smatch_function_hooks.c

   1 /*
   2  * Copyright (C) 2009 Dan Carpenter.
   3  *
   4  * This program is free software; you can redistribute it and/or
   5  * modify it under the terms of the GNU General Public License
   6  * as published by the Free Software Foundation; either version 2
   7  * of the License, or (at your option) any later version.
   8  *
   9  * This program is distributed in the hope that it will be useful,
  10  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  11  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  12  * GNU General Public License for more details.
  13  *
  14  * You should have received a copy of the GNU General Public License
  15  * along with this program; if not, see http://www.gnu.org/copyleft/gpl.txt
  16  */
  17
  18 /*
  19  * There are several types of function hooks:
  20  * add_function_hook()        - For any time a function is called.
  21  * add_function_assign_hook() - foo = the_function().
  22  * add_implied_return_hook()  - Calculates the implied return value.
  23  * add_macro_assign_hook()    - foo = the_macro().
  24  * return_implies_state()     - For when a return value of 1 implies locked
  25  *                              and 0 implies unlocked. etc. etc.
  26  *
  27  */
  28
  29 #include <stdlib.h>
  30 #include <stdio.h>
  31 #include <ctype.h>
  32 #include "smatch.h"
  33 #include "smatch_slist.h"
  34 #include "smatch_extra.h"
  35 #include "smatch_function_hashtable.h"
  36 #include "smatch_expression_stacks.h"
  37
  38 struct fcall_back {
  39         int type;
  40         struct data_range *range;
  41         union {
  42                 func_hook *call_back;
  43                 implication_hook *ranged;
  44                 implied_return_hook *implied_return;
  45         } u;
  46         void *info;
  47 };
  48
  49 ALLOCATOR(fcall_back, "call backs");
  50 DECLARE_PTR_LIST(call_back_list, struct fcall_back);
  51
  52 DEFINE_FUNCTION_HASHTABLE_STATIC(callback, struct fcall_back, struct call_back_list);
  53 static struct hashtable *func_hash;
  54
  55 int __in_fake_parameter_assign;
  56
  57 enum fn_hook_type {
  58         REGULAR_CALL,
  59         REGULAR_CALL_LATE,
  60         RANGED_CALL,
  61         RANGED_EXACT,
  62         ASSIGN_CALL,
  63         IMPLIED_RETURN,
  64         MACRO_ASSIGN,
  65         MACRO_ASSIGN_EXTRA,
  66 };
  67
  68 struct param_key_data {
  69         param_key_hook *call_back;
  70         int param;
  71         const char *key;
  72         void *info;
  73 };
  74
  75 struct return_implies_callback {
  76         int type;
  77         bool param_key;
  78         union {
  79                 return_implies_hook *callback;
  80                 param_key_hook *pk_callback;
  81         };
  82 };
  83 ALLOCATOR(return_implies_callback, "return_implies callbacks");
  84 DECLARE_PTR_LIST(db_implies_list, struct return_implies_callback);
  85 static struct db_implies_list *db_return_states_list;
  86
  87 typedef void (void_fn)(void);
  88 DECLARE_PTR_LIST(void_fn_list, void_fn *);
  89 static struct void_fn_list *return_states_before;
  90 static struct void_fn_list *return_states_after;
  91
  92 static struct fcall_back *alloc_fcall_back(int type, void *call_back,
  93                                            void *info)
  94 {
  95         struct fcall_back *cb;
  96
  97         cb = __alloc_fcall_back(0);
  98         cb->type = type;
  99         cb->u.call_back = call_back;
 100         cb->info = info;
 101         return cb;
 102 }
 103
 104 void add_function_hook(const char *look_for, func_hook *call_back, void *info)
 105 {
 106         struct fcall_back *cb;
 107
 108         cb = alloc_fcall_back(REGULAR_CALL, call_back, info);
 109         add_callback(func_hash, look_for, cb);
 110 }
 111
 112 void add_function_hook_late(const char *look_for, func_hook *call_back, void *info)
 113 {
 114         struct fcall_back *cb;
 115
 116         cb = alloc_fcall_back(REGULAR_CALL_LATE, call_back, info);
 117         add_callback(func_hash, look_for, cb);
 118 }
 119
 120 void add_function_assign_hook(const char *look_for, func_hook *call_back,
 121                               void *info)
 122 {
 123         struct fcall_back *cb;
 124
 125         cb = alloc_fcall_back(ASSIGN_CALL, call_back, info);
 126         add_callback(func_hash, look_for, cb);
 127 }
 128
 129 static void register_funcs_from_file_helper(const char *file,
 130                                             func_hook *call_back, void *info,
 131                                             bool assign)
 132 {
 133         struct token *token;
 134         const char *func;
 135         char name[64];
 136
 137         snprintf(name, sizeof(name), "%s.%s", option_project_str, file);
 138         token = get_tokens_file(name);
 139         if (!token)
 140                 return;
 141         if (token_type(token) != TOKEN_STREAMBEGIN)
 142                 return;
 143         token = token->next;
 144         while (token_type(token) != TOKEN_STREAMEND) {
 145                 if (token_type(token) != TOKEN_IDENT)
 146                         return;
 147                 func = show_ident(token->ident);
 148                 if (assign)
 149                         add_function_assign_hook(func, call_back, info);
 150                 else
 151                         add_function_hook(func, call_back, info);
 152                 token = token->next;
 153         }
 154         clear_token_alloc();
 155 }
 156
 157 void register_func_hooks_from_file(const char *file,
 158                                    func_hook *call_back, void *info)
 159 {
 160         register_funcs_from_file_helper(file, call_back, info, false);
 161 }
 162
 163 void register_assign_hooks_from_file(const char *file,
 164                                      func_hook *call_back, void *info)
 165 {
 166         register_funcs_from_file_helper(file, call_back, info, true);
 167 }
 168
 169 void add_implied_return_hook(const char *look_for,
 170                              implied_return_hook *call_back,
 171                              void *info)
 172 {
 173         struct fcall_back *cb;
 174
 175         cb = alloc_fcall_back(IMPLIED_RETURN, call_back, info);
 176         add_callback(func_hash, look_for, cb);
 177 }
 178
 179 static void db_helper(struct expression *expr, param_key_hook *call_back, int param, const char *key, void *info)
 180 {
 181         char *name;
 182         struct symbol *sym;
 183
 184         if (param == -2) {
 185                 call_back(expr, key, NULL, info);
 186                 return;
 187         }
 188
 189         name = get_name_sym_from_key(expr, param, key, &sym);
 190         if (!name || !sym)
 191                 goto free;
 192
 193         call_back(expr, name, sym, info);
 194 free:
 195         free_string(name);
 196 }
 197
 198 static void param_key_function(const char *fn, struct expression *expr, void *data)
 199 {
 200         struct param_key_data *pkd = data;
 201         struct expression *parent;
 202         int cnt = 0;
 203
 204         parent = expr;
 205         while (true) {
 206                 parent = expr_get_parent_expr(parent);
 207                 if (!parent || ++cnt >= 5)
 208                         break;
 209                 if (parent->type == EXPR_CAST)
 210                         continue;
 211                 if (parent->type == EXPR_PREOP && parent->op == '(')
 212                         continue;
 213                 break;
 214         }
 215
 216         if (parent && parent->type == EXPR_ASSIGNMENT)
 217                 expr = parent;
 218
 219         db_helper(expr, pkd->call_back, pkd->param, pkd->key, pkd->info);
 220 }
 221
 222 static void param_key_implies_function(const char *fn, struct expression *call_expr,
 223                                        struct expression *assign_expr, void *data)
 224 {
 225         struct param_key_data *pkd = data;
