smatch_buf_size.c

   1 /*
   2  * Copyright (C) 2010 Dan Carpenter.
   3  *
   4  * This program is free software; you can redistribute it and/or
   5  * modify it under the terms of the GNU General Public License
   6  * as published by the Free Software Foundation; either version 2
   7  * of the License, or (at your option) any later version.
   8  *
   9  * This program is distributed in the hope that it will be useful,
  10  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  11  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  12  * GNU General Public License for more details.
  13  *
  14  * You should have received a copy of the GNU General Public License
  15  * along with this program; if not, see http://www.gnu.org/copyleft/gpl.txt
  16  */
  17
  18 #include <stdlib.h>
  19 #include <errno.h>
  20 #include "parse.h"
  21 #include "smatch.h"
  22 #include "smatch_slist.h"
  23 #include "smatch_extra.h"
  24 #include "smatch_function_hashtable.h"
  25
  26 #define UNKNOWN_SIZE (-1)
  27
  28 static int my_size_id;
  29
  30 struct limiter {
  31         int buf_arg;
  32         int limit_arg;
  33 };
  34 static struct limiter b0_l2 = {0, 2};
  35
  36 static DEFINE_HASHTABLE_INSERT(insert_func, char, int);
  37 static DEFINE_HASHTABLE_SEARCH(search_func, char, int);
  38 static struct hashtable *allocation_funcs;
  39
  40 static char *get_fn_name(struct expression *expr)
  41 {
  42         if (expr->type != EXPR_CALL)
  43                 return NULL;
  44         if (expr->fn->type != EXPR_SYMBOL)
  45                 return NULL;
  46         return expr_to_var(expr->fn);
  47 }
  48
  49 static int is_allocation_function(struct expression *expr)
  50 {
  51         char *func;
  52         int ret = 0;
  53
  54         func = get_fn_name(expr);
  55         if (!func)
  56                 return 0;
  57         if (search_func(allocation_funcs, func))
  58                 ret = 1;
  59         free_string(func);
  60         return ret;
  61 }
  62
  63 static void add_allocation_function(const char *func, void *call_back, int param)
  64 {
  65         insert_func(allocation_funcs, (char *)func, (int *)1);
  66         add_function_assign_hook(func, call_back, INT_PTR(param));
  67 }
  68
  69 static int estate_to_size(struct smatch_state *state)
  70 {
  71         sval_t sval;
  72
  73         if (!state || !estate_rl(state))
  74                 return 0;
  75         sval = estate_max(state);
  76         return sval.value;
  77 }
  78
  79 static struct smatch_state *size_to_estate(int size)
  80 {
  81         sval_t sval;
  82
  83         sval.type = &int_ctype;
  84         sval.value = size;
  85
  86         return alloc_estate_sval(sval);
  87 }
  88
  89 static struct range_list *size_to_rl(int size)
  90 {
  91         sval_t sval;
  92
  93         sval.type = &int_ctype;
  94         sval.value = size;
  95
  96         return alloc_rl(sval, sval);
  97 }
  98
  99 static struct smatch_state *unmatched_size_state(struct sm_state *sm)
 100 {
 101         return size_to_estate(UNKNOWN_SIZE);
 102 }
 103
 104 static void set_size_undefined(struct sm_state *sm, struct expression *mod_expr)
 105 {
 106         set_state(sm->owner, sm->name, sm->sym, size_to_estate(UNKNOWN_SIZE));
 107 }
 108
 109 static struct smatch_state *merge_size_func(struct smatch_state *s1, struct smatch_state *s2)
 110 {
 111         return merge_estates(s1, s2);
 112 }
 113
 114 void set_param_buf_size(const char *name, struct symbol *sym, char *key, char *value)
 115 {
 116         struct range_list *rl = NULL;
 117         struct smatch_state *state;
 118         char fullname[256];
 119
 120         if (strncmp(key, "$", 1) != 0)
 121                 return;
 122
 123         snprintf(fullname, 256, "%s%s", name, key + 1);
 124
 125         str_to_rl(&int_ctype, value, &rl);
 126         if (!rl || is_whole_rl(rl))
