smatch_function_hooks.c

   1 /*
   2  * Copyright (C) 2009 Dan Carpenter.
   3  *
   4  * This program is free software; you can redistribute it and/or
   5  * modify it under the terms of the GNU General Public License
   6  * as published by the Free Software Foundation; either version 2
   7  * of the License, or (at your option) any later version.
   8  *
   9  * This program is distributed in the hope that it will be useful,
  10  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  11  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  12  * GNU General Public License for more details.
  13  *
  14  * You should have received a copy of the GNU General Public License
  15  * along with this program; if not, see http://www.gnu.org/copyleft/gpl.txt
  16  */
  17
  18 /*
  19  * There are several types of function hooks:
  20  * add_function_hook()        - For any time a function is called.
  21  * add_function_assign_hook() - foo = the_function().
  22  * add_implied_return_hook()  - Calculates the implied return value.
  23  * add_macro_assign_hook()    - foo = the_macro().
  24  * return_implies_state()     - For when a return value of 1 implies locked
  25  *                              and 0 implies unlocked. etc. etc.
  26  *
  27  */
  28
  29 #include <stdlib.h>
  30 #include <stdio.h>
  31 #include "smatch.h"
  32 #include "smatch_slist.h"
  33 #include "smatch_extra.h"
  34 #include "smatch_function_hashtable.h"
  35
  36 struct fcall_back {
  37         int type;
  38         struct data_range *range;
  39         union {
  40                 func_hook *call_back;
  41                 implication_hook *ranged;
  42                 implied_return_hook *implied_return;
  43         } u;
  44         void *info;
  45 };
  46
  47 ALLOCATOR(fcall_back, "call backs");
  48 DECLARE_PTR_LIST(call_back_list, struct fcall_back);
  49
  50 DEFINE_FUNCTION_HASHTABLE_STATIC(callback, struct fcall_back, struct call_back_list);
  51 static struct hashtable *func_hash;
  52
  53 #define REGULAR_CALL       0
  54 #define RANGED_CALL        1
  55 #define ASSIGN_CALL        2
  56 #define IMPLIED_RETURN     3
  57 #define MACRO_ASSIGN       4
  58 #define MACRO_ASSIGN_EXTRA 5
  59
  60 struct return_implies_callback {
  61         int type;
  62         return_implies_hook *callback;
  63 };
  64 ALLOCATOR(return_implies_callback, "return_implies callbacks");
  65 DECLARE_PTR_LIST(db_implies_list, struct return_implies_callback);
  66 static struct db_implies_list *db_return_states_list;
  67
  68 typedef void (void_fn)(void);
  69 DECLARE_PTR_LIST(void_fn_list, void_fn *);
  70 static struct void_fn_list *return_states_before;
  71 static struct void_fn_list *return_states_after;
  72
  73 static struct fcall_back *alloc_fcall_back(int type, void *call_back,
  74                                            void *info)
  75 {
  76         struct fcall_back *cb;
  77
  78         cb = __alloc_fcall_back(0);
  79         cb->type = type;
  80         cb->u.call_back = call_back;
  81         cb->info = info;
  82         return cb;
  83 }
  84
  85 void add_function_hook(const char *look_for, func_hook *call_back, void *info)
  86 {
  87         struct fcall_back *cb;
  88
  89         cb = alloc_fcall_back(REGULAR_CALL, call_back, info);
  90         add_callback(func_hash, look_for, cb);
  91 }
  92
  93 void add_function_assign_hook(const char *look_for, func_hook *call_back,
  94                               void *info)
  95 {
  96         struct fcall_back *cb;
  97
  98         cb = alloc_fcall_back(ASSIGN_CALL, call_back, info);
  99         add_callback(func_hash, look_for, cb);
 100 }
 101
 102 void add_implied_return_hook(const char *look_for,
 103                              implied_return_hook *call_back,
 104                              void *info)
 105 {
 106         struct fcall_back *cb;
 107
 108         cb = alloc_fcall_back(IMPLIED_RETURN, call_back, info);
 109         add_callback(func_hash, look_for, cb);
 110 }
 111
 112 void add_macro_assign_hook(const char *look_for, func_hook *call_back,
 113                         void *info)
 114 {
 115         struct fcall_back *cb;
 116
 117         cb = alloc_fcall_back(MACRO_ASSIGN, call_back, info);
 118         add_callback(func_hash, look_for, cb);
 119 }
 120
 121 void add_macro_assign_hook_extra(const char *look_for, func_hook *call_back,
 122                         void *info)
 123 {
 124         struct fcall_back *cb;
 125
 126         cb = alloc_fcall_back(MACRO_ASSIGN_EXTRA, call_back, info);
 127         add_callback(func_hash, look_for, cb);
