smatch_function_hooks.c

   1 /*
   2  * Copyright (C) 2009 Dan Carpenter.
   3  *
   4  * This program is free software; you can redistribute it and/or
   5  * modify it under the terms of the GNU General Public License
   6  * as published by the Free Software Foundation; either version 2
   7  * of the License, or (at your option) any later version.
   8  *
   9  * This program is distributed in the hope that it will be useful,
  10  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  11  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  12  * GNU General Public License for more details.
  13  *
  14  * You should have received a copy of the GNU General Public License
  15  * along with this program; if not, see http://www.gnu.org/copyleft/gpl.txt
  16  */
  17
  18 /*
  19  * There are several types of function hooks:
  20  * add_function_hook()        - For any time a function is called.
  21  * add_function_assign_hook() - foo = the_function().
  22  * add_implied_return_hook()  - Calculates the implied return value.
  23  * add_macro_assign_hook()    - foo = the_macro().
  24  * return_implies_state()     - For when a return value of 1 implies locked
  25  *                              and 0 implies unlocked. etc. etc.
  26  *
  27  */
  28
  29 #include <stdlib.h>
  30 #include <stdio.h>
  31 #include "smatch.h"
  32 #include "smatch_slist.h"
  33 #include "smatch_extra.h"
  34 #include "smatch_function_hashtable.h"
  35
  36 struct fcall_back {
  37         int type;
  38         struct data_range *range;
  39         union {
  40                 func_hook *call_back;
  41                 implication_hook *ranged;
  42                 implied_return_hook *implied_return;
  43         } u;
  44         void *info;
  45 };
  46
  47 ALLOCATOR(fcall_back, "call backs");
  48 DECLARE_PTR_LIST(call_back_list, struct fcall_back);
  49
  50 DEFINE_FUNCTION_HASHTABLE_STATIC(callback, struct fcall_back, struct call_back_list);
  51 static struct hashtable *func_hash;
  52
  53 int __in_fake_parameter_assign;
  54
  55 #define REGULAR_CALL       0
  56 #define RANGED_CALL        1
  57 #define ASSIGN_CALL        2
  58 #define IMPLIED_RETURN     3
  59 #define MACRO_ASSIGN       4
  60 #define MACRO_ASSIGN_EXTRA 5
  61
  62 struct return_implies_callback {
  63         int type;
  64         return_implies_hook *callback;
  65 };
  66 ALLOCATOR(return_implies_callback, "return_implies callbacks");
  67 DECLARE_PTR_LIST(db_implies_list, struct return_implies_callback);
  68 static struct db_implies_list *db_return_states_list;
  69
  70 typedef void (void_fn)(void);
  71 DECLARE_PTR_LIST(void_fn_list, void_fn *);
  72 static struct void_fn_list *return_states_before;
  73 static struct void_fn_list *return_states_after;
  74
  75 static struct fcall_back *alloc_fcall_back(int type, void *call_back,
  76                                            void *info)
  77 {
  78         struct fcall_back *cb;
  79
  80         cb = __alloc_fcall_back(0);
  81         cb->type = type;
  82         cb->u.call_back = call_back;
  83         cb->info = info;
  84         return cb;
  85 }
  86
  87 void add_function_hook(const char *look_for, func_hook *call_back, void *info)
  88 {
  89         struct fcall_back *cb;
  90
  91         cb = alloc_fcall_back(REGULAR_CALL, call_back, info);
  92         add_callback(func_hash, look_for, cb);
  93 }
  94
  95 void add_function_assign_hook(const char *look_for, func_hook *call_back,
  96                               void *info)
  97 {
  98         struct fcall_back *cb;
  99
 100         cb = alloc_fcall_back(ASSIGN_CALL, call_back, info);
 101         add_callback(func_hash, look_for, cb);
 102 }
 103
 104 void add_implied_return_hook(const char *look_for,
 105                              implied_return_hook *call_back,
 106                              void *info)
 107 {
 108         struct fcall_back *cb;
 109
 110         cb = alloc_fcall_back(IMPLIED_RETURN, call_back, info);
 111         add_callback(func_hash, look_for, cb);
 112 }
 113
 114 void add_macro_assign_hook(const char *look_for, func_hook *call_back,
 115                         void *info)
 116 {
 117         struct fcall_back *cb;
 118
 119         cb = alloc_fcall_back(MACRO_ASSIGN, call_back, info);
 120         add_callback(func_hash, look_for, cb);
 121 }
 122
 123 void add_macro_assign_hook_extra(const char *look_for, func_hook *call_back,
 124                         void *info)
 125 {
 126         struct fcall_back *cb;
 127
 128         cb = alloc_fcall_back(MACRO_ASSIGN_EXTRA, call_back, info);
 129         add_callback(func_hash, look_for, cb);
 130 }
 131
 132 void return_implies_state(const char *look_for, long long start, long long end,
 133                          implication_hook *call_back, void *info)
 134 {
 135         struct fcall_back *cb;
 136
 137         cb = alloc_fcall_back(RANGED_CALL, call_back, info);
 138         cb->range = alloc_range_perm(ll_to_sval(start), ll_to_sval(end));
 139         add_callback(func_hash, look_for, cb);
 140 }
 141
 142 void select_return_states_hook(int type, return_implies_hook *callback)
 143 {
 144         struct return_implies_callback *cb = __alloc_return_implies_callback(0);
 145
 146         cb->type = type;
 147         cb->callback = callback;
 148         add_ptr_list(&db_return_states_list, cb);
 149 }
 150
 151 void select_return_states_before(void_fn *fn)
 152 {
 153         void_fn **p = malloc(sizeof(void_fn *));
 154         *p = fn;
 155         add_ptr_list(&return_states_before, p);
 156 }
 157
 158 void select_return_states_after(void_fn *fn)
 159 {
 160         void_fn **p = malloc(sizeof(void_fn *));
 161         *p = fn;
 162         add_ptr_list(&return_states_after, p);
 163 }
 164
 165 static void call_return_states_before_hooks(void)
 166 {
 167         void_fn **fn;
