smatch_function_hooks.c

   1 /*
   2  * Copyright (C) 2009 Dan Carpenter.
   3  *
   4  * This program is free software; you can redistribute it and/or
   5  * modify it under the terms of the GNU General Public License
   6  * as published by the Free Software Foundation; either version 2
   7  * of the License, or (at your option) any later version.
   8  *
   9  * This program is distributed in the hope that it will be useful,
  10  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  11  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  12  * GNU General Public License for more details.
  13  *
  14  * You should have received a copy of the GNU General Public License
  15  * along with this program; if not, see http://www.gnu.org/copyleft/gpl.txt
  16  */
  17
  18 /*
  19  * There are several types of function hooks:
  20  * add_function_hook()        - For any time a function is called.
  21  * add_function_assign_hook() - foo = the_function().
  22  * add_implied_return_hook()  - Calculates the implied return value.
  23  * add_macro_assign_hook()    - foo = the_macro().
  24  * return_implies_state()     - For when a return value of 1 implies locked
  25  *                              and 0 implies unlocked. etc. etc.
  26  *
  27  */
  28
  29 #include <stdlib.h>
  30 #include <stdio.h>
  31 #include "smatch.h"
  32 #include "smatch_slist.h"
  33 #include "smatch_extra.h"
  34 #include "smatch_function_hashtable.h"
  35
  36 struct fcall_back {
  37         int type;
  38         struct data_range *range;
  39         union {
  40                 func_hook *call_back;
  41                 implication_hook *ranged;
  42                 implied_return_hook *implied_return;
  43         } u;
  44         void *info;
  45 };
  46
  47 ALLOCATOR(fcall_back, "call backs");
  48 DECLARE_PTR_LIST(call_back_list, struct fcall_back);
  49
  50 DEFINE_FUNCTION_HASHTABLE_STATIC(callback, struct fcall_back, struct call_back_list);
  51 static struct hashtable *func_hash;
  52
  53 int __in_fake_parameter_assign;
  54
  55 #define REGULAR_CALL       0
  56 #define RANGED_CALL        1
  57 #define RANGED_EXACT       2
  58 #define ASSIGN_CALL        3
  59 #define IMPLIED_RETURN     4
  60 #define MACRO_ASSIGN       5
  61 #define MACRO_ASSIGN_EXTRA 6
  62
  63 struct param_key_data {
  64         param_key_hook *call_back;
  65         int param;
  66         const char *key;
  67         void *info;
  68 };
  69
  70 struct return_implies_callback {
  71         int type;
  72         bool param_key;
  73         union {
  74                 return_implies_hook *callback;
  75                 param_key_hook *pk_callback;
  76         };
  77 };
  78 ALLOCATOR(return_implies_callback, "return_implies callbacks");
  79 DECLARE_PTR_LIST(db_implies_list, struct return_implies_callback);
  80 static struct db_implies_list *db_return_states_list;
  81
  82 typedef void (void_fn)(void);
  83 DECLARE_PTR_LIST(void_fn_list, void_fn *);
  84 static struct void_fn_list *return_states_before;
  85 static struct void_fn_list *return_states_after;
  86
  87 static struct fcall_back *alloc_fcall_back(int type, void *call_back,
  88                                            void *info)
  89 {
  90         struct fcall_back *cb;
  91
  92         cb = __alloc_fcall_back(0);
  93         cb->type = type;
  94         cb->u.call_back = call_back;
  95         cb->info = info;
  96         return cb;
  97 }
  98
  99 void add_function_hook(const char *look_for, func_hook *call_back, void *info)
 100 {
 101         struct fcall_back *cb;
 102
 103         cb = alloc_fcall_back(REGULAR_CALL, call_back, info);
 104         add_callback(func_hash, look_for, cb);
 105 }
 106
 107 void add_function_assign_hook(const char *look_for, func_hook *call_back,
 108                               void *info)
 109 {
 110         struct fcall_back *cb;
 111
 112         cb = alloc_fcall_back(ASSIGN_CALL, call_back, info);
 113         add_callback(func_hash, look_for, cb);
 114 }
 115
 116 static void register_funcs_from_file_helper(const char *file,
 117                                             func_hook *call_back, void *info,
 118                                             bool assign)
 119 {
 120         struct token *token;
 121         const char *func;
 122         char name[64];
 123
 124         snprintf(name, sizeof(name), "%s.%s", option_project_str, file);
 125         token = get_tokens_file(name);
 126         if (!token)
 127                 return;
 128         if (token_type(token) != TOKEN_STREAMBEGIN)
 129                 return;
 130         token = token->next;
 131         while (token_type(token) != TOKEN_STREAMEND) {
 132                 if (token_type(token) != TOKEN_IDENT)
 133                         return;
 134                 func = show_ident(token->ident);
 135                 if (assign)
 136                         add_function_assign_hook(func, call_back, info);
 137                 else
 138                         add_function_hook(func, call_back, info);
 139                 token = token->next;
 140         }
 141         clear_token_alloc();
 142 }
 143
 144 void register_func_hooks_from_file(const char *file,
 145                                    func_hook *call_back, void *info)
 146 {
 147         register_funcs_from_file_helper(file, call_back, info, false);
 148 }
 149
 150 void register_assign_hooks_from_file(const char *file,
 151                                      func_hook *call_back, void *info)
 152 {
 153         register_funcs_from_file_helper(file, call_back, info, true);
 154 }
 155
 156 void add_implied_return_hook(const char *look_for,
 157                              implied_return_hook *call_back,
 158                              void *info)
 159 {
 160         struct fcall_back *cb;
 161
 162         cb = alloc_fcall_back(IMPLIED_RETURN, call_back, info);
 163         add_callback(func_hash, look_for, cb);
 164 }
 165
 166 static void db_helper(struct expression *expr, param_key_hook *call_back, int param, const char *key, void *info)
 167 {
 168         char *name;
 169         struct symbol *sym;
 170
 171         if (param == -2) {
 172                 call_back(expr, key, NULL, info);
 173                 return;
 174         }
 175
 176         name = get_name_sym_from_key(expr, param, key, &sym);
 177         if (!name || !sym)
 178                 goto free;
 179
 180         call_back(expr, name, sym, info);
 181 free:
 182         free_string(name);
 183 }
 184
 185 static void param_key_function(const char *fn, struct expression *expr, void *data)
 186 {
 187         struct param_key_data *pkd = data;
 188         struct expression *parent;
 189         int cnt = 0;
 190
 191         parent = expr;
 192         while (true) {
 193                 parent = expr_get_parent_expr(parent);
 194                 if (!parent || ++cnt >= 5)
 195                         break;
 196                 if (parent->type == EXPR_CAST)
 197                         continue;
 198                 if (parent->type == EXPR_PREOP && parent->op == '(')
 199                         continue;
 200                 break;
 201         }
 202
 203         if (parent && parent->type == EXPR_ASSIGNMENT)
 204                 expr = parent;
 205
 206         db_helper(expr, pkd->call_back, pkd->param, pkd->key, pkd->info);
 207 }
 208
 209 static void param_key_implies_function(const char *fn, struct expression *call_expr,
 210                                        struct expression *assign_expr, void *data)