 128 }
 129
 130 void return_implies_state(const char *look_for, long long start, long long end,
 131                          implication_hook *call_back, void *info)
 132 {
 133         struct fcall_back *cb;
 134
 135         cb = alloc_fcall_back(RANGED_CALL, call_back, info);
 136         cb->range = alloc_range_perm(ll_to_sval(start), ll_to_sval(end));
 137         add_callback(func_hash, look_for, cb);
 138 }
 139
 140 void select_return_states_hook(int type, return_implies_hook *callback)
 141 {
 142         struct return_implies_callback *cb = __alloc_return_implies_callback(0);
 143
 144         cb->type = type;
 145         cb->callback = callback;
 146         add_ptr_list(&db_return_states_list, cb);
 147 }
 148
 149 void select_return_states_before(void_fn *fn)
 150 {
 151         void_fn **p = malloc(sizeof(void_fn *));
 152         *p = fn;
 153         add_ptr_list(&return_states_before, p);
 154 }
 155
 156 void select_return_states_after(void_fn *fn)
 157 {
 158         void_fn **p = malloc(sizeof(void_fn *));
 159         *p = fn;
 160         add_ptr_list(&return_states_after, p);
 161 }
 162
 163 static void call_return_states_before_hooks(void)
 164 {
 165         void_fn **fn;
 166
 167         FOR_EACH_PTR(return_states_before, fn) {
 168                 (*fn)();
 169         } END_FOR_EACH_PTR(fn);
 170 }
 171
 172 static void call_return_states_after_hooks(struct expression *expr)
 173 {
 174         void_fn **fn;
 175
 176         FOR_EACH_PTR(return_states_after, fn) {
 177                 (*fn)();
 178         } END_FOR_EACH_PTR(fn);
 179         __pass_to_client(expr, FUNCTION_CALL_HOOK_AFTER_DB);
 180 }
 181
 182 static int call_call_backs(struct call_back_list *list, int type,
 183                             const char *fn, struct expression *expr)
 184 {
 185         struct fcall_back *tmp;
 186         int handled = 0;
 187
 188         FOR_EACH_PTR(list, tmp) {
 189                 if (tmp->type == type) {
 190                         (tmp->u.call_back)(fn, expr, tmp->info);
 191                         handled = 1;
 192                 }
 193         } END_FOR_EACH_PTR(tmp);
 194
 195         return handled;
 196 }
 197
 198 static void call_ranged_call_backs(struct call_back_list *list,
 199                                 const char *fn, struct expression *call_expr,
 200                                 struct expression *assign_expr)
 201 {
 202         struct fcall_back *tmp;
 203
 204         FOR_EACH_PTR(list, tmp) {
 205                 (tmp->u.ranged)(fn, call_expr, assign_expr, tmp->info);
 206         } END_FOR_EACH_PTR(tmp);
 207 }
 208
 209 static struct call_back_list *get_same_ranged_call_backs(struct call_back_list *list,
 210                                                 struct data_range *drange)
 211 {
 212         struct call_back_list *ret = NULL;
 213         struct fcall_back *tmp;
 214
 215         FOR_EACH_PTR(list, tmp) {
 216                 if (tmp->type != RANGED_CALL)
 217                         continue;
 218                 if (ranges_equiv(tmp->range, drange))
 219                         add_ptr_list(&ret, tmp);
 220         } END_FOR_EACH_PTR(tmp);
 221         return ret;
 222 }
 223
 224 static int in_list_exact_sval(struct range_list *list, struct data_range *drange)
 225 {
 226         struct data_range *tmp;
 227
 228         FOR_EACH_PTR(list, tmp) {
 229                 if (ranges_equiv(tmp, drange))
 230                         return 1;
 231         } END_FOR_EACH_PTR(tmp);
 232         return 0;
 233 }
 234
 235 static int assign_ranged_funcs(const char *fn, struct expression *expr,
 236                                  struct call_back_list *call_backs)
 237 {
 238         struct fcall_back *tmp;
 239         struct sm_state *sm;
 240         char *var_name;
 241         struct symbol *sym;
 242         struct smatch_state *estate;
 243         struct stree *tmp_stree;
 244         struct stree *final_states = NULL;
 245         struct range_list *handled_ranges = NULL;
 246         struct call_back_list *same_range_call_backs = NULL;
 247         int handled = 0;
 248
 249         if (!call_backs)
 250                 return 0;
 251
 252         var_name = expr_to_var_sym(expr->left, &sym);
 253         if (!var_name || !sym)
 254                 goto free;
 255
 256         FOR_EACH_PTR(call_backs, tmp) {
 257                 if (tmp->type != RANGED_CALL)
 258                         continue;
 259
 260                 if (in_list_exact_sval(handled_ranges, tmp->range))