 127                 return;
 128         state = alloc_estate_rl(rl);
 129         set_state(my_size_id, fullname, sym, state);
 130 }
 131
 132 static int bytes_per_element(struct expression *expr)
 133 {
 134         struct symbol *type;
 135
 136         if (!expr)
 137                 return 0;
 138         if (expr->type == EXPR_STRING)
 139                 return 1;
 140         type = get_type(expr);
 141         if (!type)
 142                 return 0;
 143
 144         if (type->type != SYM_PTR && type->type != SYM_ARRAY)
 145                 return 0;
 146
 147         type = get_base_type(type);
 148         return type_bytes(type);
 149 }
 150
 151 static int bytes_to_elements(struct expression *expr, int bytes)
 152 {
 153         int bpe;
 154
 155         bpe = bytes_per_element(expr);
 156         if (bpe == 0)
 157                 return 0;
 158         return bytes / bpe;
 159 }
 160
 161 static int elements_to_bytes(struct expression *expr, int elements)
 162 {
 163         int bpe;
 164
 165         bpe = bytes_per_element(expr);
 166         return elements * bpe;
 167 }
 168
 169 static int get_initializer_size(struct expression *expr)
 170 {
 171         switch (expr->type) {
 172         case EXPR_STRING:
 173                 return expr->string->length;
 174         case EXPR_INITIALIZER: {
 175                 struct expression *tmp;
 176                 int i = 0;
 177
 178                 FOR_EACH_PTR(expr->expr_list, tmp) {
 179                         if (tmp->type == EXPR_INDEX) {
 180                                 if (tmp->idx_to >= i)
 181                                         i = tmp->idx_to;
 182                                 else
 183                                         continue;
 184                         }
 185
 186                         i++;
 187                 } END_FOR_EACH_PTR(tmp);
 188                 return i;
 189         }
 190         case EXPR_SYMBOL:
 191                 return get_array_size(expr);
 192         }
 193         return 0;
 194 }
 195
 196 static struct range_list *db_size_rl;
 197 static int db_size_callback(void *unused, int argc, char **argv, char **azColName)
 198 {
 199         struct range_list *tmp = NULL;
 200
 201         if (!db_size_rl) {
 202                 str_to_rl(&int_ctype, argv[0], &db_size_rl);
 203         } else {
 204                 str_to_rl(&int_ctype, argv[0], &tmp);
 205                 db_size_rl = rl_union(db_size_rl, tmp);
 206         }
 207         return 0;
 208 }
 209
 210 static struct range_list *size_from_db(struct expression *expr)
 211 {
 212         int this_file_only = 0;
 213         char *name;
 214
 215         name = get_member_name(expr);
 216         if (!name && is_static(expr)) {
 217                 name = expr_to_var(expr);
 218                 this_file_only = 1;
 219         }
 220         if (!name)
 221                 return 0;
 222
 223         if (this_file_only) {
 224                 db_size_rl = NULL;
 225                 run_sql(db_size_callback, NULL,
 226                         "select size from function_type_size where type = '%s' and file = '%s';",
 227                         name, get_filename());
 228                 if (db_size_rl)
 229                         return db_size_rl;
 230                 return 0;
 231         }
 232
 233         db_size_rl = NULL;
 234         run_sql(db_size_callback, NULL,
 235                 "select size from type_size where type = '%s';",
 236                 name);
 237         return db_size_rl;
 238 }
 239
 240 static void db_returns_buf_size(struct expression *expr, int param, char *unused, char *math)
 241 {
 242         struct expression *call;
 243         sval_t sval;
 244
 245         if (expr->type != EXPR_ASSIGNMENT)
 246                 return;
 247         call = strip_expr(expr->right);
 248
 249         if (!parse_call_math(call, math, &sval))
