2 * smatch/smatch_buf_size.c
4 * Copyright (C) 2010 Dan Carpenter.
6 * Licensed under the Open Software License version 1.1
14 #include "smatch_slist.h"
15 #include "smatch_extra.h"
18 * This check has two smatch IDs.
19 * my_size_id - used to store the size of arrays.
20 * my_strlen_id - track the strlen() of buffers.
23 static int my_size_id
;
24 static int my_strlen_id
;
30 static struct limiter b0_l2
= {0, 2};
32 static void set_undefined(struct sm_state
*sm
)
34 if (sm
->state
!= &undefined
)
35 set_state(sm
->owner
, sm
->name
, sm
->sym
, &undefined
);
38 static struct smatch_state
*merge_func(struct smatch_state
*s1
, struct smatch_state
*s2
)
40 if (PTR_INT(s1
->data
) == PTR_INT(s2
->data
))
45 void set_param_buf_size(const char *name
, struct symbol
*sym
, char *key
, char *value
)
50 if (strncmp(key
, "$$", 2))
53 snprintf(fullname
, 256, "%s%s", name
, key
+ 2);
56 size
= strtoul(value
, NULL
, 10);
60 set_state(my_size_id
, fullname
, sym
, alloc_state_num(size
));
63 static int bytes_per_element(struct expression
*expr
)
68 if (expr
->type
== EXPR_STRING
)
70 type
= get_type(expr
);
74 if (type
->type
!= SYM_PTR
&& type
->type
!= SYM_ARRAY
)
77 type
= get_base_type(type
);
78 bpe
= bits_to_bytes(type
->bit_size
);
80 if (bpe
== -1) /* void pointer */
86 static int bytes_to_elements(struct expression
*expr
, int bytes
)
90 bpe
= bytes_per_element(expr
);
96 static int elements_to_bytes(struct expression
*expr
, int elements
)
100 bpe
= bytes_per_element(expr
);
101 return elements
* bpe
;
104 static int get_initializer_size(struct expression
*expr
)
106 switch (expr
->type
) {
108 return expr
->string
->length
;
109 case EXPR_INITIALIZER
: {
110 struct expression
*tmp
;
114 FOR_EACH_PTR(expr
->expr_list
, tmp
) {
115 if (tmp
->type
== EXPR_INDEX
&& tmp
->idx_to
> max
)
118 } END_FOR_EACH_PTR(tmp
);
124 return get_array_size(expr
);
130 static int db_size_callback(void *unused
, int argc
, char **argv
, char **azColName
)
133 db_size
= atoi(argv
[0]);
139 static int size_from_db(struct expression
*expr
)
141 int this_file_only
= 0;
147 name
= get_member_name(expr
);
148 if (!name
&& is_static(expr
)) {
149 name
= expr_to_var(expr
);
156 run_sql(db_size_callback
, "select size from type_size where type = '%s' and file = '%s'",
157 name
, get_filename());
165 run_sql(db_size_callback
, "select size from type_size where type = '%s'",
174 static void db_returns_buf_size(struct expression
*expr
, int param
, char *unused
, char *math
)
176 struct expression
*call
;
179 if (expr
->type
!= EXPR_ASSIGNMENT
)
181 call
= strip_expr(expr
->right
);
183 if (!parse_call_math(call
, math
, &sval
))
185 set_state_expr(my_size_id
, expr
->left
, alloc_state_num(sval
.value
));
188 int get_real_array_size(struct expression
*expr
)
193 if (expr
->type
== EXPR_BINOP
) /* array elements foo[5] */
196 type
= get_type(expr
);
197 if (!type
|| type
->type
!= SYM_ARRAY
)
200 if (!get_implied_value(type
->array_size
, &sval
))
203 /* People put one element arrays on the end of structs */
210 static int get_size_from_initializer(struct expression
*expr
)
212 if (expr
->type
!= EXPR_SYMBOL
|| !expr
->symbol
|| !expr
->symbol
->initializer
)
214 if (expr
->symbol
->initializer
== expr
) /* int a = a; */
216 return get_initializer_size(expr
->symbol
->initializer
);
219 static int get_stored_size_bytes(struct expression
*expr
)
221 struct smatch_state
*state
;
223 state
= get_state_expr(my_size_id
, expr
);
226 return PTR_INT(state
->data
);
229 static int get_stored_size_bytes_min(struct expression
*expr
)
231 struct sm_state
*sm
, *tmp
;
234 sm
= get_sm_state_expr(my_size_id
, expr
);
237 FOR_EACH_PTR(sm
->possible
, tmp
) {
238 if (PTR_INT(tmp
->state
->data
) <= 0)
240 if (PTR_INT(tmp
->state
->data
) < min
)
241 min
= PTR_INT(tmp
->state
->data
);
