?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
capped: fix handling of assignments
[smatch.git] / smatch_flow.c
blob27864f1482e80a0115c5fd282247b68d796a3687
1 /*
2 * Copyright (C) 2006,2008 Dan Carpenter.
3 *
4 * This program is free software; you can redistribute it and/or
5 * modify it under the terms of the GNU General Public License
6 * as published by the Free Software Foundation; either version 2
7 * of the License, or (at your option) any later version.
8 *
9 * This program is distributed in the hope that it will be useful,
10 * but WITHOUT ANY WARRANTY; without even the implied warranty of
11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12 * GNU General Public License for more details.
13 *
14 * You should have received a copy of the GNU General Public License
15 * along with this program; if not, see http://www.gnu.org/copyleft/gpl.txt
16 */
17
18 #define _GNU_SOURCE 1
19 #include <unistd.h>
20 #include <stdio.h>
21 #include "token.h"
22 #include "scope.h"
23 #include "smatch.h"
24 #include "smatch_expression_stacks.h"
25 #include "smatch_extra.h"
26 #include "smatch_slist.h"
27
28 int __in_fake_assign;
29 int __in_fake_struct_assign;
30 int __in_buf_clear;
31 int __in_fake_var_assign;
32 int __fake_state_cnt;
33 int __debug_skip;
34 int in_fake_env;
35 int final_pass;
36 int __inline_call;
37 struct expression *__inline_fn;
38
39 int __smatch_lineno = 0;
40 static struct position current_pos;
41
42 static char *base_file;
43 static const char *filename;
44 static char *pathname;
45 static char *full_filename;
46 static char *full_base_file;
47 static char *cur_func;
48 int base_file_stream;
49 static unsigned int loop_count;
50 static int last_goto_statement_handled;
51 int __expr_stmt_count;
52 int __in_function_def;
53 int __in_unmatched_hook;
54 static struct expression_list *switch_expr_stack = NULL;
55 static struct expression_list *post_op_stack = NULL;
56
57 static struct ptr_list *fn_data_list;
58 static struct ptr_list *backup;
59
60 struct expression_list *big_expression_stack;
61 struct statement_list *big_statement_stack;
62 struct statement *__prev_stmt;
63 struct statement *__cur_stmt;
64 struct statement *__next_stmt;
65 static struct expression_list *parsed_calls;
66 static int indent_cnt;
67 int __in_pre_condition = 0;
68 int __bail_on_rest_of_function = 0;
69 static struct timeval fn_start_time;
70 static struct timeval outer_fn_start_time;
71 char *get_function(void) { return cur_func; }
72 int get_lineno(void) { return __smatch_lineno; }
73 int inside_loop(void) { return !!loop_count; }
74 int definitely_inside_loop(void) { return !!(loop_count & ~0x08000000); }
75 struct expression *get_switch_expr(void) { return top_expression(switch_expr_stack); }
76 int in_expression_statement(void) { return !!__expr_stmt_count; }
77
78 static void split_symlist(struct symbol_list *sym_list);
79 static void split_declaration(struct symbol_list *sym_list);
80 static void split_expr_list(struct expression_list *expr_list, struct expression *parent);
81 static void split_args(struct expression *expr);
82 static struct expression *fake_a_variable_assign(struct symbol *type, struct expression *call, struct expression *expr, int nr);
83 static void add_inline_function(struct symbol *sym);
84 static void parse_inline(struct expression *expr);
85
86 int option_assume_loops = 0;
87 int option_two_passes = 0;
88 struct symbol *cur_func_sym = NULL;
89 struct stree *global_states;
90
91 const unsigned long valid_ptr_min = 4096;
92 unsigned long valid_ptr_max = ULONG_MAX & ~(MTAG_OFFSET_MASK);
93 const sval_t valid_ptr_min_sval = {
94 .type = &ptr_ctype,
95 {.value = 4096},
96 };
97 sval_t ptr_err_min = { .type = &ptr_ctype };
98 sval_t ptr_err_max = { .type = &ptr_ctype };
99 sval_t ptr_xa_err_min = { .type = &ptr_ctype };
100 sval_t ptr_xa_err_max = { .type = &ptr_ctype };
101 sval_t ulong_ULONG_MAX = { .type = &ulong_ctype };
102
103 sval_t valid_ptr_max_sval = {
104 .type = &ptr_ctype,
105 {.value = ULONG_MAX & ~(MTAG_OFFSET_MASK)},
106 };
107 struct range_list *valid_ptr_rl;
108
109 void alloc_ptr_constants(void)
110 {
111 valid_ptr_max = sval_type_max(&ulong_ctype).value & ~(MTAG_OFFSET_MASK);
112 valid_ptr_max_sval.value = valid_ptr_max;
113
114 valid_ptr_rl = alloc_rl(valid_ptr_min_sval, valid_ptr_max_sval);
115 valid_ptr_rl = cast_rl(&ptr_ctype, valid_ptr_rl);
116 valid_ptr_rl = clone_rl_permanent(valid_ptr_rl);
117
118 ptr_err_min = sval_cast(&ptr_ctype, err_min);
119 ptr_err_max = sval_cast(&ptr_ctype, err_max);
120 ptr_xa_err_min = sval_cast(&ptr_ctype, xa_err_min);
121 ptr_xa_err_max = sval_cast(&ptr_ctype, xa_err_max);
122 ulong_ULONG_MAX = sval_type_max(&ulong_ctype);
123 }
124
125 int outside_of_function(void)
126 {
127 return cur_func_sym == NULL;
128 }
129
130 const char *get_filename(void)
131 {
132 if (option_info && option_full_path)
133 return full_base_file;
134 if (option_info)
135 return base_file;
136 if (option_full_path)
137 return full_filename;
138 return filename;
139 }
140
141 const char *get_base_file(void)
142 {
143 if (option_full_path)
144 return full_base_file;
145 return base_file;
146 }
147
148 unsigned long long get_file_id(void)
149 {
150 return str_to_llu_hash(get_filename());
151 }
152
153 unsigned long long get_base_file_id(void)
154 {
155 return str_to_llu_hash(get_base_file());
156 }
157
158 static void set_position(struct position pos)
159 {
160 int len;
161 static int prev_stream = -1;
162
163 if (in_fake_env)
164 return;
165
166 if (pos.stream == 0 && pos.line == 0)
167 return;
168
169 __smatch_lineno = pos.line;
170 current_pos = pos;
171
172 if (pos.stream == prev_stream)
173 return;
174
175 prev_stream = pos.stream;
176 filename = stream_name(pos.stream);
177
178 free(full_filename);
179 pathname = getcwd(NULL, 0);
180 if (pathname) {
181 len = strlen(pathname) + 1 + strlen(filename) + 1;
182 full_filename = malloc(len);
183 snprintf(full_filename, len, "%s/%s", pathname, filename);
184 } else {
185 full_filename = alloc_string(filename);
186 }
187 free(pathname);
188 }
189
190 int is_assigned_call(struct expression *expr)
191 {
192 struct expression *parent = expr_get_parent_expr(expr);
193
194 if (parent &&
195 parent->type == EXPR_ASSIGNMENT &&
196 parent->op == '=' &&
197 strip_expr(parent->right) == expr)
198 return 1;
199
200 return 0;
201 }
202
203 int is_fake_assigned_call(struct expression *expr)
204 {
205 struct expression *parent = expr_get_fake_parent_expr(expr);
206
207 if (parent &&
208 parent->type == EXPR_ASSIGNMENT &&
209 parent->op == '=' &&
210 strip_expr(parent->right) == expr)
211 return 1;
212
213 return 0;
214 }
215
216 static bool is_inline_func(struct expression *expr)
217 {
218 if (expr->type != EXPR_SYMBOL || !expr->symbol)
219 return false;
220 if (!expr->symbol->definition)
221 return false;
222 if (expr->symbol->definition->ctype.modifiers & MOD_INLINE)
223 return true;
224
225 return 0;
226 }
227
228 static int is_noreturn_func(struct expression *expr)
229 {
230 if (expr->type != EXPR_SYMBOL || !expr->symbol)
231 return 0;
232
233 /*
234 * It's almost impossible for Smatch to handle __builtin_constant_p()
235 * the same way that GCC does so Smatch ends up making some functions
236 * as no return functions incorrectly.