 168
 169         FOR_EACH_PTR(return_states_before, fn) {
 170                 (*fn)();
 171         } END_FOR_EACH_PTR(fn);
 172 }
 173
 174 static void call_return_states_after_hooks(struct expression *expr)
 175 {
 176         void_fn **fn;
 177
 178         FOR_EACH_PTR(return_states_after, fn) {
 179                 (*fn)();
 180         } END_FOR_EACH_PTR(fn);
 181         __pass_to_client(expr, FUNCTION_CALL_HOOK_AFTER_DB);
 182 }
 183
 184 static int call_call_backs(struct call_back_list *list, int type,
 185                             const char *fn, struct expression *expr)
 186 {
 187         struct fcall_back *tmp;
 188         int handled = 0;
 189
 190         FOR_EACH_PTR(list, tmp) {
 191                 if (tmp->type == type) {
 192                         (tmp->u.call_back)(fn, expr, tmp->info);
 193                         handled = 1;
 194                 }
 195         } END_FOR_EACH_PTR(tmp);
 196
 197         return handled;
 198 }
 199
 200 static void call_ranged_call_backs(struct call_back_list *list,
 201                                 const char *fn, struct expression *call_expr,
 202                                 struct expression *assign_expr)
 203 {
 204         struct fcall_back *tmp;
 205
 206         FOR_EACH_PTR(list, tmp) {
 207                 (tmp->u.ranged)(fn, call_expr, assign_expr, tmp->info);
 208         } END_FOR_EACH_PTR(tmp);
 209 }
 210
 211 static struct call_back_list *get_same_ranged_call_backs(struct call_back_list *list,
 212                                                 struct data_range *drange)
 213 {
 214         struct call_back_list *ret = NULL;
 215         struct fcall_back *tmp;
 216
 217         FOR_EACH_PTR(list, tmp) {
 218                 if (tmp->type != RANGED_CALL)
 219                         continue;
 220                 if (ranges_equiv(tmp->range, drange))
 221                         add_ptr_list(&ret, tmp);
 222         } END_FOR_EACH_PTR(tmp);
 223         return ret;
 224 }
 225
 226 static int in_list_exact_sval(struct range_list *list, struct data_range *drange)
 227 {
 228         struct data_range *tmp;
 229
 230         FOR_EACH_PTR(list, tmp) {
 231                 if (ranges_equiv(tmp, drange))
 232                         return 1;
 233         } END_FOR_EACH_PTR(tmp);
 234         return 0;
 235 }
 236
 237 static int assign_ranged_funcs(const char *fn, struct expression *expr,
 238                                  struct call_back_list *call_backs)
 239 {
 240         struct fcall_back *tmp;
 241         struct sm_state *sm;
 242         char *var_name;
 243         struct symbol *sym;
 244         struct smatch_state *estate;
 245         struct stree *tmp_stree;
 246         struct stree *final_states = NULL;
 247         struct range_list *handled_ranges = NULL;
 248         struct call_back_list *same_range_call_backs = NULL;
 249         int handled = 0;
 250
 251         if (!call_backs)
 252                 return 0;
 253
 254         var_name = expr_to_var_sym(expr->left, &sym);
 255         if (!var_name || !sym)
 256                 goto free;
 257
 258         FOR_EACH_PTR(call_backs, tmp) {
 259                 if (tmp->type != RANGED_CALL)
 260                         continue;
 261
 262                 if (in_list_exact_sval(handled_ranges, tmp->range))
 263                         continue;
 264                 __push_fake_cur_stree();
 265                 tack_on(&handled_ranges, tmp->range);
 266
 267                 same_range_call_backs = get_same_ranged_call_backs(call_backs, tmp->range);
 268                 call_ranged_call_backs(same_range_call_backs, fn, expr->right, expr);
 269                 __free_ptr_list((struct ptr_list **)&same_range_call_backs);
 270
 271                 estate = alloc_estate_range(tmp->range->min, tmp->range->max);
 272                 set_extra_mod(var_name, sym, expr->left, estate);
 273
 274                 tmp_stree = __pop_fake_cur_stree();
 275                 merge_fake_stree(&final_states, tmp_stree);
 276                 free_stree(&tmp_stree);
 277                 handled = 1;
 278         } END_FOR_EACH_PTR(tmp);
 279
 280         FOR_EACH_SM(final_states, sm) {
 281                 __set_sm(sm);
 282         } END_FOR_EACH_SM(sm);
 283
 284         free_stree(&final_states);
 285 free:
 286         free_string(var_name);
 287         return handled;
 288 }
 289
 290 static void call_implies_callbacks(int comparison, struct expression *expr, sval_t sval, int left, struct stree **implied_true, struct stree **implied_false)
 291 {
 292         struct call_back_list *call_backs;
 293         struct fcall_back *tmp;
 294         const char *fn;
 295         struct data_range *value_range;
 296         struct stree *true_states = NULL;
 297         struct stree *false_states = NULL;
 298         struct stree *tmp_stree;
 299
 300         *implied_true = NULL;
 301         *implied_false = NULL;
 302         if (expr->fn->type != EXPR_SYMBOL || !expr->fn->symbol)
 303                 return;
 304         fn = expr->fn->symbol->ident->name;
 305         call_backs = search_callback(func_hash, (char *)expr->fn->symbol->ident->name);
 306         if (!call_backs)
 307                 return;
 308         value_range = alloc_range(sval, sval);
 309
 310         /* set true states */
 311         __push_fake_cur_stree();
 312         FOR_EACH_PTR(call_backs, tmp) {
 313                 if (tmp->type != RANGED_CALL)
 314                         continue;
 315                 if (!true_comparison_range_LR(comparison, tmp->range, value_range, left))
 316                         continue;
 317                 (tmp->u.ranged)(fn, expr, NULL, tmp->info);
 318         } END_FOR_EACH_PTR(tmp);
 319         tmp_stree = __pop_fake_cur_stree();
 320         merge_fake_stree(&true_states, tmp_stree);
