smatch_function_hooks.c

   1 /*
   2  * Copyright (C) 2009 Dan Carpenter.
   3  *
   4  * This program is free software; you can redistribute it and/or
   5  * modify it under the terms of the GNU General Public License
   6  * as published by the Free Software Foundation; either version 2
   7  * of the License, or (at your option) any later version.
   8  *
   9  * This program is distributed in the hope that it will be useful,
  10  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  11  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  12  * GNU General Public License for more details.
  13  *
  14  * You should have received a copy of the GNU General Public License
  15  * along with this program; if not, see http://www.gnu.org/copyleft/gpl.txt
  16  */
  17
  18 /*
  19  * There are several types of function hooks:
  20  * add_function_hook()        - For any time a function is called.
  21  * add_function_assign_hook() - foo = the_function().
  22  * add_implied_return_hook()  - Calculates the implied return value.
  23  * add_macro_assign_hook()    - foo = the_macro().
  24  * return_implies_state()     - For when a return value of 1 implies locked
  25  *                              and 0 implies unlocked. etc. etc.
  26  *
  27  */
  28
  29 #include <stdlib.h>
  30 #include <stdio.h>
  31 #include "smatch.h"
  32 #include "smatch_slist.h"
  33 #include "smatch_extra.h"
  34 #include "smatch_function_hashtable.h"
  35
  36 struct fcall_back {
  37         int type;
  38         struct data_range *range;
  39         union {
  40                 func_hook *call_back;
  41                 implication_hook *ranged;
  42                 implied_return_hook *implied_return;
  43         } u;
  44         void *info;
  45 };
  46
  47 ALLOCATOR(fcall_back, "call backs");
  48 DECLARE_PTR_LIST(call_back_list, struct fcall_back);
  49
  50 DEFINE_FUNCTION_HASHTABLE_STATIC(callback, struct fcall_back, struct call_back_list);
  51 static struct hashtable *func_hash;
  52
  53 #define REGULAR_CALL       0
  54 #define RANGED_CALL        1
  55 #define ASSIGN_CALL        2
  56 #define IMPLIED_RETURN     3
  57 #define MACRO_ASSIGN       4
  58 #define MACRO_ASSIGN_EXTRA 5
  59
  60 struct return_implies_callback {
  61         int type;
  62         return_implies_hook *callback;
  63 };
  64 ALLOCATOR(return_implies_callback, "return_implies callbacks");
  65 DECLARE_PTR_LIST(db_implies_list, struct return_implies_callback);
  66 static struct db_implies_list *db_return_states_list;
  67
  68 typedef void (void_fn)(void);
  69 DECLARE_PTR_LIST(void_fn_list, void_fn *);
  70 static struct void_fn_list *return_states_before;
  71 static struct void_fn_list *return_states_after;
  72
  73 static struct fcall_back *alloc_fcall_back(int type, void *call_back,
  74                                            void *info)
  75 {
  76         struct fcall_back *cb;
  77
  78         cb = __alloc_fcall_back(0);
  79         cb->type = type;
  80         cb->u.call_back = call_back;
  81         cb->info = info;
  82         return cb;
  83 }
  84
  85 void add_function_hook(const char *look_for, func_hook *call_back, void *info)
  86 {
  87         struct fcall_back *cb;
  88
  89         cb = alloc_fcall_back(REGULAR_CALL, call_back, info);
  90         add_callback(func_hash, look_for, cb);
  91 }
  92
  93 void add_function_assign_hook(const char *look_for, func_hook *call_back,
  94                               void *info)
  95 {
  96         struct fcall_back *cb;
  97
  98         cb = alloc_fcall_back(ASSIGN_CALL, call_back, info);
  99         add_callback(func_hash, look_for, cb);
 100 }
 101
 102 void add_implied_return_hook(const char *look_for,
 103                              implied_return_hook *call_back,
 104                              void *info)
 105 {
 106         struct fcall_back *cb;
 107
 108         cb = alloc_fcall_back(IMPLIED_RETURN, call_back, info);
 109         add_callback(func_hash, look_for, cb);
 110 }
 111
 112 void add_macro_assign_hook(const char *look_for, func_hook *call_back,
 113                         void *info)
 114 {
 115         struct fcall_back *cb;
 116
 117         cb = alloc_fcall_back(MACRO_ASSIGN, call_back, info);
 118         add_callback(func_hash, look_for, cb);
 119 }
 120
 121 void add_macro_assign_hook_extra(const char *look_for, func_hook *call_back,
 122                         void *info)
 123 {
 124         struct fcall_back *cb;
 125
 126         cb = alloc_fcall_back(MACRO_ASSIGN_EXTRA, call_back, info);
 127         add_callback(func_hash, look_for, cb);
 128 }
 129
 130 void return_implies_state(const char *look_for, long long start, long long end,
 131                          implication_hook *call_back, void *info)
 132 {
 133         struct fcall_back *cb;
 134
 135         cb = alloc_fcall_back(RANGED_CALL, call_back, info);
 136         cb->range = alloc_range_perm(ll_to_sval(start), ll_to_sval(end));
 137         add_callback(func_hash, look_for, cb);
 138 }
 139
 140 void select_return_states_hook(int type, return_implies_hook *callback)
 141 {
 142         struct return_implies_callback *cb = __alloc_return_implies_callback(0);
 143
 144         cb->type = type;
 145         cb->callback = callback;
 146         add_ptr_list(&db_return_states_list, cb);
 147 }
 148
 149 void select_return_states_before(void_fn *fn)
 150 {
 151         void_fn **p = malloc(sizeof(void_fn *));
 152         *p = fn;
 153         add_ptr_list(&return_states_before, p);
 154 }
 155
 156 void select_return_states_after(void_fn *fn)
 157 {
 158         void_fn **p = malloc(sizeof(void_fn *));
 159         *p = fn;
 160         add_ptr_list(&return_states_after, p);
 161 }
 162
 163 static void call_return_states_before_hooks(void)
