2 * Copyright (C) 2010 Dan Carpenter.
4 * This program is free software; you can redistribute it and/or
5 * modify it under the terms of the GNU General Public License
6 * as published by the Free Software Foundation; either version 2
7 * of the License, or (at your option) any later version.
9 * This program is distributed in the hope that it will be useful,
10 * but WITHOUT ANY WARRANTY; without even the implied warranty of
11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12 * GNU General Public License for more details.
14 * You should have received a copy of the GNU General Public License
15 * along with this program; if not, see http://www.gnu.org/copyleft/gpl.txt
22 #include "smatch_slist.h"
23 #include "smatch_extra.h"
24 #include "smatch_function_hashtable.h"
26 #define UNKNOWN_SIZE -1
28 static int my_size_id
;
30 static DEFINE_HASHTABLE_INSERT(insert_func
, char, int);
31 static DEFINE_HASHTABLE_SEARCH(search_func
, char, int);
32 static struct hashtable
*allocation_funcs
;
34 static char *get_fn_name(struct expression
*expr
)
36 if (expr
->type
!= EXPR_CALL
)
38 if (expr
->fn
->type
!= EXPR_SYMBOL
)
40 return expr_to_var(expr
->fn
);
43 static int is_allocation_function(struct expression
*expr
)
48 func
= get_fn_name(expr
);
51 if (search_func(allocation_funcs
, func
))
57 static void add_allocation_function(const char *func
, void *call_back
, int param
)
59 insert_func(allocation_funcs
, (char *)func
, (int *)1);
60 add_function_assign_hook(func
, call_back
, INT_PTR(param
));
63 static struct smatch_state
*size_to_estate(int size
)
67 sval
.type
= &int_ctype
;
70 return alloc_estate_sval(sval
);
73 static struct range_list
*size_to_rl(int size
)
77 sval
.type
= &int_ctype
;
80 return alloc_rl(sval
, sval
);
83 static struct smatch_state
*unmatched_size_state(struct sm_state
*sm
)
85 return size_to_estate(UNKNOWN_SIZE
);
88 static void set_size_undefined(struct sm_state
*sm
, struct expression
*mod_expr
)
90 set_state(sm
->owner
, sm
->name
, sm
->sym
, size_to_estate(UNKNOWN_SIZE
));
93 static struct smatch_state
*merge_size_func(struct smatch_state
*s1
, struct smatch_state
*s2
)
95 return merge_estates(s1
, s2
);
98 void set_param_buf_size(const char *name
, struct symbol
*sym
, char *key
, char *value
)
100 struct range_list
*rl
= NULL
;
101 struct smatch_state
*state
;
104 if (strncmp(key
, "$", 1) != 0)
107 snprintf(fullname
, 256, "%s%s", name
, key
+ 1);
109 str_to_rl(&int_ctype
, value
, &rl
);
110 if (!rl
|| is_whole_rl(rl
))
112 state
= alloc_estate_rl(rl
);
113 set_state(my_size_id
, fullname
, sym
, state
);
116 static int bytes_per_element(struct expression
*expr
)
122 if (expr
->type
== EXPR_STRING
)
123 return expr
->wide
+ 1;
124 if (expr
->type
== EXPR_PREOP
&& expr
->op
== '&') {
125 type
= get_type(expr
->unop
);
126 if (type
&& type
->type
== SYM_ARRAY
)
129 type
= get_type(expr
);
133 if (type
->type
!= SYM_PTR
&& type
->type
!= SYM_ARRAY
)
136 type
= get_base_type(type
);
137 return type_bytes(type
);
140 int bytes_to_elements(struct expression
*expr
, int bytes
)
144 bpe
= bytes_per_element(expr
);
150 static int elements_to_bytes(struct expression
*expr
, int elements
)
154 bpe
= bytes_per_element(expr
);
155 return elements
* bpe
;
158 static int get_initializer_size(struct expression
*expr
)
160 switch (expr
->type
) {
162 return expr
->string
->length
* (expr
->wide
+ 1);
163 case EXPR_INITIALIZER
: {
164 struct expression
*tmp
;
167 FOR_EACH_PTR(expr
->expr_list
, tmp
) {
168 if (tmp
->type
== EXPR_INDEX
