?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
db: fix call_implies for the in-memory database
[smatch.git] / smatch_db.c
blob1bb01b9569de3e2b5451f13282e2e0f21c16be3d
1 /*
2 * smatch/smatch_db.c
3 *
4 * Copyright (C) 2010 Dan Carpenter.
5 *
6 * Licensed under the Open Software License version 1.1
7 *
8 */
9
10 #include <string.h>
11 #include <errno.h>
12 #include <sqlite3.h>
13 #include <unistd.h>
14 #include "smatch.h"
15 #include "smatch_slist.h"
16 #include "smatch_extra.h"
17
18 static sqlite3 *db;
19 static sqlite3 *mem_db;
20
21 /* like run_sql() but for the in-memory database */
22 #define mem_sql(call_back, sql...) \
23 do { \
24 char sql_txt[1024]; \
25 int rc; \
26 char *err = NULL; \
27 \
28 snprintf(sql_txt, sizeof(sql_txt), sql); \
29 sm_debug("in-mem: %s\n", sql_txt); \
30 rc = sqlite3_exec(mem_db, sql_txt, call_back, 0, &err); \
31 if (rc != SQLITE_OK) { \
32 fprintf(stderr, "SQL error #2: %s\n", err); \
33 fprintf(stderr, "SQL: '%s'\n", sql_txt); \
34 } \
35 } while (0)
36
37 #define sql_insert(table, values...) \
38 do { \
39 if (__inline_fn) { \
40 char buf[1024]; \
41 char *err, *p = buf; \
42 int rc; \
43 \
44 p += snprintf(p, buf + sizeof(buf) - p, \
45 "insert into %s values (", #table); \
46 p += snprintf(p, buf + sizeof(buf) - p, values); \
47 p += snprintf(p, buf + sizeof(buf) - p, ");"); \
48 sm_debug("mem-db: %s\n", buf); \
49 rc = sqlite3_exec(mem_db, buf, NULL, 0, &err); \
50 if (rc != SQLITE_OK) { \
51 fprintf(stderr, "SQL error #2: %s\n", err); \
52 fprintf(stderr, "SQL: '%s'\n", buf); \
53 } \
54 return; \
55 } \
56 if (option_info) { \
57 sm_prefix(); \
58 sm_printf("SQL: insert into " #table " values (" values); \
59 sm_printf(");\n"); \
60 } \
61 } while (0)
62
63 struct def_callback {
64 int hook_type;
65 void (*callback)(const char *name, struct symbol *sym, char *key, char *value);
66 };
67 ALLOCATOR(def_callback, "definition db hook callbacks");
68 DECLARE_PTR_LIST(callback_list, struct def_callback);
69 static struct callback_list *callbacks;
70
71 struct member_info_callback {
72 int owner;
73 void (*callback)(struct expression *call, int param, char *printed_name, struct smatch_state *state);
74 };
75 ALLOCATOR(member_info_callback, "caller_info callbacks");
76 DECLARE_PTR_LIST(member_info_cb_list, struct member_info_callback);
77 static struct member_info_cb_list *member_callbacks;
78
79 struct returned_state_callback {
80 void (*callback)(int return_id, char *return_ranges, struct expression *return_expr, struct state_list *slist);
81 };
82 ALLOCATOR(returned_state_callback, "returned state callbacks");
83 DECLARE_PTR_LIST(returned_state_cb_list, struct returned_state_callback);
84 static struct returned_state_cb_list *returned_state_callbacks;
85
86 struct returned_member_callback {
87 int owner;
88 void (*callback)(int return_id, char *return_ranges, char *printed_name, struct smatch_state *state);
89 };
90 ALLOCATOR(returned_member_callback, "returned member callbacks");
91 DECLARE_PTR_LIST(returned_member_cb_list, struct returned_member_callback);
92 static struct returned_member_cb_list *returned_member_callbacks;
93
94 struct call_implies_callback {
95 int type;
96 void (*callback)(struct expression *arg, char *value);
97 };
98 ALLOCATOR(call_implies_callback, "call_implies callbacks");
99 DECLARE_PTR_LIST(call_implies_cb_list, struct call_implies_callback);
100 static struct call_implies_cb_list *call_implies_cb_list;
101
102 void sql_exec(int (*callback)(void*, int, char**, char**), const char *sql)
103 {
104 char *err = NULL;
105 int rc;
106
107 if (option_no_db || !db)
108 return;
109
110 rc = sqlite3_exec(db, sql, callback, 0, &err);
111 if (rc != SQLITE_OK) {
112 fprintf(stderr, "SQL error #2: %s\n", err);
113 fprintf(stderr, "SQL: '%s'\n", sql);
114 }
