2 * Copyright (C) 2012 Oracle.
4 * This program is free software; you can redistribute it and/or
5 * modify it under the terms of the GNU General Public License
6 * as published by the Free Software Foundation; either version 2
7 * of the License, or (at your option) any later version.
9 * This program is distributed in the hope that it will be useful,
10 * but WITHOUT ANY WARRANTY; without even the implied warranty of
11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12 * GNU General Public License for more details.
14 * You should have received a copy of the GNU General Public License
15 * along with this program; if not, see http://www.gnu.org/copyleft/gpl.txt
19 * This is an --info recipe. The goal is to print a message for every parameter
20 * which we can not avoid dereferencing. This is maybe a bit restrictive but it
21 * avoids some false positives.
25 #include "smatch_extra.h"
26 #include "smatch_slist.h"
34 static void pre_merge_hook(struct sm_state
*cur
, struct sm_state
*other
)
36 if (cur
->state
== &derefed
|| other
->state
!= &derefed
)
38 if (is_impossible_path())
39 set_state(my_id
, cur
->name
, cur
->sym
, &derefed
);
42 static void set_ignore(struct sm_state
*sm
, struct expression
*mod_expr
)
44 if (sm
->state
== &derefed
)
46 set_state(my_id
, sm
->name
, sm
->sym
, &ignore
);
49 static void match_function_def(struct symbol
*sym
)
55 FOR_EACH_PTR(sym
->ctype
.base_type
->arguments
, arg
) {
59 set_state(my_id
, arg
->ident
->name
, arg
, ¶m
);
60 } END_FOR_EACH_PTR(arg
);
63 static int is_ignored_param(struct expression
*expr
)
67 if (param_was_set(expr
))
70 sm
= get_sm_state_expr(my_id
, expr
);
71 if (sm
&& slist_has_state(sm
->possible
, &ignore
))
76 static void check_deref(struct expression
*expr
)
78 struct expression
*tmp
;
80 if (is_impossible_path())
83 tmp
= get_assigned_expr(expr
);
87 if (expr
->type
== EXPR_PREOP
&&
89 expr
= strip_expr(expr
->unop
);
90 if (expr
->type
!= EXPR_DEREF
)
92 expr
= strip_expr(expr
->deref
);
93 if (expr
->type
!= EXPR_PREOP
||
96 expr
= strip_expr(expr
->unop
);
99 expr
= strip_expr(expr
);
103 if (expr
->type
== EXPR_PREOP
&& expr
->op
== '&')
106 if (get_param_num(expr
) < 0)
109 if (is_ignored_param(expr
))
112 if (param_was_set(expr
))
116 * At this point we really only care about potential NULL dereferences.
117 * Potentially in the future we will care about everything.
119 if (implied_not_equal(expr
, 0))
122 set_state_expr(my_id
, expr
, &derefed
);
125 static void match_dereference(struct expression
*expr
)
127 if (expr
->type
!= EXPR_PREOP
)
129 check_deref(expr
->unop
);
132 static void find_inner_dereferences(struct expression
*expr
)
134 while (expr
->type
== EXPR_PREOP
) {
136 check_deref(expr
->unop
);
137 expr
= strip_expr(expr
->unop
);
141 static void set_param_dereferenced(struct expression
*call
, struct expression
*arg
, char *key
, char *unused
)
148 name
= get_variable_from_key(arg
, key
, &sym
);
151 if (is_ignored_param(symbol_expression(sym
)))
153 if (get_param_num_from_sym(sym
) < 0)
155 if (param_was_set_var_sym(name
, sym
))
158 set_state(my_id
, name
, sym
, &derefed
);
159 find_inner_dereferences(arg
);
164 static void process_states(void)
166 struct sm_state
*tmp
;
170 FOR_EACH_MY_SM(my_id
, __get_cur_stree(), tmp
) {
171 if (tmp
->state
!= &derefed
)
173 arg
= get_param_num_from_sym(tmp
->sym
);
176 name
= get_param_name(tmp
);
177 if (!name
|| name
[0] == '&')
179 sql_insert_return_implies(DEREFERENCE
, arg
, name
, "1");
180 } END_FOR_EACH_SM(tmp
);
183 static void match_pointer_as_array(struct expression
*expr
)
187 check_deref(get_array_base(expr
));
190 void check_dereferences_param(int id
)
194 add_hook(&match_function_def
, FUNC_DEF_HOOK
);
196 add_hook(&match_dereference
, DEREF_HOOK
);
197 add_hook(&match_pointer_as_array
, OP_HOOK
);
198 select_return_implies_hook(DEREFERENCE
, &set_param_dereferenced
);
199 add_modification_hook(my_id
, &set_ignore
);
200 add_pre_merge_hook(my_id
, &pre_merge_hook
);
202 all_return_states_hook(&process_states
);