2 * Copyright (C) 2009 Dan Carpenter.
4 * This program is free software; you can redistribute it and/or
5 * modify it under the terms of the GNU General Public License
6 * as published by the Free Software Foundation; either version 2
7 * of the License, or (at your option) any later version.
9 * This program is distributed in the hope that it will be useful,
10 * but WITHOUT ANY WARRANTY; without even the implied warranty of
11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12 * GNU General Public License for more details.
14 * You should have received a copy of the GNU General Public License
15 * along with this program; if not, see http://www.gnu.org/copyleft/gpl.txt
19 * There are several types of function hooks.
21 * The param_key hooks are probably the right things to use going forward.
22 * They give you a name/sym pair so it means less code in the checks.
24 * The add_function_hook() functions are trigger for every call. The
25 * "return_implies" are triggered for specific return ranges. The "exact"
26 * variants will be triggered if it's *definitely* in the range where the
27 * others will be triggered if it's *possibly* in the range. The "late"
28 * variants will be triggered after the others have run.
30 * There are a few miscellaneous things like add_function_assign_hook() and
31 * add_macro_assign_hook() which are only triggered for assignments. The
32 * add_implied_return_hook() let's you manually adjust the return range.
35 * add_function_param_key_hook_early()
36 * add_function_param_key_hook()
37 * add_function_param_key_hook_late()
38 * add_param_key_expr_hook()
39 * add_function_hook_early()
42 * Just for some return ranges:
43 * return_implies_param_key()
44 * return_implies_param_key_expr()
45 * return_implies_param_key_exact()
46 * return_implies_state()
47 * select_return_param_key() (It's weird that this is not in smatch_db.c)
50 * add_function_assign_hook()
52 * For Macro Assignments:
53 * add_macro_assign_hook()
55 * Manipulate the return range.
56 * add_implied_return_hook()
64 #include "smatch_slist.h"
65 #include "smatch_extra.h"
66 #include "smatch_function_hashtable.h"
67 #include "smatch_expression_stacks.h"
71 struct data_range
*range
;
74 implication_hook
*ranged
;
75 implied_return_hook
*implied_return
;
81 ALLOCATOR(fcall_back
, "call backs");
82 DECLARE_PTR_LIST(call_back_list
, struct fcall_back
);
84 DEFINE_FUNCTION_HASHTABLE_STATIC(callback
, struct fcall_back
, struct call_back_list
);
85 static struct hashtable
*func_hash
;
87 int __in_fake_parameter_assign
;
102 struct param_key_data
{
103 param_key_hook
*call_back
;
111 expr_func
*call_back
;
116 struct return_implies_callback
{
120 return_implies_hook
*callback
;
121 param_key_hook
*pk_callback
;
124 ALLOCATOR(return_implies_callback
, "return_implies callbacks");
125 DECLARE_PTR_LIST(db_implies_list
, struct return_implies_callback
);
126 static struct db_implies_list
*db_return_states_list
;
128 static struct void_fn_list
*return_states_before
;
129 static struct void_fn_list
*return_states_after
;
130 static struct string_hook_list
*return_string_hooks
;
132 struct db_callback_info
{
135 struct expression
*expr
;
136 struct range_list
*rl
;
139 struct stree
*implied
;
140 struct db_implies_list
*callbacks
;
141 struct db_implies_list
*called
;
147 struct smatch_state
*ret_state
;
148 struct expression
*var_expr
;
149 struct expression_list
*fake_param_assign_stack
;
153 static struct expression_list
*fake_calls
;
155 void add_fake_call_after_return(struct expression
*call
)
157 add_ptr_list(&fake_calls
, call
);
160 static void parse_fake_calls(void)
162 struct expression_list
*list
;
163 struct expression
*call
;
168 FOR_EACH_PTR(list
, call
) {
170 } END_FOR_EACH_PTR(call
);
172 __free_ptr_list((struct ptr_list
**)&list
);
175 static struct fcall_back
*alloc_fcall_back(int type
, void *call_back
,
178 struct fcall_back
*cb
;
180 cb
= __alloc_fcall_back(0);
182 cb
->u
.call_back
= call_back
;
187 static const char *get_fn_name(struct expression
*fn
)
192 if (fn
->type
== EXPR_SYMBOL
&& fn
->symbol
)
193 return fn
->symbol
->ident
->name
;
194 return get_member_name(fn
);
197 static struct call_back_list
*get_call_backs(const char *fn_name
)
201 return search_callback(func_hash
, (char *)fn_name
);
204 void add_function_hook(const char *look_for
, func_hook
*call_back
, void *info
)
206 struct fcall_back
*cb
;
208 cb
= alloc_fcall_back(REGULAR_CALL
, call_back
, info
);
209 add_callback(func_hash
, look_for
, cb
);
212 void add_function_hook_early(const char *look_for
, func_hook
*call_back
, void *info
)
214 struct fcall_back
*cb
;
216 cb
= alloc_fcall_back(REGULAR_CALL_EARLY
, call_back
, info
);
217 add_callback(func_hash
, look_for
, cb
);
220 void add_function_hook_late(const char *look_for
, func_hook
*call_back
, void *info
)
222 struct fcall_back
*cb
;
224 cb
= alloc_fcall_back(REGULAR_CALL_LATE
, call_back
, info
);
225 add_callback(func_hash
, look_for
, cb
);
228 void add_function_assign_hook(const char *look_for
, func_hook
*call_back
,
231 struct fcall_back
*cb
;
233 cb
= alloc_fcall_back(ASSIGN_CALL
, call_back
, info
);
234 add_callback(func_hash
, look_for
, cb
);
237 static void register_funcs_from_file_helper(const char *file
,
238 func_hook
*call_back
, void *info
,
245 snprintf(name
, sizeof(name
), "%s.%s", option_project_str
, file
);
246 token
= get_tokens_file(name
);
249 if (token_type(token
) != TOKEN_STREAMBEGIN
)
252 while (token_type(token
) != TOKEN_STREAMEND
) {
253 if (token_type(token
) != TOKEN_IDENT
)
255 func
= show_ident(token
->ident
);
257 add_function_assign_hook(func
, call_back
, info
);
259 add_function_hook(func
, call_back
, info
);
265 void register_func_hooks_from_file(const char *file
