2 * smatch/smatch_buf_size.c
4 * Copyright (C) 2010 Dan Carpenter.
6 * Licensed under the Open Software License version 1.1
13 #include "smatch_slist.h"
14 #include "smatch_extra.h"
17 * This check has two smatch IDs.
18 * my_size_id - used to store the size of arrays.
19 * my_strlen_id - track the strlen() of buffers.
22 static int my_size_id
;
23 static int my_strlen_id
;
29 static struct limiter b0_l2
= {0, 2};
31 static int get_initializer_size(struct expression
*expr
)
35 return expr
->string
->length
;
36 case EXPR_INITIALIZER
: {
37 struct expression
*tmp
;
41 FOR_EACH_PTR(expr
->expr_list
, tmp
) {
42 if (tmp
->type
== EXPR_INDEX
&& tmp
->idx_to
> max
)
45 } END_FOR_EACH_PTR(tmp
);
51 return get_array_size(expr
);
56 static float get_cast_ratio(struct expression
*unstripped
)
58 struct expression
*start_expr
;
59 struct symbol
*start_type
;
60 struct symbol
*end_type
;
64 start_expr
= strip_expr(unstripped
);
65 start_type
= get_type(start_expr
);
66 end_type
= get_type(unstripped
);
67 if (!start_type
|| !end_type
)
70 if (start_type
->type
== SYM_PTR
)
71 start_bytes
= (get_base_type(start_type
))->ctype
.alignment
;
72 if (start_type
->type
== SYM_ARRAY
)
73 start_bytes
= (get_base_type(start_type
))->bit_size
/ 8;
74 if (end_type
->type
== SYM_PTR
)
75 end_bytes
= (get_base_type(end_type
))->ctype
.alignment
;
76 if (end_type
->type
== SYM_ARRAY
)
77 end_bytes
= (get_base_type(end_type
))->bit_size
/ 8;
79 if (!start_bytes
|| !end_bytes
)
81 return start_bytes
/ end_bytes
;
84 int get_array_size(struct expression
*expr
)
87 struct smatch_state
*state
;
92 if (expr
->type
== EXPR_STRING
)
93 return expr
->string
->length
;
95 cast_ratio
= get_cast_ratio(expr
);
96 expr
= strip_expr(expr
);
101 if (tmp
->type
== SYM_ARRAY
) {
102 ret
= get_expression_value(tmp
->array_size
);
103 /* Dynamically sized array are -1 in sparse */
106 /* People put one element arrays on the end of structs */
110 return ret
* cast_ratio
;
113 state
= get_state_expr(my_size_id
, expr
);
114 if (state
== &merged
)
116 if (state
&& state
->data
) {
117 if (tmp
->type
== SYM_PTR
)
118 tmp
= get_base_type(tmp
);
119 if (!tmp
->ctype
.alignment
)
121 ret
= (int)state
->data
/ tmp
->ctype
.alignment
;
122 return ret
* cast_ratio
;
125 if (expr
->type
== EXPR_SYMBOL
&& expr
->symbol
->initializer
) {
126 if (expr
->symbol
->initializer
!= expr
) /* int a = a; */
127 return get_initializer_size(expr
->symbol
->initializer
) * cast_ratio
;
130 state
= get_state_expr(my_strlen_id
, expr
);
131 if (!state
|| !state
->data
)
133 if (get_implied_max((struct expression
*)state
->data
, &len
))
134 return len
+ 1; /* add one because strlen doesn't include the NULL */
138 int get_array_size_bytes(struct expression
*expr
)
144 if (expr
->type
== EXPR_STRING
)
145 return expr
->string
->length
;
147 tmp
= get_type(expr
);
151 if (tmp
->type
== SYM_ARRAY
) {
152 tmp
= get_base_type(tmp
);
153 element_size
= tmp
->bit_size
/ 8;
154 } else if (tmp
->type
== SYM_PTR
) {
155 tmp
= get_base_type(tmp
);
156 element_size
= tmp
->ctype
.alignment
;
160 array_size
= get_array_size(expr
);
161 return array_size
* element_size
;
164 static void match_strlen_condition(struct expression