 321         free_stree(&tmp_stree);
 322
 323         /* set false states */
 324         __push_fake_cur_stree();
 325         FOR_EACH_PTR(call_backs, tmp) {
 326                 if (tmp->type != RANGED_CALL)
 327                         continue;
 328                 if (!false_comparison_range_LR(comparison, tmp->range, value_range, left))
 329                         continue;
 330                 (tmp->u.ranged)(fn, expr, NULL, tmp->info);
 331         } END_FOR_EACH_PTR(tmp);
 332         tmp_stree = __pop_fake_cur_stree();
 333         merge_fake_stree(&false_states, tmp_stree);
 334         free_stree(&tmp_stree);
 335
 336         *implied_true = true_states;
 337         *implied_false = false_states;
 338 }
 339
 340 struct db_callback_info {
 341         int true_side;
 342         int comparison;
 343         struct expression *expr;
 344         struct range_list *rl;
 345         int left;
 346         struct stree *stree;
 347         struct db_implies_list *callbacks;
 348         int prev_return_id;
 349         int cull;
 350         int has_states;
 351         char *ret_str;
 352         struct smatch_state *ret_state;
 353         struct expression *var_expr;
 354         int handled;
 355 };
 356
 357 static void store_return_state(struct db_callback_info *db_info, const char *ret_str, struct smatch_state *state)
 358 {
 359         db_info->ret_str = alloc_sname(ret_str),
 360         db_info->ret_state = state;
 361 }
 362
 363 static bool fake_a_param_assignment(struct expression *expr, const char *return_str)
 364 {
 365         struct expression *arg, *left, *right, *fake_assign;
 366         char *p;
 367         int param;
 368         char buf[256];
 369         char *str;
 370
 371         if (expr->type != EXPR_ASSIGNMENT || expr->op != '=')
 372                 return false;
 373         left = expr->left;
 374         right = expr->right;
 375
 376         while (right->type == EXPR_ASSIGNMENT)
 377                 right = strip_expr(right->right);
 378         if (!right || right->type != EXPR_CALL)
 379                 return false;
 380
 381         p = strchr(return_str, '[');
 382         if (!p)
 383                 return false;
 384
 385         p++;
 386         if (p[0] == '=' && p[1] == '=')
 387                 p += 2;
 388         if (p[0] != '$')
 389                 return false;
 390
 391         snprintf(buf, sizeof(buf), "%s", p);
 392
 393         p = buf;
 394         p += 1;
 395         param = strtol(p, &p, 10);
 396
 397         p = strchr(p, ']');
 398         if (!p || *p != ']')
 399                 return false;
 400         *p = '\0';
 401
 402         arg = get_argument_from_call_expr(right->args, param);
 403         if (!arg)
 404                 return false;
 405         /*
 406          * This is a sanity check to prevent side effects from evaluating stuff
 407          * twice.
 408          */
 409         str = expr_to_chunk_sym_vsl(arg, NULL, NULL);
 410         if (!str)
 411                 return false;
 412         free_string(str);
 413
 414         right = gen_expression_from_key(arg, buf);
 415         if (!right)  /* Mostly fails for binops like [$0 + 4032] */
 416                 return false;
 417         fake_assign = assign_expression(left, '=', right);
 418         __in_fake_parameter_assign++;
 419         __split_expr(fake_assign);
 420         __in_fake_parameter_assign--;
 421         return true;
 422 }
 423
 424 static void set_return_assign_state(struct db_callback_info *db_info)
 425 {
 426         struct expression *expr = db_info->expr->left;
 427         struct smatch_state *state;
 428
 429         if (!db_info->ret_state)
 430                 return;
 431
 432         state = alloc_estate_rl(cast_rl(get_type(expr), clone_rl(estate_rl(db_info->ret_state))));
 433         set_extra_expr_mod(expr, state);
 434         db_info->ret_state = NULL;
 435         fake_a_param_assignment(db_info->expr, db_info->ret_str);
 436         db_info->ret_str = NULL;
 437 }
 438
 439 static void set_other_side_state(struct db_callback_info *db_info)
 440 {
 441         struct expression *expr = db_info->var_expr;
 442         struct smatch_state *state;
 443
 444         if (!db_info->ret_state)
 445                 return;
 446
 447         state = alloc_estate_rl(cast_rl(get_type(expr), clone_rl(estate_rl(db_info->ret_state))));
 448         set_extra_expr_nomod(expr, state);
 449         db_info->ret_state = NULL;
 450         db_info->ret_str = NULL;
 451 }
 452
 453 static void handle_ret_equals_param(char *ret_string, struct range_list *rl, struct expression *call)
 454 {
 455         char *str;
 456         long long param;
 457         struct expression *arg;
 458         struct range_list *orig;
 459
 460         str = strstr(ret_string, "==$");
 461         if (!str)
 462                 return;
 463         str += 3;
 464         param = strtoll(str, NULL, 10);
 465         arg = get_argument_from_call_expr(call->args, param);
 466         if (!arg)
 467                 return;
 468         get_absolute_rl(arg, &orig);
 469         rl = rl_intersection(orig, rl);
 470         if (!rl)
 471                 return;
 472         set_extra_expr_nomod(arg, alloc_estate_rl(rl));
 473 }
 474
 475 static int impossible_limit(struct expression *expr, int param, char *key, char *value)
 476 {
 477         struct expression *arg;
 478         struct smatch_state *state;
 479         struct range_list *passed;
 480         struct range_list *limit;
 481         struct symbol *compare_type;
 482
 483         while (expr->type == EXPR_ASSIGNMENT)
 484                 expr = strip_expr(expr->right);
 485         if (expr->type != EXPR_CALL)
 486                 return 0;
 487
 488         arg = get_argument_from_call_expr(expr->args, param);
 489         if (!arg)