242 } END_FOR_EACH_PTR(tmp
);
247 static int get_bytes_from_address(struct expression
*expr
)
254 if (expr
->type
!= EXPR_PREOP
|| expr
->op
!= '&')
256 type
= get_type(expr
);
260 if (type
->type
== SYM_PTR
)
261 type
= get_base_type(type
);
263 ret
= bits_to_bytes(type
->bit_size
);
267 return 0; /* ignore char pointers */
272 static int get_size_from_strlen(struct expression
*expr
)
274 struct smatch_state
*state
;
277 state
= get_state_expr(my_strlen_id
, expr
);
278 if (!state
|| !state
->data
)
280 if (!get_implied_max((struct expression
*)state
->data
, &len
))
282 if (sval_is_max(len
))
284 if (len
.uvalue
> INT_MAX
- 1 || len
.value
< 0)
286 return len
.value
+ 1; /* add one because strlen doesn't include the NULL */
289 static struct expression
*remove_addr_fluff(struct expression
*expr
)
291 struct expression
*tmp
;
294 expr
= strip_expr(expr
);
296 /* remove '&' and '*' operations that cancel */
297 while (expr
&& expr
->type
== EXPR_PREOP
&& expr
->op
== '&') {
298 tmp
= strip_expr(expr
->unop
);
299 if (tmp
->type
!= EXPR_PREOP
)
303 expr
= strip_expr(tmp
->unop
);
309 /* "foo + 0" is just "foo" */
310 if (expr
->type
== EXPR_BINOP
&& expr
->op
== '+' &&
311 get_value(expr
->right
, &sval
) && sval
.value
== 0)
317 static int is_last_member_of_struct(struct symbol
*sym
, struct ident
*member
)
323 FOR_EACH_PTR_REVERSE(sym
->symbol_list
, tmp
) {
324 if (i
++ || !tmp
->ident
)
326 if (tmp
->ident
== member
)
329 } END_FOR_EACH_PTR_REVERSE(tmp
);
334 static int get_stored_size_end_struct_bytes(struct expression
*expr
)
339 struct smatch_state
*state
;
342 if (expr
->type
== EXPR_BINOP
) /* array elements foo[5] */
345 type
= get_type(expr
);
346 if (!type
|| type
->type
!= SYM_ARRAY
)
349 if (!get_implied_value(type
->array_size
, &sval
))
352 if (sval
.value
!= 0 && sval
.value
!= 1)
355 name
= expr_to_var_sym(expr
, &sym
);
357 if (!sym
|| !sym
->ident
|| !sym
->ident
->name
)
362 if (sym
->type
!= SYM_NODE
)
365 state
= get_state(my_size_id
, sym
->ident
->name
, sym
);
366 if (!state
|| !state
->data
)
369 sym
= get_real_base_type(sym
);
370 if (!sym
|| sym
->type
!= SYM_PTR
)
372 sym
= get_real_base_type(sym
);
373 if (!sym
|| sym
->type
!= SYM_STRUCT
)
375 if (!is_last_member_of_struct(sym
, expr
->member
))
378 return PTR_INT(state
->data
) - bits_to_bytes(sym
->bit_size
) +
379 bits_to_bytes(type
->bit_size
);
382 int get_array_size_bytes(struct expression
*expr
)
386 expr
= remove_addr_fluff(expr
);
390 /* strcpy(foo, "BAR"); */
391 if (expr
->type
== EXPR_STRING
)
392 return expr
->string
->length
;
395 size
= get_real_array_size(expr
);
397 return elements_to_bytes(expr
, size
);
399 /* buf = malloc(1024); */
400 size
= get_stored_size_bytes(expr
);
404 size
= get_stored_size_end_struct_bytes(expr
);
408 /* char *foo = "BAR" */
409 size
= get_size_from_initializer(expr
);
411 return elements_to_bytes(expr
, size
);
413 size
= get_bytes_from_address(expr
);
417 /* if (strlen(foo) > 4) */
418 size
= get_size_from_strlen(expr
);
422 return size_from_db(expr
);
425 int get_array_size_bytes_min(struct expression
*expr
)
430 size
= get_array_size_bytes(expr
);
432 tmp
= get_stored_size_bytes_min(expr
);
433 if (size
<= 0 || (tmp
>= 1 && tmp
< size
))
438 int get_array_size(struct expression
*expr
)
442 bytes
= get_array_size_bytes(expr
);
443 return bytes_to_elements(expr
, bytes
);
446 static void match_strlen_condition(struct expression
*expr
)
448 struct expression
*left
;
449 struct expression
*right
;
450 struct expression
*str
= NULL
;
452 int strlen_right
= 0;
454 struct smatch_state
*true_state
= NULL
;
455 struct smatch_state
*false_state
= NULL
;
457 if (expr
->type
!= EXPR_COMPARE
)
459 left
= strip_expr(expr
->left
);
460 right
= strip_expr(expr
->right
);
462 if (left
->type
== EXPR_CALL
&& sym_name_is("strlen", left
