 if (tmp->merged)
1405 continue;
1406 if (ptr_in_list(tmp, already_handled))
1407 continue;
1408 add_ptr_list(&already_handled, tmp);
1409
1410 ret = 1;
1411 __push_fake_cur_stree();
1412
1413 overwrite_states_using_pool(sm, tmp);
1414
1415 return_ranges = get_return_ranges_str(expr, &ret_rl);
1416 set_state(RETURN_ID, "return_ranges", NULL, alloc_estate_rl(ret_rl));
1417 compare_str = expr_lte_to_param(expr, -1);
1418 if (compare_str) {
1419 snprintf(buf, sizeof(buf), "%s%s", return_ranges, compare_str);
1420 return_ranges = alloc_sname(buf);
1421 }
1422
1423 return_id++;
1424 FOR_EACH_PTR(returned_state_callbacks, cb) {
1425 cb->callback(return_id, (char *)return_ranges, expr);
1426 } END_FOR_EACH_PTR(cb);
1427
1428 __free_fake_cur_stree();
1429 } END_FOR_EACH_PTR(tmp);
1430
1431 free_slist(&already_handled);
1432
1433 return ret;
1434 }
1435
1436 static int split_by_bool_param(struct expression *expr)
1437 {
1438 struct sm_state *start_sm, *sm;
1439 sval_t sval;
1440
1441 start_sm = find_bool_param();
1442 if (!start_sm)
1443 return 0;
1444 sm = get_sm_state(SMATCH_EXTRA, start_sm->name, start_sm->sym);
1445 if (!sm || estate_get_single_value(sm->state, &sval))
1446 return 0;
1447 return split_on_bool_sm(sm, expr);
1448 }
1449
1450 static int split_by_null_nonnull_param(struct expression *expr)
1451 {
1452 struct symbol *arg;
1453 struct sm_state *sm;
1454
1455 /* function must only take one pointer */
1456 if (ptr_list_size((struct ptr_list *)cur_func_sym->ctype.base_type->arguments) != 1)
1457 return 0;
1458 arg = first_ptr_list((struct ptr_list *)cur_func_sym->ctype.base_type->arguments);
1459 if (!arg->ident)
1460 return 0;
1461 if (get_real_base_type(arg)->type != SYM_PTR)
1462 return 0;
1463
1464 if (param_was_set_var_sym(arg->ident->name, arg))
1465 return 0;
1466 sm = get_sm_state(SMATCH_EXTRA, arg->ident->name, arg);
1467 if (!sm)
1468 return 0;
1469
1470 return split_on_bool_sm(sm, expr);
1471 }
1472
1473 static void call_return_state_hooks(struct expression *expr)
1474 {
1475 struct returned_state_callback *cb;
1476 struct range_list *ret_rl;
1477 const char *return_ranges;
1478 int nr_states;
1479 sval_t sval;
1480
1481 if (__path_is_null())
1482 return;
1483
1484 expr = strip_expr(expr);
1485
1486 if (is_impossible_path())
1487 goto vanilla;
1488
1489 if (expr && (expr->type == EXPR_COMPARE ||
1490 !get_implied_value(expr, &sval)) &&
1491 (is_condition(expr) || is_boolean(expr))) {
1492 call_return_state_hooks_compare(expr);
1493 return;
1494 } else if (is_conditional(expr)) {
1495 call_return_state_hooks_conditional(expr);
1496 return;
1497 } else if (call_return_state_hooks_split_possible(expr)) {
1498 return;
1499 } else if (call_return_state_hooks_split_null_non_null(expr)) {
1500 return;
1501 } else if (call_return_state_hooks_split_success_fail(expr)) {
1502 return;
1503 } else if (splitable_function_call(expr)) {
1504 return;
1505 } else if (split_positive_from_negative(expr)) {
1506 return;
1507 } else if (split_by_bool_param(expr)) {
1508 } else if (split_by_null_nonnull_param(expr)) {