237 *
238 */
239 if (option_project == PROJ_KERNEL && expr->symbol->ident &&
240 strstr(expr->symbol->ident->name, "__compiletime_assert"))
241 return 0;
242
243 if (expr->symbol->ctype.modifiers & MOD_NORETURN)
244 return 1;
245 return 0;
246 }
247
248 static int save_func_time(void *_rl, int argc, char **argv, char **azColName)
249 {
250 unsigned long *rl = _rl;
251
252 *rl = strtoul(argv[0], NULL, 10);
253 return 0;
254 }
255
256 static int get_func_time(struct symbol *sym)
257 {
258 unsigned long time = 0;
259
260 run_sql(&save_func_time, &time,
261 "select key from return_implies where %s and type = %d;",
262 get_static_filter(sym), FUNC_TIME);
263
264 return time;
265 }
266
267 static int inline_budget = 20;
268
269 int inlinable(struct expression *expr)
270 {
271 struct symbol *sym;
272 struct statement *last_stmt = NULL;
273
274 if (__inline_fn) /* don't nest */
275 return 0;
276
277 if (expr->type != EXPR_SYMBOL || !expr->symbol)
278 return 0;
279 if (is_no_inline_function(expr->symbol->ident->name))
280 return 0;
281 sym = get_base_type(expr->symbol);
282 if (sym->stmt && sym->stmt->type == STMT_COMPOUND) {
283 if (ptr_list_size((struct ptr_list *)sym->stmt->stmts) > 10)
284 return 0;
285 if (sym->stmt->type != STMT_COMPOUND)
286 return 0;
287 last_stmt = last_ptr_list((struct ptr_list *)sym->stmt->stmts);
288 }
289 if (sym->inline_stmt && sym->inline_stmt->type == STMT_COMPOUND) {
290 if (ptr_list_size((struct ptr_list *)sym->inline_stmt->stmts) > 10)
291 return 0;
292 if (sym->inline_stmt->type != STMT_COMPOUND)
293 return 0;
294 last_stmt = last_ptr_list((struct ptr_list *)sym->inline_stmt->stmts);
295 }
296
297 if (!last_stmt)
298 return 0;
299
300 /* the magic numbers in this function are pulled out of my bum. */
301 if (last_stmt->pos.line > sym->pos.line + inline_budget)
302 return 0;
303
304 if (get_func_time(expr->symbol) >= 2)
305 return 0;
306
307 return 1;
308 }
309
310 void __process_post_op_stack(void)
311 {
312 struct expression *expr;
313
314 FOR_EACH_PTR(post_op_stack, expr) {
315 __pass_to_client(expr, OP_HOOK);
316 } END_FOR_EACH_PTR(expr);
317
318 __free_ptr_list((struct ptr_list **)&post_op_stack);
319 }
320
321 static int handle_comma_assigns(struct expression *expr)
322 {
323 struct expression *right;
324 struct expression *assign;
325
326 right = strip_expr(expr->right);
327 if (right->type != EXPR_COMMA)
328 return 0;
329
330 __split_expr(right->left);
331 __process_post_op_stack();
332
333 assign = assign_expression(expr->left, '=', right->right);
334 __split_expr(assign);
335
336 return 1;
337 }
338
339 /* This is to handle *p++ = foo; assignments */
340 static int handle_postop_assigns(struct expression *expr)
341 {
342 struct expression *left, *fake_left;
343 struct expression *assign;
344
345 left = strip_expr(expr->left);
346 if (left->type != EXPR_PREOP || left->op != '*')
347 return 0;
348 left = strip_expr(left->unop);
349 if (left->type != EXPR_POSTOP)
350 return 0;
351
352 fake_left = deref_expression(strip_expr(left->unop));
353 assign = assign_expression(fake_left, '=', expr->right);
354
355 __split_expr(assign);
356 __split_expr(expr->left);
357
358 return 1;
359 }
360
361 static bool parent_is_dereference(struct expression *expr)
362 {
363 struct expression *parent;
364
365 parent = expr;
366 while ((parent = expr_get_parent_expr(parent))) {
367 if (parent->type == EXPR_DEREF)
368 return true;
369 if (parent->type == EXPR_PREOP &&
370 parent->op == '*')
371 return true;
372 }
373
374 return false;
375 }
376
377 static int prev_expression_is_getting_address(struct expression *expr)
378 {
379 struct expression *parent;
380
381 do {
382 parent = expr_get_parent_expr(expr);
383
384 if (!parent)
385 return 0;
386 if (parent->type == EXPR_PREOP && parent->op == '&') {
387 if (parent_is_dereference(parent))
388 return false;
389 return true;
390 }
391 if (parent->type == EXPR_PREOP && parent->op == '(')
392 goto next;
393 if (parent->type == EXPR_DEREF && parent->op == '.')
394 goto next;
395 /* Handle &foo->array[offset] */
396 if (parent->type == EXPR_BINOP && parent->op == '+') {
397 parent = expr_get_parent_expr(parent);
398 if (!parent)
399 return 0;
400 if (parent->type == EXPR_PREOP && parent->op == '*')
401 goto next;
402 }
403
404 return 0;
405 next:
406 expr = parent;
407 } while (1);
408 }
409
410 int __in_builtin_overflow_func;
411 static void handle_builtin_overflow_func(struct expression *expr)
412 {
413 struct expression *a, *b, *res, *assign;
414 int op;
415
416 if (sym_name_is("__builtin_add_overflow", expr->fn))
417 op = '+';
418 else if (sym_name_is("__builtin_sub_overflow", expr->fn))
419 op = '-';
420 else if (sym_name_is("__builtin_mul_overflow", expr->fn))
421 op = '*';
422 else
423 return;
424
425 a = get_argument_from_call_expr(expr->args, 0);
426 b = get_argument_from_call_expr(expr->args, 1);
427 res = get_argument_from_call_expr(expr->args, 2);
428
429 assign = assign_expression(deref_expression(res), '=', binop_expression(a, op, b));
430
431 __in_builtin_overflow_func++;
432 __split_expr(assign);
433 __in_builtin_overflow_func--;
434 }
435
436 static int handle__builtin_choose_expr(struct expression *expr)
437 {
438 struct expression *const_expr, *expr1, *expr2;
439 sval_t sval;
440
441 if (!sym_name_is("__builtin_choose_expr", expr->fn))
442 return 0;
443
444 const_expr = get_argument_from_call_expr(expr->args, 0);
445 expr1 = get_argument_from_call_expr(expr->args, 1);
446 expr2 = get_argument_from_call_expr(expr->args, 2);
447
448 if (!get_value(const_expr, &sval) || !expr1 || !expr2)
449 return 0;
450 if (sval.value)
451 __split_expr(expr1);
452 else
453 __split_expr(expr2);
454 return 1;
455 }
456
457 static int handle__builtin_choose_expr_assigns(struct expression *expr)
458 {
459 struct expression *const_expr, *right, *expr1, *expr2, *fake;
460 sval_t sval;
461
462 /*
463 * We can't use strip_no_cast() because it strips out
464 * __builtin_choose_expr() which turns this function into a no-op.
465 *
466 */
467 right = strip_parens(expr->right);
468 if (right->type != EXPR_CALL)
469 return 0;
470 if (!sym_name_is("__builtin_choose_expr", right->fn))
471 return 0;
472
473 const_expr = get_argument_from_call_expr(right->args, 0);
474 expr1 = get_argument_from_call_expr(right->args, 1);
475 expr2 = get_argument_from_call_expr(right->args, 2);
476
477 if (!get_value(const_expr, &sval) || !expr1 || !expr2)
478 return 0;
479
480 fake = assign_expression(expr->left, '=', sval.value ? expr1 : expr2);
481 __split_expr(fake);
482 return 1;
483 }
484
485 int is_condition_call(struct expression *expr)
486 {
487 struct expression *tmp;
488
489 FOR_EACH_PTR_REVERSE(big_condition_stack, tmp) {
490 if (expr == tmp || expr_get_parent_expr(expr) == tmp)
491 return 1;
492 if (tmp->pos.line < expr->pos.line)
493 return 0;
494 } END_FOR_EACH_PTR_REVERSE(tmp);
495
496 return 0;
497 }
498
499 static struct expression *expr_get_parent_no_parens(struct expression *expr)
500 {
501 do {
502 expr = expr_get_parent_expr(expr);
503 } while (expr &&
504 expr->type == EXPR_PREOP &&
505 expr->op == '(');
506
507 return expr;
508 }
509
510 static bool gen_fake_function_assign(struct expression *expr)
511 {
512 static struct expression *parsed;
513 struct expression *assign, *parent;
514 struct symbol *type;
515 char buf[64];
516
517 /* The rule is that every non-void function call has to be part of an
518 * assignment. TODO: Should we create a fake non-casted assignment
519 * for casted assignments? Also faked assigns for += assignments?
520 */
521 type = get_type(expr);
522 if (!type || type == &void_ctype)
523 return false;
524
525 parent = expr_get_parent_no_parens(expr);
526 if (parent && parent->type == EXPR_ASSIGNMENT)
527 return false;
528
529 parent = expr_get_fake_parent_expr(expr);
530 if (parent) {
531 struct expression *left = parent->left;
532
533 if (parent == parsed)
534 return false;
535 if (!left || left->type != EXPR_SYMBOL)
536 return false;
537 if (strncmp(left->symbol_name->name, "__fake_assign_", 14) != 0)
538 return false;
539 parsed = parent;
540 __split_expr(parent);
541 return true;
542 }
543
544 // TODO: faked_assign skipping conditions is a hack
545 if (is_condition_call(expr))
546 return false;
547
548 snprintf(buf, sizeof(buf), "__fake_assign_%p", expr);
549 assign = create_fake_assign(buf, get_type(expr), expr);
550
551 parsed = assign;
552 __split_expr(assign);
553 return true;
554 }
555
556 static void split_call(struct expression *expr)