->fn
)) {
463 str
= get_argument_from_call_expr(left
->args
, 0);
466 if (right
->type
== EXPR_CALL
&& sym_name_is("strlen", right
->fn
)) {
467 str
= get_argument_from_call_expr(right
->args
, 0);
471 if (!strlen_left
&& !strlen_right
)
473 if (strlen_left
&& strlen_right
)
477 if (!get_value(right
, &sval
))
481 if (!get_value(left
, &sval
))
485 if (expr
->op
== SPECIAL_EQUAL
) {
486 set_true_false_states_expr(my_size_id
, str
, alloc_state_num(sval
.value
+ 1), NULL
);
489 if (expr
->op
== SPECIAL_NOTEQUAL
) {
490 set_true_false_states_expr(my_size_id
, str
, NULL
, alloc_state_num(sval
.value
+ 1));
496 case SPECIAL_UNSIGNED_LT
:
498 true_state
= alloc_state_num(sval
.value
);
500 false_state
= alloc_state_num(sval
.value
+ 1);
503 case SPECIAL_UNSIGNED_LTE
:
505 true_state
= alloc_state_num(sval
.value
+ 1);
507 false_state
= alloc_state_num(sval
.value
);
510 case SPECIAL_UNSIGNED_GTE
:
512 false_state
= alloc_state_num(sval
.value
);
514 true_state
= alloc_state_num(sval
.value
+ 1);
517 case SPECIAL_UNSIGNED_GT
:
519 false_state
= alloc_state_num(sval
.value
+ 1);
521 true_state
= alloc_state_num(sval
.value
);
524 set_true_false_states_expr(my_size_id
, str
, true_state
, false_state
);
527 static struct expression
*strip_ampersands(struct expression
*expr
)
531 if (expr
->type
!= EXPR_PREOP
)
535 type
= get_type(expr
->unop
);
536 if (!type
|| type
->type
!= SYM_ARRAY
)
541 static void match_array_assignment(struct expression
*expr
)
543 struct expression
*left
;
544 struct expression
*right
;
549 left
= strip_expr(expr
->left
);
550 right
= strip_expr(expr
->right
);
551 right
= strip_ampersands(right
);
552 array_size
= get_array_size_bytes(right
);
554 set_state_expr(my_size_id
, left
, alloc_state_num(array_size
));
557 static void info_record_alloction(struct expression
*buffer
, struct expression
*size
)
565 name
= get_member_name(buffer
);
566 if (!name
&& is_static(buffer
))
567 name
= expr_to_var(buffer
);
570 if (get_implied_value(size
, &sval
))
571 sql_insert_type_size(name
, sval
.value
);
573 sql_insert_type_size(name
, -1);
578 static void match_alloc(const char *fn
, struct expression
*expr
, void *_size_arg
)
580 int size_arg
= PTR_INT(_size_arg
);
581 struct expression
*right
;
582 struct expression
*arg
;
585 right
= strip_expr(expr
->right
);
586 arg
= get_argument_from_call_expr(right
->args
, size_arg
);
588 info_record_alloction(expr
->left
, arg
);
590 if (!get_implied_value(arg
, &bytes
))
592 set_state_expr(my_size_id
, expr
->left
, alloc_state_num(bytes
.value
));
595 static void match_calloc(const char *fn
, struct expression
*expr
, void *unused
)
597 struct expression
*right
;
598 struct expression
*arg
;
602 right
= strip_expr(expr
->right
);
603 arg
= get_argument_from_call_expr(right
->args
, 0);
604 if (!get_implied_value(arg
, &elements
))
606 arg
= get_argument_from_call_expr(right
->args
, 1);
607 if (!get_implied_value(arg
, &size
))
609 set_state_expr(my_size_id
, expr
->left
, alloc_state_num(elements
.value
* size
.value
));
612 static void match_strlen(const char *fn
, struct expression
*expr
, void *unused
)
614 struct expression
*right
;
615 struct expression
*str
;
616 struct expression
*len_expr
;
618 struct smatch_state
*state
;
620 right
= strip_expr(expr
->right
);
621 str
= get_argument_from_call_expr(right
->args
, 0);
622 len_expr
= strip_expr(expr
->left
);
624 len_name
= expr_to_var(len_expr
);
628 state
= __alloc_smatch_state(0);
629 state
->name
= len_name
;
630 state
->data
= len_expr
;
631 set_state_expr(my_strlen_id
, str
, state
);
634 static void match_limited(const char *fn
, struct expression
*expr
, void *_limiter
)
636 struct limiter
*limiter
= (struct limiter
*)_limiter
;
637 struct expression
*dest
;
638 struct expression
*size_expr
;
641 dest