 226
 227         db_helper(assign_expr ?: call_expr, pkd->call_back, pkd->param, pkd->key, pkd->info);
 228 }
 229
 230 static struct param_key_data *alloc_pkd(param_key_hook *call_back, int param, const char *key, void *info)
 231 {
 232         struct param_key_data *pkd;
 233
 234         pkd = malloc(sizeof(*pkd));
 235         pkd->call_back = call_back;
 236         pkd->param = param;
 237         pkd->key = alloc_string(key);
 238         pkd->info = info;
 239
 240         return pkd;
 241 }
 242
 243 void add_function_param_key_hook(const char *look_for, param_key_hook *call_back,
 244                                  int param, const char *key, void *info)
 245 {
 246         struct param_key_data *pkd;
 247
 248         pkd = alloc_pkd(call_back, param, key, info);
 249         add_function_hook(look_for, &param_key_function, pkd);
 250 }
 251
 252 void return_implies_param_key(const char *look_for, sval_t start, sval_t end,
 253                               param_key_hook *call_back,
 254                               int param, const char *key, void *info)
 255 {
 256         struct param_key_data *pkd;
 257
 258         pkd = alloc_pkd(call_back, param, key, info);
 259         return_implies_state_sval(look_for, start, end, &param_key_implies_function, pkd);
 260 }
 261
 262 void return_implies_param_key_exact(const char *look_for, sval_t start, sval_t end,
 263                                     param_key_hook *call_back,
 264                                     int param, const char *key, void *info)
 265 {
 266         struct param_key_data *pkd;
 267
 268         pkd = alloc_pkd(call_back, param, key, info);
 269         return_implies_exact(look_for, start, end, &param_key_implies_function, pkd);
 270 }
 271
 272 void add_macro_assign_hook(const char *look_for, func_hook *call_back,
 273                         void *info)
 274 {
 275         struct fcall_back *cb;
 276
 277         cb = alloc_fcall_back(MACRO_ASSIGN, call_back, info);
 278         add_callback(func_hash, look_for, cb);
 279 }
 280
 281 void add_macro_assign_hook_extra(const char *look_for, func_hook *call_back,
 282                         void *info)
 283 {
 284         struct fcall_back *cb;
 285
 286         cb = alloc_fcall_back(MACRO_ASSIGN_EXTRA, call_back, info);
 287         add_callback(func_hash, look_for, cb);
 288 }
 289
 290 void return_implies_state(const char *look_for, long long start, long long end,
 291                          implication_hook *call_back, void *info)
 292 {
 293         struct fcall_back *cb;
 294
 295         cb = alloc_fcall_back(RANGED_CALL, call_back, info);
 296         cb->range = alloc_range_perm(ll_to_sval(start), ll_to_sval(end));
 297         add_callback(func_hash, look_for, cb);
 298 }
 299
 300 void return_implies_state_sval(const char *look_for, sval_t start, sval_t end,
 301                          implication_hook *call_back, void *info)
 302 {
 303         struct fcall_back *cb;
 304
 305         cb = alloc_fcall_back(RANGED_CALL, call_back, info);
 306         cb->range = alloc_range_perm(start, end);
 307         add_callback(func_hash, look_for, cb);
 308 }
 309
 310 void return_implies_exact(const char *look_for, sval_t start, sval_t end,
 311                           implication_hook *call_back, void *info)
 312 {
 313         struct fcall_back *cb;
 314
 315         cb = alloc_fcall_back(RANGED_EXACT, call_back, info);
 316         cb->range = alloc_range_perm(start, end);
 317         add_callback(func_hash, look_for, cb);
 318 }
 319
 320 static struct return_implies_callback *alloc_db_return_callback(int type, bool param_key, void *callback)
 321 {
 322         struct return_implies_callback *cb;
 323
 324         cb = __alloc_return_implies_callback(0);
 325         cb->type = type;
 326         cb->param_key = param_key;
 327         cb->callback = callback;
 328
 329         return cb;
 330 }
 331
 332 void select_return_states_hook(int type, return_implies_hook *callback)
 333 {
 334         struct return_implies_callback *cb;
 335
 336         cb = alloc_db_return_callback(type, false, callback);
 337         add_ptr_list(&db_return_states_list, cb);
 338 }
 339
 340 static void call_db_return_callback(struct return_implies_callback *cb,
 341                                     struct expression *expr, int param, char *key, char *value)
 342 {
 343         if (cb->param_key) {
 344                 // FIXME check if cb->pk_callback was already called
 345                 db_helper(expr, cb->pk_callback, param, key, NULL);
 346         } else {
 347                 cb->callback(expr, param, key, value);
 348         }
 349 }
 350
 351 void select_return_param_key(int type, param_key_hook *callback)
 352 {
 353         struct return_implies_callback *cb;
 354
 355         cb = alloc_db_return_callback(type, true, callback);
 356         add_ptr_list(&db_return_states_list, cb);
 357 }
 358
 359 void select_return_states_before(void_fn *fn)
 360 {
 361         void_fn **p = malloc(sizeof(void_fn *));
 362         *p = fn;
 363         add_ptr_list(&return_states_before, p);
 364 }
 365
 366 void select_return_states_after(void_fn *fn)
 367 {
 368         void_fn **p = malloc(sizeof(void_fn *));
 369         *p = fn;
 370         add_ptr_list(&return_states_after, p);
 371 }
 372
 373 static void call_return_states_before_hooks(void)
 374 {
 375         void_fn **fn;
 376
 377         FOR_EACH_PTR(return_states_before, fn) {
 378                 (*fn)();
 379         } END_FOR_EACH_PTR(fn);
 380 }
 381
 382 static int call_call_backs(struct call_back_list *list, int type,
 383                             const char *fn, struct expression *expr)
 384 {
 385         struct fcall_back *tmp;
 386         int handled = 0;
 387
 388         FOR_EACH_PTR(list, tmp) {
 389                 if (tmp->type == type) {
 390                         (tmp->u.call_back)(fn, expr, tmp->info);
 391                         handled = 1;
 392                 }
 393         } END_FOR_EACH_PTR(tmp);
 394
 395         return handled;
 396 }
 397
 398 static void call_function_hooks(struct expression *expr, enum fn_hook_type type)
 399 {
 400         struct call_back_list *call_backs;
 401         struct expression *fn;
 402
 403         while (expr->type == EXPR_ASSIGNMENT)
 404                 expr = strip_expr(expr->right);
 405         if (expr->type != EXPR_CALL)
 406                 return;
 407
 408         fn = strip_expr(expr->fn);
 409         if (fn->type != EXPR_SYMBOL || !fn->symbol)
 410                 return;
 411
 412         call_backs = search_callback(func_hash, (char *)fn->symbol->ident->name);
 413         if (!call_backs)
 414                 return;
 415
 416         call_call_backs(call_backs, type, fn->symbol->ident->name, expr);
 417 }
 418
 419 static void call_return_states_after_hooks(struct expression *expr)
 420 {
 421         void_fn **fn;
 422
 423         FOR_EACH_PTR(return_states_after, fn) {
 424                 (*fn)();
 425         } END_FOR_EACH_PTR(fn);
 426         __pass_to_client(expr, FUNCTION_CALL_HOOK_AFTER_DB);
 427         call_function_hooks(expr, REGULAR_CALL_LATE);
 428 }
 429
 430 static void call_ranged_call_backs(struct call_back_list *list,
 431                                 const char *fn, struct expression *call_expr,
 432                                 struct expression *assign_expr)
 433 {
 434         struct fcall_back *tmp;
 435
 436         FOR_EACH_PTR(list, tmp) {
 437                 (tmp->u.ranged)(fn, call_expr, assign_expr, tmp->info);
 438         } END_FOR_EACH_PTR(tmp);
 439 }
 440
 441 static struct call_back_list *get_same_ranged_call_backs(struct call_back_list *list,
 442                                                 struct data_range *drange)
 443 {
 444         struct call_back_list *ret = NULL;
 445         struct fcall_back *tmp;
 446
 447         FOR_EACH_PTR(list, tmp) {
