2 * Copyright (C) 2009 Dan Carpenter.
4 * This program is free software; you can redistribute it and/or
5 * modify it under the terms of the GNU General Public License
6 * as published by the Free Software Foundation; either version 2
7 * of the License, or (at your option) any later version.
9 * This program is distributed in the hope that it will be useful,
10 * but WITHOUT ANY WARRANTY; without even the implied warranty of
11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12 * GNU General Public License for more details.
14 * You should have received a copy of the GNU General Public License
15 * along with this program; if not, see http://www.gnu.org/copyleft/gpl.txt
19 * There are several types of function hooks:
20 * add_function_hook() - For any time a function is called.
21 * add_function_assign_hook() - foo = the_function().
22 * add_implied_return_hook() - Calculates the implied return value.
23 * add_macro_assign_hook() - foo = the_macro().
24 * return_implies_state() - For when a return value of 1 implies locked
25 * and 0 implies unlocked. etc. etc.
32 #include "smatch_slist.h"
33 #include "smatch_extra.h"
34 #include "smatch_function_hashtable.h"
38 struct data_range
*range
;
41 implication_hook
*ranged
;
42 implied_return_hook
*implied_return
;
47 ALLOCATOR(fcall_back
, "call backs");
48 DECLARE_PTR_LIST(call_back_list
, struct fcall_back
);
50 DEFINE_FUNCTION_HASHTABLE_STATIC(callback
, struct fcall_back
, struct call_back_list
);
51 static struct hashtable
*func_hash
;
53 #define REGULAR_CALL 0
56 #define IMPLIED_RETURN 3
57 #define MACRO_ASSIGN 4
58 #define MACRO_ASSIGN_EXTRA 5
60 struct return_implies_callback
{
62 return_implies_hook
*callback
;
64 ALLOCATOR(return_implies_callback
, "return_implies callbacks");
65 DECLARE_PTR_LIST(db_implies_list
, struct return_implies_callback
);
66 static struct db_implies_list
*db_return_states_list
;
68 typedef void (void_fn
)(void);
69 DECLARE_PTR_LIST(void_fn_list
, void_fn
*);
70 static struct void_fn_list
*return_states_before
;
71 static struct void_fn_list
*return_states_after
;
73 static struct fcall_back
*alloc_fcall_back(int type
, void *call_back
,
76 struct fcall_back
*cb
;
78 cb
= __alloc_fcall_back(0);
80 cb
->u
.call_back
= call_back
;
85 void add_function_hook(const char *look_for
, func_hook
*call_back
, void *info
)
87 struct fcall_back
*cb
;
89 cb
= alloc_fcall_back(REGULAR_CALL
, call_back
, info
);
90 add_callback(func_hash
, look_for
, cb
);
93 void add_function_assign_hook(const char *look_for
, func_hook
*call_back
,
96 struct fcall_back
*cb
;
98 cb
= alloc_fcall_back(ASSIGN_CALL
, call_back
, info
);
99 add_callback(func_hash
, look_for
, cb
);
102 void add_implied_return_hook(const char *look_for
,
103 implied_return_hook
*call_back
,
106 struct fcall_back
*cb
;
108 cb
= alloc_fcall_back(IMPLIED_RETURN
, call_back
, info
);
109 add_callback(func_hash
, look_for
, cb
);
112 void add_macro_assign_hook(const char *look_for
, func_hook
*call_back
,
115 struct fcall_back
*cb
;
117 cb
= alloc_fcall_back(MACRO_ASSIGN
, call_back
, info
);
118 add_callback(func_hash
, look_for
, cb
);
121 void add_macro_assign_hook_extra(const char *look_for
, func_hook
*call_back
,
124 struct fcall_back
*cb
;
126 cb
= alloc_fcall_back(MACRO_ASSIGN_EXTRA
, call_back
, info
);
127 add_callback(func_hash
, look_for
, cb
);
130 void return_implies_state(const char *look_for
, long long start
, long long end
,
131 implication_hook
*call_back
, void *info
)
133 struct fcall_back
*cb
;
135 cb
= alloc_fcall_back(RANGED_CALL
, call_back
, info
);
136 cb
->range
= alloc_range_perm(ll_to_sval(start
), ll_to_sval(end
));
137 add_callback(func_hash
, look_for
, cb
);
140 void select_return_states_hook(int type
, return_implies_hook
*callback
)
142 struct return_implies_callback
*cb
= __alloc_return_implies_callback(0);
145 cb
->callback
= callback
;
146 add_ptr_list(&db_return_states_list
, cb
);
149 void select_return_states_before(void_fn
*fn
)
151 void_fn
**p
= malloc(sizeof(void_fn
*));
153 add_ptr_list(&return_states_before
, p
);
156 void select_return_states_after(void_fn
*fn
)
158 void_fn
**p
= malloc(sizeof(void_fn
*));
160 add_ptr_list(&return_states_after
, p
);
163 static void call_return_states_before_hooks(void)
167 FOR_EACH_PTR(return_states_before
, fn
) {
169 } END_FOR_EACH_PTR(fn
);
172 static void call_return_states_after_hooks(struct expression