557 {
558 if (gen_fake_function_assign(expr))
559 return;
560
561 expr_set_parent_expr(expr->fn, expr);
562
563 if (sym_name_is("__builtin_constant_p", expr->fn))
564 return;
565 if (handle__builtin_choose_expr(expr))
566 return;
567 __split_expr(expr->fn);
568 split_args(expr);
569 if (is_inline_func(expr->fn))
570 add_inline_function(expr->fn->symbol->definition);
571 if (inlinable(expr->fn))
572 __inline_call = 1;
573 __process_post_op_stack();
574 __pass_to_client(expr, FUNCTION_CALL_HOOK_BEFORE);
575 __pass_to_client(expr, FUNCTION_CALL_HOOK);
576 __inline_call = 0;
577 if (inlinable(expr->fn))
578 parse_inline(expr);
579 __pass_to_client(expr, CALL_HOOK_AFTER_INLINE);
580 if (is_noreturn_func(expr->fn))
581 nullify_path();
582 if (!expr_get_parent_expr(expr) && indent_cnt == 1)
583 __discard_fake_states(expr);
584 handle_builtin_overflow_func(expr);
585 __add_ptr_list((struct ptr_list **)&parsed_calls, expr);
586 }
587
588 static unsigned long skip_split;
589 void parse_assignment(struct expression *expr, bool shallow)
590 {
591 struct expression *right;
592
593 expr_set_parent_expr(expr->left, expr);
594 expr_set_parent_expr(expr->right, expr);
595
596 right = strip_expr(expr->right);
597 if (!right)
598 return;
599
600 if (shallow)
601 skip_split++;
602
603 __pass_to_client(expr, RAW_ASSIGNMENT_HOOK);
604
605 /* foo = !bar() */
606 if (__handle_condition_assigns(expr))
607 goto after_assign;
608 /* foo = (x < 5 ? foo : 5); */
609 if (__handle_select_assigns(expr))
610 goto after_assign;
611 /* foo = ({frob(); frob(); frob(); 1;}) */
612 if (__handle_expr_statement_assigns(expr))
613 goto done; // FIXME: goto after
614 /* foo = (3, 4); */
615 if (handle_comma_assigns(expr))
616 goto after_assign;
617 if (handle__builtin_choose_expr_assigns(expr))
618 goto after_assign;
619 if (handle_postop_assigns(expr))
620 goto done; /* no need to goto after_assign */
621
622 __split_expr(expr->right);
623 if (outside_of_function())
624 __pass_to_client(expr, GLOBAL_ASSIGNMENT_HOOK);
625 else
626 __pass_to_client(expr, ASSIGNMENT_HOOK);
627
628
629 // FIXME: the ordering of this is tricky
630 __fake_struct_member_assignments(expr);
631
632 /* Re-examine ->right for inlines. See the commit message */
633 right = strip_expr(expr->right);
634 if (expr->op == '=' && right->type == EXPR_CALL)
635 __pass_to_client(expr, CALL_ASSIGNMENT_HOOK);
636
637 after_assign:
638 if (get_macro_name(right->pos) &&
639 get_macro_name(expr->left->pos) != get_macro_name(right->pos))
640 __pass_to_client(expr, MACRO_ASSIGNMENT_HOOK);
641
642 __pass_to_client(expr, ASSIGNMENT_HOOK_AFTER);
643 __split_expr(expr->left);
644
645 done:
646 if (shallow)
647 skip_split--;
648 }
649
650 static bool skip_split_off(struct expression *expr)
651 {
652 if (expr->type == EXPR_CALL &&
653 sym_name_is("__smatch_stop_skip", expr->fn))
654 return true;
655 return false;
656 }
657
658 void __split_expr(struct expression *expr)
659 {
660 if (!expr)
661 return;
662
663 if (skip_split_off(expr))
664 __debug_skip = 0;
665 if (__debug_skip)
666 return;
667
668 if (skip_split)
669 return;
670
671 // if (local_debug)
672 // sm_msg("Debug expr_type %d %s expr = '%s'", expr->type, show_special(expr->op), expr_to_str(expr));
673
674 if (__in_fake_assign && expr->type != EXPR_ASSIGNMENT)
675 return;
676 if (__in_fake_assign >= 4) /* don't allow too much nesting */
677 return;
678
679 push_expression(&big_expression_stack, expr);
680 set_position(expr->pos);
681 __pass_to_client(expr, EXPR_HOOK);
682
683 switch (expr->type) {
684 case EXPR_PREOP:
685 expr_set_parent_expr(expr->unop, expr);
686
687 __split_expr(expr->unop);
688 if (expr->op == '*' &&
689 !prev_expression_is_getting_address(expr))
690 __pass_to_client(expr, DEREF_HOOK);
691 __pass_to_client(expr, OP_HOOK);
692 break;
693 case EXPR_POSTOP:
694 expr_set_parent_expr(expr->unop, expr);
695
696 __split_expr(expr->unop);
697 push_expression(&post_op_stack, expr);
698 break;
699 case EXPR_STATEMENT:
700 __expr_stmt_count++;
701 if (expr->statement && !expr->statement) {
702 stmt_set_parent_stmt(expr->statement,
703 last_ptr_list((struct ptr_list *)big_statement_stack));
704 }
705 __split_stmt(expr->statement);
706 __expr_stmt_count--;
707 break;
708 case EXPR_LOGICAL:
709 case EXPR_COMPARE:
710 expr_set_parent_expr(expr->left, expr);
711 expr_set_parent_expr(expr->right, expr);
712
713 __pass_to_client(expr, LOGIC_HOOK);
714 __handle_logic(expr);
715 break;
716 case EXPR_BINOP:
717 expr_set_parent_expr(expr->left, expr);
718 expr_set_parent_expr(expr->right, expr);
719
720 __pass_to_client(expr, BINOP_HOOK);
721 __split_expr(expr->left);
722 __split_expr(expr->right);
723 break;
724 case EXPR_COMMA:
725 expr_set_parent_expr(expr->left, expr);
726 expr_set_parent_expr(expr->right, expr);
727
728 __split_expr(expr->left);
729 __process_post_op_stack();
730 __split_expr(expr->right);
731 break;
732 case EXPR_ASSIGNMENT:
733 parse_assignment(expr, false);
734 break;
735 case EXPR_DEREF:
736 expr_set_parent_expr(expr->deref, expr);
737
738 __split_expr(expr->deref);
739 __pass_to_client(expr, DEREF_HOOK);
740 break;
741 case EXPR_SLICE:
742 expr_set_parent_expr(expr->base, expr);
743
744 __split_expr(expr->base);
745 break;
746 case EXPR_CAST:
747 case EXPR_FORCE_CAST:
748 expr_set_parent_expr(expr->cast_expression, expr);
749
750 __pass_to_client(expr, CAST_HOOK);
751 __split_expr(expr->cast_expression);
752 break;
753 case EXPR_SIZEOF:
754 if (expr->cast_expression)
755 __pass_to_client(strip_parens(expr->cast_expression),
756 SIZEOF_HOOK);
757 break;
758 case EXPR_OFFSETOF:
759 case EXPR_ALIGNOF:
760 break;
761 case EXPR_CONDITIONAL:
762 case EXPR_SELECT:
763 expr_set_parent_expr(expr->conditional, expr);
764 expr_set_parent_expr(expr->cond_true, expr);
765 expr_set_parent_expr(expr->cond_false, expr);
766
767 if (known_condition_true(expr->conditional)) {
768 __split_expr(expr->cond_true);
769 break;
770 }
771 if (known_condition_false(expr->conditional)) {
772 __split_expr(expr->cond_false);
773 break;
774 }
775 __pass_to_client(expr, SELECT_HOOK);
776 __split_whole_condition(expr->conditional);
777 __split_expr(expr->cond_true);
778 __push_true_states();
779 __use_false_states();
780 __split_expr(expr->cond_false);
781 __merge_true_states();
782 break;
783 case EXPR_CALL:
784 split_call(expr);
785 break;
786 case EXPR_INITIALIZER:
787 split_expr_list(expr->expr_list, expr);
788 break;
789 case EXPR_IDENTIFIER:
790 expr_set_parent_expr(expr->ident_expression, expr);
791 __split_expr(expr->ident_expression);
792 break;
793 case EXPR_INDEX:
794 expr_set_parent_expr(expr->idx_expression, expr);
795 __split_expr(expr->idx_expression);
796 break;
797 case EXPR_POS:
798 expr_set_parent_expr(expr->init_expr, expr);
799 __split_expr(expr->init_expr);
800 break;
801 case EXPR_SYMBOL:
802 __pass_to_client(expr, SYM_HOOK);
803 break;
804 case EXPR_STRING:
805 __pass_to_client(expr, STRING_HOOK);
806 break;
807 case EXPR_GENERIC: {
808 struct expression *tmp;
809
810 tmp = strip_Generic(expr);
811 if (tmp != expr)
812 __split_expr(tmp);
813 break;
814 }
815 default:
816 break;
817 };
818 __pass_to_client(expr, EXPR_HOOK_AFTER);
819 pop_expression(&big_expression_stack);
820 }
821
822 static int is_forever_loop(struct statement *stmt)
823 {
824 struct expression *expr;
825 sval_t sval;
826
827 expr = strip_expr(stmt->iterator_pre_condition);
828 if (!expr)
829 expr = stmt->iterator_post_condition;
830 if (!expr) {
831 /* this is a for(;;) loop... */
832 return 1;
833 }
834
835 if (get_value(expr, &sval) && sval.value != 0)
836 return 1;
837
838 return 0;
839 }
840
841 static int loop_num;
842 static char *get_loop_name(int num)
843 {
844 char buf[256];
845
846 snprintf(buf, 255, "-loop%d", num);
847 buf[255] = '\0';
848 return alloc_sname(buf);
849 }
850
851 static struct bool_stmt_fn_list *once_through_hooks;
852 void add_once_through_hook(bool_stmt_func *fn)
853 {
854 add_ptr_list(&once_through_hooks, fn);
855 }
856
857 static bool call_once_through_hooks(struct statement *stmt)
858 {
859 bool_stmt_func *fn;
860
861 if (option_assume_loops)
862 return true;
863
864 FOR_EACH_PTR(once_through_hooks, fn) {
865 if ((fn)(stmt))
866 return true;
867 } END_FOR_EACH_PTR(fn);
868
869 return false;
870 }
871
872 static void do_scope_hooks(void)
873 {
874 struct position orig = current_pos;
875
876 __call_scope_hooks();
877 set_position(orig);
878 }
879
880 /*
881 * Pre Loops are while and for loops.
