smatch_function_hooks.c

   1 /*
   2  * Copyright (C) 2009 Dan Carpenter.
   3  *
   4  * This program is free software; you can redistribute it and/or
   5  * modify it under the terms of the GNU General Public License
   6  * as published by the Free Software Foundation; either version 2
   7  * of the License, or (at your option) any later version.
   8  *
   9  * This program is distributed in the hope that it will be useful,
  10  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  11  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  12  * GNU General Public License for more details.
  13  *
  14  * You should have received a copy of the GNU General Public License
  15  * along with this program; if not, see http://www.gnu.org/copyleft/gpl.txt
  16  */
  17
  18 /*
  19  * There are several types of function hooks:
  20  * add_function_hook()        - For any time a function is called.
  21  * add_function_assign_hook() - foo = the_function().
  22  * add_implied_return_hook()  - Calculates the implied return value.
  23  * add_macro_assign_hook()    - foo = the_macro().
  24  * return_implies_state()     - For when a return value of 1 implies locked
  25  *                              and 0 implies unlocked. etc. etc.
  26  *
  27  */
  28
  29 #include <stdlib.h>
  30 #include <stdio.h>
  31 #include "smatch.h"
  32 #include "smatch_slist.h"
  33 #include "smatch_extra.h"
  34 #include "smatch_function_hashtable.h"
  35
  36 struct fcall_back {
  37         int type;
  38         struct data_range *range;
  39         union {
  40                 func_hook *call_back;
  41                 implication_hook *ranged;
  42                 implied_return_hook *implied_return;
  43         } u;
  44         void *info;
  45 };
  46
  47 ALLOCATOR(fcall_back, "call backs");
  48 DECLARE_PTR_LIST(call_back_list, struct fcall_back);
  49
  50 DEFINE_FUNCTION_HASHTABLE_STATIC(callback, struct fcall_back, struct call_back_list);
  51 static struct hashtable *func_hash;
  52
  53 int __in_fake_parameter_assign;
  54
  55 #define REGULAR_CALL       0
  56 #define RANGED_CALL        1
  57 #define RANGED_EXACT       2
  58 #define ASSIGN_CALL        3
  59 #define IMPLIED_RETURN     4
  60 #define MACRO_ASSIGN       5
  61 #define MACRO_ASSIGN_EXTRA 6
  62
  63 struct return_implies_callback {
  64         int type;
  65         return_implies_hook *callback;
  66 };
  67 ALLOCATOR(return_implies_callback, "return_implies callbacks");
  68 DECLARE_PTR_LIST(db_implies_list, struct return_implies_callback);
  69 static struct db_implies_list *db_return_states_list;
  70
  71 typedef void (void_fn)(void);
  72 DECLARE_PTR_LIST(void_fn_list, void_fn *);
  73 static struct void_fn_list *return_states_before;
  74 static struct void_fn_list *return_states_after;
  75
  76 static struct fcall_back *alloc_fcall_back(int type, void *call_back,
  77                                            void *info)
  78 {
  79         struct fcall_back *cb;
  80
  81         cb = __alloc_fcall_back(0);
  82         cb->type = type;
  83         cb->u.call_back = call_back;
  84         cb->info = info;
  85         return cb;
  86 }
  87
  88 void add_function_hook(const char *look_for, func_hook *call_back, void *info)
  89 {
  90         struct fcall_back *cb;
  91
  92         cb = alloc_fcall_back(REGULAR_CALL, call_back, info);
  93         add_callback(func_hash, look_for, cb);
  94 }
  95
  96 void add_function_assign_hook(const char *look_for, func_hook *call_back,
  97                               void *info)
  98 {
  99         struct fcall_back *cb;
 100
 101         cb = alloc_fcall_back(ASSIGN_CALL, call_back, info);
 102         add_callback(func_hash, look_for, cb);
 103 }
 104
 105 static void register_funcs_from_file_helper(const char *file,
 106                                             func_hook *call_back, void *info,
 107                                             bool assign)
 108 {
 109         struct token *token;
 110         const char *func;
 111         char name[64];
 112
 113         snprintf(name, sizeof(name), "%s.%s", option_project_str, file);
 114         token = get_tokens_file(name);
 115         if (!token)
 116                 return;
 117         if (token_type(token) != TOKEN_STREAMBEGIN)
 118                 return;
 119         token = token->next;
 120         while (token_type(token) != TOKEN_STREAMEND) {
 121                 if (token_type(token) != TOKEN_IDENT)
 122                         return;
 123                 func = show_ident(token->ident);
 124                 if (assign)
 125                         add_function_assign_hook(func, call_back, info);
 126                 else
 127                         add_function_hook(func, call_back, info);
 128                 token = token->next;
 129         }
 130         clear_token_alloc();
 131 }
 132
 133 void register_func_hooks_from_file(const char *file,
 134                                    func_hook *call_back, void *info)
 135 {
 136         register_funcs_from_file_helper(file, call_back, info, false);
 137 }
 138
 139 void register_assign_hooks_from_file(const char *file,
 140                                      func_hook *call_back, void *info)
 141 {
 142         register_funcs_from_file_helper(file, call_back, info, true);
 143 }
 144
 145 void add_implied_return_hook(const char *look_for,
 146                              implied_return_hook *call_back,
 147                              void *info)
 148 {
 149         struct fcall_back *cb;
 150
 151         cb = alloc_fcall_back(IMPLIED_RETURN, call_back, info);
 152         add_callback(func_hash, look_for, cb);
 153 }
 154
 155 void add_macro_assign_hook(const char *look_for, func_hook *call_back,
 156                         void *info)
 157 {
 158         struct fcall_back *cb;
 159
 160         cb = alloc_fcall_back(MACRO_ASSIGN, call_back, info);
 161         add_callback(func_hash, look_for, cb);
 162 }
 163
 164 void add_macro_assign_hook_extra(const char *look_for, func_hook *call_back,
 165                         void *info)
 166 {
 167         struct fcall_back *cb;
 168
 169         cb = alloc_fcall_back(MACRO_ASSIGN_EXTRA, call_back, info);
 170         add_callback(func_hash, look_for, cb);