,
266 func_hook
*call_back
, void *info
)
268 register_funcs_from_file_helper(file
, call_back
, info
, false);
271 void register_assign_hooks_from_file(const char *file
,
272 func_hook
*call_back
, void *info
)
274 register_funcs_from_file_helper(file
, call_back
, info
, true);
277 void add_implied_return_hook(const char *look_for
,
278 implied_return_hook
*call_back
,
281 struct fcall_back
*cb
;
283 cb
= alloc_fcall_back(IMPLIED_RETURN
, call_back
, info
);
284 add_callback(func_hash
, look_for
, cb
);
287 void add_cull_hook(const char *look_for
, cull_hook
*call_back
, void *info
)
289 struct fcall_back
*cb
;
291 cb
= alloc_fcall_back(CULL_HOOK
, call_back
, info
);
292 add_callback(func_hash
, look_for
, cb
);
295 static void db_helper(struct expression
*expr
, param_key_hook
*call_back
, int param
, const char *key
, void *info
)
301 call_back(expr
, key
, NULL
, info
);
305 name
= get_name_sym_from_param_key(expr
, param
, key
, &sym
);
309 call_back(expr
, name
, sym
, info
);
314 static struct expression
*get_parent_assignment(struct expression
*expr
)
316 struct expression
*parent
;
319 if (expr
->type
== EXPR_ASSIGNMENT
)
322 parent
= expr_get_fake_parent_expr(expr
);
323 if (parent
&& parent
->type
== EXPR_ASSIGNMENT
)
328 parent
= expr_get_parent_expr(parent
);
329 if (!parent
|| ++cnt
>= 5)
331 if (parent
->type
== EXPR_CAST
)
333 if (parent
->type
== EXPR_PREOP
&& parent
->op
== '(')
338 if (parent
&& parent
->type
== EXPR_ASSIGNMENT
)
343 static void param_key_function(const char *fn
, struct expression
*expr
, void *data
)
345 struct param_key_data
*pkd
= data
;
346 struct expression
*parent
;
348 parent
= get_parent_assignment(expr
);
352 db_helper(expr
, pkd
->call_back
, pkd
->param
, pkd
->key
, pkd
->info
);
355 static void param_key_expr_function(const char *fn
, struct expression
*expr
, void *data
)
357 struct param_key_data
*pkd
= data
;
358 struct expression
*parent
, *arg
;
360 parent
= get_parent_assignment(expr
);
364 arg
= gen_expr_from_param_key(expr
, pkd
->param
, pkd
->key
);
370 static void param_key_implies_function(const char *fn
, struct expression
*call_expr
,
371 struct expression
*assign_expr
, void *data
)
373 struct param_key_data
*pkd
= data
;
375 db_helper(assign_expr
?: call_expr
, pkd
->call_back
, pkd
->param
, pkd
->key
, pkd
->info
);
378 static void param_key_expr_implies_function(const char *fn
, struct expression
*call_expr
,
379 struct expression
*assign_expr
, void *data
)
381 struct param_key_data
*pkd
= data
;
382 struct expression
*arg
;
384 arg
= gen_expr_from_param_key(assign_expr
?: call_expr
, pkd
->param
, pkd
->key
);
390 static struct param_key_data
*alloc_pkd(param_key_hook
*call_back
, int param
, const char *key
, void *info
)
392 struct param_key_data
*pkd
;
394 pkd
= malloc(sizeof(*pkd
));
395 pkd
->call_back
= call_back
;
397 pkd
->key
= alloc_string(key
);
403 static struct param_key_data
*alloc_pked(expr_func
*call_back
, int param
, const char *key
, void *info
)
405 struct param_key_data
*pkd
;
407 pkd
= alloc_pkd(NULL
, param
, key
, info
);
408 pkd
->expr_fn
= call_back
;
413 void add_function_param_key_hook_early(const char *look_for
, param_key_hook
*call_back
,
414 int param
, const char *key
, void *info
)
416 struct param_key_data
*pkd
;
418 pkd
= alloc_pkd(call_back
, param
, key
, info
);
419 add_function_hook_early(look_for
, ¶m_key_function
, pkd
);
422 void add_function_param_key_hook(const char *look_for
, param_key_hook
*call_back
,
423 int param
, const char *key
, void *info
)
425 struct param_key_data
*pkd
;
427 pkd
= alloc_pkd(call_back
, param
, key
, info
);
429 add_function_assign_hook(look_for
, ¶m_key_function
, pkd
);
431 add_function_hook(look_for
, ¶m_key_function
, pkd
);
434 void add_param_key_expr_hook(const char *look_for
, expr_func
*call_back
,
435 int param
, const char *key
, void *info
)
437 struct param_key_data
*pkd
;
439 pkd
= alloc_pked(call_back
, param
, key
, info
);
442 add_function_assign_hook(look_for
, ¶m_key_expr_function
, pkd
);
444 add_function_hook(look_for
, ¶m_key_expr_function
, pkd
);
447 void add_function_param_key_hook_late(const char *look_for
, param_key_hook
*call_back
,
448 int param
, const char *key
, void *info
)
450 struct param_key_data
*pkd
;
452 pkd
= alloc_pkd(call_back
, param
, key
, info
);
453 add_function_hook_late(look_for
, ¶m_key_function
, pkd
);
456 void return_implies_param_key(const char *look_for
, sval_t start
, sval_t end
,
457 param_key_hook
*call_back
,
458 int param
, const char *key
, void *info
)
460 struct param_key_data
*pkd
;
462 pkd
= alloc_pkd(call_back
, param
, key
, info
);
463 return_implies_state_sval(look_for
, start
, end
, ¶m_key_implies_function
, pkd
);
466 void return_implies_param_key_exact(const char *look_for
, sval_t start
, sval_t end
,
467 param_key_hook
*call_back
,
468 int param
, const char *key
, void *info
)
470 struct param_key_data
*pkd
;
472 pkd
= alloc_pkd(call_back
, param
, key
, info
);
473 return_implies_exact(look_for
, start
, end
, ¶m_key_implies_function
, pkd
);
476 void return_implies_param_key_expr(const char *look_for
, sval_t start
, sval_t end
,
477 expr_func
*call_back
,
478 int param
, const char *key
, void *info
)
480 struct param_key_data
*pkd
;
482 pkd
= alloc_pked(call_back
, param
, key
, info
);
483 return_implies_state_sval(look_for
, start
, end
, ¶m_key_expr_implies_function
, pkd
);
486 void add_macro_assign_hook(const char *look_for
, func_hook
*call_back
,
489 struct fcall_back
*cb
;
491 cb
= alloc_fcall_back(MACRO_ASSIGN
, call_back
, info
);
492 add_callback(func_hash
, look_for
, cb
);
495 void add_macro_assign_hook_extra(const char *look_for
, func_hook
*call_back
,
498 struct fcall_back
*cb
;