 250                 return;
 251         set_state_expr(my_size_id, expr->left, size_to_estate(sval.value));
 252 }
 253
 254 int get_real_array_size(struct expression *expr)
 255 {
 256         struct symbol *type;
 257         sval_t sval;
 258
 259         if (!expr)
 260                 return 0;
 261         if (expr->type == EXPR_BINOP) /* array elements foo[5] */
 262                 return 0;
 263
 264         type = get_type(expr);
 265         if (!type)
 266                 return 0;
 267         if (!type || type->type != SYM_ARRAY)
 268                 return 0;
 269
 270         if (!get_implied_value(type->array_size, &sval))
 271                 return 0;
 272
 273         /* People put one element arrays on the end of structs */
 274         if (sval.value == 1)
 275                 return 0;
 276
 277         return sval.value;
 278 }
 279
 280 static int get_size_from_initializer(struct expression *expr)
 281 {
 282         if (expr->type != EXPR_SYMBOL || !expr->symbol || !expr->symbol->initializer)
 283                 return 0;
 284         if (expr->symbol->initializer == expr) /* int a = a; */
 285                 return 0;
 286         return get_initializer_size(expr->symbol->initializer);
 287 }
 288
 289 static struct range_list *get_stored_size_bytes(struct expression *expr)
 290 {
 291         struct smatch_state *state;
 292
 293         state = get_state_expr(my_size_id, expr);
 294         if (!state)
 295                 return NULL;
 296         return estate_rl(state);
 297 }
 298
 299 static int get_bytes_from_address(struct expression *expr)
 300 {
 301         struct symbol *type;
 302         int ret;
 303
 304         if (!option_spammy)
 305                 return 0;
 306         if (expr->type != EXPR_PREOP || expr->op != '&')
 307                 return 0;
 308         type = get_type(expr);
 309         if (!type)
 310                 return 0;
 311
 312         if (type->type == SYM_PTR)
 313                 type = get_base_type(type);
 314
 315         ret = type_bytes(type);
 316         if (ret == 1)
 317                 return 0;  /* ignore char pointers */
 318
 319         return ret;
 320 }
 321
 322 static struct expression *remove_addr_fluff(struct expression *expr)
 323 {
 324         struct expression *tmp;
 325         sval_t sval;
 326
 327         expr = strip_expr(expr);
 328
 329         /* remove '&' and '*' operations that cancel */
 330         while (expr && expr->type == EXPR_PREOP && expr->op == '&') {
 331                 tmp = strip_expr(expr->unop);
 332                 if (tmp->type != EXPR_PREOP)
 333                         break;
 334                 if (tmp->op != '*')
 335                         break;
 336                 expr = strip_expr(tmp->unop);
 337         }
 338
 339         if (!expr)
 340                 return NULL;
 341
 342         /* "foo + 0" is just "foo" */
 343         if (expr->type == EXPR_BINOP && expr->op == '+' &&
 344             get_value(expr->right, &sval) && sval.value == 0)
 345                 return expr->left;
 346
 347         return expr;
 348 }
 349
 350 static int is_last_member_of_struct(struct symbol *sym, struct ident *member)
 351 {
 352         struct symbol *tmp;
 353         int i;
 354
 355         i = 0;
 356         FOR_EACH_PTR_REVERSE(sym->symbol_list, tmp) {
 357                 if (i++ || !tmp->ident)
 358                         return 0;
 359                 if (tmp->ident == member)
 360                         return 1;
 361                 return 0;
 362         } END_FOR_EACH_PTR_REVERSE(tmp);
 363
 364         return 0;
 365 }
 366
 367 static int last_member_is_resizable(struct symbol *sym)
 368 {
 369         struct symbol *last_member;
 370         struct symbol *type;
 371         sval_t sval;
 372
 373         last_member = last_ptr_list((struct ptr_list *)sym->symbol_list);
 374         if (!last_member || !last_member->ident)