 164 {
 165         void_fn **fn;
 166
 167         FOR_EACH_PTR(return_states_before, fn) {
 168                 (*fn)();
 169         } END_FOR_EACH_PTR(fn);
 170 }
 171
 172 static void call_return_states_after_hooks(struct expression *expr)
 173 {
 174         void_fn **fn;
 175
 176         FOR_EACH_PTR(return_states_after, fn) {
 177                 (*fn)();
 178         } END_FOR_EACH_PTR(fn);
 179         __pass_to_client(expr, FUNCTION_CALL_HOOK_AFTER_DB);
 180 }
 181
 182 static int call_call_backs(struct call_back_list *list, int type,
 183                             const char *fn, struct expression *expr)
 184 {
 185         struct fcall_back *tmp;
 186         int handled = 0;
 187
 188         FOR_EACH_PTR(list, tmp) {
 189                 if (tmp->type == type) {
 190                         (tmp->u.call_back)(fn, expr, tmp->info);
 191                         handled = 1;
 192                 }
 193         } END_FOR_EACH_PTR(tmp);
 194
 195         return handled;
 196 }
 197
 198 static void call_ranged_call_backs(struct call_back_list *list,
 199                                 const char *fn, struct expression *call_expr,
 200                                 struct expression *assign_expr)
 201 {
 202         struct fcall_back *tmp;
 203
 204         FOR_EACH_PTR(list, tmp) {
 205                 (tmp->u.ranged)(fn, call_expr, assign_expr, tmp->info);
 206         } END_FOR_EACH_PTR(tmp);
 207 }
 208
 209 static struct call_back_list *get_same_ranged_call_backs(struct call_back_list *list,
 210                                                 struct data_range *drange)
 211 {
 212         struct call_back_list *ret = NULL;
 213         struct fcall_back *tmp;
 214
 215         FOR_EACH_PTR(list, tmp) {
 216                 if (tmp->type != RANGED_CALL)
 217                         continue;
 218                 if (ranges_equiv(tmp->range, drange))
 219                         add_ptr_list(&ret, tmp);
 220         } END_FOR_EACH_PTR(tmp);
 221         return ret;
 222 }
 223
 224 static int in_list_exact_sval(struct range_list *list, struct data_range *drange)
 225 {
 226         struct data_range *tmp;
 227
 228         FOR_EACH_PTR(list, tmp) {
 229                 if (ranges_equiv(tmp, drange))
 230                         return 1;
 231         } END_FOR_EACH_PTR(tmp);
 232         return 0;
 233 }
 234
 235 static int assign_ranged_funcs(const char *fn, struct expression *expr,
 236                                  struct call_back_list *call_backs)
 237 {
 238         struct fcall_back *tmp;
 239         struct sm_state *sm;
 240         char *var_name;
 241         struct symbol *sym;
 242         struct smatch_state *estate;
 243         struct stree *tmp_stree;
 244         struct stree *final_states = NULL;
 245         struct range_list *handled_ranges = NULL;
 246         struct call_back_list *same_range_call_backs = NULL;
 247         int handled = 0;
 248
 249         if (!call_backs)
 250                 return 0;
 251
 252         var_name = expr_to_var_sym(expr->left, &sym);
 253         if (!var_name || !sym)
 254                 goto free;
 255
 256         FOR_EACH_PTR(call_backs, tmp) {
 257                 if (tmp->type != RANGED_CALL)
 258                         continue;
 259
 260                 if (in_list_exact_sval(handled_ranges, tmp->range))
 261                         continue;
 262                 __push_fake_cur_stree();
 263                 tack_on(&handled_ranges, tmp->range);
 264
 265                 same_range_call_backs = get_same_ranged_call_backs(call_backs, tmp->range);
 266                 call_ranged_call_backs(same_range_call_backs, fn, expr->right, expr);
 267                 __free_ptr_list((struct ptr_list **)&same_range_call_backs);
 268
 269                 estate = alloc_estate_range(tmp->range->min, tmp->range->max);
 270                 set_extra_mod(var_name, sym, expr->left, estate);
 271
 272                 tmp_stree = __pop_fake_cur_stree();
 273                 merge_fake_stree(&final_states, tmp_stree);
 274                 free_stree(&tmp_stree);
 275                 handled = 1;
 276         } END_FOR_EACH_PTR(tmp);
 277
 278         FOR_EACH_SM(final_states, sm) {
 279                 __set_sm(sm);
 280         } END_FOR_EACH_SM(sm);
 281
 282         free_stree(&final_states);
 283 free:
 284         free_string(var_name);
 285         return handled;
 286 }
 287
 288 static void call_implies_callbacks(int comparison, struct expression *expr, sval_t sval, int left, struct stree **implied_true, struct stree **implied_false)
 289 {
 290         struct call_back_list *call_backs;
 291         struct fcall_back *tmp;
 292         const char *fn;
 293         struct data_range *value_range;
 294         struct stree *true_states = NULL;
 295         struct stree *false_states = NULL;
 296         struct stree *tmp_stree;
 297
 298         *implied_true = NULL;
 299         *implied_false = NULL;
 300         if (expr->fn->type != EXPR_SYMBOL || !expr->fn->symbol)
 301                 return;
 302         fn = expr->fn->symbol->ident->name;
 303         call_backs = search_callback(func_hash, (char *)expr->fn->symbol->ident->name);
 304         if (!call_backs)
 305                 return;
 306         value_range = alloc_range(sval, sval);
 307
 308         /* set true states */
 309         __push_fake_cur_stree();
 310         FOR_EACH_PTR(call_backs, tmp) {
 311                 if (tmp->type != RANGED_CALL)
 312                         continue;
 313                 if (!true_comparison_range_LR(comparison, tmp->range, value_range, left))
 314                         continue;
 315                 (tmp->u.ranged)(fn, expr, NULL, tmp->info);
 316         } END_FOR_EACH_PTR(tmp);