115 }
116
117 void sql_insert_return_states(int return_id, const char *return_ranges,
118 int type, int param, const char *key, const char *value)
119 {
120 sql_insert(return_states, "'%s', '%s', %lu, %d, '%s', %d, %d, %d, '%s', '%s'",
121 get_filename(), get_function(), (unsigned long)__inline_fn,
122 return_id, return_ranges, fn_static(), type, param, key, value);
123 }
124
125 void sql_insert_caller_info(struct expression *call, int type,
126 int param, const char *key, const char *value)
127 {
128 char *fn;
129
130 if (!option_info && !__inline_call)
131 return;
132
133 fn = get_fnptr_name(call->fn);
134 if (!fn)
135 return;
136
137 if (__inline_call) {
138 char buf[1024];
139 char *err;
140 int rc;
141
142 snprintf(buf, sizeof(buf), "insert into caller_info values ("
143 "'%s', '%s', '%s', %lu, %d, %d, %d, '%s', '%s');",
144 get_filename(), get_function(), fn,
145 (unsigned long)call, is_static(call->fn), type, param,
146 key, value);
147 sm_debug("in-mem: %s\n", buf);
148 rc = sqlite3_exec(mem_db, buf, NULL, 0, &err);
149 if (rc != SQLITE_OK) {
150 fprintf(stderr, "SQL error #2: %s\n", err);
151 fprintf(stderr, "SQL: '%s'\n", buf);
152 }
153 }
154
155 if (!option_info)
156 return;
157
158 if (strncmp(fn, "__builtin_", 10) == 0)
159 return;
160
161 sm_msg("SQL_caller_info: insert into caller_info values ("
162 "'%s', '%s', '%s', %%CALL_ID%%, %d, %d, %d, '%s', '%s');",
163 get_filename(), get_function(), fn, is_static(call->fn),
164 type, param, key, value);
165
166 free_string(fn);
167 }
168
169 void sql_insert_function_ptr(const char *fn, const char *struct_name)
170 {
171 sql_insert(function_ptr, "'%s', '%s', '%s'", get_filename(), fn,
172 struct_name);
173 }
174
175 void sql_insert_return_values(const char *return_values)
176 {
177 sql_insert(return_values, "'%s', '%s', %lu, %d, '%s'", get_filename(),
178 get_function(), (unsigned long)__inline_fn, fn_static(),
179 return_values);
180 }
181
182 void sql_insert_call_implies(int type, int param, int value)
183 {
184 sql_insert(call_implies, "'%s', '%s', %lu, %d, %d, %d, %d", get_filename(),
185 get_function(), (unsigned long)__inline_fn, fn_static(),
186 type, param, value);
187 }
188
189 void sql_insert_type_size(const char *member, int size)
190 {
191 sql_insert(type_size, "'%s', '%s', %d", get_filename(), member, size);
192 }
193
194 static char *get_static_filter(struct symbol *sym)
195 {
196 static char sql_filter[1024];
197
198 if (sym->ctype.modifiers & MOD_STATIC) {
199 snprintf(sql_filter, sizeof(sql_filter),
200 "file = '%s' and function = '%s' and static = '1'",
201 get_filename(), sym->ident->name);
202 } else {
203 snprintf(sql_filter, sizeof(sql_filter),
204 "function = '%s' and static = '0'", sym->ident->name);
205 }
206
207 return sql_filter;
208 }
209
210 void sql_select_return_states(const char *cols, struct expression *call,
211 int (*callback)(void*, int, char**, char**))
212 {
213 if (call->fn->type != EXPR_SYMBOL || !call->fn->symbol)
214 return;
215
216 if (inlinable(call->fn)) {
217 mem_sql(callback,
218 "select %s from return_states where call_id = '%lu';",
219 cols, (unsigned long)call);
220 return;
221 }
222
223 run_sql(callback, "select %s from return_states where %s;",
224 cols, get_static_filter(call->fn->symbol));
225 }
226
227 void sql_select_call_implies(const char *cols, struct expression *call,
228 int (*callback)(void*, int, char**, char**))
229 {
230 if (call->fn->type != EXPR_SYMBOL || !call->fn->symbol)
231 return;
232
233 if (inlinable(call->fn)) {
234 mem_sql(callback,
235 "select %s from call_implies where call_id = '%lu';",
236 cols, (unsigned long)call);
237 return;
238 }
239
240 run_sql(callback, "select %s from call_implies where %s;",
241 cols, get_static_filter(call->fn->symbol));
242 }
243