) {
169 if (tmp
->idx_to
>= i
)
176 } END_FOR_EACH_PTR(tmp
);
180 return get_array_size(expr
);
185 static struct range_list
*db_size_rl
;
186 static int db_size_callback(void *unused
, int argc
, char **argv
, char **azColName
)
188 struct range_list
*tmp
= NULL
;
191 str_to_rl(&int_ctype
, argv
[0], &db_size_rl
);
193 str_to_rl(&int_ctype
, argv
[0], &tmp
);
194 db_size_rl
= rl_union(db_size_rl
, tmp
);
199 static struct expression
*cached_type_expr
, *cached_sym_expr
;
200 static struct range_list
*cached_type_rl
, *cached_sym_rl
;
202 static void match_clear_cache(struct symbol
*sym
)
204 cached_type_expr
= NULL
;
205 cached_type_rl
= NULL
;
206 cached_sym_expr
= NULL
;
207 cached_sym_rl
= NULL
;
210 static char *get_stored_buffer_name(struct expression
*buffer
, bool *add_static
)
212 struct expression
*array
;
218 name
= get_member_name(buffer
);
220 return alloc_string(name
);
222 if (is_static(buffer
)) {
223 name
= expr_to_var(buffer
);
230 array
= get_array_base(buffer
);
232 name
= get_member_name(array
);
235 snprintf(buf
, sizeof(buf
), "%s[]", name
);
236 return alloc_string(buf
);
242 static struct range_list
*size_from_db_type(struct expression
*expr
)
247 name
= get_stored_buffer_name(expr
, &this_file_only
);
251 if (expr
== cached_type_expr
)
252 return clone_rl(cached_type_rl
);
253 cached_type_expr
= expr
;
254 cached_type_rl
= NULL
;
256 if (this_file_only
) {
258 run_sql(db_size_callback
, NULL
,
259 "select size from function_type_size where type = '%s' and file = %d;",
260 name
, get_file_id());
261 cached_type_rl
= clone_rl(db_size_rl
);
266 run_sql(db_size_callback
, NULL
,
267 "select size from type_size where type = '%s';",
269 cached_type_rl
= clone_rl(db_size_rl
);
273 static struct range_list
*size_from_db_symbol(struct expression
*expr
)
277 if (expr
->type
!= EXPR_SYMBOL
)
280 if (!sym
|| !sym
->ident
||
281 !(sym
->ctype
.modifiers
& MOD_TOPLEVEL
) ||
282 sym
->ctype
.modifiers
& MOD_STATIC
)
285 if (expr
== cached_sym_expr
)
286 return clone_rl(cached_sym_rl
);
287 cached_sym_expr
= expr
;
288 cached_sym_rl
= NULL
;
291 run_sql(db_size_callback
, NULL
,
292 "select value from data_info where file = 0 and data = '%s' and type = %d;",
293 sym
->ident
->name
, BUF_SIZE
);
294 cached_sym_rl
= clone_rl(db_size_rl
);
298 static struct range_list
*size_from_db(struct expression
*expr
)
300 struct range_list
*rl
;
302 rl
= size_from_db_symbol(expr
);
305 return size_from_db_type(expr
);
308 static void db_returns_buf_size(struct expression
*expr
, int param
, char *unused
, char *math
)
310 struct expression
*call
;
311 struct range_list
*rl
;
314 if (expr
->type
!= EXPR_ASSIGNMENT
)
316 call
= strip_expr(expr
->right
);
318 call_results_to_rl(call
, &int_ctype
, math
, &rl
);
319 rl
= cast_rl(&int_ctype
, rl
);
320 if (rl_to_sval(rl
, &sval
) && sval
.value
== 0)
322 set_state_expr(my_size_id
, expr
->left
, alloc_estate_rl(rl
));
325 static int get_real_array_size_from_type(struct symbol
*type
)
331 if (!type
|| type
->type
!= SYM_ARRAY
)
334 if (!get_implied_value(type
->array_size
, &sval
))
340 int get_real_array_size(struct expression
*expr
)
344 if (expr
->type
== EXPR_PREOP
&& expr
->op
== '&')
346 if (expr
->type
== EXPR_BINOP
) /* array elements foo[5] */
348 return get_real_array_size_from_type(get_type(expr
));
351 static int get_size_from_initializer(struct expression
*expr
)
353 if (expr
->type
!= EXPR_SYMBOL
|| !expr
->symbol
|| !expr
->symbol
->initializer
)
355 if (expr
->symbol
->initializer
== expr