 261                         continue;
 262                 __push_fake_cur_stree();
 263                 tack_on(&handled_ranges, tmp->range);
 264
 265                 same_range_call_backs = get_same_ranged_call_backs(call_backs, tmp->range);
 266                 call_ranged_call_backs(same_range_call_backs, fn, expr->right, expr);
 267                 __free_ptr_list((struct ptr_list **)&same_range_call_backs);
 268
 269                 estate = alloc_estate_range(tmp->range->min, tmp->range->max);
 270                 set_extra_mod(var_name, sym, estate);
 271
 272                 tmp_stree = __pop_fake_cur_stree();
 273                 merge_fake_stree(&final_states, tmp_stree);
 274                 free_stree(&tmp_stree);
 275                 handled = 1;
 276         } END_FOR_EACH_PTR(tmp);
 277
 278         FOR_EACH_SM(final_states, sm) {
 279                 __set_sm(sm);
 280         } END_FOR_EACH_SM(sm);
 281
 282         free_stree(&final_states);
 283 free:
 284         free_string(var_name);
 285         return handled;
 286 }
 287
 288 static void call_implies_callbacks(int comparison, struct expression *expr, sval_t sval, int left, struct stree **implied_true, struct stree **implied_false)
 289 {
 290         struct call_back_list *call_backs;
 291         struct fcall_back *tmp;
 292         const char *fn;
 293         struct data_range *value_range;
 294         struct stree *true_states = NULL;
 295         struct stree *false_states = NULL;
 296         struct stree *tmp_stree;
 297
 298         *implied_true = NULL;
 299         *implied_false = NULL;
 300         if (expr->fn->type != EXPR_SYMBOL || !expr->fn->symbol)
 301                 return;
 302         fn = expr->fn->symbol->ident->name;
 303         call_backs = search_callback(func_hash, (char *)expr->fn->symbol->ident->name);
 304         if (!call_backs)
 305                 return;
 306         value_range = alloc_range(sval, sval);
 307
 308         /* set true states */
 309         __push_fake_cur_stree();
 310         FOR_EACH_PTR(call_backs, tmp) {
 311                 if (tmp->type != RANGED_CALL)
 312                         continue;
 313                 if (!true_comparison_range_LR(comparison, tmp->range, value_range, left))
 314                         continue;
 315                 (tmp->u.ranged)(fn, expr, NULL, tmp->info);
 316         } END_FOR_EACH_PTR(tmp);
 317         tmp_stree = __pop_fake_cur_stree();
 318         merge_fake_stree(&true_states, tmp_stree);
 319         free_stree(&tmp_stree);
 320
 321         /* set false states */
 322         __push_fake_cur_stree();
 323         FOR_EACH_PTR(call_backs, tmp) {
 324                 if (tmp->type != RANGED_CALL)
 325                         continue;
 326                 if (!false_comparison_range_LR(comparison, tmp->range, value_range, left))
 327                         continue;
 328                 (tmp->u.ranged)(fn, expr, NULL, tmp->info);
 329         } END_FOR_EACH_PTR(tmp);
 330         tmp_stree = __pop_fake_cur_stree();
 331         merge_fake_stree(&false_states, tmp_stree);
 332         free_stree(&tmp_stree);
 333
 334         *implied_true = true_states;
 335         *implied_false = false_states;
 336 }
 337
 338 struct db_callback_info {
 339         int true_side;
 340         int comparison;
 341         struct expression *expr;
 342         struct range_list *rl;
 343         int left;
 344         struct stree *stree;
 345         struct db_implies_list *callbacks;
 346         int prev_return_id;
 347         int cull;
 348         struct smatch_state *ret_state;
 349         struct expression *var_expr;
 350 };
 351
 352 static void store_return_state(struct db_callback_info *db_info, struct smatch_state *state)
 353 {
 354         db_info->ret_state = state;
 355 }
 356
 357 static void set_return_state(struct expression *expr, struct db_callback_info *db_info)
 358 {
 359         if (!db_info->ret_state)
 360                 return;
 361
 362         set_extra_expr_mod(expr, db_info->ret_state);
 363         db_info->ret_state = NULL;
 364 }
 365
 366 static void handle_ret_equals_param(char *ret_string, struct range_list *rl, struct expression *call)
 367 {
 368         char *str;
 369         long long param;
 370         struct expression *arg;
 371         struct range_list *orig;
 372
 373         str = strstr(ret_string, "==$");
 374         if (!str)
 375                 return;
 376         str += 3;
 377         param = strtoll(str, NULL, 10);
 378         arg = get_argument_from_call_expr(call->args, param);
 379         if (!arg)