 448                 if (tmp->type != RANGED_CALL &&
 449                     tmp->type != RANGED_EXACT)
 450                         continue;
 451                 if (ranges_equiv(tmp->range, drange))
 452                         add_ptr_list(&ret, tmp);
 453         } END_FOR_EACH_PTR(tmp);
 454         return ret;
 455 }
 456
 457 static int in_list_exact_sval(struct range_list *list, struct data_range *drange)
 458 {
 459         struct data_range *tmp;
 460
 461         FOR_EACH_PTR(list, tmp) {
 462                 if (ranges_equiv(tmp, drange))
 463                         return 1;
 464         } END_FOR_EACH_PTR(tmp);
 465         return 0;
 466 }
 467
 468 static int assign_ranged_funcs(const char *fn, struct expression *expr,
 469                                  struct call_back_list *call_backs)
 470 {
 471         struct fcall_back *tmp;
 472         struct sm_state *sm;
 473         char *var_name;
 474         struct symbol *sym;
 475         struct smatch_state *estate;
 476         struct stree *tmp_stree;
 477         struct stree *final_states = NULL;
 478         struct range_list *handled_ranges = NULL;
 479         struct call_back_list *same_range_call_backs = NULL;
 480         struct range_list *rl;
 481         int handled = 0;
 482
 483         if (!call_backs)
 484                 return 0;
 485
 486         var_name = expr_to_var_sym(expr->left, &sym);
 487         if (!var_name || !sym)
 488                 goto free;
 489
 490         FOR_EACH_PTR(call_backs, tmp) {
 491                 if (tmp->type != RANGED_CALL &&
 492                     tmp->type != RANGED_EXACT)
 493                         continue;
 494
 495                 if (in_list_exact_sval(handled_ranges, tmp->range))
 496                         continue;
 497                 __push_fake_cur_stree();
 498                 tack_on(&handled_ranges, tmp->range);
 499
 500                 same_range_call_backs = get_same_ranged_call_backs(call_backs, tmp->range);
 501                 call_ranged_call_backs(same_range_call_backs, fn, expr->right, expr);
 502                 __free_ptr_list((struct ptr_list **)&same_range_call_backs);
 503
 504                 rl = alloc_rl(tmp->range->min, tmp->range->max);
 505                 rl = cast_rl(get_type(expr->left), rl);
 506                 estate = alloc_estate_rl(rl);
 507                 set_extra_mod(var_name, sym, expr->left, estate);
 508
 509                 tmp_stree = __pop_fake_cur_stree();
 510                 merge_fake_stree(&final_states, tmp_stree);
 511                 free_stree(&tmp_stree);
 512                 handled = 1;
 513         } END_FOR_EACH_PTR(tmp);
 514
 515         FOR_EACH_SM(final_states, sm) {
 516                 __set_sm(sm);
 517         } END_FOR_EACH_SM(sm);
 518
 519         free_stree(&final_states);
 520 free:
 521         free_string(var_name);
 522         return handled;
 523 }
 524
 525 static void call_implies_callbacks(int comparison, struct expression *expr, sval_t sval, int left, struct stree **implied_true, struct stree **implied_false)
 526 {
 527         struct call_back_list *call_backs;
 528         struct fcall_back *tmp;
 529         const char *fn;
 530         struct data_range *value_range;
 531         struct stree *true_states = NULL;
 532         struct stree *false_states = NULL;
 533         struct stree *tmp_stree;
 534
 535         *implied_true = NULL;
 536         *implied_false = NULL;
 537         if (expr->fn->type != EXPR_SYMBOL || !expr->fn->symbol)
 538                 return;
 539         fn = expr->fn->symbol->ident->name;
 540         call_backs = search_callback(func_hash, (char *)expr->fn->symbol->ident->name);
 541         if (!call_backs)
 542                 return;
 543         value_range = alloc_range(sval, sval);
 544
 545         /* set true states */
 546         __push_fake_cur_stree();
 547         FOR_EACH_PTR(call_backs, tmp) {
 548                 if (tmp->type != RANGED_CALL &&
 549                     tmp->type != RANGED_EXACT)
 550                         continue;
 551                 if (!true_comparison_range_LR(comparison, tmp->range, value_range, left))
 552                         continue;
 553                 (tmp->u.ranged)(fn, expr, NULL, tmp->info);
 554         } END_FOR_EACH_PTR(tmp);
 555         tmp_stree = __pop_fake_cur_stree();
 556         merge_fake_stree(&true_states, tmp_stree);
 557         free_stree(&tmp_stree);
 558
 559         /* set false states */
 560         __push_fake_cur_stree();
 561         FOR_EACH_PTR(call_backs, tmp) {
 562                 if (tmp->type != RANGED_CALL &&
 563                     tmp->type != RANGED_EXACT)
 564                         continue;
 565                 if (!false_comparison_range_LR(comparison, tmp->range, value_range, left))
 566                         continue;
 567                 (tmp->u.ranged)(fn, expr, NULL, tmp->info);
 568         } END_FOR_EACH_PTR(tmp);
 569         tmp_stree = __pop_fake_cur_stree();
 570         merge_fake_stree(&false_states, tmp_stree);
 571         free_stree(&tmp_stree);
 572
 573         *implied_true = true_states;
 574         *implied_false = false_states;
 575 }
 576
 577 struct db_callback_info {
 578         int true_side;
 579         int comparison;
 580         struct expression *expr;
 581         struct range_list *rl;
 582         int left;
 583         struct stree *stree;
 584         struct stree *implied;
 585         struct db_implies_list *callbacks;
 586         int prev_return_id;
 587         int cull;
 588         int has_states;
 589         char *ret_str;
 590         struct smatch_state *ret_state;
 591         struct expression *var_expr;
 592         struct expression_list *fake_param_assign_stack;
 593         int handled;
 594 };
 595
 596 static void set_implied_states(struct db_callback_info *db_info)
 597 {
 598         struct sm_state *sm;
 599
 600         FOR_EACH_SM(db_info->implied, sm) {
 601                 __set_sm(sm);
 602         } END_FOR_EACH_SM(sm);
 603
 604         free_stree(&db_info->implied);
 605 }
 606
 607 static void store_return_state(struct db_callback_info *db_info, const char *ret_str, struct smatch_state *state)
 608 {
 609         db_info->ret_str = alloc_sname(ret_str),
 610         db_info->ret_state = state;
 611 }
 612
 613 static bool fake_a_param_assignment(struct expression *expr, const char *ret_str, struct smatch_state *orig)
 614 {
 615         struct expression *arg, *left, *right, *tmp, *fake_assign;
 616         char *p;
 617         int param;
 618         char buf[256];
 619         char *str;
 620
 621         if (expr->type != EXPR_ASSIGNMENT || expr->op != '=')
 622                 return false;
 623         left = expr->left;
 624         right = expr->right;
 625
 626         while (right->type == EXPR_ASSIGNMENT)
 627                 right = strip_expr(right->right);
 628         if (!right || right->type != EXPR_CALL)
 629                 return false;
 630
 631         p = strchr(ret_str, '[');
 632         if (!p)
 633                 return false;
 634
 635         p++;
 636         if (p[0] == '=' && p[1] == '=')
 637                 p += 2;
 638         if (p[0] != '$')
 639                 return false;
 640
 641         snprintf(buf, sizeof(buf), "%s", p);
 642
 643         p = buf;
 644         p += 1;
 645         param = strtol(p, &p, 10);
 646
 647         p = strchr(p, ']');
 648         if (!p || *p != ']')
 649                 return false;
 650         *p = '\0';
 651
 652         arg = get_argument_from_call_expr(right->args, param);
 653         if (!arg)
 654                 return false;
 655
 656         /* There should be a get_other_name() function which returns an expr */
 657         tmp = get_assigned_expr(arg);
 658         if (tmp)
 659                 arg = tmp;
 660
 661         /*
 662          * This is a sanity check to prevent side effects from evaluating stuff
 663          * twice.