882 */
883 static void handle_pre_loop(struct statement *stmt)
884 {
885 int once_through; /* we go through the loop at least once */
886 struct sm_state *extra_sm = NULL;
887 int unchanged = 0;
888 char *loop_name;
889 struct stree *stree = NULL;
890 struct sm_state *sm = NULL;
891
892 __push_scope_hooks();
893
894 loop_name = get_loop_name(loop_num);
895 loop_num++;
896
897 split_declaration(stmt->iterator_syms);
898 if (stmt->iterator_pre_statement) {
899 __split_stmt(stmt->iterator_pre_statement);
900 __prev_stmt = stmt->iterator_pre_statement;
901 }
902
903 loop_count++;
904 __push_continues();
905 __push_breaks();
906
907 __merge_gotos(loop_name, NULL);
908
909 extra_sm = __extra_handle_canonical_loops(stmt, &stree);
910 __in_pre_condition++;
911 __set_confidence_implied();
912 __split_whole_condition_tf(stmt->iterator_pre_condition, &once_through);
913 __unset_confidence();
914 if (once_through != true)
915 once_through = call_once_through_hooks(stmt);
916 __pass_to_client(stmt, PRELOOP_HOOK);
917 __in_pre_condition--;
918 FOR_EACH_SM(stree, sm) {
919 set_state(sm->owner, sm->name, sm->sym, sm->state);
920 } END_FOR_EACH_SM(sm);
921 free_stree(&stree);
922 if (extra_sm)
923 extra_sm = get_sm_state(extra_sm->owner, extra_sm->name, extra_sm->sym);
924
925 __split_stmt(stmt->iterator_statement);
926 if (is_forever_loop(stmt)) {
927 __merge_continues();
928 __save_gotos(loop_name, NULL);
929
930 __push_fake_cur_stree();
931 __split_stmt(stmt->iterator_post_statement);
932 stree = __pop_fake_cur_stree();
933
934 __discard_false_states();
935 __pass_to_client(stmt, AFTER_LOOP_NO_BREAKS);
936 __use_breaks();
937
938 if (!__path_is_null())
939 __merge_stree_into_cur(stree);
940 free_stree(&stree);
941 } else {
942 __merge_continues();
943 unchanged = __iterator_unchanged(extra_sm);
944 __split_stmt(stmt->iterator_post_statement);
945 __prev_stmt = stmt->iterator_post_statement;
946 __cur_stmt = stmt;
947
948 __save_gotos(loop_name, NULL);
949 __in_pre_condition++;
950 __split_whole_condition(stmt->iterator_pre_condition);
951 __in_pre_condition--;
952 nullify_path();
953 __merge_false_states();
954 if (once_through == true)
955 __discard_false_states();
956 else
957 __merge_false_states();
958
959 if (extra_sm && unchanged)
960 __extra_pre_loop_hook_after(extra_sm,
961 stmt->iterator_post_statement,
962 stmt->iterator_pre_condition);
963 __pass_to_client(stmt, AFTER_LOOP_NO_BREAKS);
964 __merge_breaks();
965 }
966 loop_count--;
967
968 do_scope_hooks();
969 }
970
971 /*
972 * Post loops are do {} while();
973 */
974 static void handle_post_loop(struct statement *stmt)
975 {
976 char *loop_name;
977
978 loop_name = get_loop_name(loop_num);
979 loop_num++;
980 loop_count++;
981
982 __pass_to_client(stmt, POSTLOOP_HOOK);
983
984 __push_continues();
985 __push_breaks();
986 __merge_gotos(loop_name, NULL);
987 __split_stmt(stmt->iterator_statement);
988 __merge_continues();
989 if (!expr_is_zero(stmt->iterator_post_condition))
990 __save_gotos(loop_name, NULL);
991
992 if (is_forever_loop(stmt)) {
993 __pass_to_client(stmt, AFTER_LOOP_NO_BREAKS);
994 __use_breaks();
995 } else {
996 __split_whole_condition(stmt->iterator_post_condition);
997 __use_false_states();
998 __pass_to_client(stmt, AFTER_LOOP_NO_BREAKS);
999 __merge_breaks();
1000 }
1001 loop_count--;
1002 }
1003
1004 static int empty_statement(struct statement *stmt)
1005 {
1006 if (!stmt)
1007 return 0;
1008 if (stmt->type == STMT_EXPRESSION && !stmt->expression)
1009 return 1;
1010 return 0;
1011 }
1012
1013 static int last_stmt_on_same_line(void)
1014 {
1015 struct statement *stmt;
1016 int i = 0;
1017
1018 FOR_EACH_PTR_REVERSE(big_statement_stack, stmt) {
1019 if (!i++)
1020 continue;
1021 if (stmt->pos.line == get_lineno())
1022 return 1;
1023 return 0;
1024 } END_FOR_EACH_PTR_REVERSE(stmt);
1025 return 0;
1026 }
1027
1028 static void split_asm_ops(struct asm_operand_list *ops)
1029 {
1030 struct asm_operand *op;
1031
1032 FOR_EACH_PTR(ops, op) {
1033 __split_expr(op->expr);
1034 } END_FOR_EACH_PTR(op);
1035 }
1036
1037 static int is_case_val(struct statement *stmt, sval_t sval)
1038 {
1039 sval_t case_sval;
1040
1041 if (stmt->type != STMT_CASE)
1042 return 0;
1043 if (!stmt->case_expression) {
1044 __set_default();
1045 return 1;
1046 }
1047 if (!get_value(stmt->case_expression, &case_sval))
1048 return 0;
1049 if (case_sval.value == sval.value)
1050 return 1;
1051 return 0;
1052 }
1053
1054 static struct range_list *get_case_rl(struct expression *switch_expr,
1055 struct expression *case_expr,
1056 struct expression *case_to)
1057 {
1058 sval_t start, end;
1059 struct range_list *rl = NULL;
1060 struct symbol *switch_type;
1061
1062 switch_type = get_type(switch_expr);
1063 if (get_value(case_to, &end) && get_value(case_expr, &start)) {
1064 start = sval_cast(switch_type, start);
1065 end = sval_cast(switch_type, end);
1066 add_range(&rl, start, end);
1067 } else if (get_value(case_expr, &start)) {
1068 start = sval_cast(switch_type, start);
1069 add_range(&rl, start, start);
1070 }
1071
1072 return rl;
1073 }
1074
1075 static void split_known_switch(struct statement *stmt, sval_t sval)
1076 {
1077 struct statement *tmp;
1078 struct range_list *rl;
1079
1080 __split_expr(stmt->switch_expression);
1081 sval = sval_cast(get_type(stmt->switch_expression), sval);
1082
1083 push_expression(&switch_expr_stack, stmt->switch_expression);
1084 __save_switch_states(top_expression(switch_expr_stack));
1085 nullify_path();
1086 __push_default();
1087 __push_breaks();
1088
1089 stmt = stmt->switch_statement;
1090
1091 __push_scope_hooks();
1092 FOR_EACH_PTR(stmt->stmts, tmp) {
1093 __smatch_lineno = tmp->pos.line;
1094 // FIXME: what if default comes before the known case statement?
1095 if (is_case_val(tmp, sval)) {
1096 rl = alloc_rl(sval, sval);
1097 __merge_switches(top_expression(switch_expr_stack), rl);
1098 __pass_case_to_client(top_expression(switch_expr_stack), rl);
1099 stmt_set_parent_stmt(tmp->case_statement, tmp);
1100 __split_stmt(tmp->case_statement);
1101 goto next;
1102 }
1103 if (__path_is_null())
1104 continue;
1105 __split_stmt(tmp);
1106 next:
1107 if (__path_is_null()) {
1108 __set_default();
1109 goto out;
1110 }
1111 } END_FOR_EACH_PTR(tmp);
1112 out:
1113 do_scope_hooks();
1114 if (!__pop_default())
1115 __merge_switches(top_expression(switch_expr_stack), NULL);
1116 __discard_switches();
1117 __merge_breaks();
1118 pop_expression(&switch_expr_stack);
1119 }
1120
1121 static void split_case(struct statement *stmt)
1122 {
1123 struct range_list *rl = NULL;
1124
1125 expr_set_parent_stmt(stmt->case_expression, stmt);
1126 expr_set_parent_stmt(stmt->case_to, stmt);
1127
1128 rl = get_case_rl(top_expression(switch_expr_stack),
1129 stmt->case_expression, stmt->case_to);
1130 while (stmt->case_statement->type == STMT_CASE) {
1131 struct range_list *tmp;
1132
1133 tmp = get_case_rl(top_expression(switch_expr_stack),
1134 stmt->case_statement->case_expression,
1135 stmt->case_statement->case_to);
1136 if (!tmp)
1137 goto next;
1138 rl = rl_union(rl, tmp);
1139 if (!stmt->case_expression)
1140 __set_default();
1141 next:
1142 stmt = stmt->case_statement;
1143 }
1144
1145 __merge_switches(top_expression(switch_expr_stack), rl);
1146
1147 if (!stmt->case_expression)
1148 __set_default();
1149
1150 stmt_set_parent_stmt(stmt->case_statement, stmt);
1151 __split_stmt(stmt->case_statement);
1152 }
1153
1154 int time_parsing_function(void)
1155 {
1156 return ms_since(&fn_start_time) / 1000;
1157 }
1158
1159 bool taking_too_long(void)
1160 {
1161 if ((ms_since(&outer_fn_start_time) / 1000) > 60 * 5) /* five minutes */
1162 return 1;
1163 return 0;
1164 }
1165
1166 struct statement *get_last_stmt(void)
1167 {
1168 struct symbol *fn;
1169 struct statement *stmt;
1170
1171 fn = get_base_type(cur_func_sym);
1172 if (!fn)
1173 return NULL;
1174 stmt = fn->stmt;
1175 if (!stmt)
1176 stmt = fn->inline_stmt;
1177 if (!stmt || stmt->type != STMT_COMPOUND)
1178 return NULL;
1179 stmt = last_ptr_list((struct ptr_list *)stmt->stmts);
1180 if (stmt && stmt->type == STMT_LABEL)
1181 stmt = stmt->label_statement;
1182 return stmt;
1183 }
1184
1185 int is_last_stmt(struct statement *cur_stmt)
1186 {
1187 struct statement *last;
1188
1189 last = get_last_stmt();
1190 if (last && last == cur_stmt)
1191 return 1;
1192 return 0;
1193 }
1194
1195 static bool is_function_scope(struct statement *stmt)
1196 {
1197 struct symbol *base_type;
1198
1199 if (!cur_func_sym)
1200 return false;
1201
1202 base_type = get_base_type(cur_func_sym);
1203 if (base_type->stmt == stmt ||
1204 base_type->inline_stmt == stmt)
1205 return true;
1206
1207 return false;
1208 }
1209
1210 static void handle_backward_goto(struct statement *goto_stmt)
1211 {
1212 const char *goto_name, *label_name;
1213 struct statement *func_stmt;
1214 struct symbol *base_type = get_base_type(cur_func_sym);
1215 struct statement *tmp;
1216 int found = 0;
1217
1218 if (!option_info)
1219 return;
1220 if (last_goto_statement_handled)
1221 return;
1222 last_goto_statement_handled = 1;
1223
1224 if (!goto_stmt->goto_label ||
1225 goto_stmt->goto_label->type != SYM_LABEL ||
1226 !goto_stmt->goto_label->ident)
1227 return;
1228 goto_name = goto_stmt->goto_label->ident->name;
1229
1230 func_stmt = base_type->stmt;
1231 if (!func_stmt)
1232 func_stmt = base_type->inline_stmt;
1233 if (!func_stmt)
1234 return;
1235 if (func_stmt->type != STMT_COMPOUND)
1236 return;
1237
1238 FOR_EACH_PTR(func_stmt->stmts, tmp) {
1239 if (!found) {
1240 if (tmp->type != STMT_LABEL)
1241 continue;
1242 if (!tmp->label_identifier ||
1243 tmp->label_identifier->type != SYM_LABEL ||
1244 !tmp->label_identifier->ident)
1245 continue;
1246 label_name = tmp->label_identifier->ident->name;
1247 if (strcmp(goto_name, label_name) != 0)
1248 continue;
1249 found = 1;
1250 }
1251 __split_stmt(tmp);
1252 } END_FOR_EACH_PTR(tmp);
1253 }
1254
1255 static void fake_a_return(void)
1256 {
1257 struct expression *ret = NULL;
1258
1259 nullify_path();
1260 __unnullify_path();
1261
1262 if (cur_func_return_type() != &void_ctype)
1263 ret = unknown_value_expression(NULL);
1264
1265 __pass_to_client(ret, RETURN_HOOK);
1266 nullify_path();
1267 }
1268
1269 static void split_ret_value(struct expression *expr)
1270 {
1271 struct symbol *type;
1272
1273 if (!expr)
1274 return;
1275
1276 type = get_real_base_type(cur_func_sym);
1277 type = get_real_base_type(type);
1278 expr = fake_a_variable_assign(type, NULL, expr, -1);
1279
1280 __in_fake_var_assign++;
1281 __split_expr(expr);
1282 __in_fake_var_assign--;
1283 }
1284
1285 static void fake_an_empty_default(struct position pos)
1286 {
1287 static struct statement none = {};
1288
1289 none.pos = pos;
1290 none.type = STMT_NONE;
1291 __merge_switches(top_expression(switch_expr_stack), NULL);
1292 __split_stmt(&none);
1293 }
1294
1295 static void split_compound(struct statement *stmt)
1296 {
1297 struct statement *prev = NULL;
1298 struct statement *cur = NULL;
1299 struct statement *next;
1300
1301 __push_scope_hooks();
1302
1303 FOR_EACH_PTR(stmt->stmts, next) {
1304 /* just set them all ahead of time */
1305 stmt_set_parent_stmt(next, stmt);
1306
1307 if (cur) {
1308 __prev_stmt = prev;
1309 __next_stmt = next;
1310 __cur_stmt = cur;
1311 __split_stmt(cur);
1312 }
1313 prev = cur;
1314 cur = next;
1315 } END_FOR_EACH_PTR(next);
1316 if (cur) {
1317 __prev_stmt = prev;
1318 __cur_stmt = cur;
1319 __next_stmt = NULL;
1320 __split_stmt(cur);
1321 }
1322
1323 /*
1324 * For function scope, then delay calling the scope hooks until the
1325 * end of function hooks can run.