= get_argument_from_call_expr(expr
->args
, limiter
->buf_arg
);
642 size_expr
= get_argument_from_call_expr(expr
->args
, limiter
->limit_arg
);
643 if (!get_implied_max(size_expr
, &size
))
645 set_state_expr(my_size_id
, dest
, alloc_state_num(size
.value
));
648 static void match_strcpy(const char *fn
, struct expression
*expr
, void *unused
)
650 struct expression fake_assign
;
652 fake_assign
.op
= '=';
653 fake_assign
.left
= get_argument_from_call_expr(expr
->args
, 0);
654 fake_assign
.right
= get_argument_from_call_expr(expr
->args
, 1);
655 match_array_assignment(&fake_assign
);
658 static void match_strndup(const char *fn
, struct expression
*expr
, void *unused
)
660 struct expression
*fn_expr
;
661 struct expression
*size_expr
;
664 fn_expr
= strip_expr(expr
->right
);
665 size_expr
= get_argument_from_call_expr(fn_expr
->args
, 1);
666 if (!get_implied_max(size_expr
, &size
))
669 /* It's easy to forget space for the NUL char */
671 set_state_expr(my_size_id
, expr
->left
, alloc_state_num(size
.value
));
674 static void match_call(struct expression
*expr
)
676 struct expression
*arg
;
681 FOR_EACH_PTR(expr
->args
, arg
) {
682 bytes
= get_array_size_bytes(arg
);
686 snprintf(buf
, sizeof(buf
), "%d", bytes
);
687 sql_insert_caller_info(expr
, BUF_SIZE
, i
, "$$", buf
);
690 } END_FOR_EACH_PTR(arg
);
693 static void struct_member_callback(struct expression
*call
, int param
, char *printed_name
, struct smatch_state
*state
)
695 if (state
== &merged
)
697 sql_insert_caller_info(call
, BUF_SIZE
, param
, printed_name
, state
->name
);
700 void register_buf_size(int id
)
704 add_definition_db_callback(set_param_buf_size
, BUF_SIZE
);
705 add_db_return_states_callback(BUF_SIZE
, &db_returns_buf_size
);
707 add_function_assign_hook("malloc", &match_alloc
, INT_PTR(0));
708 add_function_assign_hook("calloc", &match_calloc
, NULL
);
709 add_function_assign_hook("memdup", &match_alloc
, INT_PTR(1));
710 if (option_project
== PROJ_KERNEL
) {
711 add_function_assign_hook("kmalloc", &match_alloc
, INT_PTR(0));
712 add_function_assign_hook("kzalloc", &match_alloc
, INT_PTR(0));
713 add_function_assign_hook("vmalloc", &match_alloc
, INT_PTR(0));
714 add_function_assign_hook("__vmalloc", &match_alloc
, INT_PTR(0));
715 add_function_assign_hook("kcalloc", &match_calloc
, NULL
);
716 add_function_assign_hook("kmalloc_array", &match_calloc
, NULL
);
717 add_function_assign_hook("drm_malloc_ab", &match_calloc
, NULL
);
718 add_function_assign_hook("drm_calloc_large", &match_calloc
, NULL
);
719 add_function_assign_hook("sock_kmalloc", &match_alloc
, INT_PTR(1));
720 add_function_assign_hook("kmemdup", &match_alloc
, INT_PTR(1));
721 add_function_assign_hook("kmemdup_user", &match_alloc
, INT_PTR(1));
722 add_function_assign_hook("dma_alloc_attrs", &match_alloc
, INT_PTR(1));
724 add_hook(&match_array_assignment
, ASSIGNMENT_HOOK
);
725 add_hook(&match_strlen_condition
, CONDITION_HOOK
);
726 add_function_assign_hook("strlen", &match_strlen
, NULL
);
728 add_function_assign_hook("strndup", match_strndup
, NULL
);
729 if (option_project
== PROJ_KERNEL
)
730 add_function_assign_hook("kstrndup", match_strndup
, NULL
);
732 add_modification_hook(my_size_id
, &set_undefined
);
734 add_merge_hook(my_size_id
, &merge_func
);
737 void register_strlen(int id
)
740 add_modification_hook(my_strlen_id
, &set_undefined
);
741 add_merge_hook(my_strlen_id
, &merge_func
);
744 void register_buf_size_late(int id
)
746 add_function_hook("strlcpy", &match_limited
, &b0_l2
);
747 add_function_hook("strlcat", &match_limited
, &b0_l2
);
748 add_function_hook("memscan", &match_limited
, &b0_l2
);
750 add_function_hook("strcpy", &match_strcpy
, NULL
);
752 add_hook(&match_call
, FUNCTION_CALL_HOOK
);
753 add_member_info_callback(my_size_id
, struct_member_callback
);