 664          */
 665         str = expr_to_chunk_sym_vsl(arg, NULL, NULL);
 666         if (!str)
 667                 return false;
 668         free_string(str);
 669
 670         right = gen_expression_from_key(arg, buf);
 671         if (!right)  /* Mostly fails for binops like [$0 + 4032] */
 672                 return false;
 673         fake_assign = assign_expression(left, '=', right);
 674         __in_fake_parameter_assign++;
 675         __split_expr(fake_assign);
 676         __in_fake_parameter_assign--;
 677
 678         /*
 679          * If the return is "0-65531[$0->nla_len - 4]" the faked expression
 680          * is maybe (-4)-65531 but we know it is in the 0-65531 range so both
 681          * parts have to be considered.  We use _nomod() because it's not really
 682          * another modification, it's just a clarification.
 683          *
 684          */
 685         if (estate_rl(orig)) {
 686                 struct smatch_state *faked;
 687                 struct range_list *rl;
 688
 689                 faked = get_extra_state(left);
 690                 if (estate_rl(faked)) {
 691                         rl = rl_intersection(estate_rl(faked), estate_rl(orig));
 692                         if (rl)
 693                                 set_extra_expr_nomod(expr, alloc_estate_rl(rl));
 694                 }
 695         }
 696
 697         return true;
 698 }
 699
 700 static void fake_return_assignment(struct db_callback_info *db_info, int type, int param, char *key, char *value)
 701 {
 702         struct expression *call, *left, *right, *assign;
 703         int right_param;
 704
 705         if (type != PARAM_COMPARE)
 706                 return;
 707
 708         call = db_info->expr;
 709         while (call && call->type == EXPR_ASSIGNMENT)
 710                 call = strip_expr(call->right);
 711         if (!call || call->type != EXPR_CALL)
 712                 return;
 713
 714         // TODO: This only handles "$->foo = arg" and not "$->foo = arg->bar".
 715         if (param != -1)
 716                 return;
 717         if (!value || strncmp(value, "== $", 4) != 0)
 718                 return;
 719         if (!isdigit(value[4]) || value[5] != '\0')
 720                 return;
 721         right_param = atoi(value + 4);
 722
 723         left = gen_expr_from_param_key(db_info->expr, param, key);
 724         if (!left)
 725                 return;
 726         right = get_argument_from_call_expr(call->args, right_param);
 727
 728         assign = assign_expression(left, '=', right);
 729         push_expression(&db_info->fake_param_assign_stack, assign);
 730 }
 731
 732 static void set_fresh_mtag_returns(struct db_callback_info *db_info)
 733 {
 734         struct expression *expr = db_info->expr->left;
 735         struct smatch_state *state;
 736
 737         if (!db_info->ret_state)
 738                 return;
 739
 740         state = alloc_estate_rl(cast_rl(get_type(expr), clone_rl(estate_rl(db_info->ret_state))));
 741         state = get_mtag_return(db_info->expr, state);
 742         if (!state)
 743                 return;
 744
 745         set_real_absolute(expr, state);
 746         set_extra_expr_mod(expr, state);
 747
 748         db_info->ret_state = NULL;
 749         db_info->ret_str = NULL;
 750 }
 751
 752 static void set_return_assign_state(struct db_callback_info *db_info)
 753 {
 754         struct expression *expr = db_info->expr->left;
 755         struct expression *fake_assign;
 756         struct smatch_state *state;
 757
 758         if (!db_info->ret_state)
 759                 return;
 760
 761         state = alloc_estate_rl(cast_rl(get_type(expr), clone_rl(estate_rl(db_info->ret_state))));
 762         if (!fake_a_param_assignment(db_info->expr, db_info->ret_str, state))
 763                 set_extra_expr_mod(expr, state);
 764
 765         while ((fake_assign = pop_expression(&db_info->fake_param_assign_stack))) {
 766                 __in_fake_parameter_assign++;
 767                 __split_expr(fake_assign);
 768                 __in_fake_parameter_assign--;
 769         }
 770
 771         db_info->ret_state = NULL;
 772         db_info->ret_str = NULL;
 773 }
 774
 775 static void set_other_side_state(struct db_callback_info *db_info)
 776 {
 777         struct expression *expr = db_info->var_expr;
 778         struct smatch_state *state;
 779
 780         if (!db_info->ret_state)
 781                 return;
 782
 783         state = alloc_estate_rl(cast_rl(get_type(expr), clone_rl(estate_rl(db_info->ret_state))));
 784         set_extra_expr_nomod(expr, state);
 785         db_info->ret_state = NULL;
 786         db_info->ret_str = NULL;
 787 }
 788
 789 static void handle_ret_equals_param(char *ret_string, struct range_list *rl, struct expression *call)
 790 {
 791         char *str;
 792         long long param;
 793         struct expression *arg;
 794         struct range_list *orig;
 795
 796         str = strstr(ret_string, "==$");
 797         if (!str)
 798                 return;
 799         str += 3;
 800         param = strtoll(str, NULL, 10);
 801         arg = get_argument_from_call_expr(call->args, param);
 802         if (!arg)
 803                 return;
 804         get_absolute_rl(arg, &orig);
 805         rl = rl_intersection(orig, rl);
 806         if (!rl)
 807                 return;
 808         set_extra_expr_nomod(arg, alloc_estate_rl(rl));
 809 }
 810
 811 static int impossible_limit(struct expression *expr, int param, char *key, char *value)
 812 {
 813         struct expression *arg;
 814         struct smatch_state *state;
 815         struct range_list *passed;
 816         struct range_list *limit;
 817         struct symbol *compare_type;
 818
 819         while (expr->type == EXPR_ASSIGNMENT)
 820                 expr = strip_expr(expr->right);
 821         if (expr->type != EXPR_CALL)
 822                 return 0;
 823
 824         arg = get_argument_from_call_expr(expr->args, param);
 825         if (!arg)
 826                 return 0;
 827
 828         if (strcmp(key, "$") == 0) {
 829                 if (!get_implied_rl(arg, &passed))
 830                         return 0;
 831
 832                 compare_type = get_arg_type(expr->fn, param);
 833         } else {
 834                 char *name;
 835                 struct symbol *sym;
 836
 837                 name = get_variable_from_key(arg, key, &sym);
 838                 if (!name || !sym)
 839                         return 0;
 840
 841                 state = get_state(SMATCH_EXTRA, name, sym);
 842                 if (!state) {
 843                         free_string(name);
 844                         return 0;
 845                 }
 846                 passed = estate_rl(state);