 171 }
 172
 173 void return_implies_state(const char *look_for, long long start, long long end,
 174                          implication_hook *call_back, void *info)
 175 {
 176         struct fcall_back *cb;
 177
 178         cb = alloc_fcall_back(RANGED_CALL, call_back, info);
 179         cb->range = alloc_range_perm(ll_to_sval(start), ll_to_sval(end));
 180         add_callback(func_hash, look_for, cb);
 181 }
 182
 183 void return_implies_state_sval(const char *look_for, sval_t start, sval_t end,
 184                          implication_hook *call_back, void *info)
 185 {
 186         struct fcall_back *cb;
 187
 188         cb = alloc_fcall_back(RANGED_CALL, call_back, info);
 189         cb->range = alloc_range_perm(start, end);
 190         add_callback(func_hash, look_for, cb);
 191 }
 192
 193 void return_implies_exact(const char *look_for, sval_t start, sval_t end,
 194                           implication_hook *call_back, void *info)
 195 {
 196         struct fcall_back *cb;
 197
 198         cb = alloc_fcall_back(RANGED_EXACT, call_back, info);
 199         cb->range = alloc_range_perm(start, end);
 200         add_callback(func_hash, look_for, cb);
 201 }
 202
 203 void select_return_states_hook(int type, return_implies_hook *callback)
 204 {
 205         struct return_implies_callback *cb = __alloc_return_implies_callback(0);
 206
 207         cb->type = type;
 208         cb->callback = callback;
 209         add_ptr_list(&db_return_states_list, cb);
 210 }
 211
 212 void select_return_states_before(void_fn *fn)
 213 {
 214         void_fn **p = malloc(sizeof(void_fn *));
 215         *p = fn;
 216         add_ptr_list(&return_states_before, p);
 217 }
 218
 219 void select_return_states_after(void_fn *fn)
 220 {
 221         void_fn **p = malloc(sizeof(void_fn *));
 222         *p = fn;
 223         add_ptr_list(&return_states_after, p);
 224 }
 225
 226 static void call_return_states_before_hooks(void)
 227 {
 228         void_fn **fn;
 229
 230         FOR_EACH_PTR(return_states_before, fn) {
 231                 (*fn)();
 232         } END_FOR_EACH_PTR(fn);
 233 }
 234
 235 static void call_return_states_after_hooks(struct expression *expr)
 236 {
 237         void_fn **fn;
 238
 239         FOR_EACH_PTR(return_states_after, fn) {
 240                 (*fn)();
 241         } END_FOR_EACH_PTR(fn);
 242         __pass_to_client(expr, FUNCTION_CALL_HOOK_AFTER_DB);
 243 }
 244
 245 static int call_call_backs(struct call_back_list *list, int type,
 246                             const char *fn, struct expression *expr)
 247 {
 248         struct fcall_back *tmp;
 249         int handled = 0;
 250
 251         FOR_EACH_PTR(list, tmp) {
 252                 if (tmp->type == type) {
 253                         (tmp->u.call_back)(fn, expr, tmp->info);
 254                         handled = 1;
 255                 }
 256         } END_FOR_EACH_PTR(tmp);
 257
 258         return handled;
 259 }
 260
 261 static void call_ranged_call_backs(struct call_back_list *list,
 262                                 const char *fn, struct expression *call_expr,
 263                                 struct expression *assign_expr)
 264 {
 265         struct fcall_back *tmp;
 266
 267         FOR_EACH_PTR(list, tmp) {
 268                 (tmp->u.ranged)(fn, call_expr, assign_expr, tmp->info);
 269         } END_FOR_EACH_PTR(tmp);
 270 }
 271
 272 static struct call_back_list *get_same_ranged_call_backs(struct call_back_list *list,
 273                                                 struct data_range *drange)
 274 {
 275         struct call_back_list *ret = NULL;
 276         struct fcall_back *tmp;
 277
 278         FOR_EACH_PTR(list, tmp) {
 279                 if (tmp->type != RANGED_CALL &&
 280                     tmp->type != RANGED_EXACT)
 281                         continue;
 282                 if (ranges_equiv(tmp->range, drange))
 283                         add_ptr_list(&ret, tmp);
 284         } END_FOR_EACH_PTR(tmp);
 285         return ret;
 286 }
 287
 288 static int in_list_exact_sval(struct range_list *list, struct data_range *drange)
 289 {
 290         struct data_range *tmp;
 291
 292         FOR_EACH_PTR(list, tmp) {
 293                 if (ranges_equiv(tmp, drange))
 294                         return 1;
 295         } END_FOR_EACH_PTR(tmp);
 296         return 0;
 297 }
 298
 299 static int assign_ranged_funcs(const char *fn, struct expression *expr,
 300                                  struct call_back_list *call_backs)
 301 {
 302         struct fcall_back *tmp;
 303         struct sm_state *sm;
 304         char *var_name;
 305         struct symbol *sym;
 306         struct smatch_state *estate;
 307         struct stree *tmp_stree;
 308         struct stree *final_states = NULL;
 309         struct range_list *handled_ranges = NULL;
 310         struct call_back_list *same_range_call_backs = NULL;
 311         struct range_list *rl;
 312         int handled = 0;
 313
 314         if (!call_backs)
 315                 return 0;
 316
 317         var_name = expr_to_var_sym(expr->left, &sym);
 318         if (!var_name || !sym)
 319                 goto free;
 320
 321         FOR_EACH_PTR(call_backs, tmp) {
 322                 if (tmp->type != RANGED_CALL &&
 323                     tmp->type != RANGED_EXACT)
 324                         continue;
 325
 326                 if (in_list_exact_sval(handled_ranges, tmp->range))
 327                         continue;
 328                 __push_fake_cur_stree();
 329                 tack_on(&handled_ranges, tmp->range);
 330
 331                 same_range_call_backs = get_same_ranged_call_backs(call_backs, tmp->range);
 332                 call_ranged_call_backs(same_range_call_backs, fn, expr->right, expr);
 333                 __free_ptr_list((struct ptr_list **)&same_range_call_backs);
 334
 335                 rl = alloc_rl(tmp->range->min, tmp->range->max);
 336                 rl = cast_rl(get_type(expr->left), rl);
 337                 estate = alloc_estate_rl(rl);
 338                 set_extra_mod(var_name, sym, expr->left, estate);
 339
 340                 tmp_stree = __pop_fake_cur_stree();
 341                 merge_fake_stree(&final_states, tmp_stree);
