smatch_untracked_param.c

   1 /*
   2  * Copyright (C) 2014 Oracle.
   3  *
   4  * This program is free software; you can redistribute it and/or
   5  * modify it under the terms of the GNU General Public License
   6  * as published by the Free Software Foundation; either version 2
   7  * of the License, or (at your option) any later version.
   8  *
   9  * This program is distributed in the hope that it will be useful,
  10  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  11  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  12  * GNU General Public License for more details.
  13  *
  14  * You should have received a copy of the GNU General Public License
  15  * along with this program; if not, see http://www.gnu.org/copyleft/gpl.txt
  16  */
  17
  18 /*
  19  * Sometimes we aren't able to track a variable through a function call.  This
  20  * usually happens because a function changes too many variables so we give up.
  21  * Another reason this happens is because we call a function pointer and there
  22  * are too many functions which implement that function pointer so we give up.
  23  * Also maybe we don't have the database enabled.
  24  *
  25  * The goal here is to make a call back so what if we call:
  26  *
  27  *      frob(&foo);
  28  *
  29  * but we're not able to say what happens to "foo", then let's assume that we
  30  * don't know anything about "foo" if it's an untracked call.
  31  *
  32  */
  33
  34 #include "smatch.h"
  35 #include "smatch_slist.h"
  36 #include "smatch_extra.h"
  37
  38 static int my_id;
  39 static int tracked;
  40
  41 STATE(untracked);
  42
  43 typedef void (untracked_hook)(struct expression *call, int param);
  44 DECLARE_PTR_LIST(untracked_hook_list, untracked_hook *);
  45 static struct untracked_hook_list *untracked_hooks;
  46
  47 void add_untracked_param_hook(void (func)(struct expression *call, int param))
  48 {
  49         untracked_hook **p = malloc(sizeof(untracked_hook *));
  50         *p = func;
  51         add_ptr_list(&untracked_hooks, p);
  52 }
  53
  54 static void call_untracked_callbacks(struct expression *expr, int param)
  55 {
  56         untracked_hook **fn;
  57
  58         FOR_EACH_PTR(untracked_hooks, fn) {
  59                 (*fn)(expr, param);
  60         } END_FOR_EACH_PTR(fn);
  61 }
  62
  63 static void assume_tracked(struct expression *call_expr, int param, char *key, char *value)
  64 {
  65         tracked = 1;
  66 }
  67
  68 static void mark_untracked(struct expression *expr, int param, char *key, char *value)
  69 {
  70         char *name;
  71         struct symbol *sym;
  72
  73         while (expr->type == EXPR_ASSIGNMENT)
  74                 expr = strip_expr(expr->right);
  75         if (expr->type != EXPR_CALL)
  76                 return;
  77
  78         name = return_state_to_var_sym(expr, param, key, &sym);
  79         if (!name || !sym)
  80                 goto free;
  81
  82         call_untracked_callbacks(expr, param);
  83         set_state(my_id, name, sym, &untracked);
  84 free:
  85         free_string(name);
  86 }
  87
  88 static int lost_in_va_args(struct expression *expr)
  89 {
  90         struct symbol *fn;
  91         char *name;
  92         int is_lost;
  93
  94         fn = get_type(expr->fn);
  95         if (!fn || !fn->variadic)
  96                 return 0;
  97
  98         is_lost = 1;
  99         name = expr_to_var(expr->fn);
 100         if (strstr(name, "print"))
 101                 is_lost = 0;
 102         free_string(name);
 103
 104         return is_lost;
 105 }
 106
 107 static void match_after_call(struct expression *expr)
 108 {
 109         struct expression *arg;
 110         struct symbol *type;
 111         int i;
 112
 113
 114         if (lost_in_va_args(expr))
 115                 tracked = 0;
 116
 117         if (tracked) {
 118                 tracked = 0;
 119                 return;
 120         }
 121
 122         i = -1;
 123         FOR_EACH_PTR(expr->args, arg) {
 124                 i++;
 125
 126                 type = get_type(arg);
 127                 if (!type || type->type != SYM_PTR)
 128                         continue;
 129
 130                 call_untracked_callbacks(expr, i);
 131                 set_state_expr(my_id, arg, &untracked);
 132         } END_FOR_EACH_PTR(arg);
 133 }
 134
 135 static void print_untracked_params(int return_id, char *return_ranges, struct expression *expr)
 136 {
 137         struct symbol *arg;
 138         int param;
 139
 140         param = -1;
 141         FOR_EACH_PTR(cur_func_sym->ctype.base_type->arguments, arg) {
 142                 param++;
 143
 144                 if (!arg->ident)
 145                         continue;
 146                 if (!get_state(my_id, arg->ident->name, arg))
 147                         continue;
 148
 149                 sql_insert_return_states(return_id, return_ranges,
 150                                          UNTRACKED_PARAM, param, "$", "");
 151         } END_FOR_EACH_PTR(arg);
 152 }
 153
 154 static void match_param_assign(struct expression *expr)
 155 {
 156         struct expression *right;
 157         struct symbol *type;
 158         int param;
 159
 160         if (__in_fake_assign)
 161                 return;
 162
 163         right = strip_expr(expr->right);
 164         type = get_type(right);
 165         if (!type || type->type != SYM_PTR)
 166                 return;
 167
 168         param = get_param_num(right);
 169         if (param < 0)
 170                 return;
 171
 172         set_state_expr(my_id, right, &untracked);
 173 }
 174
 175
 176 static void match_param_assign_in_asm(struct statement *stmt)
 177 {
 178
 179         struct expression *expr;
 180         struct symbol *type;
 181         int state = 0;
 182         int param;
 183
 184         FOR_EACH_PTR(stmt->asm_inputs, expr) {
 185                 switch (state) {
 186                 case 0: /* identifier */
 187                 case 1: /* constraint */
 188                         state++;
 189                         continue;
 190                 case 2: /* expression */
 191                         state = 0;
 192
 193                         expr = strip_expr(expr);
 194                         type = get_type(expr);
 195                         if (!type || type->type != SYM_PTR)
 196                                 continue;
 197                         param = get_param_num(expr);
 198                         if (param < 0)
 199                                 continue;
 200                         set_state_expr(my_id, expr, &untracked);
 201                         continue;
 202                 }
 203         } END_FOR_EACH_PTR(expr);
 204 }
 205
 206 void register_untracked_param(int id)
 207 {
 208         my_id = id;
 209
 210         select_return_states_hook(INTERNAL, &assume_tracked);
 211         select_return_states_hook(UNTRACKED_PARAM, &mark_untracked);
 212         add_hook(&match_after_call, FUNCTION_CALL_HOOK_AFTER);
 213
 214         add_split_return_callback(&print_untracked_params);
 215
 216         add_hook(&match_param_assign, ASSIGNMENT_HOOK);
 217         add_hook(&match_param_assign_in_asm, ASM_HOOK);
 218 }