 490                 return 0;
 491
 492         if (strcmp(key, "$") == 0) {
 493                 if (!get_implied_rl(arg, &passed))
 494                         return 0;
 495
 496                 compare_type = get_arg_type(expr->fn, param);
 497         } else {
 498                 char *name;
 499                 struct symbol *sym;
 500
 501                 name = get_variable_from_key(arg, key, &sym);
 502                 if (!name || !sym)
 503                         return 0;
 504
 505                 state = get_state(SMATCH_EXTRA, name, sym);
 506                 if (!state) {
 507                         free_string(name);
 508                         return 0;
 509                 }
 510                 passed = estate_rl(state);
 511                 if (!passed || is_whole_rl(passed)) {
 512                         free_string(name);
 513                         return 0;
 514                 }
 515
 516                 compare_type = get_member_type_from_key(arg, key);
 517         }
 518
 519         passed = cast_rl(compare_type, passed);
 520         call_results_to_rl(expr, compare_type, value, &limit);
 521         if (!limit || is_whole_rl(limit))
 522                 return 0;
 523         if (possibly_true_rl(passed, SPECIAL_EQUAL, limit))
 524                 return 0;
 525         if (option_debug || local_debug)
 526                 sm_msg("impossible: %d '%s' limit '%s' == '%s'", param, key, show_rl(passed), value);
 527         return 1;
 528 }
 529
 530 static int is_impossible_data(int type, struct expression *expr, int param, char *key, char *value)
 531 {
 532         if (type == PARAM_LIMIT && impossible_limit(expr, param, key, value))
 533                 return 1;
 534         if (type == COMPARE_LIMIT && param_compare_limit_is_impossible(expr, param, key, value)) {
 535                 if (local_debug)
 536                         sm_msg("param_compare_limit_is_impossible: %d %s %s", param, key, value);
 537                 return 1;
 538         }
 539         return 0;
 540 }
 541
 542 static int func_type_mismatch(struct expression *expr, const char *value)
 543 {
 544         struct symbol *type;
 545
 546         /* This makes faking returns easier */
 547         if (!value || value[0] == '\0')
 548                 return 0;
 549
 550         while (expr->type == EXPR_ASSIGNMENT)
 551                 expr = strip_expr(expr->right);
 552
 553         /*
 554          * Short cut:  We only care about function pointers that are struct
 555          * members.
 556          *
 557          */
 558         if (expr->fn->type == EXPR_SYMBOL)
 559                 return 0;
 560
 561         type = get_type(expr->fn);
 562         if (!type)
 563                 return 0;
 564         if (type->type == SYM_PTR)
 565                 type = get_real_base_type(type);
 566
 567         if (strcmp(type_to_str(type), value) == 0)
 568                 return 0;
 569
 570         return 1;
 571 }
 572
 573 static int db_compare_callback(void *_info, int argc, char **argv, char **azColName)
 574 {
 575         struct db_callback_info *db_info = _info;
 576         struct range_list *var_rl = db_info->rl;
 577         struct range_list *ret_range;
 578         int type, param;
 579         char *key, *value;
 580         struct return_implies_callback *tmp;
 581         struct stree *stree;
 582         int return_id;
 583         int comparison;
 584
 585         if (argc != 6)
 586                 return 0;
 587
 588         return_id = atoi(argv[0]);
 589         type = atoi(argv[2]);
 590         param = atoi(argv[3]);
 591         key = argv[4];
 592         value = argv[5];
 593
 594         db_info->has_states = 1;
 595         if (db_info->prev_return_id != -1 && type == INTERNAL) {
 596                 set_other_side_state(db_info);
 597                 stree = __pop_fake_cur_stree();
 598
 599                 if (!db_info->cull)
 600                         merge_fake_stree(&db_info->stree, stree);
 601                 free_stree(&stree);
 602                 __push_fake_cur_stree();
 603                 db_info->cull = 0;
 604         }
 605         db_info->prev_return_id = return_id;
 606
 607         if (type == INTERNAL && func_type_mismatch(db_info->expr, value))
 608                 db_info->cull = 1;
 609         if (db_info->cull)
 610                 return 0;
 611         if (type == CULL_PATH) {
 612                 db_info->cull = 1;
 613                 return 0;
 614         }
 615
 616         if (is_impossible_data(type, db_info->expr, param, key, value)) {
 617                 db_info->cull = 1;
 618                 return 0;
 619         }
 620
 621         call_results_to_rl(db_info->expr, get_type(strip_expr(db_info->expr)), argv[1], &ret_range);
 622         ret_range = cast_rl(get_type(db_info->expr), ret_range);
 623         if (!ret_range)
 624                 ret_range = alloc_whole_rl(get_type(db_info->expr));
 625
 626         comparison = db_info->comparison;
 627         if (db_info->left)
 628                 comparison = flip_comparison(comparison);
 629
 630         if (db_info->true_side) {
 631                 if (!possibly_true_rl(var_rl, comparison, ret_range))
 632                         return 0;
 633                 if (type == PARAM_LIMIT)
 634                         param_limit_implications(db_info->expr, param, key, value);
 635                 filter_by_comparison(&var_rl, comparison, ret_range);
 636                 filter_by_comparison(&ret_range, flip_comparison(comparison), var_rl);
 637         } else {
 638                 if (!possibly_false_rl(var_rl, comparison, ret_range))
 639                         return 0;
 640                 if (type == PARAM_LIMIT)
 641                         param_limit_implications(db_info->expr, param, key, value);