 317         tmp_stree = __pop_fake_cur_stree();
 318         merge_fake_stree(&true_states, tmp_stree);
 319         free_stree(&tmp_stree);
 320
 321         /* set false states */
 322         __push_fake_cur_stree();
 323         FOR_EACH_PTR(call_backs, tmp) {
 324                 if (tmp->type != RANGED_CALL)
 325                         continue;
 326                 if (!false_comparison_range_LR(comparison, tmp->range, value_range, left))
 327                         continue;
 328                 (tmp->u.ranged)(fn, expr, NULL, tmp->info);
 329         } END_FOR_EACH_PTR(tmp);
 330         tmp_stree = __pop_fake_cur_stree();
 331         merge_fake_stree(&false_states, tmp_stree);
 332         free_stree(&tmp_stree);
 333
 334         *implied_true = true_states;
 335         *implied_false = false_states;
 336 }
 337
 338 struct db_callback_info {
 339         int true_side;
 340         int comparison;
 341         struct expression *expr;
 342         struct range_list *rl;
 343         int left;
 344         struct stree *stree;
 345         struct db_implies_list *callbacks;
 346         int prev_return_id;
 347         int cull;
 348         int has_states;
 349         struct smatch_state *ret_state;
 350         struct expression *var_expr;
 351         int handled;
 352 };
 353
 354 static void store_return_state(struct db_callback_info *db_info, struct smatch_state *state)
 355 {
 356         db_info->ret_state = state;
 357 }
 358
 359 static void set_return_state(struct expression *expr, struct db_callback_info *db_info)
 360 {
 361         struct smatch_state *state;
 362
 363         if (!db_info->ret_state)
 364                 return;
 365
 366         state = alloc_estate_rl(cast_rl(get_type(expr), clone_rl(estate_rl(db_info->ret_state))));
 367         set_extra_expr_mod(expr, state);
 368         db_info->ret_state = NULL;
 369 }
 370
 371 static void handle_ret_equals_param(char *ret_string, struct range_list *rl, struct expression *call)
 372 {
 373         char *str;
 374         long long param;
 375         struct expression *arg;
 376         struct range_list *orig;
 377
 378         str = strstr(ret_string, "==$");
 379         if (!str)
 380                 return;
 381         str += 3;
 382         param = strtoll(str, NULL, 10);
 383         arg = get_argument_from_call_expr(call->args, param);
 384         if (!arg)
 385                 return;
 386         get_absolute_rl(arg, &orig);
 387         rl = rl_intersection(orig, rl);
 388         if (!rl)
 389                 return;
 390         set_extra_expr_nomod(arg, alloc_estate_rl(rl));
 391 }
 392
 393 static int impossible_limit(struct expression *expr, int param, char *key, char *value)
 394 {
 395         struct expression *arg;
 396         struct smatch_state *state;
 397         struct range_list *passed;
 398         struct range_list *limit;
 399         struct symbol *compare_type;
 400
 401         while (expr->type == EXPR_ASSIGNMENT)
 402                 expr = strip_expr(expr->right);
 403         if (expr->type != EXPR_CALL)
 404                 return 0;
 405
 406         arg = get_argument_from_call_expr(expr->args, param);
 407         if (!arg)
 408                 return 0;
 409
 410         if (strcmp(key, "$") == 0) {
 411                 if (!get_implied_rl(arg, &passed))
 412                         return 0;
 413
 414                 compare_type = get_arg_type(expr->fn, param);
 415         } else {
 416                 char *name;
 417                 struct symbol *sym;
 418
 419                 name = get_variable_from_key(arg, key, &sym);
 420                 if (!name || !sym)
 421                         return 0;
 422
 423                 state = get_state(SMATCH_EXTRA, name, sym);
 424                 if (!state) {
 425                         free_string(name);
 426                         return 0;
 427                 }
 428                 passed = estate_rl(state);
 429                 if (!passed || is_whole_rl(passed)) {
 430                         free_string(name);
 431                         return 0;
 432                 }
 433
 434                 compare_type = get_member_type_from_key(arg, key);
 435         }
 436
 437         passed = cast_rl(compare_type, passed);
 438         call_results_to_rl(expr, compare_type, value, &limit);
 439         if (!limit || is_whole_rl(limit))
 440                 return 0;
 441         if (possibly_true_rl(passed, SPECIAL_EQUAL, limit))
 442                 return 0;
 443         if (option_debug || local_debug)
 444                 sm_msg("impossible: %d '%s' limit '%s' == '%s'", param, key, show_rl(passed), value);
 445         return 1;
 446 }
 447
 448 static int is_impossible_data(int type, struct expression *expr, int param, char *key, char *value)
 449 {
 450         if (type == PARAM_LIMIT && impossible_limit(expr, param, key, value))
 451                 return 1;
 452         if (type == COMPARE_LIMIT && param_compare_limit_is_impossible(expr, param, key, value)) {
 453                 if (local_debug)
 454                         sm_msg("param_compare_limit_is_impossible: %d %s %s", param, key, value);
 455                 return 1;
 456         }
 457         return 0;
 458 }
 459
 460 static int func_type_mismatch(struct expression *expr, const char *value)
 461 {
 462         struct symbol *type;
 463
 464         /* This makes faking returns easier */
 465         if (!value || value[0] == '\0')
 466                 return 0;
 467
 468         while (expr->type == EXPR_ASSIGNMENT)
 469                 expr = strip_expr(expr->right);
 470
 471         /*
 472          * Short cut:  We only care about function pointers that are struct
 473          * members.