1326 */
1327 if (!is_function_scope(stmt))
1328 do_scope_hooks();
1329 }
1330
1331 void __split_label_stmt(struct statement *stmt)
1332 {
1333 if (stmt->label_identifier &&
1334 stmt->label_identifier->type == SYM_LABEL &&
1335 stmt->label_identifier->ident) {
1336 loop_count |= 0x0800000;
1337 __merge_gotos(stmt->label_identifier->ident->name, stmt->label_identifier);
1338 }
1339 }
1340
1341 static void find_asm_gotos(struct statement *stmt)
1342 {
1343 struct symbol *sym;
1344
1345 FOR_EACH_PTR(stmt->asm_labels, sym) {
1346 __save_gotos(sym->ident->name, sym);
1347 } END_FOR_EACH_PTR(sym);
1348 }
1349
1350 static void split_if_statement(struct statement *stmt)
1351 {
1352 int known_tf;
1353
1354 stmt_set_parent_stmt(stmt->if_true, stmt);
1355 stmt_set_parent_stmt(stmt->if_false, stmt);
1356 expr_set_parent_stmt(stmt->if_conditional, stmt);
1357
1358 if (empty_statement(stmt->if_true) &&
1359 last_stmt_on_same_line() &&
1360 !get_macro_name(stmt->if_true->pos))
1361 sm_warning("if();");
1362
1363 __split_whole_condition_tf(stmt->if_conditional, &known_tf);
1364 if (known_tf == true) {
1365 __split_stmt(stmt->if_true);
1366 __discard_false_states();
1367 return;
1368 } else if (known_tf == false) {
1369 __use_false_states();
1370 __split_stmt(stmt->if_false);
1371 return;
1372 }
1373
1374 __split_stmt(stmt->if_true);
1375 __push_true_states();
1376 __use_false_states();
1377 __split_stmt(stmt->if_false);
1378 __merge_true_states();
1379 }
1380
1381 static bool already_parsed_call(struct expression *call)
1382 {
1383 struct expression *expr;
1384
1385 FOR_EACH_PTR(parsed_calls, expr) {
1386 if (expr == call)
1387 return true;
1388 } END_FOR_EACH_PTR(expr);
1389 return false;
1390 }
1391
1392 static void free_parsed_call_stuff(bool free_fake_states)
1393 {
1394 free_expression_stack(&parsed_calls);
1395 if (free_fake_states)
1396 __discard_fake_states(NULL);
1397 }
1398
1399 void __split_stmt(struct statement *stmt)
1400 {
1401 sval_t sval;
1402 struct timeval start, stop;
1403 bool skip_after = false;
1404
1405 gettimeofday(&start, NULL);
1406
1407 if (!stmt)
1408 goto out;
1409
1410 if (!__in_fake_assign)
1411 __silence_warnings_for_stmt = false;
1412
1413 if (__bail_on_rest_of_function || is_skipped_function())
1414 return;
1415
1416 if (out_of_memory() || taking_too_long()) {
1417 gettimeofday(&start, NULL);
1418
1419 __bail_on_rest_of_function = 1;
1420 final_pass = 1;
1421 sm_perror("Function too hairy. Giving up. %lu seconds",
1422 start.tv_sec - fn_start_time.tv_sec);
1423 fake_a_return();
1424 final_pass = 0; /* turn off sm_msg() from here */
1425 return;
1426 }
1427
1428 indent_cnt++;
1429
1430 add_ptr_list(&big_statement_stack, stmt);
1431 free_expression_stack(&big_expression_stack);
1432 free_parsed_call_stuff(indent_cnt == 1);
1433 set_position(stmt->pos);
1434 __pass_to_client(stmt, STMT_HOOK);
1435
1436 switch (stmt->type) {
1437 case STMT_DECLARATION:
1438 split_declaration(stmt->declaration);
1439 break;
1440 case STMT_RETURN:
1441 expr_set_parent_stmt(stmt->ret_value, stmt);
1442
1443 split_ret_value(stmt->ret_value);
1444 __process_post_op_stack();
1445 __call_all_scope_hooks();
1446 __pass_to_client(stmt->ret_value, RETURN_HOOK);
1447 nullify_path();
1448 break;
1449 case STMT_EXPRESSION:
1450 expr_set_parent_stmt(stmt->expression, stmt);
1451 expr_set_parent_stmt(stmt->context, stmt);
1452
1453 __split_expr(stmt->expression);
1454 break;
1455 case STMT_COMPOUND:
1456 split_compound(stmt);
1457 break;
1458 case STMT_IF:
1459 split_if_statement(stmt);
1460 break;
1461 case STMT_ITERATOR:
1462 stmt_set_parent_stmt(stmt->iterator_pre_statement, stmt);
1463 stmt_set_parent_stmt(stmt->iterator_statement, stmt);
1464 stmt_set_parent_stmt(stmt->iterator_post_statement, stmt);
1465 expr_set_parent_stmt(stmt->iterator_pre_condition, stmt);
1466 expr_set_parent_stmt(stmt->iterator_post_condition, stmt);
1467
1468 if (stmt->iterator_pre_condition)
1469 handle_pre_loop(stmt);
1470 else if (stmt->iterator_post_condition)
1471 handle_post_loop(stmt);
1472 else {
1473 // these are for(;;) type loops.
1474 handle_pre_loop(stmt);
1475 }
1476 break;
1477 case STMT_SWITCH:
1478 stmt_set_parent_stmt(stmt->switch_statement, stmt);
1479 expr_set_parent_stmt(stmt->switch_expression, stmt);
1480
1481 if (get_value(stmt->switch_expression, &sval)) {
1482 split_known_switch(stmt, sval);
1483 break;
1484 }
1485 __split_expr(stmt->switch_expression);
1486 push_expression(&switch_expr_stack, stmt->switch_expression);
1487 __save_switch_states(top_expression(switch_expr_stack));
1488 nullify_path();
1489 __push_default();
1490 __push_breaks();
1491 __split_stmt(stmt->switch_statement);
1492 if (!__pop_default() && have_remaining_cases())
1493 fake_an_empty_default(stmt->pos);
1494 __discard_switches();
1495 __merge_breaks();
1496 pop_expression(&switch_expr_stack);
1497 break;
1498 case STMT_CASE:
1499 split_case(stmt);
1500 break;
1501 case STMT_LABEL:
1502 __split_label_stmt(stmt);
1503 __pass_to_client(stmt, STMT_HOOK_AFTER);
1504 skip_after = true;
1505 __split_stmt(stmt->label_statement);
1506 break;
1507 case STMT_GOTO:
1508 expr_set_parent_stmt(stmt->goto_expression, stmt);
1509
1510 __split_expr(stmt->goto_expression);
1511 if (stmt->goto_label && stmt->goto_label->type == SYM_NODE) {
1512 if (!strcmp(stmt->goto_label->ident->name, "break")) {
1513 __process_breaks();
1514 } else if (!strcmp(stmt->goto_label->ident->name,
1515 "continue")) {
1516 __process_continues();
1517 }
1518 } else if (stmt->goto_label &&
1519 stmt->goto_label->type == SYM_LABEL &&
1520 stmt->goto_label->ident) {
1521 __save_gotos(stmt->goto_label->ident->name, stmt->goto_label);
1522 }
1523 nullify_path();
1524 if (is_last_stmt(stmt))
1525 handle_backward_goto(stmt);
1526 break;
1527 case STMT_NONE:
1528 break;
1529 case STMT_ASM:
1530 expr_set_parent_stmt(stmt->asm_string, stmt);
1531
1532 find_asm_gotos(stmt);
1533 __pass_to_client(stmt, ASM_HOOK);
1534 __split_expr(stmt->asm_string);
1535 split_asm_ops(stmt->asm_outputs);
1536 split_asm_ops(stmt->asm_inputs);
1537 split_expr_list(stmt->asm_clobbers, NULL);
1538 break;
1539 case STMT_CONTEXT:
1540 break;
1541 case STMT_RANGE:
1542 __split_expr(stmt->range_expression);
1543 __split_expr(stmt->range_low);
1544 __split_expr(stmt->range_high);
1545 break;
1546 }
1547 if (!skip_after)
1548 __pass_to_client(stmt, STMT_HOOK_AFTER);
1549 if (--indent_cnt == 1)
1550 free_parsed_call_stuff(true);
1551
1552 out:
1553 __process_post_op_stack();
1554
1555 gettimeofday(&stop, NULL);
1556 if (option_time_stmt && stmt)
1557 sm_msg("stmt_time%s: %ld",
1558 stmt->type == STMT_COMPOUND ? "_block" : "",
1559 stop.tv_sec - start.tv_sec);
1560 }
1561
1562 static void split_expr_list(struct expression_list *expr_list, struct expression *parent)
1563 {
1564 struct expression *expr;
1565
1566 FOR_EACH_PTR(expr_list, expr) {
1567 expr_set_parent_expr(expr, parent);
1568 __split_expr(expr);
1569 __process_post_op_stack();
1570 } END_FOR_EACH_PTR(expr);
1571 }
1572
1573 static bool cast_arg(struct symbol *type, struct expression *arg)
1574 {
1575 struct symbol *orig;
1576
1577 if (!type)
1578 return false;
1579
1580 arg = strip_parens(arg);
1581 if (arg != strip_expr(arg))
1582 return true;
1583
1584 orig = get_type(arg);
1585 if (!orig)
1586 return true;
1587 if (types_equiv(orig, type))
1588 return false;
1589
1590 if (orig->type == SYM_ARRAY && type->type == SYM_PTR)
1591 return true;
1592
1593 /*
1594 * I would have expected that we could just do use (orig == type) but I
1595 * guess for pointers we need to get the basetype to do that comparison.