) /* int a = a; */
357 return get_initializer_size(expr
->symbol
->initializer
);
360 static struct range_list
*get_stored_size_bytes(struct expression
*expr
)
362 struct smatch_state
*state
;
364 state
= get_state_expr(my_size_id
, expr
);
367 return estate_rl(state
);
370 static int get_bytes_from_address(struct expression
*expr
)
375 if (expr
->type
!= EXPR_PREOP
|| expr
->op
!= '&')
377 type
= get_type(expr
);
381 if (type
->type
== SYM_PTR
)
382 type
= get_base_type(type
);
384 ret
= type_bytes(type
);
386 return 0; /* ignore char pointers */
391 static struct expression
*remove_addr_fluff(struct expression
*expr
)
393 struct expression
*tmp
;
396 expr
= strip_expr(expr
);
398 /* remove '&' and '*' operations that cancel */
399 while (expr
&& expr
->type
== EXPR_PREOP
&& expr
->op
== '&') {
400 tmp
= strip_expr(expr
->unop
);
401 if (tmp
->type
!= EXPR_PREOP
)
405 expr
= strip_expr(tmp
->unop
);
411 /* "foo + 0" is just "foo" */
412 if (expr
->type
== EXPR_BINOP
&& expr
->op
== '+' &&
413 get_value(expr
->right
, &sval
) && sval
.value
== 0)
419 static int is_last_member_of_struct(struct symbol
*sym
, struct ident
*member
)
424 if (sym
->type
!= SYM_STRUCT
)
428 FOR_EACH_PTR_REVERSE(sym
->symbol_list
, tmp
) {
429 if (i
++ || !tmp
->ident
)
431 if (tmp
->ident
== member
)
434 } END_FOR_EACH_PTR_REVERSE(tmp
);
439 int last_member_is_resizable(struct symbol
*sym
)
441 struct symbol
*last_member
;
445 if (!sym
|| sym
->type
!= SYM_STRUCT
)
448 last_member
= last_ptr_list((struct ptr_list
*)sym
->symbol_list
);
449 if (!last_member
|| !last_member
->ident
)
452 type
= get_real_base_type(last_member
);
453 if (type
->type
== SYM_STRUCT
)
454 return last_member_is_resizable(type
);
455 if (type
->type
!= SYM_ARRAY
)
458 if (!type
->array_size
)
461 if (!get_implied_value(type
->array_size
, &sval
))
464 if (sval
.value
!= 0 && sval
.value
!= 1)
470 static struct range_list
*get_stored_size_end_struct_bytes(struct expression
*expr
)
473 struct symbol
*base_sym
;
474 struct smatch_state
*state
;
479 if (expr
->type
== EXPR_BINOP
) /* array elements foo[5] */
482 if (expr
->type
== EXPR_PREOP
&& expr
->op
== '&')
483 expr
= strip_parens(expr
->unop
);
485 sym
= expr_to_sym(expr
);
486 if (!sym
|| !sym
->ident
)
488 if (!type_bytes(sym
))
490 if (sym
->type
!= SYM_NODE
)
493 base_sym
= get_real_base_type(sym
);
494 if (!base_sym
|| base_sym
->type
!= SYM_PTR
)
496 base_sym
= get_real_base_type(base_sym
);
497 if (!base_sym
|| base_sym
->type
!= SYM_STRUCT
)
500 if (!is_last_member_of_struct(base_sym
, expr
->member
))
502 if (!last_member_is_resizable(base_sym
))
505 state
= get_state(my_size_id
, sym
->ident
->name
, sym
);
506 if (!estate_rl(state
))
508 base_size
.value
= type_bytes(base_sym
) - type_bytes(get_type(expr
));
509 if (sval_cmp(estate_min(state
), base_size
) < 0)
512 return rl_binop(estate_rl(state
), '-', alloc_rl(base_size
, base_size
));
515 static int get_last_element_bytes(struct expression
*expr
)
517 struct symbol
*type
, *member
, *member_type
;
519 type
= get_type(expr
);
520 if (!type
|| type
->type
!= SYM_STRUCT
)
522 member
= last_ptr_list((struct ptr_list
*)type
->symbol_list
);
525 member_type
= get_real_base_type(member
);
528 return type_bytes(member_type
);
531 static struct range_list
*get_outer_end_struct_bytes(struct expression
*expr
)
533 struct expression
*outer
;
534 int last_element_size
;
541 * What we're checking here is for when "u.bar.baz" is a zero element
542 * array and "u" has a buffer to determine the space for baz. Like