244 void sql_select_return_values(const char *cols, struct expression *call,
245 int (*callback)(void*, int, char**, char**))
246 {
247 if (call->fn->type != EXPR_SYMBOL || !call->fn->symbol)
248 return;
249
250 if (inlinable(call->fn)) {
251 mem_sql(callback,
252 "select %s from return_values where call_id = '%lu';",
253 cols, (unsigned long)call);
254 return;
255 }
256
257 run_sql(callback, "select %s from return_values where %s;",
258 cols, get_static_filter(call->fn->symbol));
259 }
260
261 void sql_select_caller_info(const char *cols, struct symbol *sym,
262 int (*callback)(void*, int, char**, char**))
263 {
264 if (__inline_fn) {
265 mem_sql(callback, "select %s from caller_info where call_id = %lu;",
266 cols, (unsigned long)__inline_fn);
267 return;
268 }
269
270 run_sql(callback,
271 "select %s from caller_info where %s order by call_id;",
272 cols, get_static_filter(sym));
273 }
274
275 void add_definition_db_callback(void (*callback)(const char *name, struct symbol *sym, char *key, char *value), int type)
276 {
277 struct def_callback *def_callback = __alloc_def_callback(0);
278
279 def_callback->hook_type = type;
280 def_callback->callback = callback;
281 add_ptr_list(&callbacks, def_callback);
282 }
283
284 /*
285 * These call backs are used when the --info option is turned on to print struct
286 * member information. For example foo->bar could have a state in
287 * smatch_extra.c and also check_user.c.
288 */
289 void add_member_info_callback(int owner, void (*callback)(struct expression *call, int param, char *printed_name, struct smatch_state *state))
290 {
291 struct member_info_callback *member_callback = __alloc_member_info_callback(0);
292
293 member_callback->owner = owner;
294 member_callback->callback = callback;
295 add_ptr_list(&member_callbacks, member_callback);
296 }
297
298 void add_returned_state_callback(void (*fn)(int return_id, char *return_ranges, struct expression *returned_expr, struct state_list *slist))
299 {
300 struct returned_state_callback *callback = __alloc_returned_state_callback(0);
301
302 callback->callback = fn;
303 add_ptr_list(&returned_state_callbacks, callback);
304 }
305
306 void add_returned_member_callback(int owner, void (*callback)(int return_id, char *return_ranges, char *printed_name, struct smatch_state *state))
307 {
308 struct returned_member_callback *member_callback = __alloc_returned_member_callback(0);
309
310 member_callback->owner = owner;
311 member_callback->callback = callback;
312 add_ptr_list(&returned_member_callbacks, member_callback);
313 }
314
315 void add_db_fn_call_callback(int type, void (*callback)(struct expression *arg, char *value))
316 {
317 struct call_implies_callback *cb = __alloc_call_implies_callback(0);
318
319 cb->type = type;
320 cb->callback = callback;
321 add_ptr_list(&call_implies_cb_list, cb);
322 }
323
324 static struct symbol *return_type;
325 static struct range_list *return_range_list;
326 static int db_return_callback(void *unused, int argc, char **argv, char **azColName)
327 {
328 if (argc != 1)
329 return 0;
330 if (option_debug)
331 sm_msg("return type %d", type_positive_bits(return_type));
332 str_to_rl(return_type, argv[0], &return_range_list);
333 return 0;
334 }
335
336 struct range_list *db_return_vals(struct expression *expr)
337 {
338 return_type = get_type(expr);
339 if (!return_type)
340 return NULL;
341 return_range_list = NULL;
342 sql_select_return_values("return", expr, db_return_callback);
343 return return_range_list;
344 }
345
346 static void match_call_marker(struct expression *expr)
347 {
348 /*
349 * we just want to record something in the database so that if we have
350 * two calls like: frob(4); frob(some_unkown); then on the receiving
351 * side we know that sometimes frob is called with unknown parameters.