1596 *
1597 */
1598
1599 if (orig->type != SYM_PTR ||
1600 type->type != SYM_PTR) {
1601 if (type_fits(type, orig))
1602 return false;
1603 return true;
1604 }
1605 orig = get_real_base_type(orig);
1606 type = get_real_base_type(type);
1607 if (orig == type)
1608 return false;
1609
1610 return true;
1611 }
1612
1613 static struct expression *fake_a_variable_assign(struct symbol *type, struct expression *call, struct expression *expr, int nr)
1614 {
1615 char buf[64];
1616 bool cast;
1617
1618 if (!expr || !cur_func_sym)
1619 return NULL;
1620
1621 if (already_parsed_call(call))
1622 return NULL;
1623
1624 if (expr->type == EXPR_ASSIGNMENT)
1625 return expr;
1626
1627 /* for va_args then we don't know the type */
1628 if (!type)
1629 type = get_type(expr);
1630
1631 cast = cast_arg(type, expr);
1632 /*
1633 * Using expr_to_sym() here is a hack. We want to say that we don't
1634 * need to assign frob(foo) or frob(foo->bar) if the types are right.
1635 * It turns out faking these assignments is way more expensive than I
1636 * would have imagined. I'm not sure why exactly.
1637 *
1638 */
1639 if (!cast) {
1640 /*
1641 * if the code is "return *p;" where "p" is a user pointer then
1642 * we want to create a fake assignment so that it sets the state
1643 * in check_kernel_user_data.c.
1644 *
1645 */
1646 if (expr->type != EXPR_PREOP &&
1647 expr->op != '*' && expr->op != '&' &&
1648 expr_to_sym(expr))
1649 return expr;
1650 }
1651
1652 if (nr == -1)
1653 snprintf(buf, sizeof(buf), "__fake_return_%p", expr);
1654 else
1655 snprintf(buf, sizeof(buf), "__fake_param_%p_%d", call, nr);
1656
1657 return create_fake_assign(buf, type, expr);
1658 }
1659
1660 static void split_args(struct expression *expr)
1661 {
1662 struct expression *arg, *tmp;
1663 struct symbol *type;
1664 int i;
1665
1666 i = -1;
1667 FOR_EACH_PTR(expr->args, arg) {
1668 i++;
1669 expr_set_parent_expr(arg, expr);
1670 type = get_arg_type(expr->fn, i);
1671 tmp = fake_a_variable_assign(type, expr, arg, i);
1672 if (tmp != arg)
1673 __in_fake_var_assign++;
1674 __split_expr(tmp);
1675 if (tmp != arg)
1676 __in_fake_var_assign--;
1677 __process_post_op_stack();
1678 } END_FOR_EACH_PTR(arg);
1679 }
1680
1681 static void call_cleanup_fn(void *_sym)
1682 {
1683 struct symbol *sym = _sym;
1684 struct expression *call, *arg;
1685 struct expression_list *args = NULL;
1686 struct position orig = current_pos;
1687
1688 arg = symbol_expression(sym);
1689 arg = preop_expression(arg, '&');
1690 add_ptr_list(&args, arg);
1691 call = call_expression(sym->cleanup, args);
1692
1693 __split_expr(call);
1694 set_position(orig);
1695 }
1696
1697 static void add_cleanup_hook(struct symbol *sym)
1698 {
1699 if (!sym->cleanup)
1700 return;
1701 add_scope_hook(&call_cleanup_fn, sym);
1702 }
1703
1704 static void split_sym(struct symbol *sym)
1705 {
1706 if (!sym)
1707 return;
1708 if (!(sym->namespace & NS_SYMBOL))
1709 return;
1710
1711 __split_stmt(sym->stmt);
1712 __split_expr(sym->array_size);
1713 if (sym->cleanup)
1714 add_cleanup_hook(sym);
1715 split_symlist(sym->arguments);
1716 split_symlist(sym->symbol_list);
1717 __split_stmt(sym->inline_stmt);
1718 split_symlist(sym->inline_symbol_list);
1719 }
1720
1721 static void split_symlist(struct symbol_list *sym_list)
1722 {
1723 struct symbol *sym;
1724
1725 FOR_EACH_PTR(sym_list, sym) {
1726 split_sym(sym);
1727 } END_FOR_EACH_PTR(sym);
1728 }
1729
1730 typedef void (fake_cb)(struct expression *expr);
1731
1732 static int member_to_number(struct expression *expr, struct ident *member)
1733 {
1734 struct symbol *type, *tmp;
1735 char *name;
1736 int i;
1737
1738 if (!member)
1739 return -1;
1740 name = member->name;
1741
1742 type = get_type(expr);
1743 if (!type || type->type != SYM_STRUCT)
1744 return -1;
1745
1746 i = -1;
1747 FOR_EACH_PTR(type->symbol_list, tmp) {
1748 i++;
1749 if (!tmp->ident)
1750 continue;
1751 if (strcmp(name, tmp->ident->name) == 0)
1752 return i;
1753 } END_FOR_EACH_PTR(tmp);
1754 return -1;
1755 }
1756
1757 static struct ident *number_to_member(struct expression *expr, int num)
1758 {
1759 struct symbol *type, *member;
1760 int i = 0;
1761
1762 type = get_type(expr);
1763 if (!type || type->type != SYM_STRUCT)
1764 return NULL;
1765
1766 FOR_EACH_PTR(type->symbol_list, member) {
1767 if (i == num)
1768 return member->ident;
1769 i++;
1770 } END_FOR_EACH_PTR(member);
1771 return NULL;
1772 }
1773
1774 static void fake_element_assigns_helper(struct expression *array, struct expression_list *expr_list, fake_cb *fake_cb);
1775
1776 static void set_inner_struct_members(struct expression *expr, struct symbol *member)
1777 {
1778 struct expression *edge_member, *assign;
1779 struct symbol *base = get_real_base_type(member);
1780 struct symbol *tmp;
1781
1782 if (member->ident)
1783 expr = member_expression(expr, '.', member->ident);
1784
1785 FOR_EACH_PTR(base->symbol_list, tmp) {
1786 struct symbol *type;
1787
1788 type = get_real_base_type(tmp);
1789 if (!type)
1790 continue;
1791
1792 edge_member = member_expression(expr, '.', tmp->ident);
1793 if (get_extra_state(edge_member))
1794 continue;
1795
1796 if (type->type == SYM_UNION || type->type == SYM_STRUCT) {
1797 set_inner_struct_members(expr, tmp);
1798 continue;
1799 }
1800
1801 if (!tmp->ident)
1802 continue;
1803
1804 assign = assign_expression(edge_member, '=', zero_expr());
1805 __split_expr(assign);
1806 } END_FOR_EACH_PTR(tmp);
1807
1808
1809 }
1810
1811 static void set_unset_to_zero(struct symbol *type, struct expression *expr)
1812 {
1813 struct symbol *tmp;
1814 struct expression *member = NULL;
1815 struct expression *assign;
1816
1817 FOR_EACH_PTR(type->symbol_list, tmp) {
1818 type = get_real_base_type(tmp);
1819 if (!type)
1820 continue;
1821
1822 if (tmp->ident) {
1823 member = member_expression(expr, '.', tmp->ident);
1824 if (get_extra_state(member))
1825 continue;
1826 }
1827
1828 if (type->type == SYM_UNION || type->type == SYM_STRUCT) {
1829 set_inner_struct_members(expr, tmp);
1830 continue;
1831 }
1832 if (type->type == SYM_ARRAY)
1833 continue;
1834 if (!tmp->ident)
1835 continue;
1836
1837 assign = assign_expression(member, '=', zero_expr());
1838 __split_expr(assign);
1839 } END_FOR_EACH_PTR(tmp);
1840 }
1841
1842 static void fake_member_assigns_helper(struct expression *symbol, struct expression_list *members, fake_cb *fake_cb)
1843 {
1844 struct expression *deref, *assign, *tmp, *right;
1845 struct symbol *struct_type, *type;
1846 struct ident *member;
1847 int member_idx;
1848
1849 struct_type = get_type(symbol);
1850 if (!struct_type ||
1851 (struct_type->type != SYM_STRUCT && struct_type->type != SYM_UNION))
1852 return;
1853
1854 /*
1855 * We're parsing an initializer that could look something like this:
1856 * struct foo foo = {
1857 * 42,
1858 * .whatever.xxx = 11,
1859 * .zzz = 12,
1860 * };
1861 *
1862 * So what we have here is a list with 42, .whatever, and .zzz. We need
1863 * to break it up into left and right sides of the assignments.
1864 *
1865 */
1866 member_idx = 0;
1867 FOR_EACH_PTR(members, tmp) {
1868 deref = NULL;
1869 if (tmp->type == EXPR_IDENTIFIER) {
1870 member_idx = member_to_number(symbol, tmp->expr_ident);
1871 while (tmp->type == EXPR_IDENTIFIER) {
1872 member = tmp->expr_ident;
1873 tmp = tmp->ident_expression;
1874 if (deref)
1875 deref = member_expression(deref, '.', member);
1876 else
1877 deref = member_expression(symbol, '.', member);
1878 }
1879 } else {
1880 member = number_to_member(symbol, member_idx);
1881 deref = member_expression(symbol, '.', member);
1882 }
1883 right = tmp;
1884 member_idx++;
1885 if (right->type == EXPR_INITIALIZER) {
1886 type = get_type(deref);
1887 if (type && type->type == SYM_ARRAY)
1888 fake_element_assigns_helper(deref, right->expr_list, fake_cb);
1889 else
1890 fake_member_assigns_helper(deref, right->expr_list, fake_cb);
1891 } else {
1892 assign = assign_expression(deref, '=', right);
1893 fake_cb(assign);
1894 }
1895 } END_FOR_EACH_PTR(tmp);
1896
1897 set_unset_to_zero(struct_type, symbol);
1898 }
1899
1900 static void fake_member_assigns(struct symbol *sym, fake_cb *fake_cb)
1901 {
1902 fake_member_assigns_helper(symbol_expression(sym),
1903 sym->initializer->expr_list, fake_cb);
1904 }
1905
1906 static void fake_element_assigns_helper(struct expression *array, struct expression_list *expr_list, fake_cb *fake_cb)
1907 {
1908 struct expression *offset, *binop, *assign, *tmp;
1909 struct symbol *type;
1910 int idx, max;
1911
1912 if (ptr_list_size((struct ptr_list *)expr_list) > 256) {
1913 binop = array_element_expression(array, unknown_value_expression(array));
1914 assign = assign_expression(binop, '=', unknown_value_expression(array));
1915 /* fake_cb is probably call_global_assign_hooks() which is a
1916 * a kind of hacky short cut because it's too expensive to deal
1917 * with huge global arrays. However, we may as well parse this
1918 * one the long way seeing as it's a one time thing.