500 cb
= alloc_fcall_back(MACRO_ASSIGN_EXTRA
, call_back
, info
);
501 add_callback(func_hash
, look_for
, cb
);
504 void return_implies_state(const char *look_for
, long long start
, long long end
,
505 implication_hook
*call_back
, void *info
)
507 struct fcall_back
*cb
;
509 cb
= alloc_fcall_back(RANGED_CALL
, call_back
, info
);
510 cb
->range
= alloc_range_perm(ll_to_sval(start
), ll_to_sval(end
));
511 add_callback(func_hash
, look_for
, cb
);
514 void return_implies_state_sval(const char *look_for
, sval_t start
, sval_t end
,
515 implication_hook
*call_back
, void *info
)
517 struct fcall_back
*cb
;
519 cb
= alloc_fcall_back(RANGED_CALL
, call_back
, info
);
520 cb
->range
= alloc_range_perm(start
, end
);
521 add_callback(func_hash
, look_for
, cb
);
524 void return_implies_exact(const char *look_for
, sval_t start
, sval_t end
,
525 implication_hook
*call_back
, void *info
)
527 struct fcall_back
*cb
;
529 cb
= alloc_fcall_back(RANGED_EXACT
, call_back
, info
);
530 cb
->range
= alloc_range_perm(start
, end
);
531 add_callback(func_hash
, look_for
, cb
);
534 static struct return_implies_callback
*alloc_db_return_callback(int type
, bool param_key
, void *callback
)
536 struct return_implies_callback
*cb
;
538 cb
= __alloc_return_implies_callback(0);
540 cb
->param_key
= param_key
;
541 cb
->callback
= callback
;
546 void select_return_states_hook(int type
, return_implies_hook
*callback
)
548 struct return_implies_callback
*cb
;
550 cb
= alloc_db_return_callback(type
, false, callback
);
551 add_ptr_list(&db_return_states_list
, cb
);
554 static void call_db_return_callback(struct db_callback_info
*db_info
,
555 struct return_implies_callback
*cb
,
556 int param
, char *key
, char *value
)
559 db_helper(db_info
->expr
, cb
->pk_callback
, param
, key
, NULL
);
560 add_ptr_list(&db_info
->called
, cb
);
562 cb
->callback(db_info
->expr
, param
, key
, value
);
566 void select_return_param_key(int type
, param_key_hook
*callback
)
568 struct return_implies_callback
*cb
;
570 cb
= alloc_db_return_callback(type
, true, callback
);
571 add_ptr_list(&db_return_states_list
, cb
);
574 void select_return_states_before(void_fn
*fn
)
576 add_ptr_list(&return_states_before
, fn
);
579 void select_return_states_after(void_fn
*fn
)
581 add_ptr_list(&return_states_after
, fn
);
584 void add_return_string_hook(string_hook
*fn
)
586 add_ptr_list(&return_string_hooks
, fn
);
589 static bool call_call_backs(struct call_back_list
*list
, int type
,
590 const char *fn
, struct expression
*expr
)
592 struct fcall_back
*tmp
;
593 bool handled
= false;
595 FOR_EACH_PTR(list
, tmp
) {
596 if (tmp
->type
== type
) {
597 (tmp
->u
.call_back
)(fn
, expr
, tmp
->info
);
600 } END_FOR_EACH_PTR(tmp
);
605 static void call_function_hooks(struct expression
*expr
, enum fn_hook_type type
)
607 struct call_back_list
*call_backs
;
610 while (expr
->type
== EXPR_ASSIGNMENT
)
611 expr
= strip_expr(expr
->right
);
612 if (expr
->type
!= EXPR_CALL
)
615 fn_name
= get_fn_name(expr
->fn
);
616 call_backs
= get_call_backs(fn_name
);
620 call_call_backs(call_backs
, type
, fn_name
, expr
);
623 static void call_return_states_after_hooks(struct expression
*expr
)
625 call_void_fns(return_states_after
);
626 __pass_to_client(expr
, FUNCTION_CALL_HOOK_AFTER_DB
);
627 call_function_hooks(expr
, REGULAR_CALL_LATE
);
630 static void call_ranged_call_backs(struct call_back_list
*list
,
631 const char *fn
, struct expression
*call_expr
,
632 struct expression
*assign_expr
)
634 struct fcall_back
*tmp
;
636 FOR_EACH_PTR(list
, tmp
) {
637 (tmp
->u
.ranged
)(fn
, call_expr
, assign_expr
, tmp
->info
);
638 } END_FOR_EACH_PTR(tmp
);
641 static struct call_back_list
*get_same_ranged_call_backs(struct call_back_list
*list
,
642 struct data_range
*drange
)
644 struct call_back_list
*ret
= NULL
;
645 struct fcall_back
*tmp
;
647 FOR_EACH_PTR(list
, tmp
) {
648 if (tmp
->type
!= RANGED_CALL
&&
649 tmp
->type
!= RANGED_EXACT
)
651 if (ranges_equiv(tmp
->range
, drange
))
652 add_ptr_list(&ret
, tmp
);
653 } END_FOR_EACH_PTR(tmp
);
657 static bool in_list_exact_sval(struct range_list
*list
, struct data_range
*drange
)
659 struct data_range
*tmp
;
661 FOR_EACH_PTR(list
, tmp
) {
662 if (ranges_equiv(tmp
, drange
))
664 } END_FOR_EACH_PTR(tmp
);
669 * The assign_ranged_funcs() function is called when we have no data from the DB.
671 static bool assign_ranged_funcs(const char *fn
, struct expression
*expr
,
672 struct call_back_list
*call_backs
)
674 struct fcall_back
*tmp
;
678 struct smatch_state
*estate
;
679 struct stree
*tmp_stree
;
680 struct stree
*final_states
= NULL
;
681 struct range_list
*handled_ranges
= NULL
;
682 struct range_list
*unhandled_rl
;
683 struct call_back_list
*same_range_call_backs
= NULL
;
684 struct expression
*call
;
685 struct range_list
*rl
;
691 var_name
= expr_to_var_sym(expr
->left
, &sym
);
692 if (!var_name
|| !sym
)
695 call
= strip_expr(expr
->right
);
697 FOR_EACH_PTR(call_backs
, tmp
) {
698 if (tmp
->type
!= RANGED_CALL
&&
699 tmp
->type
!= RANGED_EXACT
)
702 if (in_list_exact_sval(handled_ranges
, tmp
->range
))
704 __push_fake_cur_stree();
705 tack_on(&handled_ranges
, tmp
->range
);
707 same_range_call_backs
= get_same_ranged_call_backs(call_backs
, tmp
->range
);
708 call_ranged_call_backs(same_range_call_backs
, fn
, expr
->right
, expr
);
709 __free_ptr_list((struct ptr_list
**)&same_range_call_backs
);
711 rl
= alloc_rl(tmp
->range
->min
, tmp
->range
->max
);
712 rl
= cast_rl(get_type(expr
->left
), rl
);
713 estate
= alloc_estate_rl(rl
);
714 set_extra_mod(var_name
, sym
, expr
->left
, estate
);
716 tmp_stree
= __pop_fake_cur_stree();
717 merge_fake_stree(&final_states
, tmp_stree
);
718 free_stree(&tmp_stree
);
720 } END_FOR_EACH_PTR(tmp