 211 {
 212         struct param_key_data *pkd = data;
 213
 214         db_helper(assign_expr ?: call_expr, pkd->call_back, pkd->param, pkd->key, pkd->info);
 215 }
 216
 217 static struct param_key_data *alloc_pkd(param_key_hook *call_back, int param, const char *key, void *info)
 218 {
 219         struct param_key_data *pkd;
 220
 221         pkd = malloc(sizeof(*pkd));
 222         pkd->call_back = call_back;
 223         pkd->param = param;
 224         pkd->key = alloc_string(key);
 225         pkd->info = info;
 226
 227         return pkd;
 228 }
 229
 230 void add_function_param_key_hook(const char *look_for, param_key_hook *call_back,
 231                                  int param, const char *key, void *info)
 232 {
 233         struct param_key_data *pkd;
 234
 235         pkd = alloc_pkd(call_back, param, key, info);
 236         add_function_hook(look_for, &param_key_function, pkd);
 237 }
 238
 239 void return_implies_param_key(const char *look_for, sval_t start, sval_t end,
 240                               param_key_hook *call_back,
 241                               int param, const char *key, void *info)
 242 {
 243         struct param_key_data *pkd;
 244
 245         pkd = alloc_pkd(call_back, param, key, info);
 246         return_implies_state_sval(look_for, start, end, &param_key_implies_function, pkd);
 247 }
 248
 249 void return_implies_param_key_exact(const char *look_for, sval_t start, sval_t end,
 250                                     param_key_hook *call_back,
 251                                     int param, const char *key, void *info)
 252 {
 253         struct param_key_data *pkd;
 254
 255         pkd = alloc_pkd(call_back, param, key, info);
 256         return_implies_exact(look_for, start, end, &param_key_implies_function, pkd);
 257 }
 258
 259 void add_macro_assign_hook(const char *look_for, func_hook *call_back,
 260                         void *info)
 261 {
 262         struct fcall_back *cb;
 263
 264         cb = alloc_fcall_back(MACRO_ASSIGN, call_back, info);
 265         add_callback(func_hash, look_for, cb);
 266 }
 267
 268 void add_macro_assign_hook_extra(const char *look_for, func_hook *call_back,
 269                         void *info)
 270 {
 271         struct fcall_back *cb;
 272
 273         cb = alloc_fcall_back(MACRO_ASSIGN_EXTRA, call_back, info);
 274         add_callback(func_hash, look_for, cb);
 275 }
 276
 277 void return_implies_state(const char *look_for, long long start, long long end,
 278                          implication_hook *call_back, void *info)
 279 {
 280         struct fcall_back *cb;
 281
 282         cb = alloc_fcall_back(RANGED_CALL, call_back, info);
 283         cb->range = alloc_range_perm(ll_to_sval(start), ll_to_sval(end));
 284         add_callback(func_hash, look_for, cb);
 285 }
 286
 287 void return_implies_state_sval(const char *look_for, sval_t start, sval_t end,
 288                          implication_hook *call_back, void *info)
 289 {
 290         struct fcall_back *cb;
 291
 292         cb = alloc_fcall_back(RANGED_CALL, call_back, info);
 293         cb->range = alloc_range_perm(start, end);
 294         add_callback(func_hash, look_for, cb);
 295 }
 296
 297 void return_implies_exact(const char *look_for, sval_t start, sval_t end,
 298                           implication_hook *call_back, void *info)
 299 {
 300         struct fcall_back *cb;
 301
 302         cb = alloc_fcall_back(RANGED_EXACT, call_back, info);
 303         cb->range = alloc_range_perm(start, end);
 304         add_callback(func_hash, look_for, cb);
 305 }
 306
 307 static struct return_implies_callback *alloc_db_return_callback(int type, bool param_key, void *callback)
 308 {
 309         struct return_implies_callback *cb;
 310
 311         cb = __alloc_return_implies_callback(0);
 312         cb->type = type;
 313         cb->param_key = param_key;
 314         cb->callback = callback;
 315
 316         return cb;
 317 }
 318
 319 void select_return_states_hook(int type, return_implies_hook *callback)
 320 {
 321         struct return_implies_callback *cb;
 322
 323         cb = alloc_db_return_callback(type, false, callback);
 324         add_ptr_list(&db_return_states_list, cb);
 325 }
 326
 327 static void call_db_return_callback(struct return_implies_callback *cb,
 328                                     struct expression *expr, int param, char *key, char *value)
 329 {
 330         if (cb->param_key) {
 331                 // FIXME check if cb->pk_callback was already called
 332                 db_helper(expr, cb->pk_callback, param, key, NULL);
 333         } else {
 334                 cb->callback(expr, param, key, value);
 335         }
 336 }
 337
 338 void select_return_param_key(int type, param_key_hook *callback)
 339 {
 340         struct return_implies_callback *cb;
 341
 342         cb = alloc_db_return_callback(type, true, callback);
 343         add_ptr_list(&db_return_states_list, cb);
 344 }
 345
 346 void select_return_states_before(void_fn *fn)
 347 {
 348         void_fn **p = malloc(sizeof(void_fn *));
 349         *p = fn;
 350         add_ptr_list(&return_states_before, p);
 351 }
 352
 353 void select_return_states_after(void_fn *fn)
 354 {
 355         void_fn **p = malloc(sizeof(void_fn *));
 356         *p = fn;
 357         add_ptr_list(&return_states_after, p);
 358 }
 359
 360 static void call_return_states_before_hooks(void)
 361 {
 362         void_fn **fn;
 363
 364         FOR_EACH_PTR(return_states_before, fn) {
 365                 (*fn)();
 366         } END_FOR_EACH_PTR(fn);
 367 }
 368
 369 static void call_return_states_after_hooks(struct expression *expr)
 370 {
 371         void_fn **fn;
 372
 373         FOR_EACH_PTR(return_states_after, fn) {
 374                 (*fn)();
 375         } END_FOR_EACH_PTR(fn);
 376         __pass_to_client(expr, FUNCTION_CALL_HOOK_AFTER_DB);
 377 }
 378
 379 static int call_call_backs(struct call_back_list *list, int type,
 380                             const char *fn, struct expression *expr)
 381 {
 382         struct fcall_back *tmp;
 383         int handled = 0;
 384
 385         FOR_EACH_PTR(list, tmp) {
 386                 if (tmp->type == type) {
 387                         (tmp->u.call_back)(fn, expr, tmp->info);
 388                         handled = 1;
 389                 }
 390         } END_FOR_EACH_PTR(tmp);
 391
 392         return handled;
 393 }
 394
 395 static void call_ranged_call_backs(struct call_back_list *list,
 396                                 const char *fn, struct expression *call_expr,
 397                                 struct expression *assign_expr)
 398 {
 399         struct fcall_back *tmp;
 400
 401         FOR_EACH_PTR(list, tmp) {
 402                 (tmp->u.ranged)(fn, call_expr, assign_expr, tmp->info);
 403         } END_FOR_EACH_PTR(tmp);
 404 }
 405
 406 static struct call_back_list *get_same_ranged_call_backs(struct call_back_list *list,
 407                                                 struct data_range *drange)
 408 {
 409         struct call_back_list *ret = NULL;
 410         struct fcall_back *tmp;
 411
 412         FOR_EACH_PTR(list, tmp) {
 413                 if (tmp->type != RANGED_CALL &&
 414                     tmp->type != RANGED_EXACT)
 415                         continue;
 416                 if (ranges_equiv(tmp->range, drange))
 417                         add_ptr_list(&ret, tmp);
 418         } END_FOR_EACH_PTR(tmp);
 419         return ret;
 420 }
 421