 642                 filter_by_comparison(&var_rl, negate_comparison(comparison), ret_range);
 643                 filter_by_comparison(&ret_range, flip_comparison(negate_comparison(comparison)), var_rl);
 644         }
 645
 646         handle_ret_equals_param(argv[1], ret_range, db_info->expr);
 647
 648         if (type == INTERNAL) {
 649                 set_state(-1, "unnull_path", NULL, &true_state);
 650                 __add_return_comparison(strip_expr(db_info->expr), argv[1]);
 651                 __add_return_to_param_mapping(db_info->expr, argv[1]);
 652                 store_return_state(db_info, argv[1], alloc_estate_rl(clone_rl(var_rl)));
 653         }
 654
 655         FOR_EACH_PTR(db_info->callbacks, tmp) {
 656                 if (tmp->type == type)
 657                         tmp->callback(db_info->expr, param, key, value);
 658         } END_FOR_EACH_PTR(tmp);
 659
 660         return 0;
 661 }
 662
 663 static void compare_db_return_states_callbacks(struct expression *left, int comparison, struct expression *right, struct stree *implied_true, struct stree *implied_false)
 664 {
 665         struct stree *orig_states;
 666         struct stree *stree;
 667         struct stree *true_states;
 668         struct stree *false_states;
 669         struct sm_state *sm;
 670         struct db_callback_info db_info = {};
 671         struct expression *var_expr;
 672         struct expression *call_expr;
 673         struct range_list *rl;
 674         int call_on_left;
 675
 676         orig_states = clone_stree(__get_cur_stree());
 677
 678         /* legacy cruft.  need to fix call_implies_callbacks(). */
 679         call_on_left = 1;
 680         call_expr = left;
 681         var_expr = right;
 682         if (left->type != EXPR_CALL) {
 683                 call_on_left = 0;
 684                 call_expr = right;
 685                 var_expr = left;
 686         }
 687
 688         get_absolute_rl(var_expr, &rl);
 689
 690         db_info.comparison = comparison;
 691         db_info.expr = call_expr;
 692         db_info.rl = rl;
 693         db_info.left = call_on_left;
 694         db_info.callbacks = db_return_states_list;
 695         db_info.var_expr = var_expr;
 696
 697         call_return_states_before_hooks();
 698
 699         db_info.true_side = 1;
 700         db_info.stree = NULL;
 701         db_info.prev_return_id = -1;
 702         __push_fake_cur_stree();
 703         sql_select_return_states("return_id, return, type, parameter, key, value",
 704                                  call_expr, db_compare_callback, &db_info);
 705         set_other_side_state(&db_info);
 706         stree = __pop_fake_cur_stree();
 707         if (!db_info.cull)
 708                 merge_fake_stree(&db_info.stree, stree);
 709         free_stree(&stree);
 710         true_states = db_info.stree;
 711         if (!true_states && db_info.has_states) {
 712                 __push_fake_cur_stree();
 713                 set_path_impossible();
 714                 true_states = __pop_fake_cur_stree();
 715         }
 716
 717         nullify_path();
 718         __unnullify_path();
 719         FOR_EACH_SM(orig_states, sm) {
 720                 __set_sm_cur_stree(sm);
 721         } END_FOR_EACH_SM(sm);
 722
 723         db_info.true_side = 0;
 724         db_info.stree = NULL;
 725         db_info.prev_return_id = -1;
 726         db_info.cull = 0;
 727         __push_fake_cur_stree();
 728         sql_select_return_states("return_id, return, type, parameter, key, value", call_expr,
 729                         db_compare_callback, &db_info);
 730         set_other_side_state(&db_info);
 731         stree = __pop_fake_cur_stree();
 732         if (!db_info.cull)
 733                 merge_fake_stree(&db_info.stree, stree);
 734         free_stree(&stree);
 735         false_states = db_info.stree;
 736         if (!false_states && db_info.has_states) {
 737                 __push_fake_cur_stree();
 738                 set_path_impossible();
 739                 false_states = __pop_fake_cur_stree();
 740         }
 741
 742         nullify_path();
 743         __unnullify_path();
 744         FOR_EACH_SM(orig_states, sm) {
 745                 __set_sm_cur_stree(sm);
 746         } END_FOR_EACH_SM(sm);
 747
 748         free_stree(&orig_states);
 749
 750         FOR_EACH_SM(true_states, sm) {
 751                 __set_true_false_sm(sm, NULL);
 752         } END_FOR_EACH_SM(sm);
 753         FOR_EACH_SM(false_states, sm) {
 754                 __set_true_false_sm(NULL, sm);
 755         } END_FOR_EACH_SM(sm);
 756
 757         free_stree(&true_states);
 758         free_stree(&false_states);
 759
 760         call_return_states_after_hooks(call_expr);
 761
 762         FOR_EACH_SM(implied_true, sm) {
 763                 __set_true_false_sm(sm, NULL);
 764         } END_FOR_EACH_SM(sm);
 765         FOR_EACH_SM(implied_false, sm) {
 766                 __set_true_false_sm(NULL, sm);
 767         } END_FOR_EACH_SM(sm);
 768 }
 769
 770 void function_comparison(struct expression *left, int comparison, struct expression *right)
 771 {
 772         struct expression *var_expr;
 773         struct expression *call_expr;
 774         struct stree *implied_true = NULL;
 775         struct stree *implied_false = NULL;
 776         struct range_list *rl;
 777         sval_t sval;
 778         int call_on_left;
 779
 780         if (unreachable())
 781                 return;
 782
 783         /* legacy cruft.  need to fix call_implies_callbacks(). */
 784         call_on_left = 1;
 785         call_expr = left;
 786         var_expr = right;
 787         if (left->type != EXPR_CALL) {
 788                 call_on_left = 0;
 789                 call_expr = right;
 790                 var_expr = left;
 791         }
 792
 793         get_absolute_rl(var_expr, &rl);
 794