);
722 unhandled_rl
= rl_filter(alloc_whole_rl(get_type(call
)), handled_ranges
);
724 __push_fake_cur_stree();
725 rl
= cast_rl(get_type(expr
->left
), unhandled_rl
);
726 estate
= alloc_estate_rl(rl
);
727 set_extra_mod(var_name
, sym
, expr
->left
, estate
);
728 tmp_stree
= __pop_fake_cur_stree();
729 merge_fake_stree(&final_states
, tmp_stree
);
730 free_stree(&tmp_stree
);
733 FOR_EACH_SM(final_states
, sm
) {
735 } END_FOR_EACH_SM(sm
);
737 free_stree(&final_states
);
739 free_string(var_name
);
743 static void call_implies_callbacks(int comparison
, struct expression
*expr
, sval_t sval
, int left
, struct stree
**implied_true
, struct stree
**implied_false
)
745 struct call_back_list
*call_backs
;
746 struct fcall_back
*tmp
;
748 struct data_range
*value_range
;
749 struct stree
*true_states
= NULL
;
750 struct stree
*false_states
= NULL
;
751 struct stree
*tmp_stree
;
753 *implied_true
= NULL
;
754 *implied_false
= NULL
;
755 fn_name
= get_fn_name(expr
->fn
);
756 call_backs
= get_call_backs(fn_name
);
759 value_range
= alloc_range(sval
, sval
);
761 /* set true states */
762 __push_fake_cur_stree();
763 FOR_EACH_PTR(call_backs
, tmp
) {
764 if (tmp
->type
!= RANGED_CALL
&&
765 tmp
->type
!= RANGED_EXACT
)
767 if (!true_comparison_range_LR(comparison
, tmp
->range
, value_range
, left
))
769 (tmp
->u
.ranged
)(fn_name
, expr
, NULL
, tmp
->info
);
770 } END_FOR_EACH_PTR(tmp
);
771 tmp_stree
= __pop_fake_cur_stree();
772 merge_fake_stree(&true_states
, tmp_stree
);
773 free_stree(&tmp_stree
);
775 /* set false states */
776 __push_fake_cur_stree();
777 FOR_EACH_PTR(call_backs
, tmp
) {
778 if (tmp
->type
!= RANGED_CALL
&&
779 tmp
->type
!= RANGED_EXACT
)
781 if (!false_comparison_range_LR(comparison
, tmp
->range
, value_range
, left
))
783 (tmp
->u
.ranged
)(fn_name
, expr
, NULL
, tmp
->info
);
784 } END_FOR_EACH_PTR(tmp
);
785 tmp_stree
= __pop_fake_cur_stree();
786 merge_fake_stree(&false_states
, tmp_stree
);
787 free_stree(&tmp_stree
);
789 *implied_true
= true_states
;
790 *implied_false
= false_states
;
793 static void set_implied_states(struct db_callback_info
*db_info
)
797 FOR_EACH_SM(db_info
->implied
, sm
) {
799 } END_FOR_EACH_SM(sm
);
801 free_stree(&db_info
->implied
);
804 static void call_cull_hooks(struct db_callback_info
*db_info
, struct range_list
*rl
)
806 struct expression
*expr
= db_info
->expr
;
807 struct call_back_list
*call_backs
;
808 struct fcall_back
*tmp
;
811 while (expr
->type
== EXPR_ASSIGNMENT
)
812 expr
= strip_expr(expr
->right
);
813 if (expr
->type
!= EXPR_CALL
)
816 fn_name
= get_fn_name(expr
->fn
);
819 call_backs
= search_callback(func_hash
, (char *)fn_name
);
821 FOR_EACH_PTR(call_backs
, tmp
) {
822 if (tmp
->type
!= CULL_HOOK
)
824 if ((tmp
->u
.cull_hook
)(db_info
->expr
, rl
, tmp
->info
))
826 } END_FOR_EACH_PTR(tmp
);
829 static void store_return_state(struct db_callback_info
*db_info
, const char *ret_str
, struct smatch_state
*state
)
831 db_info
->ret_str
= alloc_sname(ret_str
),
832 db_info
->ret_state
= state
;
835 static struct expression_list
*unfaked_calls
;
837 struct expression
*get_unfaked_call(void)
839 return last_ptr_list((struct ptr_list
*)unfaked_calls
);
842 static void store_unfaked_call(struct expression
*expr
)
844 push_expression(&unfaked_calls
, expr
);
847 static void clear_unfaked_call(void)
849 delete_ptr_list_last((struct ptr_list
**)&unfaked_calls
);
852 void fake_param_assign_helper(struct expression
*call
, struct expression
*fake_assign
, bool shallow
)
854 store_unfaked_call(call
);
855 __in_fake_parameter_assign
++;
856 parse_assignment(fake_assign
, true);
857 __in_fake_parameter_assign
--;
858 clear_unfaked_call();
861 static bool fake_a_param_assignment(struct expression
*expr
, const char *ret_str
, struct smatch_state
*orig
)
863 struct expression
*arg
, *left
, *right
, *tmp
, *fake_assign
;
869 if (expr
->type
!= EXPR_ASSIGNMENT
|| expr
->op
!= '=')
874 while (right
->type
== EXPR_ASSIGNMENT
)
875 right
= strip_expr(right
->right
);
876 if (!right
|| right
->type
!= EXPR_CALL
)
879 p
= strchr(ret_str
, '[');
884 if (p
[0] == '=' && p
[1] == '=')
889 snprintf(buf
, sizeof(buf
), "%s", p
);
893 param
= strtol(p
, &p
, 10);
900 arg
= get_argument_from_call_expr(right
->args
, param
);
904 /* There should be a get_other_name() function which returns an expr */
905 tmp
= get_assigned_expr(arg
);
910 * This is a sanity check to prevent side effects from evaluating stuff
913 str
= expr_to_chunk_sym_vsl(arg
, NULL
, NULL
);
918 right
= gen_expression_from_key(arg
, buf
);
919 if (!right
) /* Mostly fails for binops like [$0 + 4032] */
921 fake_assign
= assign_expression(left
, '=', right
);
922 fake_param_assign_helper(expr
, fake_assign
, false);
925 * If the return is "0-65531[$0->nla_len - 4]" the faked expression
926 * is maybe (-4)-65531 but we know it is in the 0-65531 range so both
927 * parts have to be considered. We use _nomod() because it's not really
928 * another modification, it's just a clarification.
931 if (estate_rl(orig
)) {
932 struct smatch_state
*faked
;
933 struct range_list
*rl
;
935 faked
= get_extra_state(left
);
936 if (estate_rl(faked
)) {
937 rl
= rl_intersection(estate_rl(faked
), estate_rl(orig
));
939 set_extra_expr_nomod(left
, alloc_estate_rl(rl
));
946 static void fake_return_assignment(struct db_callback_info
*db_info
, int type
, int param
, char *key
, char *value
)
948 struct expression
*call
, *left
, *right
, *assign
;
951 if (type
!= PARAM_COMPARE
)
954 call
= db_info
->expr
;
955 while (call
&& call
->type
== EXPR_ASSIGNMENT
)
956 call
= strip_expr(call
->right
);
957 if (!call
|| call
->type
!= EXPR_CALL
)
960 // TODO: This only handles "$->foo = arg" and not "$->foo = arg->bar".