352 */
353
354 sql_insert_caller_info(expr, INTERNAL, -1, "%call_marker%", "");
355 }
356
357 static void print_struct_members(struct expression *call, struct expression *expr, int param, struct state_list *slist,
358 void (*callback)(struct expression *call, int param, char *printed_name, struct smatch_state *state))
359 {
360 struct sm_state *sm;
361 char *name;
362 struct symbol *sym;
363 int len;
364 char printed_name[256];
365 int is_address = 0;
366
367 expr = strip_expr(expr);
368 if (expr->type == EXPR_PREOP && expr->op == '&') {
369 expr = strip_expr(expr->unop);
370 is_address = 1;
371 }
372
373 name = expr_to_var_sym(expr, &sym);
374 if (!name || !sym)
375 goto free;
376
377 len = strlen(name);
378 FOR_EACH_PTR(slist, sm) {
379 if (sm->sym != sym)
380 continue;
381 if (strcmp(name, sm->name) == 0) {
382 if (is_address)
383 snprintf(printed_name, sizeof(printed_name), "*$$");
384 else /* these are already handled. fixme: handle them here */
385 continue;
386 } else if (sm->name[0] == '*' && strcmp(name, sm->name + 1) == 0) {
387 snprintf(printed_name, sizeof(printed_name), "*$$");
388 } else if (strncmp(name, sm->name, len) == 0) {
389 if (is_address)
390 snprintf(printed_name, sizeof(printed_name), "$$->%s", sm->name + len + 1);
391 else
392 snprintf(printed_name, sizeof(printed_name), "$$%s", sm->name + len);
393 } else {
394 continue;
395 }
396 callback(call, param, printed_name, sm->state);
397 } END_FOR_EACH_PTR(sm);
398 free:
399 free_string(name);
400 }
401
402 static void match_call_info(struct expression *call)
403 {
404 struct member_info_callback *cb;
405 struct expression *arg;
406 struct state_list *slist;
407 char *name;
408 int i;
409
410 name = get_fnptr_name(call->fn);
411 if (!name)
412 return;
413
414 FOR_EACH_PTR(member_callbacks, cb) {
415 slist = get_all_states(cb->owner);
416 i = 0;
417 FOR_EACH_PTR(call->args, arg) {
418 print_struct_members(call, arg, i, slist, cb->callback);
419 i++;
420 } END_FOR_EACH_PTR(arg);
421 free_slist(&slist);
422 } END_FOR_EACH_PTR(cb);
423
424 free_string(name);
425 }
426
427 static int get_param(int param, char **name, struct symbol **sym)
428 {
429 struct symbol *arg;
430 int i;
431
432 i = 0;
433 FOR_EACH_PTR(cur_func_sym->ctype.base_type->arguments, arg) {
434 /*
435 * this is a temporary hack to work around a bug (I think in sparse?)
436 * 2.6.37-rc1:fs/reiserfs/journal.o
437 * If there is a function definition without parameter name found
438 * after a function implementation then it causes a crash.