 795         if (rl_to_sval(rl, &sval))
 796                 call_implies_callbacks(comparison, call_expr, sval, call_on_left, &implied_true, &implied_false);
 797
 798         compare_db_return_states_callbacks(left, comparison, right, implied_true, implied_false);
 799         free_stree(&implied_true);
 800         free_stree(&implied_false);
 801 }
 802
 803 static void call_ranged_return_hooks(struct db_callback_info *db_info)
 804 {
 805         struct call_back_list *call_backs;
 806         struct expression *expr;
 807         struct fcall_back *tmp;
 808         char *fn;
 809
 810         expr = strip_expr(db_info->expr);
 811         while (expr->type == EXPR_ASSIGNMENT)
 812                 expr = strip_expr(expr->right);
 813         if (expr->type != EXPR_CALL ||
 814             expr->fn->type != EXPR_SYMBOL)
 815                 return;
 816
 817         fn = expr->fn->symbol_name->name;
 818
 819         call_backs = search_callback(func_hash, fn);
 820         FOR_EACH_PTR(call_backs, tmp) {
 821                 struct range_list *range_rl = NULL;
 822
 823                 if (tmp->type != RANGED_CALL)
 824                         continue;
 825                 add_range(&range_rl, tmp->range->min, tmp->range->max);
 826                 range_rl = cast_rl(estate_type(db_info->ret_state), range_rl);
 827                 if (possibly_true_rl(range_rl, SPECIAL_EQUAL, estate_rl(db_info->ret_state))) {
 828                         if (!possibly_true_rl(rl_invert(range_rl), SPECIAL_EQUAL, estate_rl(db_info->ret_state)))
 829                                 (tmp->u.ranged)(fn, expr, db_info->expr, tmp->info);
 830                         else
 831                                 db_info->handled = -1;
 832                 }
 833         } END_FOR_EACH_PTR(tmp);
 834 }
 835
 836 static int db_assign_return_states_callback(void *_info, int argc, char **argv, char **azColName)
 837 {
 838         struct db_callback_info *db_info = _info;
 839         struct range_list *ret_range;
 840         int type, param;
 841         char *key, *value;
 842         struct return_implies_callback *tmp;
 843         struct stree *stree;
 844         int return_id;
 845
 846         if (argc != 6)
 847                 return 0;
 848
 849         return_id = atoi(argv[0]);
 850         type = atoi(argv[2]);
 851         param = atoi(argv[3]);
 852         key = argv[4];
 853         value = argv[5];
 854
 855         if (db_info->prev_return_id != -1 && type == INTERNAL) {
 856                 call_ranged_return_hooks(db_info);
 857                 set_return_assign_state(db_info);
 858                 stree = __pop_fake_cur_stree();
 859                 if (!db_info->cull)
 860                         merge_fake_stree(&db_info->stree, stree);
 861                 free_stree(&stree);
 862                 __push_fake_cur_stree();
 863                 db_info->cull = 0;
 864         }
 865         db_info->prev_return_id = return_id;
 866
 867         if (type == INTERNAL && func_type_mismatch(db_info->expr, value))
 868                 db_info->cull = 1;
 869         if (db_info->cull)
 870                 return 0;
 871         if (type == CULL_PATH) {
 872                 db_info->cull = 1;
 873                 return 0;
 874         }
 875         if (is_impossible_data(type, db_info->expr, param, key, value)) {
 876                 db_info->cull = 1;
 877                 return 0;
 878         }
 879
 880         if (type == PARAM_LIMIT)
 881                 param_limit_implications(db_info->expr, param, key, value);
 882
 883         db_info->handled = 1;
 884         call_results_to_rl(db_info->expr->right, get_type(strip_expr(db_info->expr->right)), argv[1], &ret_range);
 885         if (!ret_range)
 886                 ret_range = alloc_whole_rl(get_type(strip_expr(db_info->expr->right)));
 887         ret_range = cast_rl(get_type(db_info->expr->right), ret_range);
 888
 889         if (type == INTERNAL) {
 890                 set_state(-1, "unnull_path", NULL, &true_state);
 891                 __add_return_comparison(strip_expr(db_info->expr->right), argv[1]);
 892                 __add_comparison_info(db_info->expr->left, strip_expr(db_info->expr->right), argv[1]);
 893                 __add_return_to_param_mapping(db_info->expr, argv[1]);
 894                 store_return_state(db_info, argv[1], alloc_estate_rl(ret_range));
 895         }
 896
 897         FOR_EACH_PTR(db_return_states_list, tmp) {
 898                 if (tmp->type == type)
 899                         tmp->callback(db_info->expr, param, key, value);
 900         } END_FOR_EACH_PTR(tmp);
 901
 902         return 0;
 903 }
 904
 905 static int db_return_states_assign(struct expression *expr)
 906 {
 907         struct expression *right;
 908         struct sm_state *sm;
 909         struct stree *stree;
 910         struct db_callback_info db_info = {};
 911
 912         right = strip_expr(expr->right);
 913
 914         db_info.prev_return_id = -1;
 915         db_info.expr = expr;
 916         db_info.stree = NULL;
 917         db_info.handled = 0;
 918
 919         call_return_states_before_hooks();
 920
 921         __push_fake_cur_stree();
 922         sql_select_return_states("return_id, return, type, parameter, key, value",
 923                         right, db_assign_return_states_callback, &db_info);
 924         if (option_debug) {
 925                 sm_msg("%s return_id %d return_ranges %s",
 926                         db_info.cull ? "culled" : "merging",
 927                         db_info.prev_return_id,
 928                         db_info.ret_state ? db_info.ret_state->name : "'<empty>'");
 929         }
 930         if (db_info.handled)
 931                 call_ranged_return_hooks(&db_info);
 932         set_return_assign_state(&db_info);