 474          *
 475          */
 476         if (expr->fn->type == EXPR_SYMBOL)
 477                 return 0;
 478
 479         type = get_type(expr->fn);
 480         if (!type)
 481                 return 0;
 482         if (type->type == SYM_PTR)
 483                 type = get_real_base_type(type);
 484
 485         if (strcmp(type_to_str(type), value) == 0)
 486                 return 0;
 487
 488         return 1;
 489 }
 490
 491 static int db_compare_callback(void *_info, int argc, char **argv, char **azColName)
 492 {
 493         struct db_callback_info *db_info = _info;
 494         struct range_list *var_rl = db_info->rl;
 495         struct range_list *ret_range;
 496         int type, param;
 497         char *key, *value;
 498         struct return_implies_callback *tmp;
 499         struct stree *stree;
 500         int return_id;
 501         int comparison;
 502
 503         if (argc != 6)
 504                 return 0;
 505
 506         return_id = atoi(argv[0]);
 507         type = atoi(argv[2]);
 508         param = atoi(argv[3]);
 509         key = argv[4];
 510         value = argv[5];
 511
 512         db_info->has_states = 1;
 513         if (db_info->prev_return_id != -1 && type == INTERNAL) {
 514                 set_return_state(db_info->var_expr, db_info);
 515                 stree = __pop_fake_cur_stree();
 516
 517                 if (!db_info->cull)
 518                         merge_fake_stree(&db_info->stree, stree);
 519                 free_stree(&stree);
 520                 __push_fake_cur_stree();
 521                 db_info->cull = 0;
 522         }
 523         db_info->prev_return_id = return_id;
 524
 525         if (type == INTERNAL && func_type_mismatch(db_info->expr, value))
 526                 db_info->cull = 1;
 527         if (db_info->cull)
 528                 return 0;
 529         if (type == CULL_PATH) {
 530                 db_info->cull = 1;
 531                 return 0;
 532         }
 533
 534         if (is_impossible_data(type, db_info->expr, param, key, value)) {
 535                 db_info->cull = 1;
 536                 return 0;
 537         }
 538
 539         call_results_to_rl(db_info->expr, get_type(strip_expr(db_info->expr)), argv[1], &ret_range);
 540         ret_range = cast_rl(get_type(db_info->expr), ret_range);
 541         if (!ret_range)
 542                 ret_range = alloc_whole_rl(get_type(db_info->expr));
 543
 544         comparison = db_info->comparison;
 545         if (db_info->left)
 546                 comparison = flip_comparison(comparison);
 547
 548         if (db_info->true_side) {
 549                 if (!possibly_true_rl(var_rl, comparison, ret_range))
 550                         return 0;
 551                 if (type == PARAM_LIMIT)
 552                         param_limit_implications(db_info->expr, param, key, value);
 553                 filter_by_comparison(&var_rl, comparison, ret_range);
 554                 filter_by_comparison(&ret_range, flip_comparison(comparison), var_rl);
 555         } else {
 556                 if (!possibly_false_rl(var_rl, comparison, ret_range))
 557                         return 0;
 558                 if (type == PARAM_LIMIT)
 559                         param_limit_implications(db_info->expr, param, key, value);
 560                 filter_by_comparison(&var_rl, negate_comparison(comparison), ret_range);
 561                 filter_by_comparison(&ret_range, flip_comparison(negate_comparison(comparison)), var_rl);
 562         }
 563
 564         handle_ret_equals_param(argv[1], ret_range, db_info->expr);
 565
 566         if (type == INTERNAL) {
 567                 set_state(-1, "unnull_path", NULL, &true_state);
 568                 __add_return_comparison(strip_expr(db_info->expr), argv[1]);
 569                 __add_return_to_param_mapping(db_info->expr, argv[1]);
 570         }
 571
 572         FOR_EACH_PTR(db_info->callbacks, tmp) {
 573                 if (tmp->type == type)
 574                         tmp->callback(db_info->expr, param, key, value);
 575         } END_FOR_EACH_PTR(tmp);
 576
 577         store_return_state(db_info, alloc_estate_rl(clone_rl(var_rl)));
 578         return 0;
 579 }
 580
 581 static void compare_db_return_states_callbacks(struct expression *left, int comparison, struct expression *right, struct stree *implied_true, struct stree *implied_false)
 582 {
 583         struct stree *orig_states;
 584         struct stree *stree;
 585         struct stree *true_states;
 586         struct stree *false_states;
 587         struct sm_state *sm;
 588         struct db_callback_info db_info = {};
 589         struct expression *var_expr;
 590         struct expression *call_expr;
 591         struct range_list *rl;
 592         int call_on_left;
 593
 594         orig_states = clone_stree(__get_cur_stree());
 595
 596         /* legacy cruft.  need to fix call_implies_callbacks(). */
 597         call_on_left = 1;
 598         call_expr = left;
 599         var_expr = right;
 600         if (left->type != EXPR_CALL) {
 601                 call_on_left = 0;
 602                 call_expr = right;
 603                 var_expr = left;
 604         }
 605
 606         get_absolute_rl(var_expr, &rl);
 607
 608         db_info.comparison = comparison;
 609         db_info.expr = call_expr;
 610         db_info.rl = rl;
 611         db_info.left = call_on_left;
 612         db_info.callbacks = db_return_states_list;
 613         db_info.var_expr = var_expr;
 614
 615         call_return_states_before_hooks();
 616
 617         db_info.true_side = 1;
 618         db_info.stree = NULL;
 619         db_info.prev_return_id = -1;
 620         __push_fake_cur_stree();