439 * int foo() {}
440 * int bar(char *);
441 */
442 if (arg->ident->name < (char *)100)
443 continue;
444 if (i == param && arg->ident->name) {
445 *name = arg->ident->name;
446 *sym = arg;
447 return TRUE;
448 }
449 i++;
450 } END_FOR_EACH_PTR(arg);
451
452 return FALSE;
453 }
454
455 static struct state_list *final_states;
456 static int prev_func_id = -1;
457 static int db_callback(void *unused, int argc, char **argv, char **azColName)
458 {
459 int func_id;
460 long type;
461 long param;
462 char *name = NULL;
463 struct symbol *sym = NULL;
464 struct def_callback *def_callback;
465
466 if (argc != 5)
467 return 0;
468
469 func_id = atoi(argv[0]);
470 errno = 0;
471 type = strtol(argv[1], NULL, 10);
472 param = strtol(argv[2], NULL, 10);
473 if (errno)
474 return 0;
475
476 if (prev_func_id == -1)
477 prev_func_id = func_id;
478 if (func_id != prev_func_id) {
479 merge_slist(&final_states, __pop_fake_cur_slist());
480 __push_fake_cur_slist();
481 __unnullify_path();
482 prev_func_id = func_id;
483 }
484
485 if (type == INTERNAL)
486 return 0;
487 if (param >= 0 && !get_param(param, &name, &sym))
488 return 0;
489
490 FOR_EACH_PTR(callbacks, def_callback) {
491 if (def_callback->hook_type == type)
492 def_callback->callback(name, sym, argv[3], argv[4]);
493 } END_FOR_EACH_PTR(def_callback);
494
495 return 0;
496 }
497
498 static void get_direct_callers(struct symbol *sym)
499 {
500 sql_select_caller_info("call_id, type, parameter, key, value", sym,
501 db_callback);
502 }
503
504 static char *ptr_name;
505 static int ptr_cnt;
506 static int get_ptr_name(void *unused, int argc, char **argv, char **azColName)
507 {
508 if (ptr_cnt++) {
509 free_string(ptr_name);
510 ptr_name = NULL;
511 return 0;
512 }
513 if (!ptr_name)
514 ptr_name = alloc_string(argv[0]);
515 return 0;
516 }
517
518 static void get_function_pointer_callers(struct symbol *sym)
519 {
520 char sql_filter[1024];
521
522 if (sym->ctype.modifiers & MOD_STATIC) {
523 snprintf(sql_filter, 1024, "file = '%s' and function = '%s';",
524 get_filename(), sym->ident->name);
525 } else {
526 snprintf(sql_filter, 1024, "function = '%s';",
527 sym->ident->name);
528 }
529
530 ptr_name = NULL;
531 ptr_cnt = 0;
532 run_sql(get_ptr_name, "select ptr from function_ptr where %s", sql_filter);
533 if (!ptr_name)
534 return;
535
536 run_sql(db_callback, "select call_id, type, parameter, key, value from caller_info"
537 " where function = '%s' order by call_id", ptr_name);
538
539 free_string(ptr_name);
540 }
541
542 static void match_data_from_db(struct symbol *sym)
543 {
544 struct sm_state *sm;
545
546 if (!sym || !sym->ident || !sym->ident->name)
547 return;
548
549 __push_fake_cur_slist();
550 __unnullify_path();
551 prev_func_id = -1;
552
553 get_direct_callers(sym);
554 get_function_pointer_callers(sym);
555
556 merge_slist(&final_states, __pop_fake_cur_slist());
557
558 FOR_EACH_PTR(final_states, sm) {
559 __set_sm(sm);
560 } END_FOR_EACH_PTR(sm);
561
562 free_slist(&final_states);
563 }
564
565 static void match_function_assign(struct expression *expr)
566 {
567 struct expression *right = expr->right;
568 struct symbol *sym;
569 char *fn_name;
570 char *ptr_name;
571
572 if (right->type == EXPR_PREOP && right->op == '&')
573 right = strip_expr(right->unop);
574 if (right->type != EXPR_SYMBOL)
575 return;
576 sym = get_type(right);
577 if (!sym || sym->type != SYM_FN)
578 return;
579
580 fn_name = expr_to_var(right);
581 ptr_name = get_fnptr_name(expr->left);
582 if (!fn_name || !ptr_name)
583 goto free;
584
585 sql_insert_function_ptr(fn_name, ptr_name);