 933         stree = __pop_fake_cur_stree();
 934         if (!db_info.cull)
 935                 merge_fake_stree(&db_info.stree, stree);
 936         free_stree(&stree);
 937
 938         if (!db_info.stree && db_info.cull) { /* this means we culled everything */
 939                 set_extra_expr_mod(expr->left, alloc_estate_whole(get_type(expr->left)));
 940                 set_path_impossible();
 941         }
 942         FOR_EACH_SM(db_info.stree, sm) {
 943                 __set_sm(sm);
 944         } END_FOR_EACH_SM(sm);
 945
 946         free_stree(&db_info.stree);
 947         call_return_states_after_hooks(right);
 948
 949         return db_info.handled;
 950 }
 951
 952 static int handle_implied_return(struct expression *expr)
 953 {
 954         struct range_list *rl;
 955
 956         if (!get_implied_return(expr->right, &rl))
 957                 return 0;
 958         rl = cast_rl(get_type(expr->left), rl);
 959         set_extra_expr_mod(expr->left, alloc_estate_rl(rl));
 960         return 1;
 961 }
 962
 963 static void match_assign_call(struct expression *expr)
 964 {
 965         struct call_back_list *call_backs;
 966         const char *fn;
 967         struct expression *right;
 968         int handled = 0;
 969         struct range_list *rl;
 970
 971         if (expr->op != '=')
 972                 return;
 973
 974         right = strip_expr(expr->right);
 975         if (right->fn->type != EXPR_SYMBOL || !right->fn->symbol) {
 976                 handled |= db_return_states_assign(expr);
 977                 if (!handled)
 978                         goto assigned_unknown;
 979                 return;
 980         }
 981         if (is_fake_call(right)) {
 982                 set_extra_expr_mod(expr->left, alloc_estate_whole(get_type(expr->left)));
 983                 return;
 984         }
 985
 986         fn = right->fn->symbol->ident->name;
 987         call_backs = search_callback(func_hash, (char *)fn);
 988
 989         /*
 990          * The ordering here is sort of important.
 991          * One example, of how this matters is that when we do:
 992          *
 993          *      len = strlen(str);
 994          *
 995          * That is handled by smatch_common_functions.c and smatch_strlen.c.
 996          * They use implied_return and function_assign_hook respectively.
 997          * We want to get the implied return first before we do the function
 998          * assignment hook otherwise we end up writing the wrong thing for len
 999          * in smatch_extra.c because we assume that it already holds the
1000          * strlen() when we haven't set it yet.
1001          */
1002
1003         if (db_return_states_assign(expr) == 1)
1004                 handled = 1;
1005         else
1006                 handled = assign_ranged_funcs(fn, expr, call_backs);
1007         handled |= handle_implied_return(expr);
1008
1009
1010         call_call_backs(call_backs, ASSIGN_CALL, fn, expr);
1011
1012         if (handled)
1013                 return;
1014
1015 assigned_unknown:
1016         get_absolute_rl(expr->right, &rl);
1017         rl = cast_rl(get_type(expr->left), rl);
1018         set_extra_expr_mod(expr->left, alloc_estate_rl(rl));
1019 }
1020
1021 static int db_return_states_callback(void *_info, int argc, char **argv, char **azColName)
1022 {
1023         struct db_callback_info *db_info = _info;
1024         struct range_list *ret_range;
1025         int type, param;
1026         char *key, *value;
1027         struct return_implies_callback *tmp;
1028         struct stree *stree;
1029         int return_id;
1030         char buf[64];
1031
1032         if (argc != 6)
1033                 return 0;
1034
1035         return_id = atoi(argv[0]);
1036         type = atoi(argv[2]);
1037         param = atoi(argv[3]);
1038         key = argv[4];
1039         value = argv[5];
1040
1041         if (db_info->prev_return_id != -1 && type == INTERNAL) {
1042                 stree = __pop_fake_cur_stree();
1043                 if (!db_info->cull)
1044                         merge_fake_stree(&db_info->stree, stree);
1045                 free_stree(&stree);
1046                 __push_fake_cur_stree();
1047                 __unnullify_path();
1048                 db_info->cull = 0;
1049         }
1050         db_info->prev_return_id = return_id;
1051
1052         if (type == INTERNAL && func_type_mismatch(db_info->expr, value))
1053                 db_info->cull = 1;
1054         if (db_info->cull)
1055                 return 0;
1056         if (type == CULL_PATH) {
1057                 db_info->cull = 1;
1058                 return 0;
1059         }
1060         if (is_impossible_data(type, db_info->expr, param, key, value)) {
1061                 db_info->cull = 1;
1062                 return 0;
1063         }
1064
1065         if (type == PARAM_LIMIT)
1066                 param_limit_implications(db_info->expr, param, key, value);
1067
1068         call_results_to_rl(db_info->expr, get_type(strip_expr(db_info->expr)), argv[1], &ret_range);
1069         ret_range = cast_rl(get_type(db_info->expr), ret_range);
1070
1071         if (type == INTERNAL) {
1072                 set_state(-1, "unnull_path", NULL, &true_state);
1073                 __add_return_comparison(strip_expr(db_info->expr), argv[1]);
1074                 __add_return_to_param_mapping(db_info->expr, argv[1]);
1075         }
1076
1077
1078         FOR_EACH_PTR(db_return_states_list, tmp) {
1079                 if (tmp->type == type)
1080                         tmp->callback(db_info->expr, param, key, value);
1081         } END_FOR_EACH_PTR(tmp);
1082
1083         /*
1084          * We want to store the return values so that we can split the strees
1085          * in smatch_db.c.  This uses set_state() directly because it's not a
1086          * real smatch_extra state.