 375                 return 0;
 376
 377         type = get_real_base_type(last_member);
 378         if (type->type == SYM_STRUCT)
 379                 return last_member_is_resizable(type);
 380         if (type->type != SYM_ARRAY)
 381                 return 0;
 382
 383         if (!get_implied_value(type->array_size, &sval))
 384                 return 0;
 385
 386         if (sval.value != 0 && sval.value != 1)
 387                 return 0;
 388
 389         return 1;
 390 }
 391
 392 static int get_stored_size_end_struct_bytes(struct expression *expr)
 393 {
 394         struct symbol *sym;
 395         struct symbol *base_sym;
 396         struct smatch_state *state;
 397
 398         if (expr->type == EXPR_BINOP) /* array elements foo[5] */
 399                 return 0;
 400
 401         if (expr->type == EXPR_PREOP && expr->op == '&')
 402                 expr = strip_parens(expr->unop);
 403
 404         sym = expr_to_sym(expr);
 405         if (!sym || !sym->ident)
 406                 return 0;
 407         if (!type_bytes(sym))
 408                 return 0;
 409         if (sym->type != SYM_NODE)
 410                 return 0;
 411
 412         base_sym = get_real_base_type(sym);
 413         if (!base_sym || base_sym->type != SYM_PTR)
 414                 return 0;
 415         base_sym = get_real_base_type(base_sym);
 416         if (!base_sym || base_sym->type != SYM_STRUCT)
 417                 return 0;
 418
 419         if (!is_last_member_of_struct(base_sym, expr->member))
 420                 return 0;
 421         if (!last_member_is_resizable(base_sym))
 422                 return 0;
 423
 424         state = get_state(my_size_id, sym->ident->name, sym);
 425         if (!estate_to_size(state))
 426                 return 0;
 427
 428         return estate_to_size(state) - type_bytes(base_sym) + type_bytes(get_type(expr));
 429 }
 430
 431 static struct range_list *alloc_int_rl(int value)
 432 {
 433         sval_t sval = {
 434                 .type = &int_ctype,
 435                 {.value = value},
 436         };
 437
 438         return alloc_rl(sval, sval);
 439 }
 440
 441 struct range_list *get_array_size_bytes_rl(struct expression *expr)
 442 {
 443         int declared_size = 0;
 444         struct range_list *ret = NULL;
 445         int size;
 446
 447         expr = remove_addr_fluff(expr);
 448         if (!expr)
 449                 return NULL;
 450
 451         /* "BAR" */
 452         if (expr->type == EXPR_STRING)
 453                 return alloc_int_rl(expr->string->length);
 454
 455         if (expr->type == EXPR_BINOP && expr->op == '+') {
 456                 sval_t offset;
 457
 458                 if (!get_implied_value(expr->right, &offset))
 459                         return NULL;
 460                 size = get_array_size_bytes(expr->left);
 461                 if (size <= 0)
 462                         return NULL;
 463                 return alloc_int_rl(size - offset.value);
 464         }
 465
 466         /* buf[4] */
 467         size = get_real_array_size(expr);
 468         if (size)
 469                 declared_size = elements_to_bytes(expr, size);
 470
 471         /* buf = malloc(1024); */
 472         ret = get_stored_size_bytes(expr);
 473         if (ret) {
 474                 if (declared_size)
 475                         return rl_union(ret, alloc_int_rl(size));
 476                 return ret;
 477         }
 478         if (declared_size)
 479                 return alloc_int_rl(declared_size);
 480
 481         size = get_stored_size_end_struct_bytes(expr);
 482         if (size)
 483                 return alloc_int_rl(size);
 484
 485         /* char *foo = "BAR" */
 486         size = get_size_from_initializer(expr);
 487         if (size)
 488                 return alloc_int_rl(elements_to_bytes(expr, size));
 489