 847                 if (!passed || is_whole_rl(passed)) {
 848                         free_string(name);
 849                         return 0;
 850                 }
 851
 852                 compare_type = get_member_type_from_key(arg, key);
 853         }
 854
 855         passed = cast_rl(compare_type, passed);
 856         call_results_to_rl(expr, compare_type, value, &limit);
 857         if (!limit || is_whole_rl(limit))
 858                 return 0;
 859         if (possibly_true_rl(passed, SPECIAL_EQUAL, limit))
 860                 return 0;
 861         if (option_debug || local_debug)
 862                 sm_msg("impossible: %d '%s' limit '%s' == '%s'", param, key, show_rl(passed), value);
 863         return 1;
 864 }
 865
 866 static int is_impossible_data(int type, struct expression *expr, int param, char *key, char *value)
 867 {
 868         if (type == PARAM_LIMIT && impossible_limit(expr, param, key, value))
 869                 return 1;
 870         if (type == COMPARE_LIMIT && param_compare_limit_is_impossible(expr, param, key, value)) {
 871                 if (local_debug)
 872                         sm_msg("param_compare_limit_is_impossible: %d %s %s", param, key, value);
 873                 return 1;
 874         }
 875         return 0;
 876 }
 877
 878 static int func_type_mismatch(struct expression *expr, const char *value)
 879 {
 880         struct symbol *type;
 881
 882         /* This makes faking returns easier */
 883         if (!value || value[0] == '\0')
 884                 return 0;
 885
 886         while (expr->type == EXPR_ASSIGNMENT)
 887                 expr = strip_expr(expr->right);
 888
 889         /*
 890          * Short cut:  We only care about function pointers that are struct
 891          * members.
 892          *
 893          */
 894         if (expr->fn->type == EXPR_SYMBOL)
 895                 return 0;
 896
 897         type = get_type(expr->fn);
 898         if (!type)
 899                 return 0;
 900         if (type->type == SYM_PTR)
 901                 type = get_real_base_type(type);
 902
 903         if (strcmp(type_to_str(type), value) == 0)
 904                 return 0;
 905
 906         return 1;
 907 }
 908
 909 static int db_compare_callback(void *_info, int argc, char **argv, char **azColName)
 910 {
 911         struct db_callback_info *db_info = _info;
 912         struct range_list *var_rl = db_info->rl;
 913         struct range_list *ret_range;
 914         int type, param;
 915         char *ret_str, *key, *value;
 916         struct return_implies_callback *tmp;
 917         struct stree *stree;
 918         int return_id;
 919         int comparison;
 920
 921         if (argc != 6)
 922                 return 0;
 923
 924         return_id = atoi(argv[0]);
 925         ret_str = argv[1];
 926         type = atoi(argv[2]);
 927         param = atoi(argv[3]);
 928         key = argv[4];
 929         value = argv[5];
 930
 931         db_info->has_states = 1;
 932         if (db_info->prev_return_id != -1 && type == INTERNAL) {
 933                 set_other_side_state(db_info);
 934                 set_implied_states(db_info);
 935                 stree = __pop_fake_cur_stree();
 936                 if (!db_info->cull)
 937                         merge_fake_stree(&db_info->stree, stree);
 938                 free_stree(&stree);
 939                 __push_fake_cur_stree();
 940                 db_info->cull = 0;
 941         }
 942         db_info->prev_return_id = return_id;
 943
 944         if (type == INTERNAL && func_type_mismatch(db_info->expr, value))
 945                 db_info->cull = 1;
 946         if (db_info->cull)
 947                 return 0;
 948         if (type == CULL_PATH) {
 949                 db_info->cull = 1;
 950                 return 0;
 951         }
 952
 953         if (is_impossible_data(type, db_info->expr, param, key, value)) {
 954                 db_info->cull = 1;
 955                 return 0;
 956         }
 957
 958         call_results_to_rl(db_info->expr, get_type(strip_expr(db_info->expr)), ret_str, &ret_range);
 959         ret_range = cast_rl(get_type(db_info->expr), ret_range);
 960         if (!ret_range)
 961                 ret_range = alloc_whole_rl(get_type(db_info->expr));
 962
 963         comparison = db_info->comparison;
 964         if (db_info->left)
 965                 comparison = flip_comparison(comparison);
 966
 967         if (db_info->true_side) {
 968                 if (!possibly_true_rl(var_rl, comparison, ret_range))
 969                         return 0;
 970                 if (type == PARAM_LIMIT)
 971                         param_limit_implications(db_info->expr, param, key, value, &db_info->implied);
 972                 else if (type > PARAM_LIMIT)
 973                         set_implied_states(db_info);
 974                 filter_by_comparison(&var_rl, comparison, ret_range);
 975                 filter_by_comparison(&ret_range, flip_comparison(comparison), var_rl);
 976         } else {
 977                 if (!possibly_false_rl(var_rl, comparison, ret_range))
 978                         return 0;
 979                 if (type == PARAM_LIMIT)
 980                         param_limit_implications(db_info->expr, param, key, value, &db_info->implied);
 981                 else if (type > PARAM_LIMIT)
 982                         set_implied_states(db_info);
 983                 filter_by_comparison(&var_rl, negate_comparison(comparison), ret_range);
 984                 filter_by_comparison(&ret_range, flip_comparison(negate_comparison(comparison)), var_rl);
 985         }
 986
 987         handle_ret_equals_param(ret_str, ret_range, db_info->expr);
 988
 989         if (type == INTERNAL) {
 990                 set_state(-1, "unnull_path", NULL, &true_state);
 991                 __add_return_comparison(strip_expr(db_info->expr), ret_str);
 992                 __add_return_to_param_mapping(db_info->expr, ret_str);
 993                 store_return_state(db_info, ret_str, alloc_estate_rl(clone_rl(var_rl)));
 994         }
 995
 996         FOR_EACH_PTR(db_info->callbacks, tmp) {
 997                 if (tmp->type == type)
 998                         call_db_return_callback(tmp, db_info->expr, param, key, value);
 999         } END_FOR_EACH_PTR(tmp);
1000
1001         fake_return_assignment(db_info, type, param, key, value);
1002
1003         return 0;
1004 }
1005
1006 static void compare_db_return_states_callbacks(struct expression *left, int comparison, struct expression *right, struct stree *implied_true, struct stree *implied_false)
1007 {
1008         struct stree *orig_states;
1009         struct stree *stree;
1010         struct stree *true_states;
1011         struct stree *false_states;
1012         struct sm_state *sm;
