2 * Copyright (C) 2010 Dan Carpenter.
4 * This program is free software; you can redistribute it and/or
5 * modify it under the terms of the GNU General Public License
6 * as published by the Free Software Foundation; either version 2
7 * of the License, or (at your option) any later version.
9 * This program is distributed in the hope that it will be useful,
10 * but WITHOUT ANY WARRANTY; without even the implied warranty of
11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12 * GNU General Public License for more details.
14 * You should have received a copy of the GNU General Public License
15 * along with this program; if not, see http://www.gnu.org/copyleft/gpl.txt
19 * check_memory() is getting too big and messy.
25 #include "smatch_slist.h"
26 #include "smatch_extra.h"
33 static void ok_to_use(struct sm_state
*sm
, struct expression
*mod_expr
)
36 set_state(my_id
, sm
->name
, sm
->sym
, &ok
);
39 static void pre_merge_hook(struct sm_state
*cur
, struct sm_state
*other
)
41 if (is_impossible_path())
42 set_state(my_id
, cur
->name
, cur
->sym
, &ok
);
45 static int is_freed(struct expression
*expr
)
49 sm
= get_sm_state_expr(my_id
, expr
);
50 if (sm
&& slist_has_state(sm
->possible
, &freed
))
55 static void match_symbol(struct expression
*expr
)
57 struct expression
*parent
;
60 if (is_impossible_path())
62 if (__in_fake_parameter_assign
)
65 if (is_part_of_condition(expr
))
68 parent
= expr_get_parent_expr(expr
);
69 while (parent
&& parent
->type
== EXPR_PREOP
&& parent
->op
== '(')
70 parent
= expr_get_parent_expr(parent
);
71 if (parent
&& parent
->type
== EXPR_PREOP
&& parent
->op
== '&')
77 if (is_percent_p_print(expr
))
80 name
= expr_to_var(expr
);
81 sm_warning("'%s' was already freed.", name
);
85 static void match_dereferences(struct expression
*expr
)
89 if (__in_fake_parameter_assign
)
92 if (expr
->type
!= EXPR_PREOP
)
95 if (is_impossible_path())
98 expr
= strip_expr(expr
->unop
);
101 name
= expr_to_var(expr
);
102 sm_error("dereferencing freed memory '%s'", name
);
103 set_state_expr(my_id
, expr
, &ok
);
107 static int ignored_params
[16];
109 static void set_ignored_params(struct expression
*call
)
111 struct expression
*arg
;
115 memset(&ignored_params
, 0, sizeof(ignored_params
));
118 FOR_EACH_PTR(call
->args
, arg
) {
120 if (arg
->type
!= EXPR_STRING
)
123 } END_FOR_EACH_PTR(arg
);
129 p
= arg
->string
->data
;
130 while ((p
= strchr(p
, '%'))) {
131 if (i
>= ARRAY_SIZE(ignored_params
))
143 ignored_params
[i
] = 1;
148 static int is_free_func(struct expression
*fn
)
153 name
= expr_to_str(fn
);
156 if (strstr(name
, "free"))
163 static void match_call(struct expression
*expr
)
165 struct expression
*arg
;
169 if (is_impossible_path())
172 set_ignored_params(expr
);
175 FOR_EACH_PTR(expr
->args
, arg
) {
177 if (!is_pointer(arg
))
181 if (ignored_params
[i
])
183 if (is_percent_p_print(arg
))
186 name
= expr_to_var(arg
);
187 if (is_free_func(expr
->fn
))
188 sm_error("double free of '%s'", name
);
190 sm_warning("passing freed memory '%s'", name
);
191 set_state_expr(my_id
, arg
, &ok
);
193 } END_FOR_EACH_PTR(arg
);
196 static void match_return(struct expression
*expr
)
200 if (is_impossible_path())
202 if (__in_fake_parameter_assign
)
210 name
= expr_to_var(expr
);
211 sm_warning("returning freed memory '%s'", name
);
212 set_state_expr(my_id
, expr
, &ok
);
216 static void match_free(const char *fn
, struct expression
*expr
, void *param
)
218 struct expression
*arg
;
220 if (is_impossible_path())
223 arg
= get_argument_from_call_expr(expr
->args
, PTR_INT(param
));
227 char *name
= expr_to_var(arg
);
229 sm_error("double free of '%s'", name
);
232 set_state_expr(my_id
, arg
, &freed
);
235 static void set_param_freed(struct expression
*call
, struct expression
*arg
, char *key
, char *unused
)
240 name
= get_variable_from_key(arg
, key
, &sym
);
244 set_state(my_id
, name
, sym
, &freed
);
249 int parent_is_free_var_sym(const char *name
, struct symbol
*sym
)
254 struct smatch_state
*state
;
257 if (option_project
== PROJ_KERNEL
)
258 return parent_is_free_var_sym_strict(name
, sym
);
260 strncpy(buf
, name
, sizeof(buf
) - 1);
261 buf
[sizeof(buf
) - 1] = '\0';
264 while ((*start
== '&'))
267 while ((end
= strrchr(end
, '-'))) {
270 state
= __get_state(my_id
, start
, sym
);
279 int parent_is_free(struct expression
*expr
)
285 expr
= strip_expr(expr
);
286 var
= expr_to_var_sym(expr
, &sym
);
289 ret
= parent_is_free_var_sym(var
, sym
);
295 void check_free(int id
)
299 if (option_project
== PROJ_KERNEL
) {
300 /* The kernel use check_free_strict.c */
304 add_function_hook("free", &match_free
, INT_PTR(0));
307 add_hook(&match_symbol
, SYM_HOOK
);
308 add_hook(&match_dereferences
, DEREF_HOOK
);
309 add_hook(&match_call
, FUNCTION_CALL_HOOK
);
310 add_hook(&match_return
, RETURN_HOOK
);
312 add_modification_hook(my_id
, &ok_to_use
);
313 select_return_implies_hook(PARAM_FREED
, &set_param_freed
);
314 add_pre_merge_hook(my_id
, &pre_merge_hook
);