 490         size = get_bytes_from_address(expr);
 491         if (size)
 492                 return alloc_int_rl(size);
 493
 494         /* if (strlen(foo) > 4) */
 495         size = get_size_from_strlen(expr);
 496         if (size)
 497                 return alloc_int_rl(size);
 498
 499         ret = size_from_db(expr);
 500         if (ret)
 501                 return ret;
 502
 503         return NULL;
 504 }
 505
 506 int get_array_size_bytes(struct expression *expr)
 507 {
 508         struct range_list *rl;
 509         sval_t sval;
 510
 511         rl = get_array_size_bytes_rl(expr);
 512         if (!rl_to_sval(rl, &sval))
 513                 return 0;
 514         if (sval.uvalue >= INT_MAX)
 515                 return 0;
 516         return sval.value;
 517 }
 518
 519 int get_array_size_bytes_max(struct expression *expr)
 520 {
 521         struct range_list *rl;
 522         sval_t bytes;
 523
 524         rl = get_array_size_bytes_rl(expr);
 525         if (!rl)
 526                 return 0;
 527         bytes = rl_min(rl);
 528         if (bytes.value < 0)
 529                 return 0;
 530         bytes = rl_max(rl);
 531         if (bytes.uvalue >= INT_MAX)
 532                 return 0;
 533         return bytes.value;
 534 }
 535
 536 int get_array_size_bytes_min(struct expression *expr)
 537 {
 538         struct range_list *rl;
 539         struct data_range *range;
 540
 541         rl = get_array_size_bytes_rl(expr);
 542         if (!rl)
 543                 return 0;
 544
 545         FOR_EACH_PTR(rl, range) {
 546                 if (range->min.value <= 0)
 547                         return 0;
 548                 if (range->max.value <= 0)
 549                         return 0;
 550                 if (range->min.uvalue >= INT_MAX)
 551                         return 0;
 552                 return range->min.value;
 553         } END_FOR_EACH_PTR(range);
 554
 555         return 0;
 556 }
 557
 558 int get_array_size(struct expression *expr)
 559 {
 560         if (!expr)
 561                 return 0;
 562         return bytes_to_elements(expr, get_array_size_bytes_max(expr));
 563 }
 564
 565 static void match_strlen_condition(struct expression *expr)
 566 {
 567         struct expression *left;
 568         struct expression *right;
 569         struct expression *str = NULL;
 570         int strlen_left = 0;
 571         int strlen_right = 0;
 572         sval_t sval;
 573         struct smatch_state *true_state = NULL;
 574         struct smatch_state *false_state = NULL;
 575
 576         if (expr->type != EXPR_COMPARE)
 577                 return;
 578         left = strip_expr(expr->left);
 579         right = strip_expr(expr->right);
 580
 581         if (left->type == EXPR_CALL && sym_name_is("strlen", left->fn)) {
 582                 str = get_argument_from_call_expr(left->args, 0);
 583                 strlen_left = 1;
 584         }
 585         if (right->type == EXPR_CALL && sym_name_is("strlen", right->fn)) {
 586                 str = get_argument_from_call_expr(right->args, 0);
 587                 strlen_right = 1;
 588         }
 589
 590         if (!strlen_left && !strlen_right)
 591                 return;
 592         if (strlen_left && strlen_right)
 593                 return;
 594
 595         if (strlen_left) {
 596                 if (!get_value(right, &sval))
 597                         return;
 598         }
 599         if (strlen_right) {
 600                 if (!get_value(left, &sval))
 601                         return;
 602         }
 603
 604         /* FIXME:  why are we using my_size_id here instead of my_strlen_id */
 605
 606         if (expr->op == SPECIAL_EQUAL) {
 607                 set_true_false_states_expr(my_size_id, str, size_to_estate(sval.value + 1), NULL);
 608                 return;
 609         }
 610         if (expr->op == SPECIAL_NOTEQUAL) {