1013         struct db_callback_info db_info = {};
1014         struct expression *var_expr;
1015         struct expression *call_expr;
1016         struct range_list *rl;
1017         int call_on_left;
1018
1019         orig_states = clone_stree(__get_cur_stree());
1020
1021         /* legacy cruft.  need to fix call_implies_callbacks(). */
1022         call_on_left = 1;
1023         call_expr = left;
1024         var_expr = right;
1025         if (left->type != EXPR_CALL) {
1026                 call_on_left = 0;
1027                 call_expr = right;
1028                 var_expr = left;
1029         }
1030
1031         get_absolute_rl(var_expr, &rl);
1032
1033         db_info.comparison = comparison;
1034         db_info.expr = call_expr;
1035         db_info.rl = rl;
1036         db_info.left = call_on_left;
1037         db_info.callbacks = db_return_states_list;
1038         db_info.var_expr = var_expr;
1039
1040         call_return_states_before_hooks();
1041
1042         db_info.true_side = 1;
1043         db_info.stree = NULL;
1044         db_info.prev_return_id = -1;
1045         __push_fake_cur_stree();
1046         sql_select_return_states("return_id, return, type, parameter, key, value",
1047                                  call_expr, db_compare_callback, &db_info);
1048         set_other_side_state(&db_info);
1049         set_implied_states(&db_info);
1050         stree = __pop_fake_cur_stree();
1051         if (!db_info.cull)
1052                 merge_fake_stree(&db_info.stree, stree);
1053         free_stree(&stree);
1054         true_states = db_info.stree;
1055         if (!true_states && db_info.has_states) {
1056                 __push_fake_cur_stree();
1057                 set_path_impossible();
1058                 true_states = __pop_fake_cur_stree();
1059         }
1060
1061         nullify_path();
1062         __unnullify_path();
1063         FOR_EACH_SM(orig_states, sm) {
1064                 __set_sm_cur_stree(sm);
1065         } END_FOR_EACH_SM(sm);
1066
1067         db_info.true_side = 0;
1068         db_info.stree = NULL;
1069         db_info.prev_return_id = -1;
1070         db_info.cull = 0;
1071         __push_fake_cur_stree();
1072         sql_select_return_states("return_id, return, type, parameter, key, value", call_expr,
1073                         db_compare_callback, &db_info);
1074         set_other_side_state(&db_info);
1075         set_implied_states(&db_info);
1076         stree = __pop_fake_cur_stree();
1077         if (!db_info.cull)
1078                 merge_fake_stree(&db_info.stree, stree);
1079         free_stree(&stree);
1080         false_states = db_info.stree;
1081         if (!false_states && db_info.has_states) {
1082                 __push_fake_cur_stree();
1083                 set_path_impossible();
1084                 false_states = __pop_fake_cur_stree();
1085         }
1086
1087         nullify_path();
1088         __unnullify_path();
1089         FOR_EACH_SM(orig_states, sm) {
1090                 __set_sm_cur_stree(sm);
1091         } END_FOR_EACH_SM(sm);
1092
1093         free_stree(&orig_states);
1094
1095         FOR_EACH_SM(true_states, sm) {
1096                 __set_true_false_sm(sm, NULL);
1097         } END_FOR_EACH_SM(sm);
1098         FOR_EACH_SM(false_states, sm) {
1099                 __set_true_false_sm(NULL, sm);
1100         } END_FOR_EACH_SM(sm);
1101
1102         free_stree(&true_states);
1103         free_stree(&false_states);
1104
1105         call_return_states_after_hooks(call_expr);
1106
1107         FOR_EACH_SM(implied_true, sm) {
1108                 __set_true_false_sm(sm, NULL);
1109         } END_FOR_EACH_SM(sm);
1110         FOR_EACH_SM(implied_false, sm) {
1111                 __set_true_false_sm(NULL, sm);
1112         } END_FOR_EACH_SM(sm);
1113 }
1114
1115 void function_comparison(struct expression *left, int comparison, struct expression *right)
1116 {
1117         struct expression *var_expr;
1118         struct expression *call_expr;
1119         struct stree *implied_true = NULL;
1120         struct stree *implied_false = NULL;
1121         struct range_list *rl;
1122         sval_t sval;
1123         int call_on_left;
1124
1125         if (unreachable())
1126                 return;
1127
1128         /* legacy cruft.  need to fix call_implies_callbacks(). */
1129         call_on_left = 1;
1130         call_expr = left;
1131         var_expr = right;
1132         if (left->type != EXPR_CALL) {
1133                 call_on_left = 0;
1134                 call_expr = right;
1135                 var_expr = left;
1136         }
1137
1138         get_absolute_rl(var_expr, &rl);
1139
1140         if (rl_to_sval(rl, &sval))
1141                 call_implies_callbacks(comparison, call_expr, sval, call_on_left, &implied_true, &implied_false);
1142
1143         compare_db_return_states_callbacks(left, comparison, right, implied_true, implied_false);
1144         free_stree(&implied_true);
1145         free_stree(&implied_false);
1146 }
1147
1148 static void call_ranged_return_hooks(struct db_callback_info *db_info)
1149 {
1150         struct call_back_list *call_backs;
1151         struct range_list *range_rl;
1152         struct expression *expr;
1153         struct fcall_back *tmp;
1154         char *fn;
1155
1156         expr = strip_expr(db_info->expr);
1157         while (expr->type == EXPR_ASSIGNMENT)
1158                 expr = strip_expr(expr->right);
1159         if (expr->type != EXPR_CALL ||
1160             expr->fn->type != EXPR_SYMBOL)
1161                 return;
1162
1163         fn = expr->fn->symbol_name->name;
1164
1165         call_backs = search_callback(func_hash, fn);
1166         FOR_EACH_PTR(call_backs, tmp) {
1167                 if (tmp->type != RANGED_CALL)
1168                         continue;
1169                 range_rl = alloc_rl(tmp->range->min, tmp->range->max);
1170                 range_rl = cast_rl(estate_type(db_info->ret_state), range_rl);
1171                 if (possibly_true_rl(range_rl, SPECIAL_EQUAL, estate_rl(db_info->ret_state)))
1172                         (tmp->u.ranged)(fn, expr, db_info->expr, tmp->info);
1173         } END_FOR_EACH_PTR(tmp);
1174
1175         FOR_EACH_PTR(call_backs, tmp) {
1176                 if (tmp->type != RANGED_EXACT)
1177                         continue;
1178                 if (!estate_rl(db_info->ret_state))
1179                         continue;
1180
1181                 range_rl = alloc_rl(tmp->range->min, tmp->range->max);
1182                 range_rl = cast_rl(estate_type(db_info->ret_state), range_rl);
1183
1184                 /*
1185                  * If there is an returned value out of range then this is not
1186                  * an exact match.  In other words, "0,4096-ptr_max" is not
1187                  * necessarily a valid match.