 422 static int in_list_exact_sval(struct range_list *list, struct data_range *drange)
 423 {
 424         struct data_range *tmp;
 425
 426         FOR_EACH_PTR(list, tmp) {
 427                 if (ranges_equiv(tmp, drange))
 428                         return 1;
 429         } END_FOR_EACH_PTR(tmp);
 430         return 0;
 431 }
 432
 433 static int assign_ranged_funcs(const char *fn, struct expression *expr,
 434                                  struct call_back_list *call_backs)
 435 {
 436         struct fcall_back *tmp;
 437         struct sm_state *sm;
 438         char *var_name;
 439         struct symbol *sym;
 440         struct smatch_state *estate;
 441         struct stree *tmp_stree;
 442         struct stree *final_states = NULL;
 443         struct range_list *handled_ranges = NULL;
 444         struct call_back_list *same_range_call_backs = NULL;
 445         struct range_list *rl;
 446         int handled = 0;
 447
 448         if (!call_backs)
 449                 return 0;
 450
 451         var_name = expr_to_var_sym(expr->left, &sym);
 452         if (!var_name || !sym)
 453                 goto free;
 454
 455         FOR_EACH_PTR(call_backs, tmp) {
 456                 if (tmp->type != RANGED_CALL &&
 457                     tmp->type != RANGED_EXACT)
 458                         continue;
 459
 460                 if (in_list_exact_sval(handled_ranges, tmp->range))
 461                         continue;
 462                 __push_fake_cur_stree();
 463                 tack_on(&handled_ranges, tmp->range);
 464
 465                 same_range_call_backs = get_same_ranged_call_backs(call_backs, tmp->range);
 466                 call_ranged_call_backs(same_range_call_backs, fn, expr->right, expr);
 467                 __free_ptr_list((struct ptr_list **)&same_range_call_backs);
 468
 469                 rl = alloc_rl(tmp->range->min, tmp->range->max);
 470                 rl = cast_rl(get_type(expr->left), rl);
 471                 estate = alloc_estate_rl(rl);
 472                 set_extra_mod(var_name, sym, expr->left, estate);
 473
 474                 tmp_stree = __pop_fake_cur_stree();
 475                 merge_fake_stree(&final_states, tmp_stree);
 476                 free_stree(&tmp_stree);
 477                 handled = 1;
 478         } END_FOR_EACH_PTR(tmp);
 479
 480         FOR_EACH_SM(final_states, sm) {
 481                 __set_sm(sm);
 482         } END_FOR_EACH_SM(sm);
 483
 484         free_stree(&final_states);
 485 free:
 486         free_string(var_name);
 487         return handled;
 488 }
 489
 490 static void call_implies_callbacks(int comparison, struct expression *expr, sval_t sval, int left, struct stree **implied_true, struct stree **implied_false)
 491 {
 492         struct call_back_list *call_backs;
 493         struct fcall_back *tmp;
 494         const char *fn;
 495         struct data_range *value_range;
 496         struct stree *true_states = NULL;
 497         struct stree *false_states = NULL;
 498         struct stree *tmp_stree;
 499
 500         *implied_true = NULL;
 501         *implied_false = NULL;
 502         if (expr->fn->type != EXPR_SYMBOL || !expr->fn->symbol)
 503                 return;
 504         fn = expr->fn->symbol->ident->name;
 505         call_backs = search_callback(func_hash, (char *)expr->fn->symbol->ident->name);
 506         if (!call_backs)
 507                 return;
 508         value_range = alloc_range(sval, sval);
 509
 510         /* set true states */
 511         __push_fake_cur_stree();
 512         FOR_EACH_PTR(call_backs, tmp) {
 513                 if (tmp->type != RANGED_CALL &&
 514                     tmp->type != RANGED_EXACT)
 515                         continue;
 516                 if (!true_comparison_range_LR(comparison, tmp->range, value_range, left))
 517                         continue;
 518                 (tmp->u.ranged)(fn, expr, NULL, tmp->info);
 519         } END_FOR_EACH_PTR(tmp);
 520         tmp_stree = __pop_fake_cur_stree();
 521         merge_fake_stree(&true_states, tmp_stree);
 522         free_stree(&tmp_stree);
 523
 524         /* set false states */
 525         __push_fake_cur_stree();
 526         FOR_EACH_PTR(call_backs, tmp) {
 527                 if (tmp->type != RANGED_CALL &&
 528                     tmp->type != RANGED_EXACT)
 529                         continue;
 530                 if (!false_comparison_range_LR(comparison, tmp->range, value_range, left))
 531                         continue;
 532                 (tmp->u.ranged)(fn, expr, NULL, tmp->info);
 533         } END_FOR_EACH_PTR(tmp);
 534         tmp_stree = __pop_fake_cur_stree();
 535         merge_fake_stree(&false_states, tmp_stree);
 536         free_stree(&tmp_stree);
 537
 538         *implied_true = true_states;
 539         *implied_false = false_states;
 540 }
 541
 542 struct db_callback_info {
 543         int true_side;
 544         int comparison;
 545         struct expression *expr;
 546         struct range_list *rl;
 547         int left;
 548         struct stree *stree;
 549         struct stree *implied;
 550         struct db_implies_list *callbacks;
 551         int prev_return_id;
 552         int cull;
 553         int has_states;
 554         char *ret_str;
 555         struct smatch_state *ret_state;
 556         struct expression *var_expr;
 557         int handled;
 558 };
 559
 560 static void set_implied_states(struct db_callback_info *db_info)
 561 {
 562         struct sm_state *sm;
 563
 564         FOR_EACH_SM(db_info->implied, sm) {
 565                 __set_sm(sm);
 566         } END_FOR_EACH_SM(sm);
 567
 568         free_stree(&db_info->implied);
 569 }
 570
 571 static void store_return_state(struct db_callback_info *db_info, const char *ret_str, struct smatch_state *state)
 572 {
 573         db_info->ret_str = alloc_sname(ret_str),
 574         db_info->ret_state = state;
 575 }
 576
 577 static bool fake_a_param_assignment(struct expression *expr, const char *ret_str, struct smatch_state *orig)
 578 {
 579         struct expression *arg, *left, *right, *tmp, *fake_assign;
 580         char *p;
 581         int param;
 582         char buf[256];
 583         char *str;
 584
 585         if (expr->type != EXPR_ASSIGNMENT || expr->op != '=')
 586                 return false;
 587         left = expr->left;
 588         right = expr->right;
 589
 590         while (right->type == EXPR_ASSIGNMENT)
 591                 right = strip_expr(right->right);
 592         if (!right || right->type != EXPR_CALL)
 593                 return false;
 594
 595         p = strchr(ret_str, '[');
 596         if (!p)
 597                 return false;
 598
 599         p++;
 600         if (p[0] == '=' && p[1] == '=')
 601                 p += 2;
 602         if (p[0] != '$')
 603                 return false;
 604
 605         snprintf(buf, sizeof(buf), "%s", p);
 606
 607         p = buf;
 608         p += 1;
 609         param = strtol(p, &p, 10);
 610
 611         p = strchr(p, ']');
 612         if (!p || *p != ']')
 613                 return false;
 614         *p = '\0';
 615
 616         arg = get_argument_from_call_expr(right->args, param);
 617         if (!arg)
 618                 return false;
 619
 620         /* There should be a get_other_name() function which returns an expr */
 621         tmp = get_assigned_expr(arg);
 622         if (tmp)
 623                 arg = tmp;
 624
 625         /*
 626          * This is a sanity check to prevent side effects from evaluating stuff
 627          * twice.
