2 * Copyright (C) 2015 Oracle.
4 * This program is free software; you can redistribute it and/or
5 * modify it under the terms of the GNU General Public License
6 * as published by the Free Software Foundation; either version 2
7 * of the License, or (at your option) any later version.
9 * This program is distributed in the hope that it will be useful,
10 * but WITHOUT ANY WARRANTY; without even the implied warranty of
11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12 * GNU General Public License for more details.
14 * You should have received a copy of the GNU General Public License
15 * along with this program; if not, see http://www.gnu.org/copyleft/gpl.txt
19 #include "smatch_slist.h"
20 #include "smatch_extra.h"
22 static bool is_non_null_array(struct expression
*expr
)
29 type
= get_type(expr
);
30 if (!type
|| type
->type
!= SYM_ARRAY
)
32 if (expr
->type
== EXPR_SYMBOL
)
34 if (implied_not_equal(expr
, 0))
37 /* verify that it's not the first member of the struct */
38 if (expr
->type
!= EXPR_DEREF
|| !expr
->member
)
40 sym
= expr_to_sym(expr
);
43 type
= get_real_base_type(sym
);
44 if (!type
|| type
->type
!= SYM_PTR
)
46 type
= get_real_base_type(type
);
47 if (type
->type
!= SYM_STRUCT
)
51 FOR_EACH_PTR(type
->symbol_list
, tmp
) {
55 if (strcmp(expr
->member
->name
, tmp
->ident
->name
) == 0) {
60 } END_FOR_EACH_PTR(tmp
);
65 static bool matches_anonymous_union(struct symbol
*sym
, const char *member_name
)
67 struct symbol
*type
, *tmp
;
71 type
= get_real_base_type(sym
);
72 if (!type
|| type
->type
!= SYM_UNION
)
75 FOR_EACH_PTR(type
->symbol_list
, tmp
) {
77 strcmp(member_name
, tmp
->ident
->name
) == 0) {
80 } END_FOR_EACH_PTR(tmp
);
85 int get_member_offset(struct symbol
*type
, const char *member_name
)
91 if (!type
|| type
->type
!= SYM_STRUCT
)
96 FOR_EACH_PTR(type
->symbol_list
, tmp
) {
97 if (bits_to_bytes(bits
+ type_bits(tmp
)) > tmp
->ctype
.alignment
) {
98 offset
+= bits_to_bytes(bits
);
101 offset
= ALIGN(offset
, tmp
->ctype
.alignment
);
103 strcmp(member_name
, tmp
->ident
->name
) == 0) {
106 if (matches_anonymous_union(tmp
, member_name
))
108 if (!(type_bits(tmp
) % 8) && type_bits(tmp
) / 8 == type_bytes(tmp
))
109 offset
+= type_bytes(tmp
);
111 bits
+= type_bits(tmp
);
112 } END_FOR_EACH_PTR(tmp
);
116 int get_member_offset_from_deref(struct expression
*expr
)
119 struct ident
*member
;
122 if (expr
->type
!= EXPR_DEREF
) /* hopefully, this doesn't happen */
125 if (expr
->member_offset
>= 0)
126 return expr
->member_offset
;
128 member
= expr
->member
;
132 type
= get_type(expr
->deref
);
133 if (type_is_ptr(type
))
134 type
= get_real_base_type(type
);
135 if (!type
|| type
->type
!= SYM_STRUCT
)
138 offset
= get_member_offset(type
, member
->name
);
140 expr
->member_offset
= offset
;
144 static void add_offset_to_pointer(struct range_list
**rl
, int offset
)
146 sval_t min
, max
, remove
, sval
;
147 struct range_list
*orig
= *rl
;
150 * Ha ha. Treating zero as a special case means I'm correct at least a
151 * tiny fraction of the time. Which is better than nothing.
157 if (is_unknown_ptr(orig
))
161 * This function doesn't necessarily work how you might expect...