1188                  *
1189                  */
1190                 if (remove_range(estate_rl(db_info->ret_state),
1191                                  rl_min(range_rl), rl_max(range_rl)))
1192                         continue;
1193                 (tmp->u.ranged)(fn, expr, db_info->expr, tmp->info);
1194         } END_FOR_EACH_PTR(tmp);
1195 }
1196
1197 static int db_assign_return_states_callback(void *_info, int argc, char **argv, char **azColName)
1198 {
1199         struct db_callback_info *db_info = _info;
1200         struct range_list *ret_range;
1201         int type, param;
1202         char *ret_str, *key, *value;
1203         struct return_implies_callback *tmp;
1204         struct stree *stree;
1205         int return_id;
1206
1207         if (argc != 6)
1208                 return 0;
1209
1210         return_id = atoi(argv[0]);
1211         ret_str = argv[1];
1212         type = atoi(argv[2]);
1213         param = atoi(argv[3]);
1214         key = argv[4];
1215         value = argv[5];
1216
1217         if (db_info->prev_return_id != -1 && type == INTERNAL) {
1218                 call_ranged_return_hooks(db_info);
1219                 set_return_assign_state(db_info);
1220                 set_implied_states(db_info);
1221                 stree = __pop_fake_cur_stree();
1222                 if (!db_info->cull)
1223                         merge_fake_stree(&db_info->stree, stree);
1224                 free_stree(&stree);
1225                 __push_fake_cur_stree();
1226                 db_info->cull = 0;
1227         }
1228         db_info->prev_return_id = return_id;
1229
1230         if (type == INTERNAL && func_type_mismatch(db_info->expr, value))
1231                 db_info->cull = 1;
1232         if (db_info->cull)
1233                 return 0;
1234         if (type == CULL_PATH) {
1235                 db_info->cull = 1;
1236                 return 0;
1237         }
1238         if (is_impossible_data(type, db_info->expr, param, key, value)) {
1239                 db_info->cull = 1;
1240                 return 0;
1241         }
1242
1243         if (type == PARAM_LIMIT)
1244                 param_limit_implications(db_info->expr, param, key, value, &db_info->implied);
1245         else if (type > PARAM_LIMIT)
1246                 set_implied_states(db_info);
1247
1248         db_info->handled = 1;
1249         call_results_to_rl(db_info->expr->right, get_type(strip_expr(db_info->expr->right)), ret_str, &ret_range);
1250         if (!ret_range)
1251                 ret_range = alloc_whole_rl(get_type(strip_expr(db_info->expr->right)));
1252         ret_range = cast_rl(get_type(db_info->expr->right), ret_range);
1253
1254         if (type == INTERNAL) {
1255                 set_state(-1, "unnull_path", NULL, &true_state);
1256                 __add_return_comparison(strip_expr(db_info->expr->right), ret_str);
1257                 __add_comparison_info(db_info->expr->left, strip_expr(db_info->expr->right), ret_str);
1258                 __add_return_to_param_mapping(db_info->expr, ret_str);
1259                 store_return_state(db_info, ret_str, alloc_estate_rl(ret_range));
1260                 set_fresh_mtag_returns(db_info);
1261         }
1262
1263         FOR_EACH_PTR(db_return_states_list, tmp) {
1264                 if (tmp->type == type)
1265                         call_db_return_callback(tmp, db_info->expr, param, key, value);
1266         } END_FOR_EACH_PTR(tmp);
1267
1268         fake_return_assignment(db_info, type, param, key, value);
1269
1270         return 0;
1271 }
1272
1273 static int db_return_states_assign(struct expression *expr)
1274 {
1275         struct expression *right;
1276         struct sm_state *sm;
1277         struct stree *stree;
1278         struct db_callback_info db_info = {};
1279
1280         right = strip_expr(expr->right);
1281
1282         db_info.prev_return_id = -1;
1283         db_info.expr = expr;
1284         db_info.stree = NULL;
1285         db_info.handled = 0;
1286
1287         call_return_states_before_hooks();
1288
1289         __push_fake_cur_stree();
1290         sql_select_return_states("return_id, return, type, parameter, key, value",
1291                         right, db_assign_return_states_callback, &db_info);
1292         if (option_debug) {
1293                 sm_msg("%s return_id %d return_ranges %s",
1294                         db_info.cull ? "culled" : "merging",
1295                         db_info.prev_return_id,
1296                         db_info.ret_state ? db_info.ret_state->name : "'<empty>'");
1297         }
1298         if (db_info.handled)
1299                 call_ranged_return_hooks(&db_info);
1300         set_return_assign_state(&db_info);
1301         set_implied_states(&db_info);
1302         stree = __pop_fake_cur_stree();
1303         if (!db_info.cull)
1304                 merge_fake_stree(&db_info.stree, stree);
1305         free_stree(&stree);
1306
1307         if (!db_info.stree && db_info.cull) { /* this means we culled everything */
1308                 set_extra_expr_mod(expr->left, alloc_estate_whole(get_type(expr->left)));
1309                 set_path_impossible();
1310         }
1311         FOR_EACH_SM(db_info.stree, sm) {
1312                 __set_sm(sm);
1313         } END_FOR_EACH_SM(sm);
1314
1315         free_stree(&db_info.stree);
1316         call_return_states_after_hooks(right);
1317
1318         return db_info.handled;
1319 }
1320
1321 static int handle_implied_return(struct expression *expr)
1322 {
1323         struct range_list *rl;
1324
1325         if (!get_implied_return(expr->right, &rl))
1326                 return 0;
1327         rl = cast_rl(get_type(expr->left), rl);
1328         set_extra_expr_mod(expr->left, alloc_estate_rl(rl));
1329         return 1;
1330 }
1331
1332 static void match_assign_call(struct expression *expr)
1333 {
1334         struct call_back_list *call_backs;
1335         const char *fn;
1336         struct expression *right;
1337         int handled = 0;
1338         struct range_list *rl;
1339
1340         if (expr->op != '=')
1341                 return;
1342
1343         right = strip_expr(expr->right);
1344         if (right->fn->type != EXPR_SYMBOL || !right->fn->symbol) {
1345                 handled |= db_return_states_assign(expr);
1346                 if (!handled)
1347                         goto assigned_unknown;
1348                 return;
1349         }
1350         if (is_fake_call(right))
1351                 return;
1352
1353         fn = right->fn->symbol->ident->name;
1354         call_backs = search_callback(func_hash, (char *)fn);
1355
1356         /*
1357          * The ordering here is sort of important.
1358          * One example, of how this matters is that when we do:
1359          *
1360          *      len = strlen(str);
1361          *
1362          * That is handled by smatch_common_functions.c and smatch_strlen.c.
1363          * They use implied_return and function_assign_hook respectively.
1364          * We want to get the implied return first before we do the function
1365          * assignment hook otherwise we end up writing the wrong thing for len
1366          * in smatch_extra.c because we assume that it already holds the
1367          * strlen() when we haven't set it yet.