 611                 set_true_false_states_expr(my_size_id, str, NULL, size_to_estate(sval.value + 1));
 612                 return;
 613         }
 614
 615         switch (expr->op) {
 616         case '<':
 617         case SPECIAL_UNSIGNED_LT:
 618                 if (strlen_left)
 619                         true_state = size_to_estate(sval.value);
 620                 else
 621                         false_state = size_to_estate(sval.value + 1);
 622                 break;
 623         case SPECIAL_LTE:
 624         case SPECIAL_UNSIGNED_LTE:
 625                 if (strlen_left)
 626                         true_state = size_to_estate(sval.value + 1);
 627                 else
 628                         false_state = size_to_estate(sval.value);
 629                 break;
 630         case SPECIAL_GTE:
 631         case SPECIAL_UNSIGNED_GTE:
 632                 if (strlen_left)
 633                         false_state = size_to_estate(sval.value);
 634                 else
 635                         true_state = size_to_estate(sval.value + 1);
 636                 break;
 637         case '>':
 638         case SPECIAL_UNSIGNED_GT:
 639                 if (strlen_left) {
 640                         true_state = size_to_estate(-1);
 641                         false_state = size_to_estate(sval.value + 1);
 642                 } else
 643                         true_state = size_to_estate(sval.value);
 644                 break;
 645         }
 646         set_true_false_states_expr(my_size_id, str, true_state, false_state);
 647 }
 648
 649 static struct expression *strip_ampersands(struct expression *expr)
 650 {
 651         struct symbol *type;
 652
 653         if (expr->type != EXPR_PREOP)
 654                 return expr;
 655         if (expr->op != '&')
 656                 return expr;
 657         type = get_type(expr->unop);
 658         if (!type || type->type != SYM_ARRAY)
 659                 return expr;
 660         return expr->unop;
 661 }
 662
 663 static void info_record_alloction(struct expression *buffer, struct range_list *rl)
 664 {
 665         char *name;
 666
 667         if (!option_info)
 668                 return;
 669
 670         name = get_member_name(buffer);
 671         if (!name && is_static(buffer))
 672                 name = expr_to_var(buffer);
 673         if (!name)
 674                 return;
 675         if (rl && !is_whole_rl(rl))
 676                 sql_insert_function_type_size(name, show_rl(rl));
 677         else
 678                 sql_insert_function_type_size(name, "(-1)");
 679
 680         free_string(name);
 681 }
 682
 683 static void store_alloc(struct expression *expr, struct range_list *rl)
 684 {
 685         struct symbol *type;
 686
 687         rl = clone_rl(rl); // FIXME!!!
 688         set_state_expr(my_size_id, expr, alloc_estate_rl(rl));
 689
 690         type = get_type(expr);
 691         if (!type)
 692                 return;
 693         if (type->type != SYM_PTR)
 694                 return;
 695         type = get_real_base_type(type);
 696         if (!type)
 697                 return;
 698         if (type == &void_ctype)
 699                 return;
 700         if (type->type != SYM_BASETYPE)
 701                 return;
 702
 703         info_record_alloction(expr, rl);
 704 }
 705
 706 static void match_array_assignment(struct expression *expr)
 707 {
 708         struct expression *left;
 709         struct expression *right;
 710         char *left_member, *right_member;
 711         struct range_list *rl;
 712         sval_t sval;
 713
 714         if (expr->op != '=')
 715                 return;
 716         left = strip_expr(expr->left);
 717         right = strip_expr(expr->right);
 718         right = strip_ampersands(right);
 719
 720         if (!is_pointer(left))
 721                 return;
 722         if (is_allocation_function(right))
 723                 return;