163 * Say you have s64min-(-1),1-s64max and you add 8 then I guess what
164 * we want to say is maybe something like 9-s64max. This shows that the
165 * min it could be is 9 which is potentially useful information. But
166 * if we start with (-12),5000000-57777777 and we add 8 then we'd want
167 * the result to be (-4),5000008-57777777 but (-4),5000000-57777777 is
168 * also probably acceptable. If you start with s64min-s64max then the
169 * result should be 8-s64max.
173 /* We do the math on void pointer type, because this isn't "&v + 16" it
174 * is &v->sixteenth_byte.
176 orig
= cast_rl(&ptr_ctype
, orig
);
177 min
= sval_type_min(&ptr_ctype
);
179 max
= sval_type_max(&ptr_ctype
);
181 if (!orig
|| is_whole_rl(orig
)) {
182 *rl
= alloc_rl(min
, max
);
187 max
.uvalue
= rl_max(orig
).uvalue
;
188 if (max
.uvalue
> sval_type_max(&ptr_ctype
).uvalue
- offset
) {
189 remove
= sval_type_max(&ptr_ctype
);
190 remove
.uvalue
-= offset
;
191 orig
= remove_range(orig
, remove
, max
);
194 sval
.type
= &int_ctype
;
197 *rl
= rl_binop(orig
, '+', alloc_rl(sval
, sval
));
200 static struct range_list
*where_allocated_rl(struct symbol
*sym
)
205 return alloc_rl(valid_ptr_min_sval
, valid_ptr_max_sval
);
208 int get_address_rl(struct expression
*expr
, struct range_list
**rl
)
210 struct expression
*unop
;
212 expr
= strip_expr(expr
);
216 if (expr
->type
== EXPR_STRING
) {
217 *rl
= alloc_rl(valid_ptr_min_sval
, valid_ptr_max_sval
);
221 if (expr
->type
== EXPR_PREOP
&& expr
->op
== '&')
222 expr
= strip_expr(expr
->unop
);
226 type
= get_type(expr
);
227 if (!type
|| type
->type
!= SYM_ARRAY
)
231 if (expr
->type
== EXPR_SYMBOL
) {
232 *rl
= where_allocated_rl(expr
->symbol
);
236 if (is_array(expr
)) {
237 struct expression
*array
;
238 struct expression
*offset_expr
;
239 struct range_list
*array_rl
, *offset_rl
, *bytes_rl
, *res
;
243 array
= get_array_base(expr
);
244 offset_expr
= get_array_offset(expr
);
246 type
= get_type(array
);
247 type
= get_real_base_type(type
);
248 bytes
.type
= ssize_t_ctype
;
249 bytes
.uvalue
= type_bytes(type
);
250 bytes_rl
= alloc_rl(bytes
, bytes
);
252 get_absolute_rl(array
, &array_rl
);
253 get_absolute_rl(offset_expr
, &offset_rl
);
255 if (type_bytes(type
)) {
256 res
= rl_binop(offset_rl
, '*', bytes_rl
);
257 res
= rl_binop(res
, '+', array_rl
);
262 if (implied_not_equal(array
, 0) ||
263 implied_not_equal(offset_expr
, 0)) {
264 *rl
= alloc_rl(valid_ptr_min_sval
, valid_ptr_max_sval
);
271 if (expr
->type
== EXPR_DEREF
&& expr
->member
) {
272 struct range_list
*unop_rl
;
275 offset
= get_member_offset_from_deref(expr
);
276 unop
= strip_expr(expr
->unop
);
277 if (unop
->type
== EXPR_PREOP
&& unop
->op
== '*')
278 unop
= strip_expr(unop
->unop
);
280 if (offset
>= 0 && get_implied_rl(unop
, &unop_rl
)) {
282 add_offset_to_pointer(rl
, offset
);
286 if (implied_not_equal(unop
, 0) || offset
> 0) {
287 *rl
= alloc_rl(valid_ptr_min_sval
, valid_ptr_max_sval
);
294 if (is_non_null_array(expr
)) {
295 *rl
= alloc_rl(array_min_sval
, array_max_sval
);