586
587 free:
588 free_string(fn_name);
589 free_string(ptr_name);
590 }
591
592 static struct expression *call_implies_call_expr;
593 static int call_implies_callbacks(void *unused, int argc, char **argv, char **azColName)
594 {
595 struct call_implies_callback *cb;
596 struct expression *arg = NULL;
597 int type;
598 int param;
599
600 if (argc != 4)
601 return 0;
602
603 type = atoi(argv[1]);
604 param = atoi(argv[2]);
605
606 FOR_EACH_PTR(call_implies_cb_list, cb) {
607 if (cb->type != type)
608 continue;
609 if (param != -1) {
610 arg = get_argument_from_call_expr(call_implies_call_expr->args, param);
611 if (!arg)
612 continue;
613 }
614 cb->callback(arg, argv[3]);
615 } END_FOR_EACH_PTR(cb);
616
617 return 0;
618 }
619
620 static void match_call_implies(struct expression *expr)
621 {
622 call_implies_call_expr = expr;
623 sql_select_call_implies("function, type, parameter, value", expr,
624 call_implies_callbacks);
625 return;
626 }
627
628 static void print_initializer_list(struct expression_list *expr_list,
629 struct symbol *struct_type)
630 {
631 struct expression *expr;
632 struct symbol *base_type;
633 char struct_name[256];
634
635 FOR_EACH_PTR(expr_list, expr) {
636 if (expr->type == EXPR_INDEX && expr->idx_expression && expr->idx_expression->type == EXPR_INITIALIZER) {
637 print_initializer_list(expr->idx_expression->expr_list, struct_type);
638 continue;
639 }
640 if (expr->type != EXPR_IDENTIFIER)
641 continue;
642 if (!expr->expr_ident)
643 continue;
644 if (!expr->ident_expression || !expr->ident_expression->symbol_name)
645 continue;
646 base_type = get_type(expr->ident_expression);
647 if (!base_type || base_type->type != SYM_FN)
648 continue;
649 snprintf(struct_name, sizeof(struct_name), "(struct %s)->%s",
650 struct_type->ident->name, expr->expr_ident->name);
651 sql_insert_function_ptr(expr->ident_expression->symbol_name->name,
652 struct_name);
653 } END_FOR_EACH_PTR(expr);
654 }
655
656 static void global_variable(struct symbol *sym)
657 {
658 struct symbol *struct_type;
659
660 if (!sym->ident)
661 return;
662 if (!sym->initializer || sym->initializer->type != EXPR_INITIALIZER)
663 return;
664 struct_type = get_base_type(sym);
665 if (!struct_type)
666 return;
667 if (struct_type->type == SYM_ARRAY) {
668 struct_type = get_base_type(struct_type);
669 if (!struct_type)
670 return;
671 }
672 if (struct_type->type != SYM_STRUCT || !struct_type->ident)
673 return;
674 print_initializer_list(sym->initializer->expr_list, struct_type);
675 }
676
677 static void match_return_info(int return_id, char *return_ranges, struct expression *expr, struct state_list *slist)
678 {
679 sql_insert_return_states(return_id, return_ranges, INTERNAL, -1, "", "");
680 }
681
682 static int return_id;
683 static void match_function_def(struct symbol *sym)
684 {
685 return_id = 0;
686 }
687
688 static void call_return_state_hooks_compare(struct expression *expr)
689 {
690 struct returned_state_callback *cb;
691 struct state_list *slist;
692 char *return_ranges;
693 int final_pass_orig = final_pass;
694
695 __push_fake_cur_slist();
696
697 final_pass = 0;
698 __split_whole_condition(expr);
699 final_pass = final_pass_orig;
700
701 return_ranges = alloc_sname("1");
702
703 return_id++;
704 slist = __get_cur_slist();
705 FOR_EACH_PTR(returned_state_callbacks, cb) {
706 cb->callback(return_id, return_ranges, expr, slist);
707 } END_FOR_EACH_PTR(cb);
708
709 __push_true_states();
710 __use_false_states();
711
712 return_ranges = alloc_sname("0");;
713 return_id++;
714 slist = __get_cur_slist();