*expr
)
166 struct expression
*left
;
167 struct expression
*right
;
168 struct expression
*str
;
170 int strlen_right
= 0;
172 struct smatch_state
*true_state
= NULL
;
173 struct smatch_state
*false_state
= NULL
;
175 if (expr
->type
!= EXPR_COMPARE
)
177 left
= strip_expr(expr
->left
);
178 right
= strip_expr(expr
->right
);
180 if (left
->type
== EXPR_CALL
&& sym_name_is("strlen", left
->fn
)) {
181 str
= get_argument_from_call_expr(left
->args
, 0);
184 if (right
->type
== EXPR_CALL
&& sym_name_is("strlen", right
->fn
)) {
185 str
= get_argument_from_call_expr(right
->args
, 0);
189 if (!strlen_left
&& !strlen_right
)
191 if (strlen_left
&& strlen_right
)
195 if (!get_value(right
, &val
))
199 if (!get_value(left
, &val
))
203 if (expr
->op
== SPECIAL_EQUAL
) {
204 set_true_false_states_expr(my_size_id
, str
, alloc_state_num(val
+ 1), NULL
);
207 if (expr
->op
== SPECIAL_NOTEQUAL
) {
208 set_true_false_states_expr(my_size_id
, str
, NULL
, alloc_state_num(val
+ 1));
214 case SPECIAL_UNSIGNED_LT
:
216 true_state
= alloc_state_num(val
);
218 false_state
= alloc_state_num(val
+ 1);
221 case SPECIAL_UNSIGNED_LTE
:
223 true_state
= alloc_state_num(val
+ 1);
225 false_state
= alloc_state_num(val
);
228 case SPECIAL_UNSIGNED_GTE
:
230 false_state
= alloc_state_num(val
);
232 true_state
= alloc_state_num(val
+ 1);
235 case SPECIAL_UNSIGNED_GT
:
237 false_state
= alloc_state_num(val
+ 1);
239 true_state
= alloc_state_num(val
);
242 set_true_false_states_expr(my_size_id
, str
, true_state
, false_state
);
245 static struct expression
*strip_ampersands(struct expression
*expr
)
249 if (expr
->type
!= EXPR_PREOP
)
253 type
= get_type(expr
->unop
);
254 if (!type
|| type
->type
!= SYM_ARRAY
)
259 static void match_array_assignment(struct expression
*expr
)
261 struct expression
*left
;
262 struct expression
*right
;
267 left
= strip_expr(expr
->left
);
268 right
= strip_expr(expr
->right
);
269 right
= strip_ampersands(right
);
270 array_size
= get_array_size_bytes(right
);
272 set_state_expr(my_size_id
, left
, alloc_state_num(array_size
));
275 static void match_alloc(const char *fn
, struct expression
*expr
, void *_size_arg
)
277 int size_arg
= (int)_size_arg
;
278 struct expression
*right
;
279 struct expression
*arg
;
282 right
= strip_expr(expr
->right
);
283 arg
= get_argument_from_call_expr(right
->args
, size_arg
);
284 if (!get_implied_value(arg
, &bytes
))
286 set_state_expr(my_size_id
, expr
->left
, alloc_state_num(bytes
));
289 static void match_calloc(const char *fn
, struct expression
*expr
, void *unused
)
291 struct expression
*right
;
292 struct expression
*arg
;
296 right
= strip_expr(expr
->right
);
297 arg
= get_argument_from_call_expr(right
->args
, 0);
298 if (!get_implied_value(arg
, &elements
))
300 arg
= get_argument_from_call_expr(right
->args
, 1);
301 if (!get_implied_value(arg
, &size
))
303 set_state_expr(my_size_id
, expr
->left
, alloc_state_num(elements
* size
));
306 static void match_strlen(const char *fn
, struct expression
*expr
, void *unused
)
308 struct expression
*right
;
309 struct expression
*str
;
310 struct expression
*len_expr
;
312 struct smatch_state
*state
;
314 right
= strip_expr(expr