544 * struct { struct bar bar; char buf[256]; } u;
548 if (expr
->type
== EXPR_PREOP
&& expr
->op
== '&')
549 expr
= strip_parens(expr
->unop
);
550 if (expr
->type
!= EXPR_DEREF
)
553 if (outer
->type
!= EXPR_DEREF
)
555 type
= get_type(outer
);
559 if (!is_last_member_of_struct(type
, expr
->member
))
561 if (!last_member_is_resizable(type
))
564 last_element_size
= get_last_element_bytes(outer
->deref
);
565 if (last_element_size
== 0)
567 if (type_bytes(get_type(outer
)) + last_element_size
!=
568 type_bytes(get_type(outer
->deref
)))
571 bytes
.value
= last_element_size
;
572 return alloc_rl(bytes
, bytes
);
575 static struct range_list
*alloc_int_rl(int value
)
582 return alloc_rl(sval
, sval
);
585 struct range_list
*filter_size_rl(struct range_list
*rl
)
597 return remove_range(rl
, minus_one
, zero
);
600 struct range_list
*get_array_size_bytes_rl(struct expression
*expr
)
602 struct range_list
*ret
= NULL
;
606 if (is_fake_call(expr
))
609 expr
= remove_addr_fluff(expr
);
614 if (expr
->type
== EXPR_STRING
)
615 return alloc_int_rl(expr
->string
->length
* (expr
->wide
+ 1));
617 if (expr
->type
== EXPR_BINOP
&& expr
->op
== '+') {
622 if (!get_implied_value(expr
->right
, &offset
))
624 type
= get_type(expr
->left
);
627 if (type
->type
!= SYM_ARRAY
&& type
->type
!= SYM_PTR
)
629 type
= get_real_base_type(type
);
630 bytes
= type_bytes(type
);
633 offset
.value
*= bytes
;
634 size
= get_array_size_bytes(expr
->left
);
637 return alloc_int_rl(size
- offset
.value
);
640 /* buf = malloc(1024); */
641 ret
= get_stored_size_bytes(expr
);
645 ret
= get_stored_size_end_struct_bytes(expr
);
649 ret
= get_outer_end_struct_bytes(expr
);
654 size
= get_real_array_size(expr
);
656 return alloc_int_rl(elements_to_bytes(expr
, size
));
658 /* char *foo = "BAR" */
659 size
= get_size_from_initializer(expr
);
661 return alloc_int_rl(elements_to_bytes(expr
, size
));
663 size
= get_bytes_from_address(expr
);
665 return alloc_int_rl(size
);
667 ret
= size_from_db(expr
);
668 return filter_size_rl(ret
);
670 if (rl_to_sval(ret
, &sval
) && sval
.value
== -1)
678 int get_array_size_bytes(struct expression
*expr
)
680 struct range_list
*rl
;
683 rl
= get_array_size_bytes_rl(expr
);
684 if (!rl_to_sval(rl
, &sval
))
686 if (sval
.uvalue
>= INT_MAX
)
691 int get_array_size_bytes_max(struct expression
*expr
)
693 struct range_list
*rl
;
696 rl
= get_array_size_bytes_rl(expr
);
703 if (bytes
.uvalue
>= INT_MAX
)
708 int get_array_size_bytes_min(struct expression
*expr
)
710 struct range_list
*rl
;
711 struct data_range
*range
;
713 rl
= get_array_size_bytes_rl(expr
);
717 FOR_EACH_PTR(rl
, range
) {
718 if (range
->min
.value
<= 0)
720 if (range
->max
.value
<= 0)
722 if (range
->min
.uvalue
>= INT_MAX
)
724 return range
->min
.value
;
725 } END_FOR_EACH_PTR(range
);
730 int get_array_size(struct expression
*expr
)
734 return bytes_to_elements(expr
, get_array_size_bytes_max(expr
));
737 static struct expression
*strip_ampersands(struct expression
*expr
)
741 if (expr
->type
!= EXPR_PREOP
)
745 type
= get_type(expr
->unop
);
746 if (!type
|| type
->type
!= SYM_ARRAY
)
751 static void info_record_alloction(struct expression
*buffer
, struct range_list
*rl
)
756 name
= get_stored_buffer_name(buffer
, &add_static
);
759 if (rl
&& !is_whole_rl(rl
))
760 sql_insert_function_type_size(name
, show_rl(rl
));
762 sql_insert_function_type_size(name
, "(-1)");
767 static void store_alloc(struct expression
*expr
, struct range_list
*rl
)
771 rl
= clone_rl(rl
); // FIXME!!!