 628          */
 629         str = expr_to_chunk_sym_vsl(arg, NULL, NULL);
 630         if (!str)
 631                 return false;
 632         free_string(str);
 633
 634         right = gen_expression_from_key(arg, buf);
 635         if (!right)  /* Mostly fails for binops like [$0 + 4032] */
 636                 return false;
 637         fake_assign = assign_expression(left, '=', right);
 638         __in_fake_parameter_assign++;
 639         __split_expr(fake_assign);
 640         __in_fake_parameter_assign--;
 641
 642         /*
 643          * If the return is "0-65531[$0->nla_len - 4]" the faked expression
 644          * is maybe (-4)-65531 but we know it is in the 0-65531 range so both
 645          * parts have to be considered.  We use _nomod() because it's not really
 646          * another modification, it's just a clarification.
 647          *
 648          */
 649         if (estate_rl(orig)) {
 650                 struct smatch_state *faked;
 651                 struct range_list *rl;
 652
 653                 faked = get_extra_state(left);
 654                 if (estate_rl(faked)) {
 655                         rl = rl_intersection(estate_rl(faked), estate_rl(orig));
 656                         if (rl)
 657                                 set_extra_expr_nomod(expr, alloc_estate_rl(rl));
 658                 }
 659         }
 660
 661         return true;
 662 }
 663
 664 static void set_fresh_mtag_returns(struct db_callback_info *db_info)
 665 {
 666         struct expression *expr = db_info->expr->left;
 667         struct smatch_state *state;
 668
 669         if (!db_info->ret_state)
 670                 return;
 671
 672         state = alloc_estate_rl(cast_rl(get_type(expr), clone_rl(estate_rl(db_info->ret_state))));
 673         state = get_mtag_return(db_info->expr, state);
 674         if (!state)
 675                 return;
 676
 677         set_real_absolute(expr, state);
 678         set_extra_expr_mod(expr, state);
 679
 680         db_info->ret_state = NULL;
 681         db_info->ret_str = NULL;
 682 }
 683
 684 static void set_return_assign_state(struct db_callback_info *db_info)
 685 {
 686         struct expression *expr = db_info->expr->left;
 687         struct smatch_state *state;
 688
 689         if (!db_info->ret_state)
 690                 return;
 691
 692         state = alloc_estate_rl(cast_rl(get_type(expr), clone_rl(estate_rl(db_info->ret_state))));
 693         if (!fake_a_param_assignment(db_info->expr, db_info->ret_str, state))
 694                 set_extra_expr_mod(expr, state);
 695
 696         db_info->ret_state = NULL;
 697         db_info->ret_str = NULL;
 698 }
 699
 700 static void set_other_side_state(struct db_callback_info *db_info)
 701 {
 702         struct expression *expr = db_info->var_expr;
 703         struct smatch_state *state;
 704
 705         if (!db_info->ret_state)
 706                 return;
 707
 708         state = alloc_estate_rl(cast_rl(get_type(expr), clone_rl(estate_rl(db_info->ret_state))));
 709         set_extra_expr_nomod(expr, state);
 710         db_info->ret_state = NULL;
 711         db_info->ret_str = NULL;
 712 }
 713
 714 static void handle_ret_equals_param(char *ret_string, struct range_list *rl, struct expression *call)
 715 {
 716         char *str;
 717         long long param;
 718         struct expression *arg;
 719         struct range_list *orig;
 720
 721         str = strstr(ret_string, "==$");
 722         if (!str)
 723                 return;
 724         str += 3;
 725         param = strtoll(str, NULL, 10);
 726         arg = get_argument_from_call_expr(call->args, param);
 727         if (!arg)
 728                 return;
 729         get_absolute_rl(arg, &orig);
 730         rl = rl_intersection(orig, rl);
 731         if (!rl)
 732                 return;
 733         set_extra_expr_nomod(arg, alloc_estate_rl(rl));
 734 }
 735
 736 static int impossible_limit(struct expression *expr, int param, char *key, char *value)
 737 {
 738         struct expression *arg;
 739         struct smatch_state *state;
 740         struct range_list *passed;
 741         struct range_list *limit;
 742         struct symbol *compare_type;
 743
 744         while (expr->type == EXPR_ASSIGNMENT)
 745                 expr = strip_expr(expr->right);
 746         if (expr->type != EXPR_CALL)
 747                 return 0;
 748
 749         arg = get_argument_from_call_expr(expr->args, param);
 750         if (!arg)
 751                 return 0;
 752
 753         if (strcmp(key, "$") == 0) {
 754                 if (!get_implied_rl(arg, &passed))
 755                         return 0;
 756
 757                 compare_type = get_arg_type(expr->fn, param);
 758         } else {
 759                 char *name;
 760                 struct symbol *sym;
 761
 762                 name = get_variable_from_key(arg, key, &sym);
 763                 if (!name || !sym)
 764                         return 0;
 765
 766                 state = get_state(SMATCH_EXTRA, name, sym);
 767                 if (!state) {
 768                         free_string(name);
 769                         return 0;
 770                 }
 771                 passed = estate_rl(state);
 772                 if (!passed || is_whole_rl(passed)) {
 773                         free_string(name);
 774                         return 0;
 775                 }
 776
 777                 compare_type = get_member_type_from_key(arg, key);
 778         }
 779
 780         passed = cast_rl(compare_type, passed);
 781         call_results_to_rl(expr, compare_type, value, &limit);
 782         if (!limit || is_whole_rl(limit))
 783                 return 0;
 784         if (possibly_true_rl(passed, SPECIAL_EQUAL, limit))
 785                 return 0;
 786         if (option_debug || local_debug)
 787                 sm_msg("impossible: %d '%s' limit '%s' == '%s'", param, key, show_rl(passed), value);
 788         return 1;
 789 }
 790
 791 static int is_impossible_data(int type, struct expression *expr, int param, char *key, char *value)
 792 {
 793         if (type == PARAM_LIMIT && impossible_limit(expr, param, key, value))
 794                 return 1;
 795         if (type == COMPARE_LIMIT && param_compare_limit_is_impossible(expr, param, key, value)) {
 796                 if (local_debug)
 797                         sm_msg("param_compare_limit_is_impossible: %d %s %s", param, key, value);
 798                 return 1;
 799         }
 800         return 0;
 801 }
 802
 803 static int func_type_mismatch(struct expression *expr, const char *value)
 804 {
 805         struct symbol *type;
 806
 807         /* This makes faking returns easier */
 808         if (!value || value[0] == '\0')
 809                 return 0;
 810
 811         while (expr->type == EXPR_ASSIGNMENT)
 812                 expr = strip_expr(expr->right);
 813
 814         /*
 815          * Short cut:  We only care about function pointers that are struct
 816          * members.