 621         sql_select_return_states("return_id, return, type, parameter, key, value",
 622                                  call_expr, db_compare_callback, &db_info);
 623         set_return_state(db_info.var_expr, &db_info);
 624         stree = __pop_fake_cur_stree();
 625         if (!db_info.cull) {
 626                 set_return_state(db_info.var_expr, &db_info);
 627                 merge_fake_stree(&db_info.stree, stree);
 628         }
 629         free_stree(&stree);
 630         true_states = db_info.stree;
 631         if (!true_states && db_info.has_states) {
 632                 __push_fake_cur_stree();
 633                 set_path_impossible();
 634                 true_states = __pop_fake_cur_stree();
 635         }
 636
 637         nullify_path();
 638         __unnullify_path();
 639         FOR_EACH_SM(orig_states, sm) {
 640                 __set_sm_cur_stree(sm);
 641         } END_FOR_EACH_SM(sm);
 642
 643         db_info.true_side = 0;
 644         db_info.stree = NULL;
 645         db_info.prev_return_id = -1;
 646         db_info.cull = 0;
 647         __push_fake_cur_stree();
 648         sql_select_return_states("return_id, return, type, parameter, key, value", call_expr,
 649                         db_compare_callback, &db_info);
 650         stree = __pop_fake_cur_stree();
 651         if (!db_info.cull) {
 652                 set_return_state(db_info.var_expr, &db_info);
 653                 merge_fake_stree(&db_info.stree, stree);
 654         }
 655         free_stree(&stree);
 656         false_states = db_info.stree;
 657         if (!false_states && db_info.has_states) {
 658                 __push_fake_cur_stree();
 659                 set_path_impossible();
 660                 false_states = __pop_fake_cur_stree();
 661         }
 662
 663         nullify_path();
 664         __unnullify_path();
 665         FOR_EACH_SM(orig_states, sm) {
 666                 __set_sm_cur_stree(sm);
 667         } END_FOR_EACH_SM(sm);
 668
 669         free_stree(&orig_states);
 670
 671         FOR_EACH_SM(true_states, sm) {
 672                 __set_true_false_sm(sm, NULL);
 673         } END_FOR_EACH_SM(sm);
 674         FOR_EACH_SM(false_states, sm) {
 675                 __set_true_false_sm(NULL, sm);
 676         } END_FOR_EACH_SM(sm);
 677
 678         free_stree(&true_states);
 679         free_stree(&false_states);
 680
 681         call_return_states_after_hooks(call_expr);
 682
 683         FOR_EACH_SM(implied_true, sm) {
 684                 __set_true_false_sm(sm, NULL);
 685         } END_FOR_EACH_SM(sm);
 686         FOR_EACH_SM(implied_false, sm) {
 687                 __set_true_false_sm(NULL, sm);
 688         } END_FOR_EACH_SM(sm);
 689 }
 690
 691 void function_comparison(struct expression *left, int comparison, struct expression *right)
 692 {
 693         struct expression *var_expr;
 694         struct expression *call_expr;
 695         struct stree *implied_true = NULL;
 696         struct stree *implied_false = NULL;
 697         struct range_list *rl;
 698         sval_t sval;
 699         int call_on_left;
 700
 701         if (unreachable())
 702                 return;
 703
 704         /* legacy cruft.  need to fix call_implies_callbacks(). */
 705         call_on_left = 1;
 706         call_expr = left;
 707         var_expr = right;
 708         if (left->type != EXPR_CALL) {
 709                 call_on_left = 0;
 710                 call_expr = right;
 711                 var_expr = left;
 712         }
 713
 714         get_absolute_rl(var_expr, &rl);
 715
 716         if (rl_to_sval(rl, &sval))
 717                 call_implies_callbacks(comparison, call_expr, sval, call_on_left, &implied_true, &implied_false);
 718
 719         compare_db_return_states_callbacks(left, comparison, right, implied_true, implied_false);
 720         free_stree(&implied_true);
 721         free_stree(&implied_false);
 722 }
 723
 724 static void call_ranged_return_hooks(struct db_callback_info *db_info)
 725 {
 726         struct call_back_list *call_backs;
 727         struct expression *expr;
 728         struct fcall_back *tmp;
 729         char *fn;
 730
 731         expr = strip_expr(db_info->expr);
 732         while (expr->type == EXPR_ASSIGNMENT)
 733                 expr = strip_expr(expr->right);
 734         if (expr->type != EXPR_CALL ||
 735             expr->fn->type != EXPR_SYMBOL)
 736                 return;
 737
 738         fn = expr->fn->symbol_name->name;
 739
 740         call_backs = search_callback(func_hash, fn);
 741         FOR_EACH_PTR(call_backs, tmp) {
 742                 struct range_list *range_rl = NULL;
 743
 744                 if (tmp->type != RANGED_CALL)
 745                         continue;
 746                 add_range(&range_rl, tmp->range->min, tmp->range->max);
 747                 range_rl = cast_rl(estate_type(db_info->ret_state), range_rl);
 748                 if (possibly_true_rl(range_rl, SPECIAL_EQUAL, estate_rl(db_info->ret_state))) {
 749                         if (!possibly_true_rl(rl_invert(range_rl), SPECIAL_EQUAL, estate_rl(db_info->ret_state)))
 750                                 (tmp->u.ranged)(fn, expr, db_info->expr, tmp->info);
 751                         else
 752                                 db_info->handled = -1;
 753                 }
 754         } END_FOR_EACH_PTR(tmp);
 755 }
 756
 757 static void fake_a_param_assignment(struct expression *expr, const char *return_str)
 758 {
 759         struct expression *arg, *left, *right, *fake_assign;
 760         char *p;
 761         int param;
 762         char buf[256];
 763         char *str;
 764
 765         if (expr->type != EXPR_ASSIGNMENT || expr->op != '=')
 766                 return;