 342                 free_stree(&tmp_stree);
 343                 handled = 1;
 344         } END_FOR_EACH_PTR(tmp);
 345
 346         FOR_EACH_SM(final_states, sm) {
 347                 __set_sm(sm);
 348         } END_FOR_EACH_SM(sm);
 349
 350         free_stree(&final_states);
 351 free:
 352         free_string(var_name);
 353         return handled;
 354 }
 355
 356 static void call_implies_callbacks(int comparison, struct expression *expr, sval_t sval, int left, struct stree **implied_true, struct stree **implied_false)
 357 {
 358         struct call_back_list *call_backs;
 359         struct fcall_back *tmp;
 360         const char *fn;
 361         struct data_range *value_range;
 362         struct stree *true_states = NULL;
 363         struct stree *false_states = NULL;
 364         struct stree *tmp_stree;
 365
 366         *implied_true = NULL;
 367         *implied_false = NULL;
 368         if (expr->fn->type != EXPR_SYMBOL || !expr->fn->symbol)
 369                 return;
 370         fn = expr->fn->symbol->ident->name;
 371         call_backs = search_callback(func_hash, (char *)expr->fn->symbol->ident->name);
 372         if (!call_backs)
 373                 return;
 374         value_range = alloc_range(sval, sval);
 375
 376         /* set true states */
 377         __push_fake_cur_stree();
 378         FOR_EACH_PTR(call_backs, tmp) {
 379                 if (tmp->type != RANGED_CALL &&
 380                     tmp->type != RANGED_EXACT)
 381                         continue;
 382                 if (!true_comparison_range_LR(comparison, tmp->range, value_range, left))
 383                         continue;
 384                 (tmp->u.ranged)(fn, expr, NULL, tmp->info);
 385         } END_FOR_EACH_PTR(tmp);
 386         tmp_stree = __pop_fake_cur_stree();
 387         merge_fake_stree(&true_states, tmp_stree);
 388         free_stree(&tmp_stree);
 389
 390         /* set false states */
 391         __push_fake_cur_stree();
 392         FOR_EACH_PTR(call_backs, tmp) {
 393                 if (tmp->type != RANGED_CALL &&
 394                     tmp->type != RANGED_EXACT)
 395                         continue;
 396                 if (!false_comparison_range_LR(comparison, tmp->range, value_range, left))
 397                         continue;
 398                 (tmp->u.ranged)(fn, expr, NULL, tmp->info);
 399         } END_FOR_EACH_PTR(tmp);
 400         tmp_stree = __pop_fake_cur_stree();
 401         merge_fake_stree(&false_states, tmp_stree);
 402         free_stree(&tmp_stree);
 403
 404         *implied_true = true_states;
 405         *implied_false = false_states;
 406 }
 407
 408 struct db_callback_info {
 409         int true_side;
 410         int comparison;
 411         struct expression *expr;
 412         struct range_list *rl;
 413         int left;
 414         struct stree *stree;
 415         struct stree *implied;
 416         struct db_implies_list *callbacks;
 417         int prev_return_id;
 418         int cull;
 419         int has_states;
 420         char *ret_str;
 421         struct smatch_state *ret_state;
 422         struct expression *var_expr;
 423         int handled;
 424 };
 425
 426 static void set_implied_states(struct db_callback_info *db_info)
 427 {
 428         struct sm_state *sm;
 429
 430         FOR_EACH_SM(db_info->implied, sm) {
 431                 __set_sm(sm);
 432         } END_FOR_EACH_SM(sm);
 433
 434         free_stree(&db_info->implied);
 435 }
 436
 437 static void store_return_state(struct db_callback_info *db_info, const char *ret_str, struct smatch_state *state)
 438 {
 439         db_info->ret_str = alloc_sname(ret_str),
 440         db_info->ret_state = state;
 441 }
 442
 443 static bool fake_a_param_assignment(struct expression *expr, const char *ret_str, struct smatch_state *orig)
 444 {
 445         struct expression *arg, *left, *right, *tmp, *fake_assign;
 446         char *p;
 447         int param;
 448         char buf[256];
 449         char *str;
 450
 451         if (expr->type != EXPR_ASSIGNMENT || expr->op != '=')
 452                 return false;
 453         left = expr->left;
 454         right = expr->right;
 455
 456         while (right->type == EXPR_ASSIGNMENT)
 457                 right = strip_expr(right->right);
 458         if (!right || right->type != EXPR_CALL)
 459                 return false;
 460
 461         p = strchr(ret_str, '[');
 462         if (!p)
 463                 return false;
 464
 465         p++;
 466         if (p[0] == '=' && p[1] == '=')
 467                 p += 2;
 468         if (p[0] != '$')
 469                 return false;
 470
 471         snprintf(buf, sizeof(buf), "%s", p);
 472
 473         p = buf;
 474         p += 1;
 475         param = strtol(p, &p, 10);
 476
 477         p = strchr(p, ']');
 478         if (!p || *p != ']')
 479                 return false;
 480         *p = '\0';
 481
 482         arg = get_argument_from_call_expr(right->args, param);
 483         if (!arg)
 484                 return false;
 485
 486         /* There should be a get_other_name() function which returns an expr */
 487         tmp = get_assigned_expr(arg);
 488         if (tmp)
 489                 arg = tmp;
 490
 491         /*
 492          * This is a sanity check to prevent side effects from evaluating stuff
 493          * twice.
 494          */
 495         str = expr_to_chunk_sym_vsl(arg, NULL, NULL);
 496         if (!str)
 497                 return false;
 498         free_string(str);
 499
 500         right = gen_expression_from_key(arg, buf);
 501         if (!right)  /* Mostly fails for binops like [$0 + 4032] */
 502                 return false;
 503         fake_assign = assign_expression(left, '=', right);
 504         __in_fake_parameter_assign++;
 505         __split_expr(fake_assign);
 506         __in_fake_parameter_assign--;
 507
 508         /*
 509          * If the return is "0-65531[$0->nla_len - 4]" the faked expression
 510          * is maybe (-4)-65531 but we know it is in the 0-65531 range so both
 511          * parts have to be considered.  We use _nomod() because it's not really
 512          * another modification, it's just a clarification.