 724
 725         left_member = get_member_name(left);
 726         right_member = get_member_name(right);
 727         if (left_member && right_member && strcmp(left_member, right_member) == 0) {
 728                 free_string(left_member);
 729                 free_string(right_member);
 730                 return;
 731         }
 732         free_string(left_member);
 733         free_string(right_member);
 734
 735         if (get_implied_value(right, &sval) && sval.value == 0) {
 736                 rl = alloc_int_rl(0);
 737                 goto store;
 738         }
 739
 740         rl = get_array_size_bytes_rl(right);
 741
 742 store:
 743         store_alloc(left, rl);
 744 }
 745
 746 static void match_alloc(const char *fn, struct expression *expr, void *_size_arg)
 747 {
 748         int size_arg = PTR_INT(_size_arg);
 749         struct expression *right;
 750         struct expression *arg;
 751         struct range_list *rl;
 752
 753         right = strip_expr(expr->right);
 754         arg = get_argument_from_call_expr(right->args, size_arg);
 755         get_absolute_rl(arg, &rl);
 756         rl = cast_rl(&int_ctype, rl);
 757         store_alloc(expr->left, rl);
 758 }
 759
 760 static void match_calloc(const char *fn, struct expression *expr, void *unused)
 761 {
 762         struct expression *right;
 763         struct expression *arg;
 764         sval_t elements;
 765         sval_t size;
 766
 767         right = strip_expr(expr->right);
 768         arg = get_argument_from_call_expr(right->args, 0);
 769         if (!get_implied_value(arg, &elements))
 770                 return; // FIXME!!!
 771         arg = get_argument_from_call_expr(right->args, 1);
 772         if (get_implied_value(arg, &size))
 773                 store_alloc(expr->left, size_to_rl(elements.value * size.value));
 774         else
 775                 store_alloc(expr->left, size_to_rl(-1));
 776 }
 777
 778 static void match_limited(const char *fn, struct expression *expr, void *_limiter)
 779 {
 780         struct limiter *limiter = (struct limiter *)_limiter;
 781         struct expression *dest;
 782         struct expression *size_expr;
 783         sval_t size;
 784
 785         dest = get_argument_from_call_expr(expr->args, limiter->buf_arg);
 786         size_expr = get_argument_from_call_expr(expr->args, limiter->limit_arg);
 787         if (!get_implied_max(size_expr, &size))
 788                 return;
 789         set_state_expr(my_size_id, dest, size_to_estate(size.value));
 790 }
 791
 792 static void match_strcpy(const char *fn, struct expression *expr, void *unused)
 793 {
 794         struct expression fake_assign;
 795
 796         fake_assign.op = '=';
 797         fake_assign.left = get_argument_from_call_expr(expr->args, 0);
 798         fake_assign.right = get_argument_from_call_expr(expr->args, 1);
 799         match_array_assignment(&fake_assign);
 800 }
 801
 802 static void match_strndup(const char *fn, struct expression *expr, void *unused)
 803 {
 804         struct expression *fn_expr;
 805         struct expression *size_expr;
 806         sval_t size;
 807
 808         fn_expr = strip_expr(expr->right);
 809         size_expr = get_argument_from_call_expr(fn_expr->args, 1);
 810         if (get_implied_max(size_expr, &size)) {
 811                 size.value++;
 812                 store_alloc(expr->left, size_to_rl(size.value));
 813         } else {
 814                 store_alloc(expr->left, size_to_rl(-1));
 815         }
 816
 817 }
 818
 819 static void match_call(struct expression *expr)
 820 {
 821         struct expression *arg;
 822         struct symbol *type;
 823         struct range_list *rl;
 824         int i;
 825
 826         i = -1;
 827         FOR_EACH_PTR(expr->args, arg) {
 828                 i++;
 829                 type = get_type(arg);