 767         left = expr->left;
 768         right = expr->right;
 769
 770         while (right->type == EXPR_ASSIGNMENT)
 771                 right = strip_expr(right->right);
 772         if (!right || right->type != EXPR_CALL)
 773                 return;
 774
 775         p = strchr(return_str, '[');
 776         if (!p)
 777                 return;
 778
 779         p++;
 780         if (p[0] == '=' && p[1] == '=')
 781                 p += 2;
 782         if (p[0] != '$')
 783                 return;
 784
 785         snprintf(buf, sizeof(buf), "%s", p);
 786
 787         p = buf;
 788         p += 1;
 789         param = strtol(p, &p, 10);
 790
 791         p = strchr(p, ']');
 792         if (!p || *p != ']')
 793                 return;
 794         *p = '\0';
 795
 796         arg = get_argument_from_call_expr(right->args, param);
 797         if (!arg)
 798                 return;
 799         /*
 800          * This is a sanity check to prevent side effects from evaluating stuff
 801          * twice.
 802          */
 803         str = expr_to_chunk_sym_vsl(arg, NULL, NULL);
 804         if (!str)
 805                 return;
 806         free_string(str);
 807
 808         right = gen_expression_from_key(arg, buf);
 809         if (!right)  /* Mostly fails for binops like [$0 + 4032] */
 810                 return;
 811         fake_assign = assign_expression(left, '=', right);
 812         __in_fake_assign++;
 813         __split_expr(fake_assign);
 814         __in_fake_assign--;
 815 }
 816
 817 static int db_assign_return_states_callback(void *_info, int argc, char **argv, char **azColName)
 818 {
 819         struct db_callback_info *db_info = _info;
 820         struct range_list *ret_range;
 821         int type, param;
 822         char *key, *value;
 823         struct return_implies_callback *tmp;
 824         struct stree *stree;
 825         int return_id;
 826
 827         if (argc != 6)
 828                 return 0;
 829
 830         return_id = atoi(argv[0]);
 831         type = atoi(argv[2]);
 832         param = atoi(argv[3]);
 833         key = argv[4];
 834         value = argv[5];
 835
 836         if (db_info->prev_return_id != -1 && type == INTERNAL) {
 837                 call_ranged_return_hooks(db_info);
 838                 set_return_state(db_info->expr->left, db_info);
 839                 stree = __pop_fake_cur_stree();
 840                 if (!db_info->cull)
 841                         merge_fake_stree(&db_info->stree, stree);
 842                 free_stree(&stree);
 843                 __push_fake_cur_stree();
 844                 db_info->cull = 0;
 845         }
 846         db_info->prev_return_id = return_id;
 847
 848         if (type == INTERNAL && func_type_mismatch(db_info->expr, value))
 849                 db_info->cull = 1;
 850         if (db_info->cull)
 851                 return 0;
 852         if (type == CULL_PATH) {
 853                 db_info->cull = 1;
 854                 return 0;
 855         }
 856         if (is_impossible_data(type, db_info->expr, param, key, value)) {
 857                 db_info->cull = 1;
 858                 return 0;
 859         }
 860
 861         if (type == PARAM_LIMIT)
 862                 param_limit_implications(db_info->expr, param, key, value);
 863
 864         db_info->handled = 1;
 865         call_results_to_rl(db_info->expr->right, get_type(strip_expr(db_info->expr->right)), argv[1], &ret_range);
 866         if (!ret_range)
 867                 ret_range = alloc_whole_rl(get_type(strip_expr(db_info->expr->right)));
 868         ret_range = cast_rl(get_type(db_info->expr->right), ret_range);
 869
 870         if (type == INTERNAL) {
 871                 set_state(-1, "unnull_path", NULL, &true_state);
 872                 __add_return_comparison(strip_expr(db_info->expr->right), argv[1]);
 873                 __add_comparison_info(db_info->expr->left, strip_expr(db_info->expr->right), argv[1]);
 874                 fake_a_param_assignment(db_info->expr, argv[1]);
 875                 __add_return_to_param_mapping(db_info->expr, argv[1]);
 876         }
 877
 878         FOR_EACH_PTR(db_return_states_list, tmp) {
 879                 if (tmp->type == type)
 880                         tmp->callback(db_info->expr, param, key, value);
 881         } END_FOR_EACH_PTR(tmp);
 882         store_return_state(db_info, alloc_estate_rl(ret_range));
 883
 884         return 0;
 885 }
 886
 887 static int db_return_states_assign(struct expression *expr)
 888 {
 889         struct expression *right;
 890         struct sm_state *sm;
 891         struct stree *stree;
 892         struct db_callback_info db_info = {};
 893
 894         right = strip_expr(expr->right);
 895
 896         db_info.prev_return_id = -1;
 897         db_info.expr = expr;
 898         db_info.stree = NULL;
 899         db_info.handled = 0;
 900
 901         call_return_states_before_hooks();
 902
 903         __push_fake_cur_stree();
 904         sql_select_return_states("return_id, return, type, parameter, key, value",
 905                         right, db_assign_return_states_callback, &db_info);
 906         if (option_debug) {
 907                 sm_msg("%s return_id %d return_ranges %s",
 908                         db_info.cull ? "culled" : "merging",
 909                         db_info.prev_return_id,
 910                         db_info.ret_state ? db_info.ret_state->name : "'<empty>'");
 911         }
 912         if (db_info.handled)
 913                 call_ranged_return_hooks(&db_info);
 914         set_return_state(db_info.expr->left, &db_info);
 915         stree = __pop_fake_cur_stree();
 916         if (!db_info.cull)
 917                 merge_fake_stree(&db_info.stree, stree);