 817          *
 818          */
 819         if (expr->fn->type == EXPR_SYMBOL)
 820                 return 0;
 821
 822         type = get_type(expr->fn);
 823         if (!type)
 824                 return 0;
 825         if (type->type == SYM_PTR)
 826                 type = get_real_base_type(type);
 827
 828         if (strcmp(type_to_str(type), value) == 0)
 829                 return 0;
 830
 831         return 1;
 832 }
 833
 834 static int db_compare_callback(void *_info, int argc, char **argv, char **azColName)
 835 {
 836         struct db_callback_info *db_info = _info;
 837         struct range_list *var_rl = db_info->rl;
 838         struct range_list *ret_range;
 839         int type, param;
 840         char *ret_str, *key, *value;
 841         struct return_implies_callback *tmp;
 842         struct stree *stree;
 843         int return_id;
 844         int comparison;
 845
 846         if (argc != 6)
 847                 return 0;
 848
 849         return_id = atoi(argv[0]);
 850         ret_str = argv[1];
 851         type = atoi(argv[2]);
 852         param = atoi(argv[3]);
 853         key = argv[4];
 854         value = argv[5];
 855
 856         db_info->has_states = 1;
 857         if (db_info->prev_return_id != -1 && type == INTERNAL) {
 858                 set_other_side_state(db_info);
 859                 set_implied_states(db_info);
 860                 stree = __pop_fake_cur_stree();
 861                 if (!db_info->cull)
 862                         merge_fake_stree(&db_info->stree, stree);
 863                 free_stree(&stree);
 864                 __push_fake_cur_stree();
 865                 db_info->cull = 0;
 866         }
 867         db_info->prev_return_id = return_id;
 868
 869         if (type == INTERNAL && func_type_mismatch(db_info->expr, value))
 870                 db_info->cull = 1;
 871         if (db_info->cull)
 872                 return 0;
 873         if (type == CULL_PATH) {
 874                 db_info->cull = 1;
 875                 return 0;
 876         }
 877
 878         if (is_impossible_data(type, db_info->expr, param, key, value)) {
 879                 db_info->cull = 1;
 880                 return 0;
 881         }
 882
 883         call_results_to_rl(db_info->expr, get_type(strip_expr(db_info->expr)), ret_str, &ret_range);
 884         ret_range = cast_rl(get_type(db_info->expr), ret_range);
 885         if (!ret_range)
 886                 ret_range = alloc_whole_rl(get_type(db_info->expr));
 887
 888         comparison = db_info->comparison;
 889         if (db_info->left)
 890                 comparison = flip_comparison(comparison);
 891
 892         if (db_info->true_side) {
 893                 if (!possibly_true_rl(var_rl, comparison, ret_range))
 894                         return 0;
 895                 if (type == PARAM_LIMIT)
 896                         param_limit_implications(db_info->expr, param, key, value, &db_info->implied);
 897                 else if (type > PARAM_LIMIT)
 898                         set_implied_states(db_info);
 899                 filter_by_comparison(&var_rl, comparison, ret_range);
 900                 filter_by_comparison(&ret_range, flip_comparison(comparison), var_rl);
 901         } else {
 902                 if (!possibly_false_rl(var_rl, comparison, ret_range))
 903                         return 0;
 904                 if (type == PARAM_LIMIT)
 905                         param_limit_implications(db_info->expr, param, key, value, &db_info->implied);
 906                 else if (type > PARAM_LIMIT)
 907                         set_implied_states(db_info);
 908                 filter_by_comparison(&var_rl, negate_comparison(comparison), ret_range);
 909                 filter_by_comparison(&ret_range, flip_comparison(negate_comparison(comparison)), var_rl);
 910         }
 911
 912         handle_ret_equals_param(ret_str, ret_range, db_info->expr);
 913
 914         if (type == INTERNAL) {
 915                 set_state(-1, "unnull_path", NULL, &true_state);
 916                 __add_return_comparison(strip_expr(db_info->expr), ret_str);
 917                 __add_return_to_param_mapping(db_info->expr, ret_str);
 918                 store_return_state(db_info, ret_str, alloc_estate_rl(clone_rl(var_rl)));
 919         }
 920
 921         FOR_EACH_PTR(db_info->callbacks, tmp) {
 922                 if (tmp->type == type)
 923                         call_db_return_callback(tmp, db_info->expr, param, key, value);
 924         } END_FOR_EACH_PTR(tmp);
 925
 926         return 0;
 927 }
 928
 929 static void compare_db_return_states_callbacks(struct expression *left, int comparison, struct expression *right, struct stree *implied_true, struct stree *implied_false)
 930 {
 931         struct stree *orig_states;
 932         struct stree *stree;
 933         struct stree *true_states;
 934         struct stree *false_states;
 935         struct sm_state *sm;
 936         struct db_callback_info db_info = {};
 937         struct expression *var_expr;
 938         struct expression *call_expr;
 939         struct range_list *rl;
 940         int call_on_left;
 941
 942         orig_states = clone_stree(__get_cur_stree());
 943
 944         /* legacy cruft.  need to fix call_implies_callbacks(). */
 945         call_on_left = 1;
 946         call_expr = left;
 947         var_expr = right;
 948         if (left->type != EXPR_CALL) {
 949                 call_on_left = 0;
 950                 call_expr = right;
 951                 var_expr = left;
 952         }
 953
 954         get_absolute_rl(var_expr, &rl);
 955
 956         db_info.comparison = comparison;
 957         db_info.expr = call_expr;
 958         db_info.rl = rl;
 959         db_info.left = call_on_left;
 960         db_info.callbacks = db_return_states_list;
 961         db_info.var_expr = var_expr;
 962