1509 return;
1510 }
1511
1512 vanilla:
1513 return_ranges = get_return_ranges_str(expr, &ret_rl);
1514 set_state(RETURN_ID, "return_ranges", NULL, alloc_estate_rl(ret_rl));
1515
1516 return_id++;
1517 nr_states = stree_count(__get_cur_stree());
1518 if (nr_states >= 10000) {
1519 match_return_info(return_id, (char *)return_ranges, expr);
1520 return;
1521 }
1522 FOR_EACH_PTR(returned_state_callbacks, cb) {
1523 cb->callback(return_id, (char *)return_ranges, expr);
1524 } END_FOR_EACH_PTR(cb);
1525 }
1526
1527 static void print_returned_struct_members(int return_id, char *return_ranges, struct expression *expr)
1528 {
1529 struct returned_member_callback *cb;
1530 struct stree *stree;
1531 struct sm_state *sm;
1532 struct symbol *type;
1533 char *name;
1534 char member_name[256];
1535 int len;
1536
1537 type = get_type(expr);
1538 if (!type || type->type != SYM_PTR)
1539 return;
1540 name = expr_to_var(expr);
1541 if (!name)
1542 return;
1543
1544 member_name[sizeof(member_name) - 1] = '\0';
1545 strcpy(member_name, "$");
1546
1547 len = strlen(name);
1548 FOR_EACH_PTR(returned_member_callbacks, cb) {
1549 stree = __get_cur_stree();
1550 FOR_EACH_MY_SM(cb->owner, stree, sm) {
1551 if (sm->name[0] == '*' && strcmp(sm->name + 1, name) == 0) {
1552 strcpy(member_name, "*$");
1553 cb->callback(return_id, return_ranges, expr, member_name, sm->state);
1554 continue;
1555 }
1556 if (strncmp(sm->name, name, len) != 0)
1557 continue;
1558 if (strncmp(sm->name + len, "->", 2) != 0)
1559 continue;
1560 snprintf(member_name, sizeof(member_name), "$%s", sm->name + len);
1561 cb->callback(return_id, return_ranges, expr, member_name, sm->state);
1562 } END_FOR_EACH_SM(sm);
1563 } END_FOR_EACH_PTR(cb);
1564
1565 free_string(name);
1566 }
1567
1568 static void reset_memdb(struct symbol *sym)
1569 {
1570 mem_sql(NULL, NULL, "delete from caller_info;");
1571 mem_sql(NULL, NULL, "delete from return_states;");
1572 mem_sql(NULL, NULL, "delete from call_implies;");
1573 }
1574
1575 static void match_end_func_info(struct symbol *sym)
1576 {
1577 if (__path_is_null())
1578 return;
1579 call_return_state_hooks(NULL);
1580 }
1581
1582 static void match_after_func(struct symbol *sym)
1583 {
1584 if (!__inline_fn)
1585 reset_memdb(sym);
1586 }
1587
1588 static void init_memdb(void)
1589 {
1590 char *err = NULL;
1591 int rc;
1592 const char *schema_files[] = {
1593 "db/db.schema",
1594 "db/caller_info.schema",
1595 "db/return_states.schema",
1596 "db/function_type_size.schema",
1597 "db/type_size.schema",
1598 "db/call_implies.schema",
1599 "db/function_ptr.schema",
1600 "db/local_values.schema",
1601 "db/function_type_value.schema",
1602 "db/type_value.schema",
1603 "db/function_type.schema",
1604 "db/data_info.schema",
1605 "db/parameter_name.schema",
1606 };
1607 static char buf[4096];
1608 int fd;
1609 int ret;
1610 int i;
1611
1612 rc = sqlite3_open(":memory:", &mem_db);
1613 if (rc != SQLITE_OK) {
1614 printf("Error starting In-Memory database.");
1615 return;
1616 }
1617
1618 for (i = 0; i < ARRAY_SIZE(schema_files); i++) {