 918         free_stree(&stree);
 919
 920         if (!db_info.stree && db_info.cull) { /* this means we culled everything */
 921                 set_extra_expr_mod(expr->left, alloc_estate_whole(get_type(expr->left)));
 922                 set_path_impossible();
 923         }
 924         FOR_EACH_SM(db_info.stree, sm) {
 925                 __set_sm(sm);
 926         } END_FOR_EACH_SM(sm);
 927
 928         free_stree(&db_info.stree);
 929         call_return_states_after_hooks(right);
 930
 931         return db_info.handled;
 932 }
 933
 934 static int handle_implied_return(struct expression *expr)
 935 {
 936         struct range_list *rl;
 937
 938         if (!get_implied_return(expr->right, &rl))
 939                 return 0;
 940         rl = cast_rl(get_type(expr->left), rl);
 941         set_extra_expr_mod(expr->left, alloc_estate_rl(rl));
 942         return 1;
 943 }
 944
 945 static void match_assign_call(struct expression *expr)
 946 {
 947         struct call_back_list *call_backs;
 948         const char *fn;
 949         struct expression *right;
 950         int handled = 0;
 951         struct range_list *rl;
 952
 953         if (expr->op != '=')
 954                 return;
 955
 956         right = strip_expr(expr->right);
 957         if (right->fn->type != EXPR_SYMBOL || !right->fn->symbol) {
 958                 handled |= db_return_states_assign(expr);
 959                 if (!handled)
 960                         goto assigned_unknown;
 961                 return;
 962         }
 963         if (is_fake_call(right)) {
 964                 set_extra_expr_mod(expr->left, alloc_estate_whole(get_type(expr->left)));
 965                 return;
 966         }
 967
 968         fn = right->fn->symbol->ident->name;
 969         call_backs = search_callback(func_hash, (char *)fn);
 970
 971         /*
 972          * The ordering here is sort of important.
 973          * One example, of how this matters is that when we do:
 974          *
 975          *      len = strlen(str);
 976          *
 977          * That is handled by smatch_common_functions.c and smatch_strlen.c.
 978          * They use implied_return and function_assign_hook respectively.
 979          * We want to get the implied return first before we do the function
 980          * assignment hook otherwise we end up writing the wrong thing for len
 981          * in smatch_extra.c because we assume that it already holds the
 982          * strlen() when we haven't set it yet.
 983          */
 984
 985         if (db_return_states_assign(expr) == 1)
 986                 handled = 1;
 987         else
 988                 handled = assign_ranged_funcs(fn, expr, call_backs);
 989         handled |= handle_implied_return(expr);
 990
 991
 992         call_call_backs(call_backs, ASSIGN_CALL, fn, expr);
 993
 994         if (handled)
 995                 return;
 996
 997 assigned_unknown:
 998         get_absolute_rl(expr->right, &rl);
 999         rl = cast_rl(get_type(expr->left), rl);
1000         set_extra_expr_mod(expr->left, alloc_estate_rl(rl));
1001 }
1002
1003 static int db_return_states_callback(void *_info, int argc, char **argv, char **azColName)
1004 {
1005         struct db_callback_info *db_info = _info;
1006         struct range_list *ret_range;
1007         int type, param;
1008         char *key, *value;
1009         struct return_implies_callback *tmp;
1010         struct stree *stree;
1011         int return_id;
1012         char buf[64];
1013
1014         if (argc != 6)
1015                 return 0;
1016
1017         return_id = atoi(argv[0]);
1018         type = atoi(argv[2]);
1019         param = atoi(argv[3]);
1020         key = argv[4];
1021         value = argv[5];
1022
1023         if (db_info->prev_return_id != -1 && type == INTERNAL) {
1024                 stree = __pop_fake_cur_stree();
1025                 if (!db_info->cull)
1026                         merge_fake_stree(&db_info->stree, stree);
1027                 free_stree(&stree);
1028                 __push_fake_cur_stree();
1029                 __unnullify_path();
1030                 db_info->cull = 0;
1031         }
1032         db_info->prev_return_id = return_id;
1033
1034         if (type == INTERNAL && func_type_mismatch(db_info->expr, value))
1035                 db_info->cull = 1;
1036         if (db_info->cull)
1037                 return 0;
1038         if (type == CULL_PATH) {
1039                 db_info->cull = 1;
1040                 return 0;
1041         }
1042         if (is_impossible_data(type, db_info->expr, param, key, value)) {
1043                 db_info->cull = 1;
1044                 return 0;
1045         }
1046
1047         if (type == PARAM_LIMIT)
1048                 param_limit_implications(db_info->expr, param, key, value);
1049
1050         call_results_to_rl(db_info->expr, get_type(strip_expr(db_info->expr)), argv[1], &ret_range);
1051         ret_range = cast_rl(get_type(db_info->expr), ret_range);
1052
1053         if (type == INTERNAL) {
1054                 set_state(-1, "unnull_path", NULL, &true_state);
1055                 __add_return_comparison(strip_expr(db_info->expr), argv[1]);
1056                 __add_return_to_param_mapping(db_info->expr, argv[1]);
1057         }
1058
1059
1060         FOR_EACH_PTR(db_return_states_list, tmp) {
1061                 if (tmp->type == type)
1062                         tmp->callback(db_info->expr, param, key, value);
1063         } END_FOR_EACH_PTR(tmp);
1064
1065         /*
1066          * We want to store the return values so that we can split the strees
1067          * in smatch_db.c.  This uses set_state() directly because it's not a
1068          * real smatch_extra state.