773 rl
= size_to_rl(UNKNOWN_SIZE
);
775 if (rl_min(rl
).value
!= UNKNOWN_SIZE
||
776 rl_max(rl
).value
!= UNKNOWN_SIZE
||
777 get_state_expr(my_size_id
, expr
))
778 set_state_expr(my_size_id
, expr
, alloc_estate_rl(rl
));
780 type
= get_type(expr
);
783 if (type
->type
!= SYM_PTR
&&
784 type
->type
!= SYM_ARRAY
)
786 type
= get_real_base_type(type
);
789 // Why not store the size for void pointers?
790 if (type
== &void_ctype
)
792 // Because of 4 files that produce 30 warnings like this:
793 // arch/x86/crypto/des3_ede_glue.c:145 __cbc_encrypt() warn: potential memory corrupting cast 8 vs 1 bytes
794 if (type
->type
!= SYM_BASETYPE
&&
795 type
->type
!= SYM_PTR
&&
796 type
->type
!= SYM_ARRAY
)
799 info_record_alloction(expr
, rl
);
802 static bool is_array_base(struct expression
*expr
)
806 type
= get_type(expr
);
807 if (type
&& type
->type
== SYM_ARRAY
)
812 static void match_array_assignment(struct expression
*expr
)
814 struct expression
*left
;
815 struct expression
*right
;
816 char *left_member
, *right_member
;
817 struct range_list
*rl
;
823 left
= strip_expr(expr
->left
);
824 right
= strip_expr(expr
->right
);
825 right
= strip_ampersands(right
);
827 if (!is_pointer(left
) && !get_state_expr(my_size_id
, expr
))
830 /* char buf[24] = "str"; */
831 if (is_array_base(left
))
833 if (is_allocation_function(right
))
836 left_member
= get_member_name(left
);
837 right_member
= get_member_name(right
);
838 if (left_member
&& right_member
&& strcmp(left_member
, right_member
) == 0)
841 if (get_implied_value(right
, &sval
) && sval
.value
== 0) {
842 rl
= alloc_int_rl(0);
846 rl
= get_array_size_bytes_rl(right
);
847 if (!rl
&& __in_fake_assign
)
851 store_alloc(left
, rl
);
854 static struct expression
*get_variable_struct_member(struct expression
*expr
)
856 struct symbol
*type
, *last_member
;
860 * This is a hack. It should look at how the size is calculated instead
861 * of just assuming that it's the last element. However, ugly hacks are
865 type
= get_type(expr
);
866 if (!type
|| type
->type
!= SYM_PTR
)
868 type
= get_real_base_type(type
);
869 if (!type
|| type
->type
!= SYM_STRUCT
)
871 last_member
= last_ptr_list((struct ptr_list
*)type
->symbol_list
);
872 if (!last_member
|| !last_member
->ident
)
874 type
= get_real_base_type(last_member
);
875 if (!type
|| type
->type
!= SYM_ARRAY
)
877 /* Is non-zero array size */
878 if (type
->array_size
) {
879 if (!get_implied_value(type
->array_size
, &sval
) ||
884 return member_expression(expr
, '*', last_member
->ident
);
887 static void match_struct_size_helper(struct expression
*pointer
, struct range_list
*rl
)
889 struct range_list
*buf_size
;
890 struct expression
*member
;
891 sval_t sval
= { .type
= &ulong_ctype
};
893 member
= get_variable_struct_member(pointer
);
896 sval
.value
= bytes_per_element(pointer
);
899 buf_size
= rl_binop(rl
, '-', alloc_rl(sval
, sval
));
900 store_alloc(member
, buf_size
);
903 static void match_alloc(const char *fn
, struct expression
*expr
, void *_size_arg
)