 513          *
 514          */
 515         if (estate_rl(orig)) {
 516                 struct smatch_state *faked;
 517                 struct range_list *rl;
 518
 519                 faked = get_extra_state(left);
 520                 if (estate_rl(faked)) {
 521                         rl = rl_intersection(estate_rl(faked), estate_rl(orig));
 522                         if (rl)
 523                                 set_extra_expr_nomod(expr, alloc_estate_rl(rl));
 524                 }
 525         }
 526
 527         return true;
 528 }
 529
 530 static void set_fresh_mtag_returns(struct db_callback_info *db_info)
 531 {
 532         struct expression *expr = db_info->expr->left;
 533         struct smatch_state *state;
 534
 535         if (!db_info->ret_state)
 536                 return;
 537
 538         state = alloc_estate_rl(cast_rl(get_type(expr), clone_rl(estate_rl(db_info->ret_state))));
 539         state = get_mtag_return(db_info->expr, state);
 540         if (!state)
 541                 return;
 542
 543         set_real_absolute(expr, state);
 544         set_extra_expr_mod(expr, state);
 545
 546         db_info->ret_state = NULL;
 547         db_info->ret_str = NULL;
 548 }
 549
 550 static void set_return_assign_state(struct db_callback_info *db_info)
 551 {
 552         struct expression *expr = db_info->expr->left;
 553         struct smatch_state *state;
 554
 555         if (!db_info->ret_state)
 556                 return;
 557
 558         state = alloc_estate_rl(cast_rl(get_type(expr), clone_rl(estate_rl(db_info->ret_state))));
 559         if (!fake_a_param_assignment(db_info->expr, db_info->ret_str, state))
 560                 set_extra_expr_mod(expr, state);
 561
 562         db_info->ret_state = NULL;
 563         db_info->ret_str = NULL;
 564 }
 565
 566 static void set_other_side_state(struct db_callback_info *db_info)
 567 {
 568         struct expression *expr = db_info->var_expr;
 569         struct smatch_state *state;
 570
 571         if (!db_info->ret_state)
 572                 return;
 573
 574         state = alloc_estate_rl(cast_rl(get_type(expr), clone_rl(estate_rl(db_info->ret_state))));
 575         set_extra_expr_nomod(expr, state);
 576         db_info->ret_state = NULL;
 577         db_info->ret_str = NULL;
 578 }
 579
 580 static void handle_ret_equals_param(char *ret_string, struct range_list *rl, struct expression *call)
 581 {
 582         char *str;
 583         long long param;
 584         struct expression *arg;
 585         struct range_list *orig;
 586
 587         str = strstr(ret_string, "==$");
 588         if (!str)
 589                 return;
 590         str += 3;
 591         param = strtoll(str, NULL, 10);
 592         arg = get_argument_from_call_expr(call->args, param);
 593         if (!arg)
 594                 return;
 595         get_absolute_rl(arg, &orig);
 596         rl = rl_intersection(orig, rl);
 597         if (!rl)
 598                 return;
 599         set_extra_expr_nomod(arg, alloc_estate_rl(rl));
 600 }
 601
 602 static int impossible_limit(struct expression *expr, int param, char *key, char *value)
 603 {
 604         struct expression *arg;
 605         struct smatch_state *state;
 606         struct range_list *passed;
 607         struct range_list *limit;
 608         struct symbol *compare_type;
 609
 610         while (expr->type == EXPR_ASSIGNMENT)
 611                 expr = strip_expr(expr->right);
 612         if (expr->type != EXPR_CALL)
 613                 return 0;
 614
 615         arg = get_argument_from_call_expr(expr->args, param);
 616         if (!arg)
 617                 return 0;
 618
 619         if (strcmp(key, "$") == 0) {
 620                 if (!get_implied_rl(arg, &passed))
 621                         return 0;
 622
 623                 compare_type = get_arg_type(expr->fn, param);
 624         } else {
 625                 char *name;
 626                 struct symbol *sym;
 627
 628                 name = get_variable_from_key(arg, key, &sym);
 629                 if (!name || !sym)
 630                         return 0;
 631
 632                 state = get_state(SMATCH_EXTRA, name, sym);
 633                 if (!state) {
 634                         free_string(name);
 635                         return 0;
 636                 }
 637                 passed = estate_rl(state);
 638                 if (!passed || is_whole_rl(passed)) {
 639                         free_string(name);
 640                         return 0;
 641                 }
 642
 643                 compare_type = get_member_type_from_key(arg, key);
 644         }
 645
 646         passed = cast_rl(compare_type, passed);
 647         call_results_to_rl(expr, compare_type, value, &limit);
 648         if (!limit || is_whole_rl(limit))
 649                 return 0;
 650         if (possibly_true_rl(passed, SPECIAL_EQUAL, limit))
 651                 return 0;
 652         if (option_debug || local_debug)
 653                 sm_msg("impossible: %d '%s' limit '%s' == '%s'", param, key, show_rl(passed), value);
 654         return 1;
 655 }
 656
 657 static int is_impossible_data(int type, struct expression *expr, int param, char *key, char *value)
 658 {
 659         if (type == PARAM_LIMIT && impossible_limit(expr, param, key, value))
 660                 return 1;
 661         if (type == COMPARE_LIMIT && param_compare_limit_is_impossible(expr, param, key, value)) {
 662                 if (local_debug)
 663                         sm_msg("param_compare_limit_is_impossible: %d %s %s", param, key, value);
 664                 return 1;
 665         }
 666         return 0;
 667 }
 668
 669 static int func_type_mismatch(struct expression *expr, const char *value)
 670 {
 671         struct symbol *type;
 672
 673         /* This makes faking returns easier */
 674         if (!value || value[0] == '\0')
 675                 return 0;
 676
 677         while (expr->type == EXPR_ASSIGNMENT)
 678                 expr = strip_expr(expr->right);
 679
 680         /*
 681          * Short cut:  We only care about function pointers that are struct
 682          * members.