->right
);
315 str
= get_argument_from_call_expr(right
->args
, 0);
316 len_expr
= strip_expr(expr
->left
);
318 len_name
= get_variable_from_expr(len_expr
, NULL
);
322 state
= __alloc_smatch_state(0);
323 state
->name
= len_name
;
324 state
->data
= len_expr
;
325 set_state_expr(my_strlen_id
, str
, state
);
328 static void match_limited(const char *fn
, struct expression
*expr
, void *_limiter
)
330 struct limiter
*limiter
= (struct limiter
*)_limiter
;
331 struct expression
*dest
;
332 struct expression
*size_expr
;
335 dest
= get_argument_from_call_expr(expr
->args
, limiter
->buf_arg
);
336 size_expr
= get_argument_from_call_expr(expr
->args
, limiter
->limit_arg
);
337 if (!get_implied_max(size_expr
, &size
))
339 set_state_expr(my_size_id
, dest
, alloc_state_num(size
));
342 static void match_strcpy(const char *fn
, struct expression
*expr
, void *unused
)
344 struct expression fake_assign
;
346 fake_assign
.op
= '=';
347 fake_assign
.left
= get_argument_from_call_expr(expr
->args
, 0);
348 fake_assign
.right
= get_argument_from_call_expr(expr
->args
, 1);
349 match_array_assignment(&fake_assign
);
352 static void match_strndup(const char *fn
, struct expression
*expr
, void *unused
)
354 struct expression
*fn_expr
;
355 struct expression
*size_expr
;
358 fn_expr
= strip_expr(expr
->right
);
359 size_expr
= get_argument_from_call_expr(fn_expr
->args
, 1);
360 if (!get_implied_max(size_expr
, &size
))
363 /* It's easy to forget space for the NUL char */
365 set_state_expr(my_size_id
, expr
->left
, alloc_state_num(size
));
368 void register_buf_size(int id
)
372 add_function_assign_hook("malloc", &match_alloc
, INT_PTR(0));
373 add_function_assign_hook("calloc", &match_calloc
, NULL
);
374 add_function_assign_hook("memdup", &match_alloc
, INT_PTR(1));
375 if (option_project
== PROJ_KERNEL
) {
376 add_function_assign_hook("kmalloc", &match_alloc
, INT_PTR(0));
377 add_function_assign_hook("kzalloc", &match_alloc
, INT_PTR(0));
378 add_function_assign_hook("vmalloc", &match_alloc
, INT_PTR(0));
379 add_function_assign_hook("__vmalloc", &match_alloc
, INT_PTR(0));
380 add_function_assign_hook("kcalloc", &match_calloc
, NULL
);
381 add_function_assign_hook("drm_malloc_ab", &match_calloc
, NULL
);
382 add_function_assign_hook("drm_calloc_large", &match_calloc
, NULL
);
383 add_function_assign_hook("kmemdup", &match_alloc
, INT_PTR(1));
384 add_function_assign_hook("kmemdup_user", &match_alloc
, INT_PTR(1));
386 add_hook(&match_array_assignment
, ASSIGNMENT_HOOK
);
387 add_hook(&match_strlen_condition
, CONDITION_HOOK
);
388 add_function_assign_hook("strlen", &match_strlen
, NULL
);
390 add_function_hook("strncpy", &match_limited
, &b0_l2
);
391 add_function_hook("strlcpy", &match_limited
, &b0_l2
);
392 add_function_hook("strlcat", &match_limited
, &b0_l2
);
393 add_function_hook("memcpy", &match_limited
, &b0_l2
);
394 add_function_hook("memscan", &match_limited
, &b0_l2
);
396 add_function_hook("strcpy", &match_strcpy
, NULL
);
398 add_function_assign_hook("strndup", match_strndup
, NULL
);
399 if (option_project
== PROJ_KERNEL
)
400 add_function_assign_hook("kstrndup", match_strndup
, NULL
);
403 void register_strlen(int id
)