1368          */
1369
1370         if (db_return_states_assign(expr))
1371                 handled = 1;
1372         else
1373                 handled = assign_ranged_funcs(fn, expr, call_backs);
1374         handled |= handle_implied_return(expr);
1375
1376
1377         call_call_backs(call_backs, ASSIGN_CALL, fn, expr);
1378
1379         if (handled)
1380                 return;
1381
1382 assigned_unknown:
1383         get_absolute_rl(expr->right, &rl);
1384         rl = cast_rl(get_type(expr->left), rl);
1385         set_extra_expr_mod(expr->left, alloc_estate_rl(rl));
1386 }
1387
1388 static int db_return_states_callback(void *_info, int argc, char **argv, char **azColName)
1389 {
1390         struct db_callback_info *db_info = _info;
1391         struct range_list *ret_range;
1392         int type, param;
1393         char *ret_str, *key, *value;
1394         struct return_implies_callback *tmp;
1395         struct stree *stree;
1396         int return_id;
1397         char buf[64];
1398
1399         if (argc != 6)
1400                 return 0;
1401
1402         return_id = atoi(argv[0]);
1403         ret_str = argv[1];
1404         type = atoi(argv[2]);
1405         param = atoi(argv[3]);
1406         key = argv[4];
1407         value = argv[5];
1408
1409         if (db_info->prev_return_id != -1 && type == INTERNAL) {
1410                 call_ranged_return_hooks(db_info);
1411                 set_implied_states(db_info);
1412                 stree = __pop_fake_cur_stree();
1413                 if (!db_info->cull)
1414                         merge_fake_stree(&db_info->stree, stree);
1415                 free_stree(&stree);
1416                 __push_fake_cur_stree();
1417                 __unnullify_path();
1418                 db_info->cull = 0;
1419         }
1420         db_info->prev_return_id = return_id;
1421
1422         if (type == INTERNAL && func_type_mismatch(db_info->expr, value))
1423                 db_info->cull = 1;
1424         if (db_info->cull)
1425                 return 0;
1426         if (type == CULL_PATH) {
1427                 db_info->cull = 1;
1428                 return 0;
1429         }
1430         if (is_impossible_data(type, db_info->expr, param, key, value)) {
1431                 db_info->cull = 1;
1432                 return 0;
1433         }
1434
1435         if (type == PARAM_LIMIT)
1436                 param_limit_implications(db_info->expr, param, key, value, &db_info->implied);
1437         else if (type > PARAM_LIMIT)
1438                 set_implied_states(db_info);
1439
1440         call_results_to_rl(db_info->expr, get_type(strip_expr(db_info->expr)), ret_str, &ret_range);
1441         ret_range = cast_rl(get_type(db_info->expr), ret_range);
1442
1443         if (type == INTERNAL) {
1444                 struct smatch_state *state;
1445
1446                 set_state(-1, "unnull_path", NULL, &true_state);
1447                 __add_return_comparison(strip_expr(db_info->expr), ret_str);
1448                 __add_return_to_param_mapping(db_info->expr, ret_str);
1449                 /*
1450                  * We want to store the return values so that we can split the strees
1451                  * in smatch_db.c.  This uses set_state() directly because it's not a
1452                  * real smatch_extra state.
1453                  */
1454                 snprintf(buf, sizeof(buf), "return %p", db_info->expr);
1455                 state = alloc_estate_rl(ret_range);
1456                 set_state(SMATCH_EXTRA, buf, NULL, state);
1457                 store_return_state(db_info, ret_str, state);
1458         }
1459
1460         FOR_EACH_PTR(db_return_states_list, tmp) {
1461                 if (tmp->type == type)
1462                         call_db_return_callback(tmp, db_info->expr, param, key, value);
1463         } END_FOR_EACH_PTR(tmp);
1464
1465         fake_return_assignment(db_info, type, param, key, value);
1466
1467         return 0;
1468 }
1469
1470 static void db_return_states(struct expression *expr)
1471 {
1472         struct sm_state *sm;
1473         struct stree *stree;
1474         struct db_callback_info db_info = {};
1475
1476         if (!__get_cur_stree())  /* no return functions */
1477                 return;
1478
1479         db_info.prev_return_id = -1;
1480         db_info.expr = expr;
1481         db_info.stree = NULL;
1482
1483         call_return_states_before_hooks();
1484
1485         __push_fake_cur_stree();
1486         __unnullify_path();
1487         sql_select_return_states("return_id, return, type, parameter, key, value",
1488                         expr, db_return_states_callback, &db_info);
1489         call_ranged_return_hooks(&db_info);
1490         set_implied_states(&db_info);
1491         stree = __pop_fake_cur_stree();
1492         if (!db_info.cull)
1493                 merge_fake_stree(&db_info.stree, stree);
1494         free_stree(&stree);
1495
1496         FOR_EACH_SM(db_info.stree, sm) {
1497                 __set_sm(sm);
1498         } END_FOR_EACH_SM(sm);
1499
1500         free_stree(&db_info.stree);
1501         call_return_states_after_hooks(expr);
1502 }
1503
1504 static int is_condition_call(struct expression *expr)
1505 {
1506         struct expression *tmp;
1507
1508         FOR_EACH_PTR_REVERSE(big_condition_stack, tmp) {
1509                 if (expr == tmp || expr_get_parent_expr(expr) == tmp)
1510                         return 1;
1511                 if (tmp->pos.line < expr->pos.line)
1512                         return 0;
1513         } END_FOR_EACH_PTR_REVERSE(tmp);
1514
1515         return 0;
1516 }
1517
1518 static void db_return_states_call(struct expression *expr)
1519 {
1520         if (unreachable())
1521                 return;
1522
1523         if (is_assigned_call(expr) || is_fake_assigned_call(expr))
1524                 return;
1525         if (is_condition_call(expr))
1526                 return;
1527         db_return_states(expr);
1528 }
1529
1530 static void match_function_call(struct expression *expr)
1531 {
1532         call_function_hooks(expr, REGULAR_CALL);
1533         db_return_states_call(expr);
1534 }
1535
1536 static void match_macro_assign(struct expression *expr)
1537 {
1538         struct call_back_list *call_backs;
1539         const char *macro;
1540         struct expression *right;
1541
1542         right = strip_expr(expr->right);
1543         macro = get_macro_name(right->pos);
1544         call_backs = search_callback(func_hash, (char *)macro);
1545         if (!call_backs)
1546                 return;
1547         call_call_backs(call_backs, MACRO_ASSIGN, macro, expr);
1548         call_call_backs(call_backs, MACRO_ASSIGN_EXTRA, macro, expr);
1549 }
1550
1551 int get_implied_return(struct expression *expr, struct range_list **rl)
1552 {
1553         struct call_back_list *call_backs;
1554         struct fcall_back *tmp;
1555         int handled = 0;
1556         char *fn;
1557
1558         *rl = NULL;
1559
1560         expr = strip_expr(expr);
1561         fn = expr_to_var(expr->fn);
1562         if (!fn)
1563                 goto out;
1564
1565         call_backs = search_callback(func_hash, fn);
1566
1567         FOR_EACH_PTR(call_backs, tmp) {
1568                 if (tmp->type == IMPLIED_RETURN)
1569                         handled |= (tmp->u.implied_return)(expr, tmp->info, rl);
1570         } END_FOR_EACH_PTR(tmp);
1571
1572 out:
1573         free_string(fn);
1574         return handled;
1575 }
1576
1577 struct range_list *get_range_implications(const char *fn)
1578 {
1579         struct call_back_list *call_backs;
1580         struct range_list *ret = NULL;
1581         struct fcall_back *tmp;
1582
1583         call_backs = search_callback(func_hash, (char *)fn);
1584
1585         FOR_EACH_PTR(call_backs, tmp) {
1586                 if (tmp->type != RANGED_CALL &&
1587                     tmp->type != RANGED_EXACT)
1588                         continue;
1589                 add_ptr_list(&ret, tmp->range);
1590         } END_FOR_EACH_PTR(tmp);
1591
1592         return ret;
1593 }
1594
1595 void create_function_hook_hash(void)
1596 {
1597         func_hash = create_function_hashtable(5000);
1598 }
1599
1600 void register_function_hooks(int id)
1601 {
1602         add_hook(&match_function_call, CALL_HOOK_AFTER_INLINE);
1603         add_hook(&match_assign_call, CALL_ASSIGNMENT_HOOK);
1604         add_hook(&match_macro_assign, MACRO_ASSIGNMENT_HOOK);
1605 }