 380                 return;
 381         get_absolute_rl(arg, &orig);
 382         rl = rl_intersection(orig, rl);
 383         if (!rl)
 384                 return;
 385         set_extra_expr_nomod(arg, alloc_estate_rl(rl));
 386 }
 387
 388 static int impossible_limit(struct expression *expr, int param, char *key, char *value)
 389 {
 390         struct expression *arg;
 391         struct range_list *passed;
 392         struct range_list *limit;
 393         struct symbol *compare_type;
 394
 395         if (strcmp(key, "$") != 0)
 396                 return 0;
 397
 398         while (expr->type == EXPR_ASSIGNMENT)
 399                 expr = strip_expr(expr->right);
 400         if (expr->type != EXPR_CALL)
 401                 return 0;
 402
 403         arg = get_argument_from_call_expr(expr->args, param);
 404         if (!arg)
 405                 return 0;
 406         if (!get_implied_rl(arg, &passed))
 407                 return 0;
 408         if (!passed || is_whole_rl(passed))
 409                 return 0;
 410
 411         compare_type = get_arg_type(expr->fn, param);
 412         passed = cast_rl(compare_type, passed);
 413         call_results_to_rl(expr, compare_type, value, &limit);
 414         if (!limit || is_whole_rl(limit))
 415                 return 0;
 416         if (possibly_true_rl(passed, SPECIAL_EQUAL, limit))
 417                 return 0;
 418         if (option_debug || local_debug)
 419                 sm_msg("impossible: %d '%s' limit '%s' == '%s'", param, key, show_rl(passed), value);
 420         return 1;
 421 }
 422
 423 static int db_compare_callback(void *_info, int argc, char **argv, char **azColName)
 424 {
 425         struct db_callback_info *db_info = _info;
 426         struct range_list *var_rl = db_info->rl;
 427         struct range_list *ret_range;
 428         int type, param;
 429         char *key, *value;
 430         struct return_implies_callback *tmp;
 431         struct stree *stree;
 432         int return_id;
 433         int comparison;
 434
 435         if (argc != 6)
 436                 return 0;
 437
 438         return_id = atoi(argv[0]);
 439         type = atoi(argv[2]);
 440         param = atoi(argv[3]);
 441         key = argv[4];
 442         value = argv[5];
 443
 444         if (db_info->prev_return_id != -1 && return_id != db_info->prev_return_id) {
 445                 set_return_state(db_info->var_expr, db_info);
 446                 stree = __pop_fake_cur_stree();
 447
 448                 if (!db_info->cull)
 449                         merge_fake_stree(&db_info->stree, stree);
 450                 free_stree(&stree);
 451                 __push_fake_cur_stree();
 452                 db_info->cull = 0;
 453         }
 454         db_info->prev_return_id = return_id;
 455
 456         if (db_info->cull)
 457                 return 0;
 458         if (type == CULL_PATH) {
 459                 db_info->cull = 1;
 460                 return 0;
 461         }
 462         if (type == PARAM_LIMIT && impossible_limit(db_info->expr, param, key, value)) {
 463                 db_info->cull = 1;
 464                 return 0;
 465         }
 466
 467         call_results_to_rl(db_info->expr, get_type(strip_expr(db_info->expr)), argv[1], &ret_range);
 468         ret_range = cast_rl(get_type(db_info->expr), ret_range);
 469         if (!ret_range)
 470                 ret_range = alloc_whole_rl(get_type(db_info->expr));
 471
 472         comparison = db_info->comparison;
 473         if (db_info->left)
 474                 comparison = flip_comparison(comparison);
 475
 476         if (db_info->true_side) {
 477                 if (!possibly_true_rl(var_rl, comparison, ret_range))
 478                         return 0;
 479                 if (type == PARAM_LIMIT)
 480                         param_limit_implications(db_info->expr, param, key, value);
 481                 filter_by_comparison(&var_rl, comparison, ret_range);
 482                 filter_by_comparison(&ret_range, flip_comparison(comparison), var_rl);
 483         } else {
 484                 if (!possibly_false_rl(var_rl, comparison, ret_range))
 485                         return 0;
 486                 if (type == PARAM_LIMIT)
 487                         param_limit_implications(db_info->expr, param, key, value);
 488                 filter_by_comparison(&var_rl, negate_comparison(comparison), ret_range);
 489                 filter_by_comparison(&ret_range, flip_comparison(negate_comparison(comparison)), var_rl);
 490         }
 491