1619 fd = open_data_file(schema_files[i]);
1620 if (fd < 0) {
1621 mem_db = NULL;
1622 return;
1623 }
1624 ret = read(fd, buf, sizeof(buf));
1625 if (ret == sizeof(buf)) {
1626 printf("Schema file too large: %s (limit %zd bytes)",
1627 schema_files[i], sizeof(buf));
1628 }
1629 buf[ret] = '\0';
1630 rc = sqlite3_exec(mem_db, buf, NULL, NULL, &err);
1631 if (rc != SQLITE_OK) {
1632 fprintf(stderr, "SQL error #2: %s\n", err);
1633 fprintf(stderr, "%s\n", buf);
1634 }
1635 }
1636 }
1637
1638 void open_smatch_db(void)
1639 {
1640 int rc;
1641
1642 if (option_no_db)
1643 return;
1644
1645 init_memdb();
1646
1647 rc = sqlite3_open_v2("smatch_db.sqlite", &db, SQLITE_OPEN_READONLY, NULL);
1648 if (rc != SQLITE_OK) {
1649 option_no_db = 1;
1650 return;
1651 }
1652 return;
1653 }
1654
1655 static void register_common_funcs(void)
1656 {
1657 struct token *token;
1658 char *func;
1659 char filename[256];
1660
1661 if (option_project == PROJ_NONE)
1662 strcpy(filename, "common_functions");
1663 else
1664 snprintf(filename, 256, "%s.common_functions", option_project_str);
1665
1666 token = get_tokens_file(filename);
1667 if (!token)
1668 return;
1669 if (token_type(token) != TOKEN_STREAMBEGIN)
1670 return;
1671 token = token->next;
1672 while (token_type(token) != TOKEN_STREAMEND) {
1673 if (token_type(token) != TOKEN_IDENT)
1674 return;
1675 func = alloc_string(show_ident(token->ident));
1676 add_ptr_list(&common_funcs, func);
1677 token = token->next;
1678 }
1679 clear_token_alloc();
1680 }
1681
1682
1683 void register_definition_db_callbacks(int id)
1684 {
1685 add_hook(&match_call_info, FUNCTION_CALL_HOOK);
1686 add_hook(&global_variable, BASE_HOOK);
1687 add_hook(&global_variable, DECLARATION_HOOK);
1688 add_split_return_callback(match_return_info);
1689 add_split_return_callback(print_returned_struct_members);
1690 add_hook(&call_return_state_hooks, RETURN_HOOK);
1691 add_hook(&match_end_func_info, END_FUNC_HOOK);
1692 add_hook(&match_after_func, AFTER_FUNC_HOOK);
1693
1694 add_hook(&match_data_from_db, FUNC_DEF_HOOK);
1695 add_hook(&match_call_implies, CALL_HOOK_AFTER_INLINE);
1696
1697 register_common_funcs();
1698 }
1699
1700 void register_db_call_marker(int id)
1701 {
1702 add_hook(&match_call_marker, FUNCTION_CALL_HOOK);
1703 }
1704
1705 char *return_state_to_var_sym(struct expression *expr, int param, const char *key, struct symbol **sym)
1706 {
1707 struct expression *arg;
1708 char *name = NULL;
1709 char member_name[256];
1710
1711 *sym = NULL;
1712
1713 if (param == -1) {
1714 const char *star = "";
1715
1716 if (expr->type != EXPR_ASSIGNMENT)
1717 return NULL;
1718 name = expr_to_var_sym(expr->left, sym);
1719 if (!name)
1720 return NULL;
1721 if (key[0] == '*') {
1722 star = "*";
1723 key++;
1724 }
1725 if (strncmp(key, "$", 1) != 0)
1726 return name;
1727 snprintf(member_name, sizeof(member_name), "%s%s%s", star, name, key + 1);
1728 free_string(name);
1729 return alloc_string(member_name);
1730 }
1731
1732 while (expr->type == EXPR_ASSIGNMENT)
1733 expr = strip_expr(expr->right);
