smatch_passes_array_size.c

   1 /*
   2  * Copyright (C) 2017 Oracle.
   3  *
   4  * This program is free software; you can redistribute it and/or
   5  * modify it under the terms of the GNU General Public License
   6  * as published by the Free Software Foundation; either version 2
   7  * of the License, or (at your option) any later version.
   8  *
   9  * This program is distributed in the hope that it will be useful,
  10  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  11  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  12  * GNU General Public License for more details.
  13  *
  14  * You should have received a copy of the GNU General Public License
  15  * along with this program; if not, see http://www.gnu.org/copyleft/gpl.txt
  16  */
  17
  18 #include "smatch.h"
  19 #include "smatch_extra.h"
  20
  21 static int find_param_eq(struct expression *expr, int size)
  22 {
  23         struct expression *arg;
  24         sval_t val;
  25         int i;
  26
  27         i = -1;
  28         FOR_EACH_PTR(expr->args, arg) {
  29                 i++;
  30                 if (!get_implied_value(arg, &val))
  31                         continue;
  32                 if (val.value == size)
  33                         return i;
  34         } END_FOR_EACH_PTR(arg);
  35
  36         return -1;
  37 }
  38
  39 static int find_skb_len(struct expression *call, struct expression *arg)
  40 {
  41         struct expression *tmp;
  42         char buf[64];
  43         char *data_name, *len_name;
  44         int ret = -1;
  45         int len, i;
  46
  47         data_name = expr_to_str(arg);
  48         if (!data_name)
  49                 return -1;
  50         len = snprintf(buf, sizeof(buf), "%s", data_name);
  51         if (len < 4 || len >= sizeof(buf))
  52                 goto free;
  53         sprintf(buf + len - 4, "len");
  54
  55         i = -1;
  56         FOR_EACH_PTR(call->args, tmp) {
  57                 bool match = false;
  58
  59                 i++;
  60                 if (tmp == arg)
  61                         continue;
  62                 len_name = expr_to_var(tmp);
  63                 if (!len_name)
  64                         continue;
  65                 if (strcmp(buf, len_name) == 0)
  66                         match = true;
  67                 free_string(len_name);
  68                 if (match) {
  69                         ret = i;
  70                         goto free;
  71                 }
  72         } END_FOR_EACH_PTR(tmp);
  73
  74 free:
  75         free_string(data_name);
  76         return ret;
  77 }
  78
  79 static void match_call(struct expression *expr)
  80 {
  81         struct expression *arg;
  82         struct symbol *type, *arg_type;
  83         int size, bytes;
  84         int i, nr;
  85         char buf[16];
  86         char elem_count[8];
  87         char byte_count[8];
  88
  89         snprintf(elem_count, sizeof(elem_count), "%d", ELEM_COUNT);
  90         snprintf(byte_count, sizeof(byte_count), "%d", BYTE_COUNT);
  91
  92         i = -1;
  93         FOR_EACH_PTR(expr->args, arg) {
  94                 i++;
  95                 type = get_type(arg);
  96                 if (!type || (type->type != SYM_PTR && type->type != SYM_ARRAY))
  97                         continue;
  98
  99                 if (is_skb_data(arg)) {
 100                         nr = find_skb_len(expr, arg);
 101                         if (nr >= 0) {
 102                                 snprintf(buf, sizeof(buf), "==$%d", nr);
 103                                 sql_insert_caller_info(expr, BYTE_COUNT, i, buf, byte_count);
 104                                 continue;
 105                         }
 106                 }
 107                 bytes = get_array_size_bytes(arg);
 108                 if (bytes > 0) {
 109                         nr = find_param_eq(expr, bytes);
 110                         if (nr >= 0) {
 111                                 snprintf(buf, sizeof(buf), "==$%d", nr);
 112                                 sql_insert_caller_info(expr, BYTE_COUNT, i, buf, byte_count);
 113                                 continue;
 114                         }
 115                 }
 116                 arg_type = get_arg_type(expr->fn, i);
 117                 if (arg_type != type)
 118                         continue;
 119
 120                 size = get_array_size(arg);
 121                 if (size > 0) {
 122                         nr = find_param_eq(expr, size);
 123                         if (nr >= 0) {
 124                                 snprintf(buf, sizeof(buf), "==$%d", nr);
 125                                 sql_insert_caller_info(expr, ELEM_COUNT, i, buf, elem_count);
 126                                 continue;
 127                         }
 128                 }
 129         } END_FOR_EACH_PTR(arg);
 130 }
 131
 132 void register_passes_array_size(int id)
 133 {
 134         add_hook(&match_call, FUNCTION_CALL_HOOK);
 135 }
 136