 492         handle_ret_equals_param(argv[1], ret_range, db_info->expr);
 493
 494         if (type == INTERNAL)
 495                 set_state(-1, "unnull_path", NULL, &true_state);
 496
 497         FOR_EACH_PTR(db_info->callbacks, tmp) {
 498                 if (tmp->type == type)
 499                         tmp->callback(db_info->expr, param, key, value);
 500         } END_FOR_EACH_PTR(tmp);
 501
 502         store_return_state(db_info, alloc_estate_rl(clone_rl(var_rl)));
 503         return 0;
 504 }
 505
 506 static void compare_db_return_states_callbacks(struct expression *left, int comparison, struct expression *right, struct stree *implied_true, struct stree *implied_false)
 507 {
 508         struct stree *orig_states;
 509         struct stree *stree;
 510         struct stree *true_states;
 511         struct stree *false_states;
 512         struct sm_state *sm;
 513         struct db_callback_info db_info = {};
 514         struct expression *var_expr;
 515         struct expression *call_expr;
 516         struct range_list *rl;
 517         int call_on_left;
 518
 519         orig_states = clone_stree(__get_cur_stree());
 520
 521         /* legacy cruft.  need to fix call_implies_callbacks(). */
 522         call_on_left = 1;
 523         call_expr = left;
 524         var_expr = right;
 525         if (left->type != EXPR_CALL) {
 526                 call_on_left = 0;
 527                 call_expr = right;
 528                 var_expr = left;
 529         }
 530
 531         get_absolute_rl(var_expr, &rl);
 532
 533         db_info.comparison = comparison;
 534         db_info.expr = call_expr;
 535         db_info.rl = rl;
 536         db_info.left = call_on_left;
 537         db_info.callbacks = db_return_states_list;
 538         db_info.var_expr = var_expr;
 539
 540         call_return_states_before_hooks();
 541
 542         db_info.true_side = 1;
 543         db_info.stree = NULL;
 544         db_info.prev_return_id = -1;
 545         __push_fake_cur_stree();
 546         sql_select_return_states("return_id, return, type, parameter, key, value",
 547                                  call_expr, db_compare_callback, &db_info);
 548         set_return_state(db_info.var_expr, &db_info);
 549         stree = __pop_fake_cur_stree();
 550         if (!db_info.cull) {
 551                 set_return_state(db_info.var_expr, &db_info);
 552                 merge_fake_stree(&db_info.stree, stree);
 553         }
 554         free_stree(&stree);
 555         true_states = db_info.stree;
 556
 557         nullify_path();
 558         __unnullify_path();
 559         FOR_EACH_SM(orig_states, sm) {
 560                 __set_sm_cur_stree(sm);
 561         } END_FOR_EACH_SM(sm);
 562
 563         db_info.true_side = 0;
 564         db_info.stree = NULL;
 565         db_info.prev_return_id = -1;
 566         db_info.cull = 0;
 567         __push_fake_cur_stree();
 568         sql_select_return_states("return_id, return, type, parameter, key, value", call_expr,
 569                         db_compare_callback, &db_info);
 570         stree = __pop_fake_cur_stree();
 571         if (!db_info.cull) {
 572                 set_return_state(db_info.var_expr, &db_info);
 573                 merge_fake_stree(&db_info.stree, stree);
 574         }
 575         free_stree(&stree);
 576         false_states = db_info.stree;
 577
 578         nullify_path();
 579         __unnullify_path();
 580         FOR_EACH_SM(orig_states, sm) {
 581                 __set_sm_cur_stree(sm);
 582         } END_FOR_EACH_SM(sm);
 583
 584         free_stree(&orig_states);
 585
 586         FOR_EACH_SM(true_states, sm) {
 587                 __set_true_false_sm(sm, NULL);
 588         } END_FOR_EACH_SM(sm);
 589         FOR_EACH_SM(false_states, sm) {
 590                 __set_true_false_sm(NULL, sm);
 591         } END_FOR_EACH_SM(sm);
 592
 593         free_stree(&true_states);
 594         free_stree(&false_states);
 595
 596         call_return_states_after_hooks(call_expr);
 597
 598         FOR_EACH_SM(implied_true, sm) {
 599                 __set_true_false_sm(sm, NULL);
 600         } END_FOR_EACH_SM(sm);
 601         FOR_EACH_SM(implied_false, sm) {
 602                 __set_true_false_sm(NULL, sm);
 603         } END_FOR_EACH_SM(sm);
 604 }
 605
 606 void function_comparison(struct expression *left, int comparison, struct expression *right)
 607 {
 608         struct expression *var_expr;
 609         struct expression *call_expr;
 610         struct stree *implied_true = NULL;
 611         struct stree *implied_false = NULL;