1069          */
1070         snprintf(buf, sizeof(buf), "return %p", db_info->expr);
1071         set_state(SMATCH_EXTRA, buf, NULL, alloc_estate_rl(ret_range));
1072
1073         return 0;
1074 }
1075
1076 static void db_return_states(struct expression *expr)
1077 {
1078         struct sm_state *sm;
1079         struct stree *stree;
1080         struct db_callback_info db_info = {};
1081
1082         if (!__get_cur_stree())  /* no return functions */
1083                 return;
1084
1085         db_info.prev_return_id = -1;
1086         db_info.expr = expr;
1087         db_info.stree = NULL;
1088
1089         call_return_states_before_hooks();
1090
1091         __push_fake_cur_stree();
1092         __unnullify_path();
1093         sql_select_return_states("return_id, return, type, parameter, key, value",
1094                         expr, db_return_states_callback, &db_info);
1095         stree = __pop_fake_cur_stree();
1096         if (!db_info.cull)
1097                 merge_fake_stree(&db_info.stree, stree);
1098         free_stree(&stree);
1099
1100         FOR_EACH_SM(db_info.stree, sm) {
1101                 __set_sm(sm);
1102         } END_FOR_EACH_SM(sm);
1103
1104         free_stree(&db_info.stree);
1105         call_return_states_after_hooks(expr);
1106 }
1107
1108 static int is_condition_call(struct expression *expr)
1109 {
1110         struct expression *tmp;
1111
1112         FOR_EACH_PTR_REVERSE(big_condition_stack, tmp) {
1113                 if (expr == tmp || expr_get_parent_expr(expr) == tmp)
1114                         return 1;
1115                 if (tmp->pos.line < expr->pos.line)
1116                         return 0;
1117         } END_FOR_EACH_PTR_REVERSE(tmp);
1118
1119         return 0;
1120 }
1121
1122 static void db_return_states_call(struct expression *expr)
1123 {
1124         if (unreachable())
1125                 return;
1126
1127         if (is_assigned_call(expr))
1128                 return;
1129         if (is_condition_call(expr))
1130                 return;
1131         db_return_states(expr);
1132 }
1133
1134 static void match_function_call(struct expression *expr)
1135 {
1136         struct call_back_list *call_backs;
1137
1138         if (expr->fn->type == EXPR_SYMBOL && expr->fn->symbol) {
1139                 call_backs = search_callback(func_hash, (char *)expr->fn->symbol->ident->name);
1140                 if (call_backs)
1141                         call_call_backs(call_backs, REGULAR_CALL,
1142                                         expr->fn->symbol->ident->name, expr);
1143         }
1144         db_return_states_call(expr);
1145 }
1146
1147 static void match_macro_assign(struct expression *expr)
1148 {
1149         struct call_back_list *call_backs;
1150         const char *macro;
1151         struct expression *right;
1152
1153         right = strip_expr(expr->right);
1154         macro = get_macro_name(right->pos);
1155         call_backs = search_callback(func_hash, (char *)macro);
1156         if (!call_backs)
1157                 return;
1158         call_call_backs(call_backs, MACRO_ASSIGN, macro, expr);
1159         call_call_backs(call_backs, MACRO_ASSIGN_EXTRA, macro, expr);
1160 }
1161
1162 int get_implied_return(struct expression *expr, struct range_list **rl)
1163 {
1164         struct call_back_list *call_backs;
1165         struct fcall_back *tmp;
1166         int handled = 0;
1167         char *fn;
1168
1169         *rl = NULL;
1170
1171         expr = strip_expr(expr);
1172         fn = expr_to_var(expr->fn);
1173         if (!fn)
1174                 goto out;
1175
1176         call_backs = search_callback(func_hash, fn);
1177
1178         FOR_EACH_PTR(call_backs, tmp) {
1179                 if (tmp->type == IMPLIED_RETURN) {
1180                         (tmp->u.implied_return)(expr, tmp->info, rl);
1181                         handled = 1;
1182                 }
1183         } END_FOR_EACH_PTR(tmp);
1184
1185 out:
1186         free_string(fn);
1187         return handled;
1188 }
1189
1190 void create_function_hook_hash(void)
1191 {
1192         func_hash = create_function_hashtable(5000);
1193 }
1194
1195 void register_function_hooks(int id)
1196 {
1197         add_hook(&match_function_call, CALL_HOOK_AFTER_INLINE);
1198         add_hook(&match_assign_call, CALL_ASSIGNMENT_HOOK);
1199         add_hook(&match_macro_assign, MACRO_ASSIGNMENT_HOOK);
1200 }