 963         call_return_states_before_hooks();
 964
 965         db_info.true_side = 1;
 966         db_info.stree = NULL;
 967         db_info.prev_return_id = -1;
 968         __push_fake_cur_stree();
 969         sql_select_return_states("return_id, return, type, parameter, key, value",
 970                                  call_expr, db_compare_callback, &db_info);
 971         set_other_side_state(&db_info);
 972         set_implied_states(&db_info);
 973         stree = __pop_fake_cur_stree();
 974         if (!db_info.cull)
 975                 merge_fake_stree(&db_info.stree, stree);
 976         free_stree(&stree);
 977         true_states = db_info.stree;
 978         if (!true_states && db_info.has_states) {
 979                 __push_fake_cur_stree();
 980                 set_path_impossible();
 981                 true_states = __pop_fake_cur_stree();
 982         }
 983
 984         nullify_path();
 985         __unnullify_path();
 986         FOR_EACH_SM(orig_states, sm) {
 987                 __set_sm_cur_stree(sm);
 988         } END_FOR_EACH_SM(sm);
 989
 990         db_info.true_side = 0;
 991         db_info.stree = NULL;
 992         db_info.prev_return_id = -1;
 993         db_info.cull = 0;
 994         __push_fake_cur_stree();
 995         sql_select_return_states("return_id, return, type, parameter, key, value", call_expr,
 996                         db_compare_callback, &db_info);
 997         set_other_side_state(&db_info);
 998         set_implied_states(&db_info);
 999         stree = __pop_fake_cur_stree();
1000         if (!db_info.cull)
1001                 merge_fake_stree(&db_info.stree, stree);
1002         free_stree(&stree);
1003         false_states = db_info.stree;
1004         if (!false_states && db_info.has_states) {
1005                 __push_fake_cur_stree();
1006                 set_path_impossible();
1007                 false_states = __pop_fake_cur_stree();
1008         }
1009
1010         nullify_path();
1011         __unnullify_path();
1012         FOR_EACH_SM(orig_states, sm) {
1013                 __set_sm_cur_stree(sm);
1014         } END_FOR_EACH_SM(sm);
1015
1016         free_stree(&orig_states);
1017
1018         FOR_EACH_SM(true_states, sm) {
1019                 __set_true_false_sm(sm, NULL);
1020         } END_FOR_EACH_SM(sm);
1021         FOR_EACH_SM(false_states, sm) {
1022                 __set_true_false_sm(NULL, sm);
1023         } END_FOR_EACH_SM(sm);
1024
1025         free_stree(&true_states);
1026         free_stree(&false_states);
1027
1028         call_return_states_after_hooks(call_expr);
1029
1030         FOR_EACH_SM(implied_true, sm) {
1031                 __set_true_false_sm(sm, NULL);
1032         } END_FOR_EACH_SM(sm);
1033         FOR_EACH_SM(implied_false, sm) {
1034                 __set_true_false_sm(NULL, sm);
1035         } END_FOR_EACH_SM(sm);
1036 }
1037
1038 void function_comparison(struct expression *left, int comparison, struct expression *right)
1039 {
1040         struct expression *var_expr;
1041         struct expression *call_expr;
1042         struct stree *implied_true = NULL;
1043         struct stree *implied_false = NULL;
1044         struct range_list *rl;
1045         sval_t sval;
1046         int call_on_left;
1047
1048         if (unreachable())
1049                 return;
1050
1051         /* legacy cruft.  need to fix call_implies_callbacks(). */
1052         call_on_left = 1;
1053         call_expr = left;
1054         var_expr = right;
1055         if (left->type != EXPR_CALL) {
1056                 call_on_left = 0;
1057                 call_expr = right;
1058                 var_expr = left;
1059         }
1060
1061         get_absolute_rl(var_expr, &rl);
1062
1063         if (rl_to_sval(rl, &sval))
1064                 call_implies_callbacks(comparison, call_expr, sval, call_on_left, &implied_true, &implied_false);
1065
1066         compare_db_return_states_callbacks(left, comparison, right, implied_true, implied_false);
1067         free_stree(&implied_true);
1068         free_stree(&implied_false);
1069 }
1070
1071 static void call_ranged_return_hooks(struct db_callback_info *db_info)
1072 {
1073         struct call_back_list *call_backs;
1074         struct range_list *range_rl;
1075         struct expression *expr;
1076         struct fcall_back *tmp;
1077         char *fn;
1078
1079         expr = strip_expr(db_info->expr);
1080         while (expr->type == EXPR_ASSIGNMENT)
1081                 expr = strip_expr(expr->right);
1082         if (expr->type != EXPR_CALL ||
1083             expr->fn->type != EXPR_SYMBOL)
1084                 return;
1085
1086         fn = expr->fn->symbol_name->name;
1087
1088         call_backs = search_callback(func_hash, fn);
1089         FOR_EACH_PTR(call_backs, tmp) {
1090                 if (tmp->type != RANGED_CALL)
1091                         continue;
1092                 range_rl = alloc_rl(tmp->range->min, tmp->range->max);
1093                 range_rl = cast_rl(estate_type(db_info->ret_state), range_rl);
1094                 if (possibly_true_rl(range_rl, SPECIAL_EQUAL, estate_rl(db_info->ret_state)))
1095                         (tmp->u.ranged)(fn, expr, db_info->expr, tmp->info);
1096         } END_FOR_EACH_PTR(tmp);
1097
1098         FOR_EACH_PTR(call_backs, tmp) {
1099                 if (tmp->type != RANGED_EXACT)
1100                         continue;
1101                 if (!estate_rl(db_info->ret_state))
1102                         continue;
1103
1104                 range_rl = alloc_rl(tmp->range->min, tmp->range->max);
1105                 range_rl = cast_rl(estate_type(db_info->ret_state), range_rl);
1106
1107                 /*
1108                  * If there is an returned value out of range then this is not
1109                  * an exact match.  In other words, "0,4096-ptr_max" is not
1110                  * necessarily a valid match.