905 int size_arg
= PTR_INT(_size_arg
);
906 struct expression
*pointer
, *right
, *arg
;
907 struct range_list
*rl
;
909 pointer
= strip_expr(expr
->left
);
910 right
= strip_expr(expr
->right
);
911 arg
= get_argument_from_call_expr(right
->args
, size_arg
);
912 get_absolute_rl(arg
, &rl
);
913 rl
= cast_rl(&ulong_ctype
, rl
);
914 store_alloc(pointer
, rl
);
915 match_struct_size_helper(pointer
, rl
);
918 static void match_calloc(const char *fn
, struct expression
*expr
, void *_param
)
920 struct expression
*right
;
921 struct expression
*size
, *nr
, *mult
;
922 struct range_list
*rl
;
923 int param
= PTR_INT(_param
);
925 right
= strip_expr(expr
->right
);
926 nr
= get_argument_from_call_expr(right
->args
, param
);
927 size
= get_argument_from_call_expr(right
->args
, param
+ 1);
928 mult
= binop_expression(nr
, '*', size
);
929 if (get_implied_rl(mult
, &rl
))
930 store_alloc(expr
->left
, rl
);
932 store_alloc(expr
->left
, size_to_rl(UNKNOWN_SIZE
));
935 static void match_page(const char *fn
, struct expression
*expr
, void *_unused
)
942 store_alloc(expr
->left
, alloc_rl(page_size
, page_size
));
945 static void match_bitmap_alloc(const char *fn
, struct expression
*expr
, void *_size_arg
)
947 int size_arg
= PTR_INT(_size_arg
);
948 struct expression
*right
;
949 struct expression
*arg
;
950 struct range_list
*rl
;
956 right
= strip_expr(expr
->right
);
957 arg
= get_argument_from_call_expr(right
->args
, size_arg
);
958 get_absolute_rl(arg
, &rl
);
959 if (rl_max(rl
).uvalue
<= SHRT_MAX
&& rl_max(rl
).uvalue
% 8) {
960 sval_t max
= rl_max(rl
);
963 rl
= alloc_rl(rl_min(rl
), max
);
965 rl
= rl_binop(rl
, '/', alloc_rl(int_8
, int_8
));
966 rl
= cast_rl(&ulong_ctype
, rl
);
967 store_alloc(expr
->left
, rl
);
970 static void match_strndup(const char *fn
, struct expression
*expr
, void *unused
)
972 struct expression
*fn_expr
;
973 struct expression
*size_expr
;
976 fn_expr
= strip_expr(expr
->right
);
977 size_expr
= get_argument_from_call_expr(fn_expr
->args
, 1);
978 if (get_implied_max(size_expr
, &size
)) {
980 store_alloc(expr
->left
, size_to_rl(size
.value
));
982 store_alloc(expr
->left
, size_to_rl(UNKNOWN_SIZE
));
986 static void match_alloc_pages(const char *fn
, struct expression
*expr
, void *_order_arg
)
988 int order_arg
= PTR_INT(_order_arg
);
989 struct expression
*right
;
990 struct expression
*arg
;
993 right
= strip_expr(expr
->right
);
994 arg
= get_argument_from_call_expr(right
->args
, order_arg
);
995 if (!get_implied_value(arg
, &sval
))
997 if (sval
.value
< 0 || sval
.value
> 10)
1000 sval
.type
= &int_ctype
;
1001 sval
.value
= (1 << sval
.value
) * 4096;
1003 store_alloc(expr
->left
, alloc_rl(sval
, sval
));
1006 static int is_type_bytes(struct range_list
*rl
, struct expression
*call
, int nr
)
1008 struct symbol
*type
;
1011 if (!rl_to_sval(rl
, &sval
))
1014 type
= get_arg_type(call
->fn
, nr
);
1017 if (type
->type
!= SYM_PTR
)
1019 type
= get_real_base_type(type
);
1020 if (sval
.value
!= type_bytes(type
))