 683          *
 684          */
 685         if (expr->fn->type == EXPR_SYMBOL)
 686                 return 0;
 687
 688         type = get_type(expr->fn);
 689         if (!type)
 690                 return 0;
 691         if (type->type == SYM_PTR)
 692                 type = get_real_base_type(type);
 693
 694         if (strcmp(type_to_str(type), value) == 0)
 695                 return 0;
 696
 697         return 1;
 698 }
 699
 700 static int db_compare_callback(void *_info, int argc, char **argv, char **azColName)
 701 {
 702         struct db_callback_info *db_info = _info;
 703         struct range_list *var_rl = db_info->rl;
 704         struct range_list *ret_range;
 705         int type, param;
 706         char *ret_str, *key, *value;
 707         struct return_implies_callback *tmp;
 708         struct stree *stree;
 709         int return_id;
 710         int comparison;
 711
 712         if (argc != 6)
 713                 return 0;
 714
 715         return_id = atoi(argv[0]);
 716         ret_str = argv[1];
 717         type = atoi(argv[2]);
 718         param = atoi(argv[3]);
 719         key = argv[4];
 720         value = argv[5];
 721
 722         db_info->has_states = 1;
 723         if (db_info->prev_return_id != -1 && type == INTERNAL) {
 724                 set_other_side_state(db_info);
 725                 set_implied_states(db_info);
 726                 stree = __pop_fake_cur_stree();
 727                 if (!db_info->cull)
 728                         merge_fake_stree(&db_info->stree, stree);
 729                 free_stree(&stree);
 730                 __push_fake_cur_stree();
 731                 db_info->cull = 0;
 732         }
 733         db_info->prev_return_id = return_id;
 734
 735         if (type == INTERNAL && func_type_mismatch(db_info->expr, value))
 736                 db_info->cull = 1;
 737         if (db_info->cull)
 738                 return 0;
 739         if (type == CULL_PATH) {
 740                 db_info->cull = 1;
 741                 return 0;
 742         }
 743
 744         if (is_impossible_data(type, db_info->expr, param, key, value)) {
 745                 db_info->cull = 1;
 746                 return 0;
 747         }
 748
 749         call_results_to_rl(db_info->expr, get_type(strip_expr(db_info->expr)), ret_str, &ret_range);
 750         ret_range = cast_rl(get_type(db_info->expr), ret_range);
 751         if (!ret_range)
 752                 ret_range = alloc_whole_rl(get_type(db_info->expr));
 753
 754         comparison = db_info->comparison;
 755         if (db_info->left)
 756                 comparison = flip_comparison(comparison);
 757
 758         if (db_info->true_side) {
 759                 if (!possibly_true_rl(var_rl, comparison, ret_range))
 760                         return 0;
 761                 if (type == PARAM_LIMIT)
 762                         param_limit_implications(db_info->expr, param, key, value, &db_info->implied);
 763                 else if (type > PARAM_LIMIT)
 764                         set_implied_states(db_info);
 765                 filter_by_comparison(&var_rl, comparison, ret_range);
 766                 filter_by_comparison(&ret_range, flip_comparison(comparison), var_rl);
 767         } else {
 768                 if (!possibly_false_rl(var_rl, comparison, ret_range))
 769                         return 0;
 770                 if (type == PARAM_LIMIT)
 771                         param_limit_implications(db_info->expr, param, key, value, &db_info->implied);
 772                 else if (type > PARAM_LIMIT)
 773                         set_implied_states(db_info);
 774                 filter_by_comparison(&var_rl, negate_comparison(comparison), ret_range);
 775                 filter_by_comparison(&ret_range, flip_comparison(negate_comparison(comparison)), var_rl);
 776         }
 777
 778         handle_ret_equals_param(ret_str, ret_range, db_info->expr);
 779
 780         if (type == INTERNAL) {
 781                 set_state(-1, "unnull_path", NULL, &true_state);
 782                 __add_return_comparison(strip_expr(db_info->expr), ret_str);
 783                 __add_return_to_param_mapping(db_info->expr, ret_str);
 784                 store_return_state(db_info, ret_str, alloc_estate_rl(clone_rl(var_rl)));
 785         }
 786
 787         FOR_EACH_PTR(db_info->callbacks, tmp) {
 788                 if (tmp->type == type)
 789                         tmp->callback(db_info->expr, param, key, value);
 790         } END_FOR_EACH_PTR(tmp);
 791
 792         return 0;
 793 }
 794
 795 static void compare_db_return_states_callbacks(struct expression *left, int comparison, struct expression *right, struct stree *implied_true, struct stree *implied_false)
 796 {
 797         struct stree *orig_states;
 798         struct stree *stree;
 799         struct stree *true_states;
 800         struct stree *false_states;
 801         struct sm_state *sm;
 802         struct db_callback_info db_info = {};
 803         struct expression *var_expr;
 804         struct expression *call_expr;
 805         struct range_list *rl;
 806         int call_on_left;
 807
 808         orig_states = clone_stree(__get_cur_stree());
 809
 810         /* legacy cruft.  need to fix call_implies_callbacks(). */
 811         call_on_left = 1;
 812         call_expr = left;
 813         var_expr = right;
 814         if (left->type != EXPR_CALL) {
 815                 call_on_left = 0;
 816                 call_expr = right;
 817                 var_expr = left;
 818         }
 819
 820         get_absolute_rl(var_expr, &rl);
 821
 822         db_info.comparison = comparison;
 823         db_info.expr = call_expr;
 824         db_info.rl = rl;
 825         db_info.left = call_on_left;
 826         db_info.callbacks = db_return_states_list;
 827         db_info.var_expr = var_expr;
 828
 829         call_return_states_before_hooks();
 830
 831         db_info.true_side = 1;
 832         db_info.stree = NULL;
 833         db_info.prev_return_id = -1;
 834         __push_fake_cur_stree();
 835         sql_select_return_states("return_id, return, type, parameter, key, value",
 836                                  call_expr, db_compare_callback, &db_info);
 837         set_other_side_state(&db_info);
 838         set_implied_states(&db_info);
 839         stree = __pop_fake_cur_stree();
 840         if (!db_info.cull)
 841                 merge_fake_stree(&db_info.stree, stree);
 842         free_stree(&stree);
 843         true_states = db_info.stree;
 844         if (!true_states && db_info.has_states) {
 845                 __push_fake_cur_stree();
 846                 set_path_impossible();
 847                 true_states = __pop_fake_cur_stree();
 848         }
 849
 850         nullify_path();
 851         __unnullify_path();
 852         FOR_EACH_SM(orig_states, sm) {
 853                 __set_sm_cur_stree(sm);
 854         } END_FOR_EACH_SM(sm);
 855
 856         db_info.true_side = 0;
 857         db_info.stree = NULL;
 858         db_info.prev_return_id = -1;
 859         db_info.cull = 0;
 860         __push_fake_cur_stree();
 861         sql_select_return_states("return_id, return, type, parameter, key, value", call_expr,
 862                         db_compare_callback, &db_info);
 863         set_other_side_state(&db_info);
 864         set_implied_states(&db_info);
 865         stree = __pop_fake_cur_stree();
 866         if (!db_info.cull)