1111                  *
1112                  */
1113                 if (remove_range(estate_rl(db_info->ret_state),
1114                                  rl_min(range_rl), rl_max(range_rl)))
1115                         continue;
1116                 (tmp->u.ranged)(fn, expr, db_info->expr, tmp->info);
1117         } END_FOR_EACH_PTR(tmp);
1118 }
1119
1120 static int db_assign_return_states_callback(void *_info, int argc, char **argv, char **azColName)
1121 {
1122         struct db_callback_info *db_info = _info;
1123         struct range_list *ret_range;
1124         int type, param;
1125         char *ret_str, *key, *value;
1126         struct return_implies_callback *tmp;
1127         struct stree *stree;
1128         int return_id;
1129
1130         if (argc != 6)
1131                 return 0;
1132
1133         return_id = atoi(argv[0]);
1134         ret_str = argv[1];
1135         type = atoi(argv[2]);
1136         param = atoi(argv[3]);
1137         key = argv[4];
1138         value = argv[5];
1139
1140         if (db_info->prev_return_id != -1 && type == INTERNAL) {
1141                 call_ranged_return_hooks(db_info);
1142                 set_return_assign_state(db_info);
1143                 set_implied_states(db_info);
1144                 stree = __pop_fake_cur_stree();
1145                 if (!db_info->cull)
1146                         merge_fake_stree(&db_info->stree, stree);
1147                 free_stree(&stree);
1148                 __push_fake_cur_stree();
1149                 db_info->cull = 0;
1150         }
1151         db_info->prev_return_id = return_id;
1152
1153         if (type == INTERNAL && func_type_mismatch(db_info->expr, value))
1154                 db_info->cull = 1;
1155         if (db_info->cull)
1156                 return 0;
1157         if (type == CULL_PATH) {
1158                 db_info->cull = 1;
1159                 return 0;
1160         }
1161         if (is_impossible_data(type, db_info->expr, param, key, value)) {
1162                 db_info->cull = 1;
1163                 return 0;
1164         }
1165
1166         if (type == PARAM_LIMIT)
1167                 param_limit_implications(db_info->expr, param, key, value, &db_info->implied);
1168         else if (type > PARAM_LIMIT)
1169                 set_implied_states(db_info);
1170
1171         db_info->handled = 1;
1172         call_results_to_rl(db_info->expr->right, get_type(strip_expr(db_info->expr->right)), ret_str, &ret_range);
1173         if (!ret_range)
1174                 ret_range = alloc_whole_rl(get_type(strip_expr(db_info->expr->right)));
1175         ret_range = cast_rl(get_type(db_info->expr->right), ret_range);
1176
1177         if (type == INTERNAL) {
1178                 set_state(-1, "unnull_path", NULL, &true_state);
1179                 __add_return_comparison(strip_expr(db_info->expr->right), ret_str);
1180                 __add_comparison_info(db_info->expr->left, strip_expr(db_info->expr->right), ret_str);
1181                 __add_return_to_param_mapping(db_info->expr, ret_str);
1182                 store_return_state(db_info, ret_str, alloc_estate_rl(ret_range));
1183                 set_fresh_mtag_returns(db_info);
1184         }
1185
1186         FOR_EACH_PTR(db_return_states_list, tmp) {
1187                 if (tmp->type == type)
1188                         call_db_return_callback(tmp, db_info->expr, param, key, value);
1189         } END_FOR_EACH_PTR(tmp);
1190
1191         return 0;
1192 }
1193
1194 static int db_return_states_assign(struct expression *expr)
1195 {
1196         struct expression *right;
1197         struct sm_state *sm;
1198         struct stree *stree;
1199         struct db_callback_info db_info = {};
1200
1201         right = strip_expr(expr->right);
1202
1203         db_info.prev_return_id = -1;
1204         db_info.expr = expr;
1205         db_info.stree = NULL;
1206         db_info.handled = 0;
1207
1208         call_return_states_before_hooks();
1209
1210         __push_fake_cur_stree();
1211         sql_select_return_states("return_id, return, type, parameter, key, value",
1212                         right, db_assign_return_states_callback, &db_info);
1213         if (option_debug) {
1214                 sm_msg("%s return_id %d return_ranges %s",
1215                         db_info.cull ? "culled" : "merging",
1216                         db_info.prev_return_id,
1217                         db_info.ret_state ? db_info.ret_state->name : "'<empty>'");
1218         }
1219         if (db_info.handled)
1220                 call_ranged_return_hooks(&db_info);
1221         set_return_assign_state(&db_info);
1222         set_implied_states(&db_info);
1223         stree = __pop_fake_cur_stree();
1224         if (!db_info.cull)
1225                 merge_fake_stree(&db_info.stree, stree);
1226         free_stree(&stree);
1227
1228         if (!db_info.stree && db_info.cull) { /* this means we culled everything */
1229                 set_extra_expr_mod(expr->left, alloc_estate_whole(get_type(expr->left)));
1230                 set_path_impossible();
1231         }
1232         FOR_EACH_SM(db_info.stree, sm) {
1233                 __set_sm(sm);
1234         } END_FOR_EACH_SM(sm);
1235
1236         free_stree(&db_info.stree);
1237         call_return_states_after_hooks(right);
1238
1239         return db_info.handled;
1240 }
1241
1242 static int handle_implied_return(struct expression *expr)
1243 {
1244         struct range_list *rl;
1245
1246         if (!get_implied_return(expr->right, &rl))
1247                 return 0;
1248         rl = cast_rl(get_type(expr->left), rl);
1249         set_extra_expr_mod(expr->left, alloc_estate_rl(rl));
1250         return 1;
1251 }
1252
1253 static void match_assign_call(struct expression *expr)
1254 {
1255         struct call_back_list *call_backs;
1256         const char *fn;
1257         struct expression *right;
1258         int handled = 0;
1259         struct range_list *rl;
1260
1261         if (expr->op != '=')
1262                 return;
1263
1264         right = strip_expr(expr->right);
1265         if (right->fn->type != EXPR_SYMBOL || !right->fn->symbol) {
1266                 handled |= db_return_states_assign(expr);
1267                 if (!handled)
1268                         goto assigned_unknown;
1269                 return;
1270         }
1271         if (is_fake_call(right))
1272                 return;
1273
1274         fn = right->fn->symbol->ident->name;
1275         call_backs = search_callback(func_hash, (char *)fn);
1276
1277         /*
1278          * The ordering here is sort of important.
1279          * One example, of how this matters is that when we do:
1280          *
1281          *      len = strlen(str);
1282          *
1283          * That is handled by smatch_common_functions.c and smatch_strlen.c.
1284          * They use implied_return and function_assign_hook respectively.
1285          * We want to get the implied return first before we do the function
1286          * assignment hook otherwise we end up writing the wrong thing for len
1287          * in smatch_extra.c because we assume that it already holds the
1288          * strlen() when we haven't set it yet.
1289          */
1290
1291         if (db_return_states_assign(expr) == 1)
1292                 handled = 1;
1293         else
1294                 handled = assign_ranged_funcs(fn, expr, call_backs);
1295         handled |= handle_implied_return(expr);
1296
1297
1298         call_call_backs(call_backs, ASSIGN_CALL, fn, expr);
1299
1300         if (handled)
1301                 return;
1302
1303 assigned_unknown:
1304         get_absolute_rl(expr->right, &rl);
1305         rl = cast_rl(get_type(expr->left), rl);
1306         set_extra_expr_mod(expr->left, alloc_estate_rl(rl));
1307 }
1308
1309 static int db_return_states_callback(void *_info, int argc, char **argv, char **azColName)
1310 {
1311         struct db_callback_info *db_info = _info;
1312         struct range_list *ret_range;
1313         int type, param;
1314         char *ret_str, *key, *value;
1315         struct return_implies_callback *tmp;
1316         struct stree *stree;
1317         int return_id;
1318         char buf[64];
1319
1320         if (argc != 6)
1321                 return 0;
1322
1323         return_id = atoi(argv[0]);
1324         ret_str = argv[1];
1325         type = atoi(argv[2]);
1326         param = atoi(argv[3]);
1327         key = argv[4];
1328         value = argv[5];
1329
1330         if (db_info->prev_return_id != -1 && type == INTERNAL) {
1331                 call_ranged_return_hooks(db_info);
1332                 set_implied_states(db_info);
1333                 stree = __pop_fake_cur_stree();
1334                 if (!db_info->cull)
1335                         merge_fake_stree(&db_info->stree, stree);
1336                 free_stree(&stree);
1337                 __push_fake_cur_stree();
1338                 __unnullify_path();
1339                 db_info->cull = 0;
1340         }
1341         db_info->prev_return_id = return_id;
1342
1343         if (type == INTERNAL && func_type_mismatch(db_info->expr, value))
1344                 db_info->cull = 1;
1345         if (db_info->cull)
1346                 return 0;
1347         if (type == CULL_PATH) {
1348                 db_info->cull = 1;
1349                 return 0;
1350         }
1351         if (is_impossible_data(type, db_info->expr, param, key, value)) {
1352                 db_info->cull = 1;
1353                 return 0;
1354         }
1355
1356         if (type == PARAM_LIMIT)
1357                 param_limit_implications(db_info->expr, param, key, value, &db_info->implied);
1358         else if (type > PARAM_LIMIT)
1359                 set_implied_states(db_info);
1360
1361         call_results_to_rl(db_info->expr, get_type(strip_expr(db_info->expr)), ret_str, &ret_range);
1362         ret_range = cast_rl(get_type(db_info->expr), ret_range);
1363
1364         if (type == INTERNAL) {
1365                 struct smatch_state *state;
1366
1367                 set_state(-1, "unnull_path", NULL, &true_state);
1368                 __add_return_comparison(strip_expr(db_info->expr), ret_str);
1369                 __add_return_to_param_mapping(db_info->expr, ret_str);
1370                 /*
1371                  * We want to store the return values so that we can split the strees
1372                  * in smatch_db.c.  This uses set_state() directly because it's not a
1373                  * real smatch_extra state.