1025 static void match_call(struct expression
*expr
)
1027 struct expression
*arg
;
1028 struct symbol
*type
;
1029 struct range_list
*rl
;
1033 FOR_EACH_PTR(expr
->args
, arg
) {
1035 type
= get_type(arg
);
1036 if (!type
|| (type
->type
!= SYM_PTR
&& type
->type
!= SYM_ARRAY
))
1038 rl
= get_array_size_bytes_rl(arg
);
1041 if (rl_min(rl
).value
== UNKNOWN_SIZE
&&
1042 rl_max(rl
).value
== UNKNOWN_SIZE
)
1044 if (is_whole_rl(rl
))
1046 if (is_type_bytes(rl
, expr
, i
))
1048 if (rl_min(rl
).value
== -1 && rl_max(rl
).value
== 0)
1050 sql_insert_caller_info(expr
, BUF_SIZE
, i
, "$", show_rl(rl
));
1051 } END_FOR_EACH_PTR(arg
);
1054 static void struct_member_callback(struct expression
*call
, int param
, char *printed_name
, struct sm_state
*sm
)
1058 if (!estate_rl(sm
->state
))
1060 if (estate_get_single_value(sm
->state
, &sval
) &&
1061 (sval
.value
== -1 || sval
.value
== 0))
1063 if (estate_min(sm
->state
).value
== -1 &&
1064 estate_max(sm
->state
).value
== 0)
1067 sql_insert_caller_info(call
, BUF_SIZE
, param
, printed_name
, sm
->state
->name
);
1071 * This is slightly (very) weird because half of this stuff is handled in
1072 * smatch_parse_call_math.c which is poorly named. But anyway, add some buf
1076 static void print_returned_allocations(int return_id
, char *return_ranges
, struct expression
*expr
)
1078 const char *param_math
;
1079 struct range_list
*rl
;
1083 rl
= get_array_size_bytes_rl(expr
);
1084 param_math
= get_allocation_math(expr
);
1085 if (!rl
&& !param_math
)
1089 rl_to_sval(rl
, &sval
) &&
1090 (sval
.value
== -1 || sval
.value
== 0))
1094 snprintf(buf
, sizeof(buf
), "%s[%s]", show_rl(rl
), param_math
);
1096 snprintf(buf
, sizeof(buf
), "%s", show_rl(rl
));
1098 // FIXME: don't store if you can guess the size from the type
1099 // FIXME: return if we allocate a parameter $0->bar
1100 sql_insert_return_states(return_id
, return_ranges
, BUF_SIZE
, -1, "", buf
);
1103 static void record_global_size(struct symbol
*sym
)
1111 if (!(sym
->ctype
.modifiers
& MOD_TOPLEVEL
) ||
1112 sym
->ctype
.modifiers
& MOD_STATIC
)
1115 bytes
= get_array_size_bytes(symbol_expression(sym
));
1119 snprintf(buf
, sizeof(buf
), "%d", bytes
);
1120 sql_insert_data_info_var_sym(sym
->ident
->name
, sym
, BUF_SIZE
, buf
);
1123 void register_buf_size(int id
)
1127 set_dynamic_states(my_size_id
);
1129 add_unmatched_state_hook(my_size_id
, &unmatched_size_state
);
1130 add_merge_hook(my_size_id
, &merge_estates
);
1132 select_caller_info_hook(set_param_buf_size
, BUF_SIZE
);
1133 select_return_states_hook(BUF_SIZE
, &db_returns_buf_size
);
1134 add_split_return_callback(print_returned_allocations
);
1136 allocation_funcs
= create_function_hashtable(100);
1137 add_allocation_function("malloc", &match_alloc
, 0);
1138 add_allocation_function("calloc", &match_calloc
, 0);
1139 add_allocation_function("memdup", &match_alloc
, 1);
1140 add_allocation_function("realloc", &match_alloc
, 1);
1141 if (option_project
== PROJ_KERNEL
) {
1142 add_allocation_function("kmalloc", &match_alloc