 867                 merge_fake_stree(&db_info.stree, stree);
 868         free_stree(&stree);
 869         false_states = db_info.stree;
 870         if (!false_states && db_info.has_states) {
 871                 __push_fake_cur_stree();
 872                 set_path_impossible();
 873                 false_states = __pop_fake_cur_stree();
 874         }
 875
 876         nullify_path();
 877         __unnullify_path();
 878         FOR_EACH_SM(orig_states, sm) {
 879                 __set_sm_cur_stree(sm);
 880         } END_FOR_EACH_SM(sm);
 881
 882         free_stree(&orig_states);
 883
 884         FOR_EACH_SM(true_states, sm) {
 885                 __set_true_false_sm(sm, NULL);
 886         } END_FOR_EACH_SM(sm);
 887         FOR_EACH_SM(false_states, sm) {
 888                 __set_true_false_sm(NULL, sm);
 889         } END_FOR_EACH_SM(sm);
 890
 891         free_stree(&true_states);
 892         free_stree(&false_states);
 893
 894         call_return_states_after_hooks(call_expr);
 895
 896         FOR_EACH_SM(implied_true, sm) {
 897                 __set_true_false_sm(sm, NULL);
 898         } END_FOR_EACH_SM(sm);
 899         FOR_EACH_SM(implied_false, sm) {
 900                 __set_true_false_sm(NULL, sm);
 901         } END_FOR_EACH_SM(sm);
 902 }
 903
 904 void function_comparison(struct expression *left, int comparison, struct expression *right)
 905 {
 906         struct expression *var_expr;
 907         struct expression *call_expr;
 908         struct stree *implied_true = NULL;
 909         struct stree *implied_false = NULL;
 910         struct range_list *rl;
 911         sval_t sval;
 912         int call_on_left;
 913
 914         if (unreachable())
 915                 return;
 916
 917         /* legacy cruft.  need to fix call_implies_callbacks(). */
 918         call_on_left = 1;
 919         call_expr = left;
 920         var_expr = right;
 921         if (left->type != EXPR_CALL) {
 922                 call_on_left = 0;
 923                 call_expr = right;
 924                 var_expr = left;
 925         }
 926
 927         get_absolute_rl(var_expr, &rl);
 928
 929         if (rl_to_sval(rl, &sval))
 930                 call_implies_callbacks(comparison, call_expr, sval, call_on_left, &implied_true, &implied_false);
 931
 932         compare_db_return_states_callbacks(left, comparison, right, implied_true, implied_false);
 933         free_stree(&implied_true);
 934         free_stree(&implied_false);
 935 }
 936
 937 static void call_ranged_return_hooks(struct db_callback_info *db_info)
 938 {
 939         struct call_back_list *call_backs;
 940         struct range_list *range_rl;
 941         struct expression *expr;
 942         struct fcall_back *tmp;
 943         char *fn;
 944
 945         expr = strip_expr(db_info->expr);
 946         while (expr->type == EXPR_ASSIGNMENT)
 947                 expr = strip_expr(expr->right);
 948         if (expr->type != EXPR_CALL ||
 949             expr->fn->type != EXPR_SYMBOL)
 950                 return;
 951
 952         fn = expr->fn->symbol_name->name;
 953
 954         call_backs = search_callback(func_hash, fn);
 955         FOR_EACH_PTR(call_backs, tmp) {
 956                 if (tmp->type != RANGED_CALL)
 957                         continue;
 958                 range_rl = alloc_rl(tmp->range->min, tmp->range->max);
 959                 range_rl = cast_rl(estate_type(db_info->ret_state), range_rl);
 960                 if (possibly_true_rl(range_rl, SPECIAL_EQUAL, estate_rl(db_info->ret_state)))
 961                         (tmp->u.ranged)(fn, expr, db_info->expr, tmp->info);
 962         } END_FOR_EACH_PTR(tmp);
 963
 964         FOR_EACH_PTR(call_backs, tmp) {
 965                 if (tmp->type != RANGED_EXACT)
 966                         continue;
 967                 if (!estate_rl(db_info->ret_state))
 968                         continue;
 969
 970                 range_rl = alloc_rl(tmp->range->min, tmp->range->max);
 971                 range_rl = cast_rl(estate_type(db_info->ret_state), range_rl);
 972
 973                 /*
 974                  * If there is an returned value out of range then this is not
 975                  * an exact match.  In other words, "0,4096-ptr_max" is not
 976                  * necessarily a valid match.
 977                  *
 978                  */
 979                 if (remove_range(estate_rl(db_info->ret_state),
 980                                  rl_min(range_rl), rl_max(range_rl)))
 981                         continue;
 982                 (tmp->u.ranged)(fn, expr, db_info->expr, tmp->info);
 983         } END_FOR_EACH_PTR(tmp);
 984 }
 985
 986 static int db_assign_return_states_callback(void *_info, int argc, char **argv, char **azColName)
 987 {
 988         struct db_callback_info *db_info = _info;
 989         struct range_list *ret_range;
 990         int type, param;
 991         char *ret_str, *key, *value;
 992         struct return_implies_callback *tmp;
 993         struct stree *stree;
 994         int return_id;
 995
 996         if (argc != 6)
 997                 return 0;
 998
 999         return_id = atoi(argv[0]);
1000         ret_str = argv[1];
1001         type = atoi(argv[2]);
1002         param = atoi(argv[3]);
1003         key = argv[4];
1004         value = argv[5];
1005
1006         if (db_info->prev_return_id != -1 && type == INTERNAL) {
1007                 call_ranged_return_hooks(db_info);
1008                 set_return_assign_state(db_info);
1009                 set_implied_states(db_info);
1010                 stree = __pop_fake_cur_stree();
1011                 if (!db_info->cull)
1012                         merge_fake_stree(&db_info->stree, stree);
1013                 free_stree(&stree);
1014                 __push_fake_cur_stree();
1015                 db_info->cull = 0;
1016         }
1017         db_info->prev_return_id = return_id;
1018
1019         if (type == INTERNAL && func_type_mismatch(db_info->expr, value))
1020                 db_info->cull = 1;
1021         if (db_info->cull)
1022                 return 0;
1023         if (type == CULL_PATH) {
1024                 db_info->cull = 1;
1025                 return 0;
1026         }
1027         if (is_impossible_data(type, db_info->expr, param, key, value)) {
1028                 db_info->cull = 1;
1029                 return 0;
1030         }
1031
1032         if (type == PARAM_LIMIT)
1033                 param_limit_implications(db_info->expr, param, key, value, &db_info->implied);
1034         else if (type > PARAM_LIMIT)
1035                 set_implied_states(db_info);
1036
1037         db_info->handled = 1;
1038         call_results_to_rl(db_info->expr->right, get_type(strip_expr(db_info->expr->right)), ret_str, &ret_range);
1039         if (!ret_range)
1040                 ret_range = alloc_whole_rl(get_type(strip_expr(db_info->expr->right)));
1041         ret_range = cast_rl(get_type(db_info->expr->right), ret_range);
1042
1043         if (type == INTERNAL) {
1044                 set_state(-1, "unnull_path", NULL, &true_state);
1045                 __add_return_comparison(strip_expr(db_info->expr->right), ret_str);
1046                 __add_comparison_info(db_info->expr->left, strip_expr(db_info->expr->right), ret_str);
1047                 __add_return_to_param_mapping(db_info->expr, ret_str);
1048                 store_return_state(db_info, ret_str, alloc_estate_rl(ret_range));