1374                  */
1375                 snprintf(buf, sizeof(buf), "return %p", db_info->expr);
1376                 state = alloc_estate_rl(ret_range);
1377                 set_state(SMATCH_EXTRA, buf, NULL, state);
1378                 store_return_state(db_info, ret_str, state);
1379         }
1380
1381         FOR_EACH_PTR(db_return_states_list, tmp) {
1382                 if (tmp->type == type)
1383                         call_db_return_callback(tmp, db_info->expr, param, key, value);
1384         } END_FOR_EACH_PTR(tmp);
1385
1386
1387         return 0;
1388 }
1389
1390 static void db_return_states(struct expression *expr)
1391 {
1392         struct sm_state *sm;
1393         struct stree *stree;
1394         struct db_callback_info db_info = {};
1395
1396         if (!__get_cur_stree())  /* no return functions */
1397                 return;
1398
1399         db_info.prev_return_id = -1;
1400         db_info.expr = expr;
1401         db_info.stree = NULL;
1402
1403         call_return_states_before_hooks();
1404
1405         __push_fake_cur_stree();
1406         __unnullify_path();
1407         sql_select_return_states("return_id, return, type, parameter, key, value",
1408                         expr, db_return_states_callback, &db_info);
1409         call_ranged_return_hooks(&db_info);
1410         set_implied_states(&db_info);
1411         stree = __pop_fake_cur_stree();
1412         if (!db_info.cull)
1413                 merge_fake_stree(&db_info.stree, stree);
1414         free_stree(&stree);
1415
1416         FOR_EACH_SM(db_info.stree, sm) {
1417                 __set_sm(sm);
1418         } END_FOR_EACH_SM(sm);
1419
1420         free_stree(&db_info.stree);
1421         call_return_states_after_hooks(expr);
1422 }
1423
1424 static int is_condition_call(struct expression *expr)
1425 {
1426         struct expression *tmp;
1427
1428         FOR_EACH_PTR_REVERSE(big_condition_stack, tmp) {
1429                 if (expr == tmp || expr_get_parent_expr(expr) == tmp)
1430                         return 1;
1431                 if (tmp->pos.line < expr->pos.line)
1432                         return 0;
1433         } END_FOR_EACH_PTR_REVERSE(tmp);
1434
1435         return 0;
1436 }
1437
1438 static void db_return_states_call(struct expression *expr)
1439 {
1440         if (unreachable())
1441                 return;
1442
1443         if (is_assigned_call(expr) || is_fake_assigned_call(expr))
1444                 return;
1445         if (is_condition_call(expr))
1446                 return;
1447         db_return_states(expr);
1448 }
1449
1450 static void match_function_call(struct expression *expr)
1451 {
1452         struct call_back_list *call_backs;
1453         struct expression *fn;
1454
1455         fn = strip_expr(expr->fn);
1456         if (fn->type == EXPR_SYMBOL && fn->symbol) {
1457                 call_backs = search_callback(func_hash, (char *)fn->symbol->ident->name);
1458                 if (call_backs)
1459                         call_call_backs(call_backs, REGULAR_CALL,
1460                                         fn->symbol->ident->name, expr);
1461         }
1462         db_return_states_call(expr);
1463 }
1464
1465 static void match_macro_assign(struct expression *expr)
1466 {
1467         struct call_back_list *call_backs;
1468         const char *macro;
1469         struct expression *right;
1470
1471         right = strip_expr(expr->right);
1472         macro = get_macro_name(right->pos);
1473         call_backs = search_callback(func_hash, (char *)macro);
1474         if (!call_backs)
1475                 return;
1476         call_call_backs(call_backs, MACRO_ASSIGN, macro, expr);
1477         call_call_backs(call_backs, MACRO_ASSIGN_EXTRA, macro, expr);
1478 }
1479
1480 int get_implied_return(struct expression *expr, struct range_list **rl)
1481 {
1482         struct call_back_list *call_backs;
1483         struct fcall_back *tmp;
1484         int handled = 0;
1485         char *fn;
1486
1487         *rl = NULL;
1488
1489         expr = strip_expr(expr);
1490         fn = expr_to_var(expr->fn);
1491         if (!fn)
1492                 goto out;
1493
1494         call_backs = search_callback(func_hash, fn);
1495
1496         FOR_EACH_PTR(call_backs, tmp) {
1497                 if (tmp->type == IMPLIED_RETURN)
1498                         handled |= (tmp->u.implied_return)(expr, tmp->info, rl);
1499         } END_FOR_EACH_PTR(tmp);
1500
1501 out:
1502         free_string(fn);
1503         return handled;
1504 }
1505
1506 struct range_list *get_range_implications(const char *fn)
1507 {
1508         struct call_back_list *call_backs;
1509         struct range_list *ret = NULL;
1510         struct fcall_back *tmp;
1511
1512         call_backs = search_callback(func_hash, (char *)fn);
1513
1514         FOR_EACH_PTR(call_backs, tmp) {
1515                 if (tmp->type != RANGED_CALL &&
1516                     tmp->type != RANGED_EXACT)
1517                         continue;
1518                 add_ptr_list(&ret, tmp->range);
1519         } END_FOR_EACH_PTR(tmp);
1520
1521         return ret;
1522 }
1523
1524 void create_function_hook_hash(void)
1525 {
1526         func_hash = create_function_hashtable(5000);
1527 }
1528
1529 void register_function_hooks(int id)
1530 {
1531         add_hook(&match_function_call, CALL_HOOK_AFTER_INLINE);
1532         add_hook(&match_assign_call, CALL_ASSIGNMENT_HOOK);
1533         add_hook(&match_macro_assign, MACRO_ASSIGNMENT_HOOK);
1534 }