715 FOR_EACH_PTR(returned_state_callbacks, cb) {
716 cb->callback(return_id, return_ranges, expr, slist);
717 } END_FOR_EACH_PTR(cb);
718
719 __merge_true_states();
720 __pop_fake_cur_slist();
721 }
722
723 static int call_return_state_hooks_split_possible(struct expression *expr)
724 {
725 struct returned_state_callback *cb;
726 struct state_list *slist;
727 struct range_list *rl;
728 char *return_ranges;
729 struct sm_state *sm;
730 struct sm_state *tmp;
731 int ret = 0;
732 int nr_possible, nr_states;
733
734 sm = get_sm_state_expr(SMATCH_EXTRA, expr);
735 if (!sm || !sm->merged)
736 return 0;
737
738 /* bail if it gets too complicated */
739 nr_possible = ptr_list_size((struct ptr_list *)sm->possible);
740 nr_states = ptr_list_size((struct ptr_list *)__get_cur_slist());
741 if (nr_possible >= 100)
742 return 0;
743 if (nr_states * nr_possible >= 1000)
744 return 0;
745
746 FOR_EACH_PTR(sm->possible, tmp) {
747 if (tmp->merged)
748 continue;
749
750 ret = 1;
751 __push_fake_cur_slist();
752
753 overwrite_states_using_pool(tmp);
754
755 rl = cast_rl(cur_func_return_type(), estate_rl(tmp->state));
756 return_ranges = show_rl(rl);
757
758 return_id++;
759 slist = __get_cur_slist();
760 FOR_EACH_PTR(returned_state_callbacks, cb) {
761 cb->callback(return_id, return_ranges, expr, slist);
762 } END_FOR_EACH_PTR(cb);
763
764 __pop_fake_cur_slist();
765 } END_FOR_EACH_PTR(tmp);
766
767 return ret;
768 }
769
770 static void call_return_state_hooks(struct expression *expr)
771 {
772 struct returned_state_callback *cb;
773 struct state_list *slist;
774 struct range_list *rl;
775 char *return_ranges;
776 int nr_states;
777
778 expr = strip_expr(expr);
779
780 if (!expr) {
781 return_ranges = alloc_sname("");
782 } else if (is_condition(expr)) {
783 call_return_state_hooks_compare(expr);
784 return;
785 } else if (call_return_state_hooks_split_possible(expr)) {
786 return;
787 } else if (get_implied_rl(expr, &rl)) {
788 rl = cast_rl(cur_func_return_type(), rl);
789 return_ranges = show_rl(rl);
790 } else {
791 rl = alloc_whole_rl(cur_func_return_type());
792 return_ranges = show_rl(rl);
793 }
794
795 return_id++;
796 slist = __get_cur_slist();
797 nr_states = ptr_list_size((struct ptr_list *)__get_cur_slist());
798 FOR_EACH_PTR(returned_state_callbacks, cb) {
799 if (nr_states < 10000)
800 cb->callback(return_id, return_ranges, expr, slist);
801 else
802 cb->callback(return_id, return_ranges, expr, NULL);
803 } END_FOR_EACH_PTR(cb);
804 }
805
806 static void print_returned_struct_members(int return_id, char *return_ranges, struct expression *expr, struct state_list *slist)
807 {
808 struct returned_member_callback *cb;
809 struct state_list *my_slist;
810 struct sm_state *sm;
811 struct symbol *type;
812 char *name;
813 char member_name[256];
814 int len;
815
816 type = get_type(expr);
817 if (!type || type->type != SYM_PTR)
818 return;
819 type = get_real_base_type(type);
820 if (!type || type->type != SYM_STRUCT)
821 return;
822 name = expr_to_var(expr);
823 if (!name)
824 return;
825
826 member_name[sizeof(member_name) - 1] = '\0';
827 strcpy(member_name, "$$");
828
829 len = strlen(name);
830 FOR_EACH_PTR(returned_member_callbacks, cb) {
831 my_slist = get_all_states_slist(cb->owner, slist);
832 FOR_EACH_PTR(my_slist, sm) {
833 if (strncmp(sm->name, name, len) != 0)
834 continue;
835 if (strncmp(sm->name + len, "->", 2) != 0)
836 continue;
837 strncpy(member_name + 2, sm->name + len, sizeof(member_name) - 2);
838 cb->callback(return_id, return_ranges, member_name, sm->state);
839 } END_FOR_EACH_PTR(sm);
840 free_slist(&my_slist);