1049                 set_fresh_mtag_returns(db_info);
1050         }
1051
1052         FOR_EACH_PTR(db_return_states_list, tmp) {
1053                 if (tmp->type == type)
1054                         tmp->callback(db_info->expr, param, key, value);
1055         } END_FOR_EACH_PTR(tmp);
1056
1057         return 0;
1058 }
1059
1060 static int db_return_states_assign(struct expression *expr)
1061 {
1062         struct expression *right;
1063         struct sm_state *sm;
1064         struct stree *stree;
1065         struct db_callback_info db_info = {};
1066
1067         right = strip_expr(expr->right);
1068
1069         db_info.prev_return_id = -1;
1070         db_info.expr = expr;
1071         db_info.stree = NULL;
1072         db_info.handled = 0;
1073
1074         call_return_states_before_hooks();
1075
1076         __push_fake_cur_stree();
1077         sql_select_return_states("return_id, return, type, parameter, key, value",
1078                         right, db_assign_return_states_callback, &db_info);
1079         if (option_debug) {
1080                 sm_msg("%s return_id %d return_ranges %s",
1081                         db_info.cull ? "culled" : "merging",
1082                         db_info.prev_return_id,
1083                         db_info.ret_state ? db_info.ret_state->name : "'<empty>'");
1084         }
1085         if (db_info.handled)
1086                 call_ranged_return_hooks(&db_info);
1087         set_return_assign_state(&db_info);
1088         set_implied_states(&db_info);
1089         stree = __pop_fake_cur_stree();
1090         if (!db_info.cull)
1091                 merge_fake_stree(&db_info.stree, stree);
1092         free_stree(&stree);
1093
1094         if (!db_info.stree && db_info.cull) { /* this means we culled everything */
1095                 set_extra_expr_mod(expr->left, alloc_estate_whole(get_type(expr->left)));
1096                 set_path_impossible();
1097         }
1098         FOR_EACH_SM(db_info.stree, sm) {
1099                 __set_sm(sm);
1100         } END_FOR_EACH_SM(sm);
1101
1102         free_stree(&db_info.stree);
1103         call_return_states_after_hooks(right);
1104
1105         return db_info.handled;
1106 }
1107
1108 static int handle_implied_return(struct expression *expr)
1109 {
1110         struct range_list *rl;
1111
1112         if (!get_implied_return(expr->right, &rl))
1113                 return 0;
1114         rl = cast_rl(get_type(expr->left), rl);
1115         set_extra_expr_mod(expr->left, alloc_estate_rl(rl));
1116         return 1;
1117 }
1118
1119 static void match_assign_call(struct expression *expr)
1120 {
1121         struct call_back_list *call_backs;
1122         const char *fn;
1123         struct expression *right;
1124         int handled = 0;
1125         struct range_list *rl;
1126
1127         if (expr->op != '=')
1128                 return;
1129
1130         right = strip_expr(expr->right);
1131         if (right->fn->type != EXPR_SYMBOL || !right->fn->symbol) {
1132                 handled |= db_return_states_assign(expr);
1133                 if (!handled)
1134                         goto assigned_unknown;
1135                 return;
1136         }
1137         if (is_fake_call(right)) {
1138                 set_extra_expr_mod(expr->left, alloc_estate_whole(get_type(expr->left)));
1139                 return;
1140         }
1141
1142         fn = right->fn->symbol->ident->name;
1143         call_backs = search_callback(func_hash, (char *)fn);
1144
1145         /*
1146          * The ordering here is sort of important.
1147          * One example, of how this matters is that when we do:
1148          *
1149          *      len = strlen(str);
1150          *
1151          * That is handled by smatch_common_functions.c and smatch_strlen.c.
1152          * They use implied_return and function_assign_hook respectively.
1153          * We want to get the implied return first before we do the function
1154          * assignment hook otherwise we end up writing the wrong thing for len
1155          * in smatch_extra.c because we assume that it already holds the
1156          * strlen() when we haven't set it yet.
1157          */
1158
1159         if (db_return_states_assign(expr) == 1)
1160                 handled = 1;
1161         else
1162                 handled = assign_ranged_funcs(fn, expr, call_backs);
1163         handled |= handle_implied_return(expr);
1164
1165
1166         call_call_backs(call_backs, ASSIGN_CALL, fn, expr);
1167
1168         if (handled)
1169                 return;
1170
1171 assigned_unknown:
1172         get_absolute_rl(expr->right, &rl);
1173         rl = cast_rl(get_type(expr->left), rl);
1174         set_extra_expr_mod(expr->left, alloc_estate_rl(rl));
1175 }
1176
1177 static int db_return_states_callback(void *_info, int argc, char **argv, char **azColName)
1178 {
1179         struct db_callback_info *db_info = _info;
1180         struct range_list *ret_range;
1181         int type, param;
1182         char *ret_str, *key, *value;
1183         struct return_implies_callback *tmp;
1184         struct stree *stree;
1185         int return_id;
1186         char buf[64];
1187
1188         if (argc != 6)
1189                 return 0;
1190
1191         return_id = atoi(argv[0]);
1192         ret_str = argv[1];
1193         type = atoi(argv[2]);
1194         param = atoi(argv[3]);
1195         key = argv[4];
1196         value = argv[5];
1197
1198         if (db_info->prev_return_id != -1 && type == INTERNAL) {
1199                 call_ranged_return_hooks(db_info);
1200                 set_implied_states(db_info);
1201                 stree = __pop_fake_cur_stree();
1202                 if (!db_info->cull)
1203                         merge_fake_stree(&db_info->stree, stree);
1204                 free_stree(&stree);
1205                 __push_fake_cur_stree();
1206                 __unnullify_path();
1207                 db_info->cull = 0;
1208         }
1209         db_info->prev_return_id = return_id;
1210
1211         if (type == INTERNAL && func_type_mismatch(db_info->expr, value))
1212                 db_info->cull = 1;
1213         if (db_info->cull)
1214                 return 0;
1215         if (type == CULL_PATH) {
1216                 db_info->cull = 1;
1217                 return 0;
1218         }
1219         if (is_impossible_data(type, db_info->expr, param, key, value)) {
1220                 db_info->cull = 1;
1221                 return 0;
1222         }
1223
1224         if (type == PARAM_LIMIT)
1225                 param_limit_implications(db_info->expr, param, key, value, &db_info->implied);
1226         else if (type > PARAM_LIMIT)
1227                 set_implied_states(db_info);
1228
1229         call_results_to_rl(db_info->expr, get_type(strip_expr(db_info->expr)), ret_str, &ret_range);
1230         ret_range = cast_rl(get_type(db_info->expr), ret_range);
1231
1232         if (type == INTERNAL) {
1233                 struct smatch_state *state;
1234
1235                 set_state(-1, "unnull_path", NULL, &true_state);
1236                 __add_return_comparison(strip_expr(db_info->expr), ret_str);
1237                 __add_return_to_param_mapping(db_info->expr, ret_str);
1238                 /*
1239                  * We want to store the return values so that we can split the strees
1240                  * in smatch_db.c.  This uses set_state() directly because it's not a
1241                  * real smatch_extra state.
