check_pointer_math.c

   1 /*
   2  * smatch/check_pointer_math.c
   3  *
   4  * Copyright (C) 2012 Oracle.
   5  *
   6  * Licensed under the Open Software License version 1.1
   7  *
   8  */
   9
  10 #include "smatch.h"
  11
  12 static int my_id;
  13
  14 STATE(size_in_bytes);
  15
  16 static void set_undefined(struct sm_state *sm, struct expression *mod_expr)
  17 {
  18         if (sm->state == &size_in_bytes)
  19                 set_state(my_id, sm->name, sm->sym, &undefined);
  20 }
  21
  22 static int is_sizeof(struct expression *expr)
  23 {
  24         return (expr->type == EXPR_SIZEOF);
  25 }
  26
  27 static int is_align(struct expression *expr)
  28 {
  29         char *name;
  30         struct expression *outside_expr;
  31
  32         /* check that we aren't inside the ALIGN() macro itself */
  33         outside_expr = last_ptr_list((struct ptr_list *)big_expression_stack);
  34         if (outside_expr && positions_eq(expr->pos, outside_expr->pos))
  35                 return 0;
  36
  37         name = get_macro_name(expr->pos);
  38         if (name && strcmp(name, "ALIGN") == 0)
  39                 return 1;
  40         return 0;
  41 }
  42
  43 static int is_size_in_bytes(struct expression *expr)
  44 {
  45         if (is_sizeof(expr))
  46                 return 1;
  47
  48         if (is_align(expr))
  49                 return 1;
  50
  51         if (get_state_expr(my_id, expr) == &size_in_bytes)
  52                 return 1;
  53
  54         return 0;
  55 }
  56
  57 static void match_binop(struct expression *expr)
  58 {
  59         struct symbol *type;
  60         char *name;
  61
  62         if (expr->op != '+')
  63                 return;
  64         type = get_pointer_type(expr->left);
  65         if (!type)
  66                 return;
  67         if (type->bit_size <= 8) /* ignore void, bool and char pointers*/
  68                 return;
  69         if (!is_size_in_bytes(expr->right))
  70                 return;
  71
  72         name = expr_to_str(expr->left);
  73         sm_msg("warn: potential pointer math issue ('%s' is a %d bit pointer)",
  74                name, type->bit_size);
  75         free_string(name);
  76 }
  77
  78 static void match_assign(struct expression *expr)
  79 {
  80         if (expr->op != '=')
  81                 return;
  82
  83         if (!is_size_in_bytes(expr->right))
  84                 return;
  85         set_state_expr(my_id, expr->left, &size_in_bytes);
  86 }
  87
  88 static void check_assign(struct expression *expr)
  89 {
  90         struct symbol *type;
  91         char *name;
  92
  93         type = get_pointer_type(expr->left);
  94         if (!type)
  95                 return;
  96         if (type_bits(type) == 8 || type_bits(type) == -1)
  97                 return;
  98         if (!is_size_in_bytes(expr->right))
  99                 return;
 100         name = expr_to_var(expr->left);
 101         sm_msg("warn: potential pointer math issue ('%s' is a %d bit pointer)",
 102                name, type_bits(type));
 103         free_string(name);
 104 }
 105
 106 void check_pointer_math(int id)
 107 {
 108         my_id = id;
 109         add_hook(&match_binop, BINOP_HOOK);
 110         add_hook(&match_assign, ASSIGNMENT_HOOK);
 111         add_hook(&check_assign, ASSIGNMENT_HOOK);
 112         add_modification_hook(my_id, &set_undefined);
 113 }