963 if (!value
|| strncmp(value
, "== $", 4) != 0)
965 if (!isdigit(value
[4]) || value
[5] != '\0')
967 right_param
= atoi(value
+ 4);
969 left
= gen_expr_from_param_key(db_info
->expr
, param
, key
);
972 right
= get_argument_from_call_expr(call
->args
, right_param
);
974 assign
= assign_expression(left
, '=', right
);
975 push_expression(&db_info
->fake_param_assign_stack
, assign
);
978 static void set_fresh_mtag_returns(struct db_callback_info
*db_info
)
980 struct expression
*expr
;
981 struct smatch_state
*state
;
983 if (!db_info
->ret_state
)
986 if (!db_info
->expr
||
987 db_info
->expr
->type
!= EXPR_ASSIGNMENT
||
988 db_info
->expr
->op
!= '=')
991 expr
= db_info
->expr
->left
;
993 state
= alloc_estate_rl(cast_rl(get_type(expr
), clone_rl(estate_rl(db_info
->ret_state
))));
994 state
= get_mtag_return(db_info
->expr
, state
);
998 set_real_absolute(expr
, state
);
999 set_extra_expr_mod(expr
, state
);
1002 static void set_return_assign_state(struct db_callback_info
*db_info
)
1004 struct expression
*expr
= db_info
->expr
->left
;
1005 struct expression
*fake_assign
;
1006 struct smatch_state
*state
;
1007 bool was_set
= false;
1009 if (!db_info
->ret_state
)
1012 state
= alloc_estate_rl(cast_rl(get_type(expr
), clone_rl(estate_rl(db_info
->ret_state
))));
1013 if (!fake_a_param_assignment(db_info
->expr
, db_info
->ret_str
, state
)) {
1014 set_extra_expr_mod(expr
, state
);
1018 while ((fake_assign
= pop_expression(&db_info
->fake_param_assign_stack
))) {
1019 struct range_list
*right
;
1022 * Originally, I tried to do this as a assignment to record that
1023 * a = frob(b) implies that "a->foo == b->foo" etc. But that
1024 * caused a problem because then it was recorded that "a->foo"
1025 * was modified and recorded as a PARAM_SET in the database.
1027 * So now, instead of faking an assignment we use
1028 * set_extra_expr_nomod() but it's still recorded as an
1029 * assignment in the ->fake_param_assign_stack for legacy
1030 * reasons and because it's a handy way to store a left/right
1034 get_absolute_rl(fake_assign
->right
, &right
);
1035 right
= cast_rl(get_type(fake_assign
->left
), right
);
1036 // FIXME: add some sanity checks
1037 // FIXME: preserve the sm state if possible
1038 set_extra_expr_nomod(fake_assign
->left
, alloc_estate_rl(right
));
1043 set_extra_expr_mod(expr
, state
);
1046 static void set_other_side_state(struct db_callback_info
*db_info
)
1048 struct expression
*expr
= db_info
->var_expr
;
1049 struct smatch_state
*state
;
1051 if (!db_info
->ret_state
)
1054 // TODO: faked_assign set ==$ equiv here
1056 state
= alloc_estate_rl(cast_rl(get_type(expr
), clone_rl(estate_rl(db_info
->ret_state
))));
1057 set_extra_expr_nomod(expr
, state
);
1058 db_info
->ret_state
= NULL
;
1059 db_info
->ret_str
= NULL
;
1062 static void handle_ret_equals_param(char *ret_string
, struct range_list
*rl
, struct expression
*call
)
1066 struct expression
*arg
;
1067 struct range_list
*orig
;
1069 // TODO: faked_assign This needs to be handled in the assignment code
1071 str
= strstr(ret_string
, "==$");
1075 param
= strtoll(str
, NULL
, 10);
1076 arg
= get_argument_from_call_expr(call
->args
, param
);
1079 get_absolute_rl(arg
, &orig
);
1080 rl
= rl_intersection(orig
, rl
);
1083 set_extra_expr_nomod(arg
, alloc_estate_rl(rl
));
1086 static bool impossible_limit(struct db_callback_info
*db_info
, int param
, char *key
, char *value
)
1088 struct expression
*expr
= db_info
->expr
;
1089 struct expression
*arg
;
1090 struct smatch_state
*state
;
1091 struct range_list
*passed
;
1092 struct range_list
*limit
;
1093 struct symbol
*compare_type
;
1095 while (expr
->type
== EXPR_ASSIGNMENT
)
1096 expr
= strip_expr(expr
->right
);
1097 if (expr
->type
!= EXPR_CALL
)
1100 arg
= get_argument_from_call_expr(expr
->args
, param
);
1104 if (strcmp(key
, "$") == 0) {
1105 if (!get_implied_rl(arg
, &passed
))
1108 compare_type
= get_arg_type(expr
->fn
, param
);
1113 name
= get_variable_from_key(arg
, key
, &sym
);
1117 state
= get_state(SMATCH_EXTRA
, name
, sym
);
1122 passed
= estate_rl(state
);
1123 if (!passed
|| is_whole_rl(passed
)) {
1128 compare_type
= get_member_type_from_key(arg
, key
);
1131 passed
= cast_rl(compare_type
, passed
);
1132 call_results_to_rl(expr
, compare_type
, value
, &limit
);
1133 if (!limit
|| is_whole_rl(limit
))
1135 if (possibly_true_rl(passed
, SPECIAL_EQUAL
, limit
))
1137 if (option_debug
|| local_debug
|| debug_db
)
1138 sm_msg("impossible: %d '%s' limit '%s' == '%s' return='%s'", param
, key
, show_rl(passed
), value
, db_info
->ret_str
);
1142 static bool is_impossible_data(int type
, struct db_callback_info
*db_info
, int param
, char *key
, char *value
)
1144 if (type
== PARAM_LIMIT
&& impossible_limit(db_info
, param
, key
, value
))
1146 if (type
== COMPARE_LIMIT
&& param_compare_limit_is_impossible(db_info
->expr
, param
, key
, value
)) {
1147 if (local_debug
|| debug_db
)
1148 sm_msg("param_compare_limit_is_impossible: %d %s %s", param
, key
, value
);
1154 static bool func_type_mismatch(struct expression
*expr
, const char *value
)
1156 struct symbol
*type
;
1158 /* This makes faking returns easier */
1159 if (!value
|| value
[0] == '\0')
1162 while (expr
->type
== EXPR_ASSIGNMENT
)
1163 expr
= strip_expr(expr
->right
);
1166 * Short cut: We only care about function pointers that are struct
1170 if (expr
->fn
->type
== EXPR_SYMBOL
)
1173 type
= get_type(expr
->fn
);
1176 if (type
->type
== SYM_PTR
)
1177 type
= get_real_base_type(type
);
1179 if (strcmp(type_to_str(type
), value
) == 0)
1185 static void process_return_states(struct db_callback_info
*db_info
)
1187 struct stree
*stree
;
1189 set_implied_states(db_info
);
1190 set_fresh_mtag_returns(db_info
);
1192 free_ptr_list(&db_info
->called
);
1193 stree
= __pop_fake_cur_stree();
1195 sm_msg("States from DB: %s expr='%s' ret_str='%s' rl='%s' state='%s'",
1196 db_info
->cull
? "Culling" : "Merging",
1197 expr_to_str(db_info
->expr
),
1198 db_info
->ret_str
, show_rl(db_info
->rl
),
1199 db_info
->ret_state
? db_info
->ret_state
->name
: "<none>");
1200 __print_stree(stree
);
1203 if (!db_info
->cull
) {
1204 merge_fake_stree(&db_info
->stree
, stree
);
1205 db_info
->states_merged
= true;
1209 db_info
->ret_state
= NULL
;
1210 db_info
->ret_str
= NULL
;
1213 static int db_compare_callback(void *_info
, int argc
, char **argv
, char **azColName
)
1215 struct db_callback_info
*db_info
= _info
;
1216 struct range_list
*var_rl
= db_info
->rl
;
1217 struct range_list
*ret_range
;
1219 char *ret_str
, *key
, *value
;
1220 struct return_implies_callback
*tmp
;
1227 return_id
= atoi(argv
[0]);
1229 type
= atoi(argv
[2]);
1230 param
= atoi(argv
[3]);
1234 db_info
->has_states
= 1;
1235 if (db_info
->prev_return_id
!= -1 && type
== INTERNAL
) {
1236 set_other_side_state(db_info
);
1237 process_return_states(db_info
);
1238 __push_fake_cur_stree();
1241 db_info
->prev_return_id
= return_id