1242                  */
1243                 snprintf(buf, sizeof(buf), "return %p", db_info->expr);
1244                 state = alloc_estate_rl(ret_range);
1245                 set_state(SMATCH_EXTRA, buf, NULL, state);
1246                 store_return_state(db_info, ret_str, state);
1247         }
1248
1249         FOR_EACH_PTR(db_return_states_list, tmp) {
1250                 if (tmp->type == type)
1251                         tmp->callback(db_info->expr, param, key, value);
1252         } END_FOR_EACH_PTR(tmp);
1253
1254
1255         return 0;
1256 }
1257
1258 static void db_return_states(struct expression *expr)
1259 {
1260         struct sm_state *sm;
1261         struct stree *stree;
1262         struct db_callback_info db_info = {};
1263
1264         if (!__get_cur_stree())  /* no return functions */
1265                 return;
1266
1267         db_info.prev_return_id = -1;
1268         db_info.expr = expr;
1269         db_info.stree = NULL;
1270
1271         call_return_states_before_hooks();
1272
1273         __push_fake_cur_stree();
1274         __unnullify_path();
1275         sql_select_return_states("return_id, return, type, parameter, key, value",
1276                         expr, db_return_states_callback, &db_info);
1277         call_ranged_return_hooks(&db_info);
1278         set_implied_states(&db_info);
1279         stree = __pop_fake_cur_stree();
1280         if (!db_info.cull)
1281                 merge_fake_stree(&db_info.stree, stree);
1282         free_stree(&stree);
1283
1284         FOR_EACH_SM(db_info.stree, sm) {
1285                 __set_sm(sm);
1286         } END_FOR_EACH_SM(sm);
1287
1288         free_stree(&db_info.stree);
1289         call_return_states_after_hooks(expr);
1290 }
1291
1292 static int is_condition_call(struct expression *expr)
1293 {
1294         struct expression *tmp;
1295
1296         FOR_EACH_PTR_REVERSE(big_condition_stack, tmp) {
1297                 if (expr == tmp || expr_get_parent_expr(expr) == tmp)
1298                         return 1;
1299                 if (tmp->pos.line < expr->pos.line)
1300                         return 0;
1301         } END_FOR_EACH_PTR_REVERSE(tmp);
1302
1303         return 0;
1304 }
1305
1306 static void db_return_states_call(struct expression *expr)
1307 {
1308         if (unreachable())
1309                 return;
1310
1311         if (is_assigned_call(expr) || is_fake_assigned_call(expr))
1312                 return;
1313         if (is_condition_call(expr))
1314                 return;
1315         db_return_states(expr);
1316 }
1317
1318 static void match_function_call(struct expression *expr)
1319 {
1320         struct call_back_list *call_backs;
1321         struct expression *fn;
1322
1323         fn = strip_expr(expr->fn);
1324         if (fn->type == EXPR_SYMBOL && fn->symbol) {
1325                 call_backs = search_callback(func_hash, (char *)fn->symbol->ident->name);
1326                 if (call_backs)
1327                         call_call_backs(call_backs, REGULAR_CALL,
1328                                         fn->symbol->ident->name, expr);
1329         }
1330         db_return_states_call(expr);
1331 }
1332
1333 static void match_macro_assign(struct expression *expr)
1334 {
1335         struct call_back_list *call_backs;
1336         const char *macro;
1337         struct expression *right;
1338
1339         right = strip_expr(expr->right);
1340         macro = get_macro_name(right->pos);
1341         call_backs = search_callback(func_hash, (char *)macro);
1342         if (!call_backs)
1343                 return;
1344         call_call_backs(call_backs, MACRO_ASSIGN, macro, expr);
1345         call_call_backs(call_backs, MACRO_ASSIGN_EXTRA, macro, expr);
1346 }
1347
1348 int get_implied_return(struct expression *expr, struct range_list **rl)
1349 {
1350         struct call_back_list *call_backs;
1351         struct fcall_back *tmp;
1352         int handled = 0;
1353         char *fn;
1354
1355         *rl = NULL;
1356
1357         expr = strip_expr(expr);
1358         fn = expr_to_var(expr->fn);
1359         if (!fn)
1360                 goto out;
1361
1362         call_backs = search_callback(func_hash, fn);
1363
1364         FOR_EACH_PTR(call_backs, tmp) {
1365                 if (tmp->type == IMPLIED_RETURN)
1366                         handled |= (tmp->u.implied_return)(expr, tmp->info, rl);
1367         } END_FOR_EACH_PTR(tmp);
1368
1369 out:
1370         free_string(fn);
1371         return handled;
1372 }
1373
1374 struct range_list *get_range_implications(const char *fn)
1375 {
1376         struct call_back_list *call_backs;
1377         struct range_list *ret = NULL;
1378         struct fcall_back *tmp;
1379
1380         call_backs = search_callback(func_hash, (char *)fn);
1381
1382         FOR_EACH_PTR(call_backs, tmp) {
1383                 if (tmp->type != RANGED_CALL &&
1384                     tmp->type != RANGED_EXACT)
1385                         continue;
1386                 add_ptr_list(&ret, tmp->range);
1387         } END_FOR_EACH_PTR(tmp);
1388
1389         return ret;
1390 }
1391
1392 void create_function_hook_hash(void)
1393 {
1394         func_hash = create_function_hashtable(5000);
1395 }
1396
1397 void register_function_hooks(int id)
1398 {
1399         add_hook(&match_function_call, CALL_HOOK_AFTER_INLINE);
1400         add_hook(&match_assign_call, CALL_ASSIGNMENT_HOOK);
1401         add_hook(&match_macro_assign, MACRO_ASSIGNMENT_HOOK);
1402 }