1919 */
1920 __split_expr(assign);
1921 return;
1922 }
1923
1924 max = 0;
1925 idx = 0;
1926 FOR_EACH_PTR(expr_list, tmp) {
1927 if (tmp->type == EXPR_INDEX) {
1928 if (tmp->idx_from != tmp->idx_to)
1929 return;
1930 idx = tmp->idx_from;
1931 if (idx > max)
1932 max = idx;
1933 if (!tmp->idx_expression)
1934 goto next;
1935 tmp = tmp->idx_expression;
1936 }
1937 offset = value_expr(idx);
1938 binop = array_element_expression(array, offset);
1939 if (tmp->type == EXPR_INITIALIZER) {
1940 type = get_type(binop);
1941 if (type && type->type == SYM_ARRAY)
1942 fake_element_assigns_helper(binop, tmp->expr_list, fake_cb);
1943 else
1944 fake_member_assigns_helper(binop, tmp->expr_list, fake_cb);
1945 } else {
1946 assign = assign_expression(binop, '=', tmp);
1947 fake_cb(assign);
1948 }
1949 next:
1950 idx++;
1951 if (idx > max)
1952 max = idx;
1953 } END_FOR_EACH_PTR(tmp);
1954
1955 __call_array_initialized_hooks(array, max);
1956 }
1957
1958 static void fake_element_assigns(struct symbol *sym, fake_cb *fake_cb)
1959 {
1960 fake_element_assigns_helper(symbol_expression(sym), sym->initializer->expr_list, fake_cb);
1961 }
1962
1963 static void fake_assign_expr(struct symbol *sym)
1964 {
1965 struct expression *assign, *symbol;
1966
1967 symbol = symbol_expression(sym);
1968 assign = assign_expression(symbol, '=', sym->initializer);
1969 __split_expr(assign);
1970 }
1971
1972 static void do_initializer_stuff(struct symbol *sym)
1973 {
1974 if (!sym->initializer)
1975 return;
1976
1977 if (sym->initializer->type == EXPR_INITIALIZER) {
1978 if (get_real_base_type(sym)->type == SYM_ARRAY)
1979 fake_element_assigns(sym, __split_expr);
1980 else
1981 fake_member_assigns(sym, __split_expr);
1982 } else {
1983 fake_assign_expr(sym);
1984 }
1985 }
1986
1987 static void split_declaration(struct symbol_list *sym_list)
1988 {
1989 struct symbol *sym;
1990
1991 FOR_EACH_PTR(sym_list, sym) {
1992 __pass_to_client(sym, DECLARATION_HOOK);
1993 do_initializer_stuff(sym);
1994 __pass_to_client(sym, DECLARATION_HOOK_AFTER);
1995 split_sym(sym);
1996 } END_FOR_EACH_PTR(sym);
1997 }
1998
1999 static void call_global_assign_hooks(struct expression *assign)
2000 {
2001 __pass_to_client(assign, GLOBAL_ASSIGNMENT_HOOK);
2002 }
2003
2004 static void fake_global_assign(struct symbol *sym)
2005 {
2006 struct expression *assign, *symbol;
2007
2008 if (get_real_base_type(sym)->type == SYM_ARRAY) {
2009 if (sym->initializer && sym->initializer->type == EXPR_INITIALIZER) {
2010 fake_element_assigns(sym, call_global_assign_hooks);
2011 } else if (sym->initializer) {
2012 symbol = symbol_expression(sym);
2013 assign = assign_expression(symbol, '=', sym->initializer);
2014 __pass_to_client(assign, GLOBAL_ASSIGNMENT_HOOK);
2015 } else {
2016 fake_element_assigns_helper(symbol_expression(sym), NULL, call_global_assign_hooks);
2017 }
2018 } else if (get_real_base_type(sym)->type == SYM_STRUCT) {
2019 if (sym->initializer && sym->initializer->type == EXPR_INITIALIZER) {
2020 fake_member_assigns(sym, call_global_assign_hooks);
2021 } else if (sym->initializer) {
2022 symbol = symbol_expression(sym);
2023 assign = assign_expression(symbol, '=', sym->initializer);
2024 __pass_to_client(assign, GLOBAL_ASSIGNMENT_HOOK);
2025 } else {
2026 fake_member_assigns_helper(symbol_expression(sym), NULL, call_global_assign_hooks);
2027 }
2028 } else {
2029 symbol = symbol_expression(sym);
2030 if (sym->initializer) {
2031 assign = assign_expression(symbol, '=', sym->initializer);
2032 __split_expr(assign);
2033 } else {
2034 assign = assign_expression(symbol, '=', zero_expr());
2035 }
2036 __pass_to_client(assign, GLOBAL_ASSIGNMENT_HOOK);
2037 }
2038 }
2039
2040 static void start_function_definition(struct symbol *sym)
2041 {
2042 __in_function_def = 1;
2043 __pass_to_client(sym, FUNC_DEF_HOOK);
2044 __in_function_def = 0;
2045 __pass_to_client(sym, AFTER_DEF_HOOK);
2046
2047 }
2048
2049 static void parse_fn_statements(struct symbol *base)
2050 {
2051 __split_stmt(base->stmt);
2052 __split_stmt(base->inline_stmt);
2053 }
2054
2055 void add_function_data(unsigned long *fn_data)
2056 {
2057 __add_ptr_list(&fn_data_list, fn_data);
2058 }
2059
2060 static void clear_function_data(void)
2061 {
2062 unsigned long *tmp;
2063
2064 FOR_EACH_PTR(fn_data_list, tmp) {
2065 *tmp = 0;
2066 } END_FOR_EACH_PTR(tmp);
2067 }
2068
2069 static void record_func_time(void)
2070 {
2071 struct timeval stop;
2072 int func_time;
2073 char buf[32];
2074
2075 gettimeofday(&stop, NULL);
2076 func_time = stop.tv_sec - fn_start_time.tv_sec;
2077 snprintf(buf, sizeof(buf), "%d", func_time);
2078 sql_insert_return_implies(FUNC_TIME, 0, "", buf);
2079 if (option_time && func_time > 2) {
2080 final_pass++;
2081 sm_msg("func_time: %d", func_time);
2082 final_pass--;
2083 }
2084 }
2085
2086 static void split_function(struct symbol *sym)
2087 {
2088 struct symbol *base_type = get_base_type(sym);
2089
2090 if (!base_type->stmt && !base_type->inline_stmt)
2091 return;
2092
2093 gettimeofday(&outer_fn_start_time, NULL);
2094 gettimeofday(&fn_start_time, NULL);
2095 cur_func_sym = sym;
2096 if (sym->ident)
2097 cur_func = sym->ident->name;
2098 if (option_process_function && cur_func &&
2099 strcmp(option_process_function, cur_func) != 0)
2100 return;
2101 set_position(sym->pos);
2102 clear_function_data();
2103 loop_count = 0;
2104 last_goto_statement_handled = 0;
2105 sm_debug("new function: %s\n", cur_func);
2106 __stree_id = 0;
2107 if (option_two_passes) {
2108 __unnullify_path();
2109 loop_num = 0;
2110 final_pass = 0;
2111 start_function_definition(sym);
2112 parse_fn_statements(base_type);
2113 do_scope_hooks();
2114 nullify_path();
2115 }
2116 __unnullify_path();
2117 loop_num = 0;
2118 final_pass = 1;
2119 start_function_definition(sym);
2120 parse_fn_statements(base_type);
2121 if (!__path_is_null() &&
2122 cur_func_return_type() == &void_ctype &&
2123 !__bail_on_rest_of_function) {
2124 __call_all_scope_hooks();
2125 __pass_to_client(NULL, RETURN_HOOK);
2126 nullify_path();
2127 }
2128 __pass_to_client(sym, END_FUNC_HOOK);
2129 __free_scope_hooks();
2130 __pass_to_client(sym, AFTER_FUNC_HOOK);
2131 sym->parsed = true;
2132
2133 clear_all_states();
2134
2135 record_func_time();
2136
2137 cur_func_sym = NULL;
2138 cur_func = NULL;
2139 free_data_info_allocs();
2140 free_expression_stack(&switch_expr_stack);
2141 __free_ptr_list((struct ptr_list **)&big_statement_stack);
2142 __bail_on_rest_of_function = 0;
2143 }
2144
2145 static void save_flow_state(void)
2146 {
2147 unsigned long *tmp;
2148
2149 __add_ptr_list(&backup, INT_PTR(loop_num << 2));
2150 __add_ptr_list(&backup, INT_PTR(loop_count << 2));
2151 __add_ptr_list(&backup, INT_PTR(final_pass << 2));
2152
2153 __add_ptr_list(&backup, big_statement_stack);
2154 __add_ptr_list(&backup, big_expression_stack);
2155 __add_ptr_list(&backup, big_condition_stack);
2156 __add_ptr_list(&backup, switch_expr_stack);
2157
2158 __add_ptr_list(&backup, cur_func_sym);
2159
2160 __add_ptr_list(&backup, parsed_calls);
2161
2162 __add_ptr_list(&backup, __prev_stmt);
2163 __add_ptr_list(&backup, __cur_stmt);
2164 __add_ptr_list(&backup, __next_stmt);
2165
2166 FOR_EACH_PTR(fn_data_list, tmp) {
2167 __add_ptr_list(&backup, (void *)*tmp);
2168 } END_FOR_EACH_PTR(tmp);
2169 }
2170
2171 static void *pop_backup(void)
2172 {
2173 void *ret;
2174
2175 ret = last_ptr_list(backup);
2176 delete_ptr_list_last(&backup);
2177 return ret;
2178 }
2179
2180 static void restore_flow_state(void)
2181 {
2182 unsigned long *tmp;
2183
2184 FOR_EACH_PTR_REVERSE(fn_data_list, tmp) {
2185 *tmp = (unsigned long)pop_backup();
2186 } END_FOR_EACH_PTR_REVERSE(tmp);
2187
2188 __next_stmt = pop_backup();
2189 __cur_stmt = pop_backup();
2190 __prev_stmt = pop_backup();
2191
2192 parsed_calls = pop_backup();
2193
2194 cur_func_sym = pop_backup();
2195 switch_expr_stack = pop_backup();
2196 big_condition_stack = pop_backup();
2197 big_expression_stack = pop_backup();
2198 big_statement_stack = pop_backup();
2199 final_pass = PTR_INT(pop_backup()) >> 2;
2200 loop_count = PTR_INT(pop_backup()) >> 2;
2201 loop_num = PTR_INT(pop_backup()) >> 2;
2202 }
2203