 612         struct range_list *rl;
 613         sval_t sval;
 614         int call_on_left;
 615
 616         if (unreachable())
 617                 return;
 618
 619         /* legacy cruft.  need to fix call_implies_callbacks(). */
 620         call_on_left = 1;
 621         call_expr = left;
 622         var_expr = right;
 623         if (left->type != EXPR_CALL) {
 624                 call_on_left = 0;
 625                 call_expr = right;
 626                 var_expr = left;
 627         }
 628
 629         get_absolute_rl(var_expr, &rl);
 630
 631         if (rl_to_sval(rl, &sval))
 632                 call_implies_callbacks(comparison, call_expr, sval, call_on_left, &implied_true, &implied_false);
 633
 634         compare_db_return_states_callbacks(left, comparison, right, implied_true, implied_false);
 635         free_stree(&implied_true);
 636         free_stree(&implied_false);
 637 }
 638
 639 static int db_assign_return_states_callback(void *_info, int argc, char **argv, char **azColName)
 640 {
 641         struct db_callback_info *db_info = _info;
 642         struct range_list *ret_range;
 643         int type, param;
 644         char *key, *value;
 645         struct return_implies_callback *tmp;
 646         struct stree *stree;
 647         int return_id;
 648
 649         if (argc != 6)
 650                 return 0;
 651
 652         return_id = atoi(argv[0]);
 653         type = atoi(argv[2]);
 654         param = atoi(argv[3]);
 655         key = argv[4];
 656         value = argv[5];
 657
 658         if (db_info->prev_return_id != -1 && return_id != db_info->prev_return_id) {
 659                 set_return_state(db_info->expr->left, db_info);
 660                 stree = __pop_fake_cur_stree();
 661                 if (!db_info->cull)
 662                         merge_fake_stree(&db_info->stree, stree);
 663                 free_stree(&stree);
 664                 __push_fake_cur_stree();
 665                 db_info->cull = 0;
 666         }
 667         db_info->prev_return_id = return_id;
 668
 669         if (db_info->cull)
 670                 return 0;
 671         if (type == CULL_PATH) {
 672                 db_info->cull = 1;
 673                 return 0;
 674         }
 675         if (type == PARAM_LIMIT && impossible_limit(db_info->expr, param, key, value)) {
 676                 db_info->cull = 1;
 677                 return 0;
 678         }
 679
 680         call_results_to_rl(db_info->expr->right, get_type(strip_expr(db_info->expr->right)), argv[1], &ret_range);
 681         __add_comparison_info(db_info->expr->left, strip_expr(db_info->expr->right), argv[1]);
 682         if (!ret_range)
 683                 ret_range = alloc_whole_rl(get_type(strip_expr(db_info->expr->right)));
 684         ret_range = cast_rl(get_type(db_info->expr->right), ret_range);
 685
 686         if (type == INTERNAL)
 687                 set_state(-1, "unnull_path", NULL, &true_state);
 688
 689         FOR_EACH_PTR(db_return_states_list, tmp) {
 690                 if (tmp->type == type)
 691                         tmp->callback(db_info->expr, param, key, value);
 692         } END_FOR_EACH_PTR(tmp);
 693         ret_range = cast_rl(get_type(db_info->expr->left), ret_range);
 694         store_return_state(db_info, alloc_estate_rl(ret_range));
 695
 696         return 0;
 697 }
 698
 699 static int db_return_states_assign(struct expression *expr)
 700 {
 701         struct expression *right;
 702         struct sm_state *sm;
 703         struct stree *stree;
 704         int handled = 0;
 705         struct db_callback_info db_info = {};
 706
 707         right = strip_expr(expr->right);
 708
 709         db_info.prev_return_id = -1;
 710         db_info.expr = expr;
 711         db_info.stree = NULL;
 712
 713         call_return_states_before_hooks();
 714
 715         __push_fake_cur_stree();
 716         sql_select_return_states("return_id, return, type, parameter, key, value",
 717                         right, db_assign_return_states_callback, &db_info);
 718         if (option_debug) {
 719                 sm_msg("%s return_id %d return_ranges %s",
 720                         db_info.cull ? "culled" : "merging",
 721                         db_info.prev_return_id,
 722                         db_info.ret_state ? db_info.ret_state->name : "'<empty'");
 723         }
 724         set_return_state(db_info.expr->left, &db_info);
 725         stree = __pop_fake_cur_stree();
 726         if (!db_info.cull)
 727                 merge_fake_stree(&db_info.stree, stree);