1734 if (expr->type != EXPR_CALL)
1735 return NULL;
1736
1737 arg = get_argument_from_call_expr(expr->args, param);
1738 if (!arg)
1739 return NULL;
1740
1741 return get_variable_from_key(arg, key, sym);
1742 }
1743
1744 char *get_variable_from_key(struct expression *arg, const char *key, struct symbol **sym)
1745 {
1746 char buf[256];
1747 char *tmp;
1748
1749 if (!arg)
1750 return NULL;
1751
1752 arg = strip_expr(arg);
1753
1754 if (strcmp(key, "$") == 0)
1755 return expr_to_var_sym(arg, sym);
1756
1757 if (strcmp(key, "*$") == 0) {
1758 if (arg->type == EXPR_PREOP && arg->op == '&') {
1759 arg = strip_expr(arg->unop);
1760 return expr_to_var_sym(arg, sym);
1761 } else {
1762 tmp = expr_to_var_sym(arg, sym);
1763 if (!tmp)
1764 return NULL;
1765 snprintf(buf, sizeof(buf), "*%s", tmp);
1766 free_string(tmp);
1767 return alloc_string(buf);
1768 }
1769 }
1770
1771 if (arg->type == EXPR_PREOP && arg->op == '&') {
1772 arg = strip_expr(arg->unop);
1773 tmp = expr_to_var_sym(arg, sym);
1774 if (!tmp)
1775 return NULL;
1776 snprintf(buf, sizeof(buf), "%s.%s", tmp, key + 3);
1777 return alloc_string(buf);
1778 }
1779
1780 tmp = expr_to_var_sym(arg, sym);
1781 if (!tmp)
1782 return NULL;
1783 snprintf(buf, sizeof(buf), "%s%s", tmp, key + 1);
1784 free_string(tmp);
1785 return alloc_string(buf);
1786 }
1787
1788 char *get_chunk_from_key(struct expression *arg, char *key, struct symbol **sym, struct var_sym_list **vsl)
1789 {
1790 *vsl = NULL;
1791
1792 if (strcmp("$", key) == 0)
1793 return expr_to_chunk_sym_vsl(arg, sym, vsl);
1794 return get_variable_from_key(arg, key, sym);
1795 }
1796
1797 const char *get_param_name_var_sym(const char *name, struct symbol *sym)
1798 {
1799 char *param_name;
1800 int name_len;
1801 static char buf[256];
1802
1803 if (!sym || !sym->ident)
1804 return NULL;
1805
1806 param_name = sym->ident->name;
1807 name_len = strlen(param_name);
1808
1809 if (strcmp(name, param_name) == 0) {
1810 return "$";
1811 } else if (name[name_len] == '-' && /* check for '-' from "->" */
1812 strncmp(name, param_name, name_len) == 0) {
1813 snprintf(buf, sizeof(buf), "$%s", name + name_len);
1814 return buf;
1815 } else if (name[0] == '*' && strcmp(name + 1, param_name) == 0) {
1816 return "*$";
1817 }
1818 return NULL;
1819 }
1820
1821 const char *get_param_name(struct sm_state *sm)
1822 {
1823 return get_param_name_var_sym(sm->name, sm->sym);
1824 }
1825
1826 char *get_data_info_name(struct expression *expr)
1827 {
1828 struct symbol *sym;
1829 char *name;
1830 char buf[256];
1831 char *ret = NULL;
1832
1833 expr = strip_expr(expr);
1834 name = get_member_name(expr);
1835 if (name)
1836 return name;
1837 name = expr_to_var_sym(expr, &sym);
1838 if (!name || !sym)
1839 goto free;
1840 if (!(sym->ctype.modifiers & MOD_TOPLEVEL))
1841 goto free;
1842 if (sym->ctype.modifiers & MOD_STATIC)
1843 snprintf(buf, sizeof(buf), "static %s", name);
1844 else
1845 snprintf(buf, sizeof(buf), "global %s", name);
1846 ret = alloc_sname(buf);
1847 free:
1848 free_string(name);
1849 return ret;
1850 }
Static analysis for C