2204 void parse_inline(struct expression *call)
2205 {
2206 struct symbol *base_type;
2207 char *cur_func_bak = cur_func; /* not aligned correctly for backup */
2208 struct timeval time_backup = fn_start_time;
2209 struct expression *orig_inline = __inline_fn;
2210 int orig_budget;
2211
2212 if (out_of_memory() || taking_too_long())
2213 return;
2214
2215 if (already_parsed_call(call))
2216 return;
2217
2218 save_flow_state();
2219
2220 __pass_to_client(call, INLINE_FN_START);
2221 final_pass = 0; /* don't print anything */
2222 __inline_fn = call;
2223 orig_budget = inline_budget;
2224 inline_budget = inline_budget - 5;
2225
2226 base_type = get_base_type(call->fn->symbol);
2227 cur_func_sym = call->fn->symbol;
2228 if (call->fn->symbol->ident)
2229 cur_func = call->fn->symbol->ident->name;
2230 else
2231 cur_func = NULL;
2232 set_position(call->fn->symbol->pos);
2233
2234 save_all_states();
2235 big_statement_stack = NULL;
2236 big_expression_stack = NULL;
2237 big_condition_stack = NULL;
2238 switch_expr_stack = NULL;
2239 parsed_calls = NULL;
2240
2241 sm_debug("inline function: %s\n", cur_func);
2242 __unnullify_path();
2243 clear_function_data();
2244 loop_num = 0;
2245 loop_count = 0;
2246 start_function_definition(call->fn->symbol);
2247 parse_fn_statements(base_type);
2248 if (!__path_is_null() &&
2249 cur_func_return_type() == &void_ctype &&
2250 !__bail_on_rest_of_function) {
2251 __call_all_scope_hooks();
2252 __pass_to_client(NULL, RETURN_HOOK);
2253 nullify_path();
2254 }
2255 __pass_to_client(call->fn->symbol, END_FUNC_HOOK);
2256 __free_scope_hooks();
2257 __pass_to_client(call->fn->symbol, AFTER_FUNC_HOOK);
2258 call->fn->symbol->parsed = true;
2259
2260 free_expression_stack(&switch_expr_stack);
2261 __free_ptr_list((struct ptr_list **)&big_statement_stack);
2262 nullify_path();
2263 free_goto_stack();
2264
2265 restore_flow_state();
2266 fn_start_time = time_backup;
2267 cur_func = cur_func_bak;
2268
2269 restore_all_states();
2270 set_position(call->pos);
2271 __inline_fn = orig_inline;
2272 inline_budget = orig_budget;
2273 __pass_to_client(call, INLINE_FN_END);
2274 }
2275
2276 static struct symbol_list *inlines_called;
2277 static void add_inline_function(struct symbol *sym)
2278 {
2279 static struct symbol_list *already_added;
2280 struct symbol *tmp;
2281
2282 FOR_EACH_PTR(already_added, tmp) {
2283 if (tmp == sym)
2284 return;
2285 } END_FOR_EACH_PTR(tmp);
2286
2287 add_ptr_list(&already_added, sym);
2288 add_ptr_list(&inlines_called, sym);
2289 }
2290
2291 static void process_inlines(void)
2292 {
2293 struct symbol *tmp;
2294
2295 FOR_EACH_PTR(inlines_called, tmp) {
2296 split_function(tmp);
2297 } END_FOR_EACH_PTR(tmp);
2298 free_ptr_list(&inlines_called);
2299 }
2300
2301 static struct symbol *get_last_scoped_symbol(struct symbol_list *big_list, int use_static)
2302 {
2303 struct symbol *sym;
2304
2305 FOR_EACH_PTR_REVERSE(big_list, sym) {
2306 if (!sym->scope)
2307 continue;
2308 if (use_static && sym->ctype.modifiers & MOD_STATIC)
2309 return sym;
2310 if (!use_static && !(sym->ctype.modifiers & MOD_STATIC))
2311 return sym;
2312 } END_FOR_EACH_PTR_REVERSE(sym);
2313
2314 return NULL;
2315 }
2316
2317 static bool interesting_function(struct symbol *sym)
2318 {
2319 static int prev_stream = -1;
2320 static bool prev_answer;
2321 const char *filename;
2322 int len;
2323
2324 if (!(sym->ctype.modifiers & MOD_INLINE))
2325 return true;
2326
2327 if (sym->pos.stream == prev_stream)
2328 return prev_answer;
2329
2330 prev_stream = sym->pos.stream;
2331 prev_answer = false;
2332
2333 filename = stream_name(sym->pos.stream);
2334 len = strlen(filename);
2335 if (len > 0 && filename[len - 1] == 'c')
2336 prev_answer = true;
2337 return prev_answer;
2338 }
2339
2340 static void split_inlines_in_scope(struct symbol *sym)
2341 {
2342 struct symbol *base;
2343 struct symbol_list *scope_list;
2344 int stream;
2345
2346 scope_list = sym->scope->symbols;
2347 stream = sym->pos.stream;
2348
2349 /* find the last static symbol in the file */
2350 FOR_EACH_PTR_REVERSE(scope_list, sym) {
2351 if (sym->pos.stream != stream)
2352 continue;
2353 if (sym->type != SYM_NODE)
2354 continue;
2355 base = get_base_type(sym);
2356 if (!base)
2357 continue;
2358 if (base->type != SYM_FN)
2359 continue;
2360 if (!base->inline_stmt)
2361 continue;
2362 if (!interesting_function(sym))
2363 continue;
2364 add_inline_function(sym);
2365 } END_FOR_EACH_PTR_REVERSE(sym);
2366
2367 process_inlines();
2368 }
2369
2370 static void split_inlines(struct symbol_list *sym_list)
2371 {
2372 struct symbol *sym;
2373
2374 sym = get_last_scoped_symbol(sym_list, 0);
2375 if (sym)
2376 split_inlines_in_scope(sym);
2377 sym = get_last_scoped_symbol(sym_list, 1);
2378 if (sym)
2379 split_inlines_in_scope(sym);
2380 }
2381
2382 static struct stree *clone_estates_perm(struct stree *orig)
2383 {
2384 struct stree *ret = NULL;
2385 struct sm_state *tmp;
2386
2387 FOR_EACH_SM(orig, tmp) {
2388 set_state_stree_perm(&ret, tmp->owner, tmp->name, tmp->sym, clone_estate_perm(tmp->state));
2389 } END_FOR_EACH_SM(tmp);
2390
2391 return ret;
2392 }
2393
2394 struct position last_pos;
2395 static void split_c_file_functions(struct symbol_list *sym_list)
2396 {
2397 struct symbol *sym;
2398
2399 __unnullify_path();
2400 FOR_EACH_PTR(sym_list, sym) {
2401 set_position(sym->pos);
2402 if (sym->type != SYM_NODE || get_base_type(sym)->type != SYM_FN) {
2403 __pass_to_client(sym, BASE_HOOK);
2404 fake_global_assign(sym);
2405 __pass_to_client(sym, DECLARATION_HOOK_AFTER);
2406 }
2407 } END_FOR_EACH_PTR(sym);
2408 global_states = clone_estates_perm(get_all_states_stree(SMATCH_EXTRA));
2409 nullify_path();
2410
2411 FOR_EACH_PTR(sym_list, sym) {
2412 set_position(sym->pos);
2413 last_pos = sym->pos;
2414 if (!interesting_function(sym))
2415 continue;
2416 if (sym->type == SYM_NODE && get_base_type(sym)->type == SYM_FN) {
2417 split_function(sym);
2418 process_inlines();
2419 }
2420 last_pos = sym->pos;
2421 } END_FOR_EACH_PTR(sym);
2422 split_inlines(sym_list);
2423 __pass_to_client(sym_list, END_FILE_HOOK);
2424 }
2425
2426 static int final_before_fake;
2427 void init_fake_env(void)
2428 {
2429 if (!in_fake_env)
2430 final_before_fake = final_pass;
2431 in_fake_env++;
2432 __push_fake_cur_stree();
2433 final_pass = 0;
2434 }
2435
2436 void end_fake_env(void)
2437 {
2438 __free_fake_cur_stree();
2439 in_fake_env--;
2440 if (!in_fake_env)
2441 final_pass = final_before_fake;
2442 }
2443
2444 static void open_output_files(char *base_file)
2445 {
2446 char buf[256];
2447
2448 snprintf(buf, sizeof(buf), "%s.smatch", base_file);
2449 sm_outfd = fopen(buf, "w");
2450 if (!sm_outfd)
2451 sm_fatal("Cannot open %s", buf);
2452
2453 if (!option_info)
2454 return;
2455
2456 snprintf(buf, sizeof(buf), "%s.smatch.sql", base_file);
2457 sql_outfd = fopen(buf, "w");
2458 if (!sql_outfd)
2459 sm_fatal("Error: Cannot open %s", buf);
2460
2461 snprintf(buf, sizeof(buf), "%s.smatch.caller_info", base_file);
2462 caller_info_fd = fopen(buf, "w");
2463 if (!caller_info_fd)
2464 sm_fatal("Error: Cannot open %s", buf);
2465 }
2466
2467 void smatch(struct string_list *filelist)
2468 {
2469 struct symbol_list *sym_list;
2470 struct timeval stop, start;
2471 char *path;
2472 int len;
2473
2474 gettimeofday(&start, NULL);
2475
2476 FOR_EACH_PTR_NOTAG(filelist, base_file) {
2477 path = getcwd(NULL, 0);
2478 free(full_base_file);
2479 if (path) {
2480 len = strlen(path) + 1 + strlen(base_file) + 1;
2481 full_base_file = malloc(len);
2482 snprintf(full_base_file, len, "%s/%s", path, base_file);
2483 } else {
2484 full_base_file = alloc_string(base_file);
2485 }
2486 if (option_file_output)
2487 open_output_files(base_file);
2488 base_file_stream = input_stream_nr;
2489 sym_list = sparse_keep_tokens(base_file);
2490 split_c_file_functions(sym_list);
2491 } END_FOR_EACH_PTR_NOTAG(base_file);
2492
2493 gettimeofday(&stop, NULL);
2494
2495 set_position(last_pos);
2496 final_pass = 1;
2497 if (option_time)
2498 sm_msg("time: %lu", stop.tv_sec - start.tv_sec);
2499 if (option_mem)
2500 sm_msg("mem: %luKb", get_max_memory());
2501 }
Static analysis for C