 728         free_stree(&stree);
 729
 730         FOR_EACH_SM(db_info.stree, sm) {
 731                 __set_sm(sm);
 732                 handled = 1;
 733         } END_FOR_EACH_SM(sm);
 734
 735         free_stree(&db_info.stree);
 736         call_return_states_after_hooks(right);
 737
 738         return handled;
 739 }
 740
 741 static int handle_implied_return(struct expression *expr)
 742 {
 743         struct range_list *rl;
 744
 745         if (!get_implied_return(expr->right, &rl))
 746                 return 0;
 747         rl = cast_rl(get_type(expr->left), rl);
 748         set_extra_expr_mod(expr->left, alloc_estate_rl(rl));
 749         return 1;
 750 }
 751
 752 static void match_assign_call(struct expression *expr)
 753 {
 754         struct call_back_list *call_backs;
 755         const char *fn;
 756         struct expression *right;
 757         int handled = 0;
 758         struct range_list *rl;
 759
 760         if (expr->op != '=')
 761                 return;
 762
 763         right = strip_expr(expr->right);
 764         if (right->fn->type != EXPR_SYMBOL || !right->fn->symbol) {
 765                 handled |= db_return_states_assign(expr);
 766                 if (!handled)
 767                         goto assigned_unknown;
 768                 return;
 769         }
 770         if (is_fake_call(right)) {
 771                 set_extra_expr_mod(expr->left, alloc_estate_whole(get_type(expr->left)));
 772                 return;
 773         }
 774
 775         fn = right->fn->symbol->ident->name;
 776
 777         /*
 778          * some of these conflict (they try to set smatch extra twice), so we
 779          * call them in order from least important to most important.
 780          */
 781
 782         call_backs = search_callback(func_hash, (char *)fn);
 783         call_call_backs(call_backs, ASSIGN_CALL, fn, expr);
 784
 785         handled |= db_return_states_assign(expr);
 786         handled |= assign_ranged_funcs(fn, expr, call_backs);
 787         handled |= handle_implied_return(expr);
 788
 789         if (handled)
 790                 return;
 791
 792 assigned_unknown:
 793         get_absolute_rl(expr->right, &rl);
 794         rl = cast_rl(get_type(expr->left), rl);
 795         set_extra_expr_mod(expr->left, alloc_estate_rl(rl));
 796 }
 797
 798 static int db_return_states_callback(void *_info, int argc, char **argv, char **azColName)
 799 {
 800         struct db_callback_info *db_info = _info;
 801         struct range_list *ret_range;
 802         int type, param;
 803         char *key, *value;
 804         struct return_implies_callback *tmp;
 805         struct stree *stree;
 806         int return_id;
 807         char buf[64];
 808
 809         if (argc != 6)
 810                 return 0;
 811
 812         return_id = atoi(argv[0]);
 813         type = atoi(argv[2]);
 814         param = atoi(argv[3]);
 815         key = argv[4];
 816         value = argv[5];
 817
 818         if (db_info->prev_return_id != -1 && return_id != db_info->prev_return_id) {
 819                 stree = __pop_fake_cur_stree();
 820                 if (!db_info->cull)
 821                         merge_fake_stree(&db_info->stree, stree);
 822                 free_stree(&stree);
 823                 __push_fake_cur_stree();
 824                 __unnullify_path();
 825                 db_info->cull = 0;
 826         }
 827         db_info->prev_return_id = return_id;
 828
 829         if (db_info->cull)
 830                 return 0;
 831         if (type == CULL_PATH) {
 832                 db_info->cull = 1;
 833                 return 0;
 834         }
 835         if (type == PARAM_LIMIT && impossible_limit(db_info->expr, param, key, value)) {
 836                 db_info->cull = 1;
 837                 return 0;
 838         }
 839
 840         call_results_to_rl(db_info->expr, get_type(strip_expr(db_info->expr)), argv[1], &ret_range);
 841         ret_range = cast_rl(get_type(db_info->expr), ret_range);
 842
 843         if (type == INTERNAL)
 844                 set_state(-1, "unnull_path", NULL, &true_state);
 845
 846         FOR_EACH_PTR(db_return_states_list, tmp) {
 847                 if (tmp->type == type)
 848                         tmp->callback(db_info->expr, param, key, value);
 849         } END_FOR_EACH_PTR(tmp);
 850
 851         /*
 852          * We want to store the return values so that we can split the strees
 853          * in smatch_db.c.  This uses set_state() directly because it's not a
 854          * real smatch_extra state.