;
1243 if (type
== INTERNAL
&& func_type_mismatch(db_info
->expr
, value
))
1247 if (type
== CULL_PATH
) {
1252 if (is_impossible_data(type
, db_info
, param
, key
, value
)) {
1257 call_results_to_rl(db_info
->expr
, get_type(strip_expr(db_info
->expr
)), ret_str
, &ret_range
);
1258 ret_range
= cast_rl(get_type(db_info
->expr
), ret_range
);
1260 ret_range
= alloc_whole_rl(get_type(db_info
->expr
));
1262 comparison
= db_info
->comparison
;
1264 comparison
= flip_comparison(comparison
);
1266 if (db_info
->true_side
) {
1267 if (!possibly_true_rl(var_rl
, comparison
, ret_range
))
1269 if (type
== PARAM_LIMIT
)
1270 param_limit_implications(db_info
->expr
, param
, key
, value
, &db_info
->implied
);
1271 else if (type
> PARAM_LIMIT
)
1272 set_implied_states(db_info
);
1273 filter_by_comparison(&var_rl
, comparison
, ret_range
);
1274 filter_by_comparison(&ret_range
, flip_comparison(comparison
), var_rl
);
1276 if (!possibly_false_rl(var_rl
, comparison
, ret_range
))
1278 if (type
== PARAM_LIMIT
)
1279 param_limit_implications(db_info
->expr
, param
, key
, value
, &db_info
->implied
);
1280 else if (type
> PARAM_LIMIT
)
1281 set_implied_states(db_info
);
1282 filter_by_comparison(&var_rl
, negate_comparison(comparison
), ret_range
);
1283 filter_by_comparison(&ret_range
, flip_comparison(negate_comparison(comparison
)), var_rl
);
1286 handle_ret_equals_param(ret_str
, ret_range
, db_info
->expr
);
1288 if (type
== INTERNAL
) {
1289 set_state(-1, "unnull_path", NULL
, &true_state
);
1290 call_string_hooks(return_string_hooks
, db_info
->expr
, ret_str
);
1291 call_cull_hooks(db_info
, ret_range
);
1292 store_return_state(db_info
, ret_str
, alloc_estate_rl(clone_rl(var_rl
)));
1295 FOR_EACH_PTR(db_info
->callbacks
, tmp
) {
1296 if (tmp
->type
== type
)
1297 call_db_return_callback(db_info
, tmp
, param
, key
, value
);
1298 } END_FOR_EACH_PTR(tmp
);
1300 fake_return_assignment(db_info
, type
, param
, key
, value
);
1305 static void compare_db_return_states_callbacks(struct expression
*left
, int comparison
, struct expression
*right
, struct stree
*implied_true
, struct stree
*implied_false
)
1307 struct stree
*orig_states
;
1308 struct stree
*true_states
;
1309 struct stree
*false_states
;
1310 struct sm_state
*sm
;
1311 struct db_callback_info db_info
= {};
1312 struct expression
*var_expr
;
1313 struct expression
*call_expr
;
1314 struct range_list
*rl
;
1317 orig_states
= clone_stree(__get_cur_stree());
1319 /* legacy cruft. need to fix call_implies_callbacks(). */
1323 if (left
->type
!= EXPR_CALL
) {
1329 get_absolute_rl(var_expr
, &rl
);
1331 db_info
.comparison
= comparison
;
1332 db_info
.expr
= call_expr
;
1334 db_info
.left
= call_on_left
;
1335 db_info
.callbacks
= db_return_states_list
;
1336 db_info
.var_expr
= var_expr
;
1338 call_void_fns(return_states_before
);
1340 db_info
.true_side
= 1;
1341 db_info
.stree
= NULL
;
1342 db_info
.prev_return_id
= -1;
1343 __push_fake_cur_stree();
1344 sql_select_return_states("return_id, return, type, parameter, key, value",
1345 call_expr
, db_compare_callback
, &db_info
);
1346 set_other_side_state(&db_info
);
1347 process_return_states(&db_info
);
1348 true_states
= db_info
.stree
;
1349 if (!true_states
&& db_info
.has_states
) {
1350 __push_fake_cur_stree();
1351 set_path_impossible();
1352 true_states
= __pop_fake_cur_stree();
1357 FOR_EACH_SM(orig_states
, sm
) {
1358 __set_sm_cur_stree(sm
);
1359 } END_FOR_EACH_SM(sm
);
1361 db_info
.true_side
= 0;
1362 db_info
.stree
= NULL
;
1363 db_info
.prev_return_id
= -1;
1365 __push_fake_cur_stree();
1366 sql_select_return_states("return_id, return, type, parameter, key, value", call_expr
,
1367 db_compare_callback
, &db_info
);
1368 set_other_side_state(&db_info
);
1369 process_return_states(&db_info
);
1370 false_states
= db_info
.stree
;
1371 if (!false_states
&& db_info
.has_states
) {
1372 __push_fake_cur_stree();
1373 set_path_impossible();
1374 false_states
= __pop_fake_cur_stree();
1379 FOR_EACH_SM(orig_states
, sm
) {
1380 __set_sm_cur_stree(sm
);
1381 } END_FOR_EACH_SM(sm
);
1383 free_stree(&orig_states
);
1385 FOR_EACH_SM(true_states
, sm
) {
1386 __set_true_false_sm(sm
, NULL
);
1387 } END_FOR_EACH_SM(sm
);
1388 FOR_EACH_SM(false_states
, sm
) {
1389 __set_true_false_sm(NULL
, sm
);
1390 } END_FOR_EACH_SM(sm
);
1392 free_stree(&true_states
);
1393 free_stree(&false_states
);
1395 if (!db_info
.states_merged
)
1396 mark_call_params_untracked(call_expr
);
1398 call_return_states_after_hooks(call_expr
);
1400 FOR_EACH_SM(implied_true
, sm
) {
1401 __set_true_false_sm(sm
, NULL
);
1402 } END_FOR_EACH_SM(sm
);
1403 FOR_EACH_SM(implied_false
, sm
) {
1404 __set_true_false_sm(NULL
, sm
);
1405 } END_FOR_EACH_SM(sm
);
1408 void function_comparison(struct expression
*left
, int comparison
, struct expression
*right
)
1410 struct expression
*var_expr
;
1411 struct expression
*call_expr
;
1412 struct stree
*implied_true
= NULL
;
1413 struct stree
*implied_false
= NULL
;
1414 struct range_list
*rl
;
1418 // TODO: faked_assign delete this
1419 // condition calls should be faked and then handled as assignments
1420 // this code is a lazy work around
1425 /* legacy cruft. need to fix call_implies_callbacks(). */
1429 if (left
->type
!= EXPR_CALL
) {
1435 get_absolute_rl(var_expr
, &rl
);
1437 if (rl_to_sval(rl
, &sval
))
1438 call_implies_callbacks(comparison
, call_expr
, sval
, call_on_left
, &implied_true
, &implied_false
);
1440 compare_db_return_states_callbacks(left
, comparison
, right
, implied_true
, implied_false
);
1441 free_stree(&implied_true
);
1442 free_stree(&implied_false
);
1445 static void call_ranged_return_hooks(struct db_callback_info
*db_info
)
1447 struct call_back_list
*call_backs
;
1448 struct range_list
*range_rl
;
1449 struct expression
*expr
;
1450 struct fcall_back
*tmp
;
1451 const char *fn_name
;
1453 expr
= strip_expr(db_info
->expr
);
1454 while (expr
->type
== EXPR_ASSIGNMENT
)
1455 expr
= strip_expr(expr
->right
);
1456 if (expr
->type
!= EXPR_CALL
)
1459 fn_name
= get_fn_name(expr
->fn
);
1460 call_backs
= get_call_backs(fn_name
);
1461 FOR_EACH_PTR(call_backs
, tmp
) {
1462 if (tmp
->type
!= RANGED_CALL
)
1464 range_rl
= alloc_rl(tmp
->range
->min
, tmp
->range
->max
);
1465 range_rl
= cast_rl(estate_type(db_info
->ret_state
), range_rl
);
1466 if (possibly_true_rl(range_rl
, SPECIAL_EQUAL
, estate_rl(db_info
->ret_state
)))
1467 (tmp
->u
.ranged
)(fn_name
, expr
, db_info
->expr
, tmp
->info
);
1468 } END_FOR_EACH_PTR(tmp
);
1470 FOR_EACH_PTR(call_backs
, tmp
) {
1471 if (tmp
->type
!= RANGED_EXACT
)
1473 if (!estate_rl(db_info
->ret_state
))
1476 range_rl
= alloc_rl(tmp
->range
->min
, tmp
->range
->max
);
1477 range_rl
= cast_rl(estate_type(db_info
->ret_state
), range_rl
);
1480 * If there is an returned value out of range then this is not
1481 * an exact match. In other words, "0,4096-ptr_max" is not
1482 * necessarily a valid match.