841 } END_FOR_EACH_PTR(cb);
842
843 free_string(name);
844 }
845
846 static void reset_memdb(void)
847 {
848 mem_sql(NULL, "delete from caller_info;");
849 mem_sql(NULL, "delete from return_states;");
850 mem_sql(NULL, "delete from call_implies;");
851 mem_sql(NULL, "delete from return_values;");
852 }
853
854 static void match_end_func_info(struct symbol *sym)
855 {
856 if (__path_is_null())
857 return;
858 call_return_state_hooks(NULL);
859 if (!__inline_fn)
860 reset_memdb();
861 }
862
863 static void init_memdb(void)
864 {
865 char *err = NULL;
866 int rc;
867 const char *schema_files[] = {
868 "db/caller_info.schema",
869 "db/return_states.schema",
870 "db/call_implies.schema",
871 "db/return_values.schema",
872 };
873 static char buf[4096];
874 int fd;
875 int ret;
876 int i;
877
878 rc = sqlite3_open(":memory:", &mem_db);
879 if (rc != SQLITE_OK) {
880 printf("Error starting In-Memory database.");
881 return;
882 }
883
884 for (i = 0; i < ARRAY_SIZE(schema_files); i++) {
885 fd = open_data_file(schema_files[i]);
886 if (fd < 0)
887 continue;
888 ret = read(fd, buf, sizeof(buf));
889 if (ret == sizeof(buf)) {
890 printf("Schema file too large: %s (limit %zd bytes)",
891 schema_files[i], sizeof(buf));
892 }
893 buf[ret] = '\0';
894 rc = sqlite3_exec(mem_db, buf, NULL, 0, &err);
895 if (rc != SQLITE_OK) {
896 fprintf(stderr, "SQL error #2: %s\n", err);
897 fprintf(stderr, "%s\n", buf);
898 }
899 }
900 }
901
902 void open_smatch_db(void)
903 {
904 int rc;
905
906 if (option_no_db)
907 return;
908
909 init_memdb();
910
911 rc = sqlite3_open_v2("smatch_db.sqlite", &db, SQLITE_OPEN_READONLY, NULL);
912 if (rc != SQLITE_OK) {
913 option_no_db = 1;
914 return;
915 }
916 return;
917 }
918
919 void register_definition_db_callbacks(int id)
920 {
921 add_hook(&match_function_def, FUNC_DEF_HOOK);
922
923 add_hook(&match_call_info, FUNCTION_CALL_HOOK);
924 add_hook(&match_function_assign, ASSIGNMENT_HOOK);
925 // add_hook(&match_function_assign, GLOBAL_ASSIGNMENT_HOOK);
926 add_hook(&global_variable, BASE_HOOK);
927 add_hook(&global_variable, DECLARATION_HOOK);
928 add_returned_state_callback(match_return_info);
929 add_returned_state_callback(print_returned_struct_members);
930 add_hook(&call_return_state_hooks, RETURN_HOOK);
931 add_hook(&match_end_func_info, END_FUNC_HOOK);
932
933 add_hook(&match_data_from_db, FUNC_DEF_HOOK);
934 add_hook(&match_call_implies, CALL_HOOK_AFTER_INLINE);
935 }
936
937 void register_db_call_marker(int id)
938 {
939 add_hook(&match_call_marker, FUNCTION_CALL_HOOK);
940 }
941
942 char *get_variable_from_key(struct expression *arg, char *key, struct symbol **sym)
943 {
944 char buf[256];
945 char *tmp;
946
947 if (strcmp(key, "$$") == 0)
948 return expr_to_var_sym(arg, sym);
949
950 if (strcmp(key, "*$$") == 0) {
951 if (arg->type == EXPR_PREOP && arg->op == '&') {
952 arg = strip_expr(arg->unop);
953 return expr_to_var_sym(arg, sym);
954 } else {
955 tmp = expr_to_var_sym(arg, sym);
956 if (!tmp)
957 return NULL;
958 snprintf(buf, sizeof(buf), "*%s", tmp);
959 free_string(tmp);
960 return alloc_string(buf);
961 }
962 }
963
964 if (arg->type == EXPR_PREOP && arg->op == '&') {
965 arg = strip_expr(arg->unop);
966 tmp = expr_to_var_sym(arg, sym);
967 if (!tmp)
968 return NULL;
969 snprintf(buf, sizeof(buf), "%s.%s", tmp, key + 4);
970 return alloc_string(buf);
971 }
972
973 tmp = expr_to_var_sym(arg, sym);
974 if (!tmp)
975 return NULL;
976 snprintf(buf, sizeof(buf), "%s%s", tmp, key + 2);
977 free_string(tmp);
978 return alloc_string(buf);
979 }
980
981
Static analysis for C