1087          */
1088         snprintf(buf, sizeof(buf), "return %p", db_info->expr);
1089         set_state(SMATCH_EXTRA, buf, NULL, alloc_estate_rl(ret_range));
1090
1091         return 0;
1092 }
1093
1094 static void db_return_states(struct expression *expr)
1095 {
1096         struct sm_state *sm;
1097         struct stree *stree;
1098         struct db_callback_info db_info = {};
1099
1100         if (!__get_cur_stree())  /* no return functions */
1101                 return;
1102
1103         db_info.prev_return_id = -1;
1104         db_info.expr = expr;
1105         db_info.stree = NULL;
1106
1107         call_return_states_before_hooks();
1108
1109         __push_fake_cur_stree();
1110         __unnullify_path();
1111         sql_select_return_states("return_id, return, type, parameter, key, value",
1112                         expr, db_return_states_callback, &db_info);
1113         stree = __pop_fake_cur_stree();
1114         if (!db_info.cull)
1115                 merge_fake_stree(&db_info.stree, stree);
1116         free_stree(&stree);
1117
1118         FOR_EACH_SM(db_info.stree, sm) {
1119                 __set_sm(sm);
1120         } END_FOR_EACH_SM(sm);
1121
1122         free_stree(&db_info.stree);
1123         call_return_states_after_hooks(expr);
1124 }
1125
1126 static int is_condition_call(struct expression *expr)
1127 {
1128         struct expression *tmp;
1129
1130         FOR_EACH_PTR_REVERSE(big_condition_stack, tmp) {
1131                 if (expr == tmp || expr_get_parent_expr(expr) == tmp)
1132                         return 1;
1133                 if (tmp->pos.line < expr->pos.line)
1134                         return 0;
1135         } END_FOR_EACH_PTR_REVERSE(tmp);
1136
1137         return 0;
1138 }
1139
1140 static void db_return_states_call(struct expression *expr)
1141 {
1142         if (unreachable())
1143                 return;
1144
1145         if (is_assigned_call(expr))
1146                 return;
1147         if (is_condition_call(expr))
1148                 return;
1149         db_return_states(expr);
1150 }
1151
1152 static void match_function_call(struct expression *expr)
1153 {
1154         struct call_back_list *call_backs;
1155
1156         if (expr->fn->type == EXPR_SYMBOL && expr->fn->symbol) {
1157                 call_backs = search_callback(func_hash, (char *)expr->fn->symbol->ident->name);
1158                 if (call_backs)
1159                         call_call_backs(call_backs, REGULAR_CALL,
1160                                         expr->fn->symbol->ident->name, expr);
1161         }
1162         db_return_states_call(expr);
1163 }
1164
1165 static void match_macro_assign(struct expression *expr)
1166 {
1167         struct call_back_list *call_backs;
1168         const char *macro;
1169         struct expression *right;
1170
1171         right = strip_expr(expr->right);
1172         macro = get_macro_name(right->pos);
1173         call_backs = search_callback(func_hash, (char *)macro);
1174         if (!call_backs)
1175                 return;
1176         call_call_backs(call_backs, MACRO_ASSIGN, macro, expr);
1177         call_call_backs(call_backs, MACRO_ASSIGN_EXTRA, macro, expr);
1178 }
1179
1180 int get_implied_return(struct expression *expr, struct range_list **rl)
1181 {
1182         struct call_back_list *call_backs;
1183         struct fcall_back *tmp;
1184         int handled = 0;
1185         char *fn;
1186
1187         *rl = NULL;
1188
1189         expr = strip_expr(expr);
1190         fn = expr_to_var(expr->fn);
1191         if (!fn)
1192                 goto out;
1193
1194         call_backs = search_callback(func_hash, fn);
1195
1196         FOR_EACH_PTR(call_backs, tmp) {
1197                 if (tmp->type == IMPLIED_RETURN) {
1198                         (tmp->u.implied_return)(expr, tmp->info, rl);
1199                         handled = 1;
1200                 }
1201         } END_FOR_EACH_PTR(tmp);
1202
1203 out:
1204         free_string(fn);
1205         return handled;
1206 }
1207
1208 void create_function_hook_hash(void)
1209 {
1210         func_hash = create_function_hashtable(5000);
1211 }
1212
1213 void register_function_hooks(int id)
1214 {
1215         add_hook(&match_function_call, CALL_HOOK_AFTER_INLINE);
1216         add_hook(&match_assign_call, CALL_ASSIGNMENT_HOOK);
1217         add_hook(&match_macro_assign, MACRO_ASSIGNMENT_HOOK);
1218 }