 855          */
 856         snprintf(buf, sizeof(buf), "return %p", db_info->expr);
 857         set_state(SMATCH_EXTRA, buf, NULL, alloc_estate_rl(ret_range));
 858
 859         return 0;
 860 }
 861
 862 static void db_return_states(struct expression *expr)
 863 {
 864         struct sm_state *sm;
 865         struct stree *stree;
 866         struct db_callback_info db_info = {};
 867
 868         if (!__get_cur_stree())  /* no return functions */
 869                 return;
 870
 871         db_info.prev_return_id = -1;
 872         db_info.expr = expr;
 873         db_info.stree = NULL;
 874
 875         call_return_states_before_hooks();
 876
 877         __push_fake_cur_stree();
 878         __unnullify_path();
 879         sql_select_return_states("return_id, return, type, parameter, key, value",
 880                         expr, db_return_states_callback, &db_info);
 881         stree = __pop_fake_cur_stree();
 882         if (!db_info.cull)
 883                 merge_fake_stree(&db_info.stree, stree);
 884         free_stree(&stree);
 885
 886         FOR_EACH_SM(db_info.stree, sm) {
 887                 __set_sm(sm);
 888         } END_FOR_EACH_SM(sm);
 889
 890         free_stree(&db_info.stree);
 891         call_return_states_after_hooks(expr);
 892 }
 893
 894 static int is_condition_call(struct expression *expr)
 895 {
 896         struct expression *tmp;
 897
 898         FOR_EACH_PTR_REVERSE(big_condition_stack, tmp) {
 899                 if (expr == tmp || expr->parent == tmp)
 900                         return 1;
 901                 if (tmp->pos.line < expr->pos.line)
 902                         return 0;
 903         } END_FOR_EACH_PTR_REVERSE(tmp);
 904
 905         return 0;
 906 }
 907
 908 static void db_return_states_call(struct expression *expr)
 909 {
 910         if (unreachable())
 911                 return;
 912
 913         if (is_assigned_call(expr))
 914                 return;
 915         if (is_condition_call(expr))
 916                 return;
 917         db_return_states(expr);
 918 }
 919
 920 static void match_function_call(struct expression *expr)
 921 {
 922         struct call_back_list *call_backs;
 923
 924         if (expr->fn->type == EXPR_SYMBOL && expr->fn->symbol) {
 925                 call_backs = search_callback(func_hash, (char *)expr->fn->symbol->ident->name);
 926                 if (call_backs)
 927                         call_call_backs(call_backs, REGULAR_CALL,
 928                                         expr->fn->symbol->ident->name, expr);
 929         }
 930         db_return_states_call(expr);
 931 }
 932
 933 static void match_macro_assign(struct expression *expr)
 934 {
 935         struct call_back_list *call_backs;
 936         const char *macro;
 937         struct expression *right;
 938
 939         right = strip_expr(expr->right);
 940         macro = get_macro_name(right->pos);
 941         call_backs = search_callback(func_hash, (char *)macro);
 942         if (!call_backs)
 943                 return;
 944         call_call_backs(call_backs, MACRO_ASSIGN, macro, expr);
 945         call_call_backs(call_backs, MACRO_ASSIGN_EXTRA, macro, expr);
 946 }
 947
 948 int get_implied_return(struct expression *expr, struct range_list **rl)
 949 {
 950         struct call_back_list *call_backs;
 951         struct fcall_back *tmp;
 952         int handled = 0;
 953         char *fn;
 954
 955         *rl = NULL;
 956
 957         expr = strip_expr(expr);
 958         fn = expr_to_var(expr->fn);
 959         if (!fn)
 960                 goto out;
 961
 962         call_backs = search_callback(func_hash, fn);
 963
 964         FOR_EACH_PTR(call_backs, tmp) {
 965                 if (tmp->type == IMPLIED_RETURN) {
 966                         (tmp->u.implied_return)(expr, tmp->info, rl);
 967                         handled = 1;
 968                 }
 969         } END_FOR_EACH_PTR(tmp);
 970
 971 out:
 972         free_string(fn);
 973         return handled;
 974 }
 975
 976 void create_function_hook_hash(void)
 977 {
 978         func_hash = create_function_hashtable(5000);
 979 }
 980
 981 void register_function_hooks(int id)
 982 {
 983         add_hook(&match_function_call, CALL_HOOK_AFTER_INLINE);
 984         add_hook(&match_assign_call, CALL_ASSIGNMENT_HOOK);
 985         add_hook(&match_macro_assign, MACRO_ASSIGNMENT_HOOK);
 986 }