1485 if (remove_range(estate_rl(db_info
->ret_state
),
1486 rl_min(range_rl
), rl_max(range_rl
)))
1488 (tmp
->u
.ranged
)(fn_name
, expr
, db_info
->expr
, tmp
->info
);
1489 } END_FOR_EACH_PTR(tmp
);
1492 static int db_assign_return_states_callback(void *_info
, int argc
, char **argv
, char **azColName
)
1494 struct db_callback_info
*db_info
= _info
;
1495 struct range_list
*ret_range
;
1497 char *ret_str
, *key
, *value
;
1498 struct return_implies_callback
*tmp
;
1504 return_id
= atoi(argv
[0]);
1506 type
= atoi(argv
[2]);
1507 param
= atoi(argv
[3]);
1511 if (db_info
->prev_return_id
!= -1 && type
== INTERNAL
) {
1512 call_ranged_return_hooks(db_info
);
1513 set_return_assign_state(db_info
);
1514 process_return_states(db_info
);
1515 __push_fake_cur_stree();
1518 db_info
->prev_return_id
= return_id
;
1520 if (type
== INTERNAL
&& func_type_mismatch(db_info
->expr
, value
))
1524 if (type
== CULL_PATH
) {
1528 if (is_impossible_data(type
, db_info
, param
, key
, value
)) {
1533 if (type
== PARAM_LIMIT
)
1534 param_limit_implications(db_info
->expr
, param
, key
, value
, &db_info
->implied
);
1535 else if (type
> PARAM_LIMIT
)
1536 set_implied_states(db_info
);
1538 db_info
->handled
= 1;
1539 call_results_to_rl(db_info
->expr
->right
, get_type(strip_expr(db_info
->expr
->right
)), ret_str
, &ret_range
);
1541 ret_range
= alloc_whole_rl(get_type(strip_expr(db_info
->expr
->right
)));
1542 ret_range
= cast_rl(get_type(db_info
->expr
->right
), ret_range
);
1544 if (type
== INTERNAL
) {
1545 set_state(-1, "unnull_path", NULL
, &true_state
);
1546 __add_comparison_info(db_info
->expr
->left
, strip_expr(db_info
->expr
->right
), ret_str
);
1547 call_string_hooks(return_string_hooks
, db_info
->expr
, ret_str
);
1548 call_cull_hooks(db_info
, ret_range
);
1549 store_return_state(db_info
, ret_str
, alloc_estate_rl(ret_range
));
1552 FOR_EACH_PTR(db_return_states_list
, tmp
) {
1553 if (tmp
->type
== type
)
1554 call_db_return_callback(db_info
, tmp
, param
, key
, value
);
1555 } END_FOR_EACH_PTR(tmp
);
1557 fake_return_assignment(db_info
, type
, param
, key
, value
);
1562 static int db_return_states_assign(struct expression
*expr
)
1564 struct expression
*right
;
1565 struct sm_state
*sm
;
1566 struct db_callback_info db_info
= {};
1568 right
= strip_expr(expr
->right
);
1570 db_info
.prev_return_id
= -1;
1571 db_info
.expr
= expr
;
1572 db_info
.stree
= NULL
;
1573 db_info
.handled
= 0;
1575 call_void_fns(return_states_before
);
1577 __push_fake_cur_stree();
1578 sql_select_return_states("return_id, return, type, parameter, key, value",
1579 right
, db_assign_return_states_callback
, &db_info
);
1581 sm_msg("%s return_id %d return_ranges %s",
1582 db_info
.cull
? "culled" : "merging",
1583 db_info
.prev_return_id
,
1584 db_info
.ret_state
? db_info
.ret_state
->name
: "'<empty>'");
1586 if (db_info
.handled
)
1587 call_ranged_return_hooks(&db_info
);
1588 set_return_assign_state(&db_info
);
1589 process_return_states(&db_info
);
1591 if (!db_info
.stree
&& db_info
.cull
) { /* this means we culled everything */
1592 set_extra_expr_mod(expr
->left
, alloc_estate_whole(get_type(expr
->left
)));
1593 set_path_impossible();
1595 FOR_EACH_SM(db_info
.stree
, sm
) {
1597 } END_FOR_EACH_SM(sm
);
1599 free_stree(&db_info
.stree
);
1601 if (!db_info
.states_merged
)
1602 mark_call_params_untracked(right
);
1604 call_return_states_after_hooks(right
);
1606 return db_info
.handled
;
1609 static bool handle_implied_return(struct expression
*expr
)
1611 struct range_list
*rl
;
1613 if (!get_implied_return(expr
->right
, &rl
))
1615 rl
= cast_rl(get_type(expr
->left
), rl
);
1616 set_extra_expr_mod(expr
->left
, alloc_estate_rl(rl
));
1620 static void match_assign_call(struct expression
*expr
)
1622 struct call_back_list
*call_backs
;
1623 const char *fn_name
;
1624 struct expression
*right
;
1626 struct range_list
*rl
;
1628 if (expr
->op
!= '=')
1631 right
= strip_expr(expr
->right
);
1632 if (is_fake_call(right
))
1635 fn_name
= get_fn_name(right
->fn
);
1636 call_backs
= get_call_backs(fn_name
);
1639 * The ordering here is sort of important.
