smatch_array_values.c

   1 /*
   2  * Copyright (C) 2018 Oracle.  All rights reserved.
   3  *
   4  * This program is free software; you can redistribute it and/or
   5  * modify it under the terms of the GNU General Public License
   6  * as published by the Free Software Foundation; either version 2
   7  * of the License, or (at your option) any later version.
   8  *
   9  * This program is distributed in the hope that it will be useful,
  10  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  11  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  12  * GNU General Public License for more details.
  13  *
  14  * You should have received a copy of the GNU General Public License
  15  * along with this program; if not, see http://www.gnu.org/copyleft/gpl.txt
  16  */
  17
  18 #include "smatch.h"
  19 #include "smatch_extra.h"
  20 #include "smatch_slist.h"
  21
  22 static int my_id;
  23
  24 struct db_info {
  25         int count;
  26         struct symbol *type;
  27         struct range_list *rl;
  28 };
  29
  30 static int get_vals(void *_db_info, int argc, char **argv, char **azColName)
  31 {
  32         struct db_info *db_info = _db_info;
  33         struct range_list *rl;
  34
  35         str_to_rl(db_info->type, argv[0], &rl);
  36         db_info->rl = rl_union(db_info->rl, rl);
  37
  38         return 0;
  39 }
  40
  41 static int is_file_local(struct expression *array)
  42 {
  43         struct symbol *sym = NULL;
  44         char *name;
  45
  46         name = expr_to_str_sym(array, &sym);
  47         free_string(name);
  48         if (!sym)
  49                 return 0;
  50
  51         if ((sym->ctype.modifiers & MOD_TOPLEVEL) &&
  52             (sym->ctype.modifiers & MOD_STATIC))
  53                 return 1;
  54         return 0;
  55 }
  56
  57 static char *get_toplevel_name(struct expression *array)
  58 {
  59         char *name;
  60         char buf[128];
  61
  62         if (is_array(array))
  63                 array = get_array_base(array);
  64
  65         if (!array || array->type != EXPR_SYMBOL)
  66                 return NULL;
  67         if (!is_file_local(array))
  68                 return NULL;
  69
  70         name = expr_to_str(array);
  71         snprintf(buf, sizeof(buf), "%s[]", name);
  72         free_string(name);
  73
  74         return alloc_sname(buf);
  75 }
  76
  77 static char *get_member_array(struct expression *array)
  78 {
  79         char *name;
  80         char buf[128];
  81
  82         name = get_member_name(array);
  83         if (!name)
  84                 return NULL;
  85         snprintf(buf, sizeof(buf), "%s[]", name);
  86         free_string(name);
  87         return alloc_sname(buf);
  88 }
  89
  90 static char *get_array_name(struct expression *array)
  91 {
  92         struct symbol *type;
  93         char *name;
  94
  95         type = get_type(array);
  96         if (!type || type->type != SYM_ARRAY)
  97                 return NULL;
  98
  99         name = get_toplevel_name(array);
 100         if (name)
 101                 return name;
 102         name = get_member_array(array);
 103         if (name)
 104                 return name;
 105
 106         return NULL;
 107 }
 108
 109 static struct {
 110         const char *name;
 111         struct range_list *rl;
 112 } cached_results[4];
 113
 114 static bool get_cached_select(const char *name, struct range_list **rl)
 115 {
 116         int i;
 117
 118         for (i = 0; i < ARRAY_SIZE(cached_results); i++) {
 119                 if (!cached_results[i].name)
 120                         continue;
 121                 if (strcmp(name, cached_results[i].name) == 0) {
 122                         *rl = cached_results[i].rl;
 123                         return true;
 124                 }
 125         }
 126         return false;
 127 }
 128
 129 static void store_result(const char *name, struct range_list *rl)
 130 {
 131         static int idx;
 132
 133         idx = (idx + 1) % ARRAY_SIZE(cached_results);
 134
 135         cached_results[idx].name = name;
 136         cached_results[idx].rl = rl;
 137 }
 138
 139 void clear_array_values_cache(void)
 140 {
 141         memset(cached_results, 0, sizeof(cached_results));
 142 }
 143
 144 int get_array_rl(struct expression *expr, struct range_list **rl)
 145 {
 146         struct expression *array;
 147         struct symbol *type;