 830                 if (!type || (type->type != SYM_PTR && type->type != SYM_ARRAY))
 831                         continue;
 832                 rl = get_array_size_bytes_rl(arg);
 833                 if (!rl)
 834                         continue;
 835                 if (is_whole_rl(rl))
 836                         continue;
 837                 sql_insert_caller_info(expr, BUF_SIZE, i, "$", show_rl(rl));
 838         } END_FOR_EACH_PTR(arg);
 839 }
 840
 841 static void struct_member_callback(struct expression *call, int param, char *printed_name, struct sm_state *sm)
 842 {
 843         if (sm->state == &merged ||
 844             strcmp(sm->state->name, "(-1)") == 0 ||
 845             strcmp(sm->state->name, "empty") == 0 ||
 846             strcmp(sm->state->name, "0") == 0)
 847                 return;
 848         sql_insert_caller_info(call, BUF_SIZE, param, printed_name, sm->state->name);
 849 }
 850
 851 void register_buf_size(int id)
 852 {
 853         my_size_id = id;
 854
 855         add_unmatched_state_hook(my_size_id, &unmatched_size_state);
 856
 857         select_caller_info_hook(set_param_buf_size, BUF_SIZE);
 858         select_return_states_hook(BUF_SIZE, &db_returns_buf_size);
 859
 860         allocation_funcs = create_function_hashtable(100);
 861         add_allocation_function("malloc", &match_alloc, 0);
 862         add_allocation_function("calloc", &match_calloc, 0);
 863         add_allocation_function("memdup", &match_alloc, 1);
 864         add_allocation_function("realloc", &match_alloc, 1);
 865         if (option_project == PROJ_KERNEL) {
 866                 add_allocation_function("kmalloc", &match_alloc, 0);
 867                 add_allocation_function("kzalloc", &match_alloc, 0);
 868                 add_allocation_function("vmalloc", &match_alloc, 0);
 869                 add_allocation_function("__vmalloc", &match_alloc, 0);
 870                 add_allocation_function("kcalloc", &match_calloc, 0);
 871                 add_allocation_function("kmalloc_array", &match_calloc, 0);
 872                 add_allocation_function("drm_malloc_ab", &match_calloc, 0);
 873                 add_allocation_function("drm_calloc_large", &match_calloc, 0);
 874                 add_allocation_function("sock_kmalloc", &match_alloc, 1);
 875                 add_allocation_function("kmemdup", &match_alloc, 1);
 876                 add_allocation_function("kmemdup_user", &match_alloc, 1);
 877                 add_allocation_function("dma_alloc_attrs", &match_alloc, 1);
 878                 add_allocation_function("pci_alloc_consistent", &match_alloc, 1);
 879                 add_allocation_function("pci_alloc_coherent", &match_alloc, 1);
 880                 add_allocation_function("devm_kmalloc", &match_alloc, 1);
 881                 add_allocation_function("devm_kzalloc", &match_alloc, 1);
 882                 add_allocation_function("krealloc", &match_alloc, 1);
 883         }
 884         add_hook(&match_strlen_condition, CONDITION_HOOK);
 885
 886         add_allocation_function("strndup", match_strndup, 0);
 887         if (option_project == PROJ_KERNEL)
 888                 add_allocation_function("kstrndup", match_strndup, 0);
 889
 890         add_modification_hook(my_size_id, &set_size_undefined);
 891
 892         add_merge_hook(my_size_id, &merge_size_func);
 893 }
 894
 895 void register_buf_size_late(int id)
 896 {
 897         /* has to happen after match_alloc() */
 898         add_hook(&match_array_assignment, ASSIGNMENT_HOOK);
 899
 900         add_function_hook("strlcpy", &match_limited, &b0_l2);
 901         add_function_hook("strlcat", &match_limited, &b0_l2);
 902         add_function_hook("memscan", &match_limited, &b0_l2);
 903
 904         add_function_hook("strcpy", &match_strcpy, NULL);
 905
 906         add_hook(&match_call, FUNCTION_CALL_HOOK);
 907         add_member_info_callback(my_size_id, struct_member_callback);
 908 }