, 0);
1143 add_allocation_function("kmalloc_node", &match_alloc
, 0);
1144 add_allocation_function("kmalloc_noprof", &match_alloc
, 0);
1145 add_allocation_function("kzalloc", &match_alloc
, 0);
1146 add_allocation_function("kzalloc_node", &match_alloc
, 0);
1147 add_allocation_function("kzalloc_noprof", &match_alloc
, 0);
1148 add_allocation_function("vmalloc", &match_alloc
, 0);
1149 add_allocation_function("vzalloc", &match_alloc
, 0);
1150 add_allocation_function("__vmalloc", &match_alloc
, 0);
1151 add_allocation_function("kvmalloc", &match_alloc
, 0);
1152 add_allocation_function("kcalloc", &match_calloc
, 0);
1153 add_allocation_function("kvcalloc", &match_calloc
, 0);
1154 add_allocation_function("kmalloc_array", &match_calloc
, 0);
1155 add_allocation_function("devm_kmalloc_array", &match_calloc
, 1);
1156 add_allocation_function("sock_kmalloc", &match_alloc
, 1);
1157 add_allocation_function("kmemdup", &match_alloc
, 1);
1158 add_allocation_function("memdup_user", &match_alloc
, 1);
1159 add_allocation_function("dma_alloc_attrs", &match_alloc
, 1);
1160 add_allocation_function("devm_kmalloc", &match_alloc
, 1);
1161 add_allocation_function("devm_kzalloc", &match_alloc
, 1);
1162 add_allocation_function("krealloc", &match_alloc
, 1);
1163 add_allocation_function("__alloc_bootmem", &match_alloc
, 0);
1164 add_allocation_function("alloc_bootmem", &match_alloc
, 0);
1165 add_allocation_function("kmap", &match_page
, 0);
1166 add_allocation_function("kmap_atomic", &match_page
, 0);
1167 add_allocation_function("get_zeroed_page", &match_page
, 0);
1168 add_allocation_function("alloc_page", &match_page
, 0);
1169 add_allocation_function("alloc_pages", &match_alloc_pages
, 1);
1170 add_allocation_function("alloc_pages_current", &match_alloc_pages
, 1);
1171 add_allocation_function("__get_free_pages", &match_alloc_pages
, 1);
1172 add_allocation_function("dma_alloc_contiguous", &match_alloc
, 1);
1173 add_allocation_function("dma_alloc_coherent", &match_alloc
, 1);
1174 add_allocation_function("bitmap_alloc", &match_bitmap_alloc
, 0);
1175 add_allocation_function("bitmap_alloc_node", &match_bitmap_alloc
, 0);
1176 add_allocation_function("bitmap_zalloc", &match_bitmap_alloc
, 0);
1177 add_allocation_function("devm_bitmap_alloc", &match_bitmap_alloc
, 1);
1178 add_allocation_function("devm_bitmap_zalloc", &match_bitmap_alloc
, 1);
1181 add_allocation_function("strndup", match_strndup
, 0);
1182 if (option_project
== PROJ_KERNEL
)
1183 add_allocation_function("kstrndup", match_strndup
, 0);
1185 add_modification_hook(my_size_id
, &set_size_undefined
);
1187 add_merge_hook(my_size_id
, &merge_size_func
);
1190 add_hook(record_global_size
, BASE_HOOK
);
1192 add_hook(&match_clear_cache
, AFTER_FUNC_HOOK
);
1195 void register_buf_size_late(int id
)
1197 /* has to happen after match_alloc() */
1198 add_hook(&match_array_assignment
, ASSIGNMENT_HOOK
);
1200 add_hook(&match_call
, FUNCTION_CALL_HOOK
);
1201 add_member_info_callback(my_size_id
, struct_member_callback
);