 148         struct db_info db_info = {};
 149         char *name;
 150
 151         type = get_type(expr);
 152         if (!type || type->type != SYM_BASETYPE)
 153                 return 0;
 154         db_info.type = type;
 155
 156         array = get_array_base(expr);
 157         name = get_array_name(array);
 158         if (!name)
 159                 return 0;
 160
 161         if (get_cached_select(name, rl))
 162                 return 1;
 163
 164         if (is_file_local(array)) {
 165                 run_sql(&get_vals, &db_info,
 166                         "select value from sink_info where file = '%s' and static = 1 and sink_name = '%s' and type = %d;",
 167                         get_filename(), name, DATA_VALUE);
 168         } else {
 169                 run_sql(&get_vals, &db_info,
 170                         "select value from sink_info where sink_name = '%s' and type = %d limit 10;",
 171                         name, DATA_VALUE);
 172         }
 173         if (db_info.count >= 10)
 174                 db_info.rl = NULL;
 175         store_result(name, db_info.rl);
 176         if (!db_info.rl)
 177                 return 0;
 178
 179         *rl = db_info.rl;
 180         return 1;
 181 }
 182
 183 static struct range_list *get_saved_rl(struct symbol *type, char *name)
 184 {
 185         struct db_info db_info = {.type = type};
 186
 187         cache_sql(&get_vals, &db_info, "select value from sink_info where sink_name = '%s' and type = %d;",
 188                   name, DATA_VALUE);
 189         return db_info.rl;
 190 }
 191
 192 static void update_cache(char *name, int is_static, struct range_list *rl)
 193 {
 194         cache_sql(NULL, NULL, "delete from sink_info where sink_name = '%s' and type = %d;",
 195                   name, DATA_VALUE);
 196         cache_sql(NULL, NULL, "insert into sink_info values ('%s', %d, '%s', %d, '', '%s');",
 197                   get_filename(), is_static, name, DATA_VALUE, show_rl(rl));
 198 }
 199
 200 static void match_assign(struct expression *expr)
 201 {
 202         struct expression *left, *array;
 203         struct range_list *orig_rl, *rl;
 204         struct symbol *type;
 205         char *name;
 206
 207         type = get_type(expr->left);
 208         if (!type || type->type != SYM_BASETYPE)
 209                 return;
 210
 211         left = strip_expr(expr->left);
 212         if (!is_array(left))
 213                 return;
 214         array = get_array_base(left);
 215         name = get_array_name(array);
 216         if (!name)
 217                 return;
 218
 219         if (expr->op != '=') {
 220                 rl = alloc_whole_rl(get_type(expr->right));
 221                 rl = cast_rl(type, rl);
 222         } else {
 223                 get_absolute_rl(expr->right, &rl);
 224                 rl = cast_rl(type, rl);
 225                 orig_rl = get_saved_rl(type, name);
 226                 rl = rl_union(orig_rl, rl);
 227         }
 228
 229         update_cache(name, is_file_local(array), rl);
 230 }
 231
 232 static void mark_strings_unknown(const char *fn, struct expression *expr, void *_arg)
 233 {
 234         struct expression *dest;
 235         struct symbol *type;
 236         int arg = PTR_INT(_arg);
 237         char *name;
 238
 239         dest = get_argument_from_call_expr(expr->args, arg);
 240         if (!dest)
 241                 return;
 242         name = get_array_name(dest);
 243         if (!name)
 244                 return;
 245         type = get_type(dest);
 246         if (type_is_ptr(type))
 247                 type = get_real_base_type(type);
 248         update_cache(name, is_file_local(dest), alloc_whole_rl(type));
 249 }
 250
 251 void register_array_values(int id)
 252 {
 253         my_id = id;
 254
 255         add_hook(&match_assign, ASSIGNMENT_HOOK);
 256         add_hook(&match_assign, GLOBAL_ASSIGNMENT_HOOK);
 257
 258         add_function_hook("sprintf", &mark_strings_unknown, INT_PTR(0));
 259         add_function_hook("snprintf", &mark_strings_unknown, INT_PTR(0));
 260
 261         add_function_hook("strcpy", &mark_strings_unknown, INT_PTR(0));
 262         add_function_hook("strncpy", &mark_strings_unknown, INT_PTR(0));
 263         add_function_hook("strlcpy", &mark_strings_unknown, INT_PTR(0));
 264         add_function_hook("strscpy", &mark_strings_unknown, INT_PTR(0));
 265 }