check_sscanf_return.c

   1 /*
   2  * Copyright (C) 2021 Oracle.
   3  *
   4  * This program is free software; you can redistribute it and/or
   5  * modify it under the terms of the GNU General Public License
   6  * as published by the Free Software Foundation; either version 2
   7  * of the License, or (at your option) any later version.
   8  *
   9  * This program is distributed in the hope that it will be useful,
  10  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  11  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  12  * GNU General Public License for more details.
  13  *
  14  * You should have received a copy of the GNU General Public License
  15  * along with this program; if not, see http://www.gnu.org/copyleft/gpl.txt
  16  */
  17
  18 /*
  19  * This tries to find places which should probably return -EFAULT
  20  * but return the number of bytes to copy instead.
  21  */
  22
  23 #include <string.h>
  24 #include "smatch.h"
  25 #include "smatch_slist.h"
  26 #include "smatch_extra.h"
  27
  28 static int my_id;
  29
  30 static bool is_sscanf(struct expression *expr)
  31 {
  32         if (!expr || expr->type != EXPR_CALL)
  33                 return false;
  34         return sym_name_is("sscanf", expr->fn);
  35 }
  36
  37 static void match_return(struct expression *expr)
  38 {
  39         struct sm_state *sm, *tmp;
  40
  41         sm = get_assigned_sm(expr);
  42         if (!sm)
  43                 return;
  44         FOR_EACH_PTR(sm->possible, tmp) {
  45                 if (is_sscanf(tmp->state->data)) {
  46                         sm_warning("sscanf doesn't return error codes");
  47                         return;
  48                 }
  49         } END_FOR_EACH_PTR(tmp);
  50 }
  51
  52 void check_sscanf_return(int id)
  53 {
  54         if (option_project != PROJ_KERNEL)
  55                 return;
  56
  57         my_id = id;
  58         add_hook(&match_return, RETURN_HOOK);
  59 }