1640 * One example, of how this matters is that when we do:
1642 * len = strlen(str);
1644 * That is handled by smatch_common_functions.c and smatch_strlen.c.
1645 * They use implied_return and function_assign_hook respectively.
1646 * We want to get the implied return first before we do the function
1647 * assignment hook otherwise we end up writing the wrong thing for len
1648 * in smatch_extra.c because we assume that it already holds the
1649 * strlen() when we haven't set it yet.
1652 if (db_return_states_assign(expr
))
1655 handled
= assign_ranged_funcs(fn_name
, expr
, call_backs
);
1656 handled
|= handle_implied_return(expr
);
1659 call_call_backs(call_backs
, ASSIGN_CALL
, fn_name
, expr
);
1664 /* assignment wasn't handled at all */
1665 get_absolute_rl(expr
->right
, &rl
);
1666 rl
= cast_rl(get_type(expr
->left
), rl
);
1667 set_extra_expr_mod(expr
->left
, alloc_estate_rl(rl
));
1670 static int db_return_states_callback(void *_info
, int argc
, char **argv
, char **azColName
)
1672 struct db_callback_info
*db_info
= _info
;
1673 struct range_list
*ret_range
;
1675 char *ret_str
, *key
, *value
;
1676 struct return_implies_callback
*tmp
;
1682 return_id
= atoi(argv
[0]);
1684 type
= atoi(argv
[2]);
1685 param
= atoi(argv
[3]);
1689 if (db_info
->prev_return_id
!= -1 && type
== INTERNAL
) {
1690 call_ranged_return_hooks(db_info
);
1691 process_return_states(db_info
);
1692 __push_fake_cur_stree();
1696 db_info
->prev_return_id
= return_id
;
1698 if (type
== INTERNAL
&& func_type_mismatch(db_info
->expr
, value
))
1702 if (type
== CULL_PATH
) {
1706 if (is_impossible_data(type
, db_info
, param
, key
, value
)) {
1711 if (type
== PARAM_LIMIT
)
1712 param_limit_implications(db_info
->expr
, param
, key
, value
, &db_info
->implied
);
1713 else if (type
> PARAM_LIMIT
)
1714 set_implied_states(db_info
);
1716 call_results_to_rl(db_info
->expr
, get_type(strip_expr(db_info
->expr
)), ret_str
, &ret_range
);
1717 ret_range
= cast_rl(get_type(db_info
->expr
), ret_range
);
1719 if (type
== INTERNAL
) {
1720 struct smatch_state
*state
;
1722 set_state(-1, "unnull_path", NULL
, &true_state
);
1723 call_string_hooks(return_string_hooks
, db_info
->expr
, ret_str
);
1724 call_cull_hooks(db_info
, ret_range
);
1725 state
= alloc_estate_rl(ret_range
);
1726 store_return_state(db_info
, ret_str
, state
);
1729 FOR_EACH_PTR(db_return_states_list
, tmp
) {
1730 if (tmp
->type
== type
)
1731 call_db_return_callback(db_info
, tmp
, param
, key
, value
);
1732 } END_FOR_EACH_PTR(tmp
);
1734 fake_return_assignment(db_info
, type
, param
, key
, value
);
1739 static void db_return_states(struct expression
*expr
)
1741 struct sm_state
*sm
;
1742 struct db_callback_info db_info
= {};
1744 if (!__get_cur_stree()) /* no return functions */
1747 db_info
.prev_return_id
= -1;
1748 db_info
.expr
= expr
;
1749 db_info
.stree
= NULL
;
1751 call_void_fns(return_states_before
);
1753 __push_fake_cur_stree();
1755 sql_select_return_states("return_id, return, type, parameter, key, value",
1756 expr
, db_return_states_callback
, &db_info
);
1757 call_ranged_return_hooks(&db_info
);
1758 process_return_states(&db_info
);
1760 FOR_EACH_SM(db_info
.stree
, sm
) {
1762 } END_FOR_EACH_SM(sm
);
1764 free_stree(&db_info
.stree
);
1766 if (!db_info
.states_merged
)
1767 mark_call_params_untracked(expr
);
1769 call_return_states_after_hooks(expr
);
1772 static void db_return_states_call(struct expression
*expr
)
1777 if (is_assigned_call(expr
) || is_fake_assigned_call(expr
))
1779 if (is_condition_call(expr
))
1781 db_return_states(expr
);
1784 static void match_function_call_early(struct expression
*expr
)
1786 call_function_hooks(expr
, REGULAR_CALL_EARLY
);
1789 static void match_function_call(struct expression
*expr
)
1791 call_function_hooks(expr
, REGULAR_CALL
);
1792 db_return_states_call(expr
);
1793 /* If we have no database there could be unprocessed fake calls */
1797 static void match_macro_assign(struct expression
*expr
)
1799 struct call_back_list
*call_backs
;
1801 struct expression
*right
;
1803 right
= strip_expr(expr
->right
);
1804 macro
= get_macro_name(right
->pos
);
1805 call_backs
= search_callback(func_hash
, (char *)macro
);
1808 call_call_backs(call_backs
, MACRO_ASSIGN
, macro
, expr
);
1809 call_call_backs(call_backs
, MACRO_ASSIGN_EXTRA
, macro
, expr
);
1812 bool get_implied_return(struct expression
*expr
, struct range_list
**rl
)
1814 struct call_back_list
*call_backs
;
1815 struct fcall_back
*tmp
;
1816 bool handled
= false;
1821 expr
= strip_expr(expr
);
1822 fn
= expr_to_var(expr
->fn
);
1826 call_backs
= search_callback(func_hash
, fn
);
1828 FOR_EACH_PTR(call_backs
, tmp
) {
1829 if (tmp
->type
== IMPLIED_RETURN
)
1830 handled
|= (tmp
->u
.implied_return
)(expr
, tmp
->info
, rl
);
1831 } END_FOR_EACH_PTR(tmp
);
1838 struct range_list
*get_range_implications(const char *fn
)
1840 struct call_back_list
*call_backs
;
1841 struct range_list
*ret
= NULL
;
1842 struct fcall_back
*tmp
;
1844 call_backs
= search_callback(func_hash
, (char *)fn
);
1846 FOR_EACH_PTR(call_backs
, tmp
) {
1847 if (tmp
->type
!= RANGED_CALL
&&
1848 tmp
->type
!= RANGED_EXACT
)
1850 add_ptr_list(&ret
, tmp
->range
);
1851 } END_FOR_EACH_PTR(tmp
);
1856 void create_function_hook_hash(void)
1858 func_hash
= create_function_hashtable(5000);
1861 void register_function_hooks_early(int id
)
1863 add_hook(&match_function_call_early
, FUNCTION_CALL_HOOK_BEFORE
);
1866 void register_function_hooks(int id
)
1868 add_function_data((unsigned long *)&fake_calls
);
1869 add_hook(&match_function_call
, CALL_HOOK_AFTER_INLINE
);
1870 add_hook(&match_assign_call
, CALL_ASSIGNMENT_HOOK
);
1871 add_hook(&match_macro_assign
, MACRO_ASSIGNMENT_HOOK
);