*expr
)
176 FOR_EACH_PTR(return_states_after
, fn
) {
178 } END_FOR_EACH_PTR(fn
);
179 __pass_to_client(expr
, FUNCTION_CALL_HOOK_AFTER_DB
);
182 static int call_call_backs(struct call_back_list
*list
, int type
,
183 const char *fn
, struct expression
*expr
)
185 struct fcall_back
*tmp
;
188 FOR_EACH_PTR(list
, tmp
) {
189 if (tmp
->type
== type
) {
190 (tmp
->u
.call_back
)(fn
, expr
, tmp
->info
);
193 } END_FOR_EACH_PTR(tmp
);
198 static void call_ranged_call_backs(struct call_back_list
*list
,
199 const char *fn
, struct expression
*call_expr
,
200 struct expression
*assign_expr
)
202 struct fcall_back
*tmp
;
204 FOR_EACH_PTR(list
, tmp
) {
205 (tmp
->u
.ranged
)(fn
, call_expr
, assign_expr
, tmp
->info
);
206 } END_FOR_EACH_PTR(tmp
);
209 static struct call_back_list
*get_same_ranged_call_backs(struct call_back_list
*list
,
210 struct data_range
*drange
)
212 struct call_back_list
*ret
= NULL
;
213 struct fcall_back
*tmp
;
215 FOR_EACH_PTR(list
, tmp
) {
216 if (tmp
->type
!= RANGED_CALL
)
218 if (ranges_equiv(tmp
->range
, drange
))
219 add_ptr_list(&ret
, tmp
);
220 } END_FOR_EACH_PTR(tmp
);
224 static int in_list_exact_sval(struct range_list
*list
, struct data_range
*drange
)
226 struct data_range
*tmp
;
228 FOR_EACH_PTR(list
, tmp
) {
229 if (ranges_equiv(tmp
, drange
))
231 } END_FOR_EACH_PTR(tmp
);
235 static int assign_ranged_funcs(const char *fn
, struct expression
*expr
,
236 struct call_back_list
*call_backs
)
238 struct fcall_back
*tmp
;
242 struct smatch_state
*estate
;
243 struct stree
*tmp_stree
;
244 struct stree
*final_states
= NULL
;
245 struct range_list
*handled_ranges
= NULL
;
246 struct call_back_list
*same_range_call_backs
= NULL
;
252 var_name
= expr_to_var_sym(expr
->left
, &sym
);
253 if (!var_name
|| !sym
)
256 FOR_EACH_PTR(call_backs
, tmp
) {
257 if (tmp
->type
!= RANGED_CALL
)
260 if (in_list_exact_sval(handled_ranges
, tmp
->range
))
262 __push_fake_cur_stree();
263 tack_on(&handled_ranges
, tmp
->range
);
265 same_range_call_backs
= get_same_ranged_call_backs(call_backs
, tmp
->range
);
266 call_ranged_call_backs(same_range_call_backs
, fn
, expr
->right
, expr
);
267 __free_ptr_list((struct ptr_list
**)&same_range_call_backs
);
269 estate
= alloc_estate_range(tmp
->range
->min
, tmp
->range
->max
);
270 set_extra_mod(var_name
, sym
, estate
);
272 tmp_stree
= __pop_fake_cur_stree();
273 merge_fake_stree(&final_states
, tmp_stree
);
274 free_stree(&tmp_stree
);
276 } END_FOR_EACH_PTR(tmp
);
278 FOR_EACH_SM(final_states
, sm
) {
280 } END_FOR_EACH_SM(sm
);
282 free_stree(&final_states
);
284 free_string(var_name
);
288 static void call_implies_callbacks(int comparison
, struct expression
*expr
, sval_t sval
, int left
, struct stree
**implied_true
, struct stree
**implied_false
)
290 struct call_back_list
*call_backs
;
291 struct fcall_back
*tmp
;
293 struct data_range
*value_range
;
294 struct stree
*true_states
= NULL
;
295 struct stree
*false_states
= NULL
;
296 struct stree
*tmp_stree
;
298 *implied_true
= NULL
;
299 *implied_false
= NULL
;
300 if (expr
->fn
->type
!= EXPR_SYMBOL
|| !expr
->fn
->symbol
)
302 fn
= expr
->fn
->symbol
->ident
->name
;
303 call_backs
= search_callback(func_hash
, (char *)expr
->fn
->symbol
->ident
->name
);
306 value_range
= alloc_range(sval
, sval
);
308 /* set true states */
309 __push_fake_cur_stree();
310 FOR_EACH_PTR(call_backs
, tmp
) {
311 if (tmp
->type
!= RANGED_CALL
)
313 if (!true_comparison_range_LR(comparison
, tmp
->range
, value_range
, left
))
315 (tmp
->u
.ranged
)(fn
, expr
, NULL
, tmp
->info
);
316 } END_FOR_EACH_PTR(tmp
);
317 tmp_stree
= __pop_fake_cur_stree();
318 merge_fake_stree(&true_states
, tmp_stree
);
319 free_stree(&tmp_stree
);
321 /* set false states */
322 __push_fake_cur_stree();
323 FOR_EACH_PTR(call_backs
, tmp
) {
324 if (tmp
->type
!= RANGED_CALL
)
326 if (!false_comparison_range_LR(comparison
, tmp
->range
, value_range
, left
))
328 (tmp
->u
.ranged
)(fn
, expr
, NULL
, tmp
->info
);
329 } END_FOR_EACH_PTR(tmp
);
330 tmp_stree
= __pop_fake_cur_stree();
331 merge_fake_stree(&false_states
, tmp_stree
);
332 free_stree(&tmp_stree
);
334 *implied_true
= true_states
;
335 *implied_false
= false_states
;
338 struct db_callback_info
{
341 struct expression
*expr
;
342 struct range_list
*rl
;
345 struct db_implies_list
*callbacks
;
348 struct smatch_state
*ret_state
;
349 struct expression
*var_expr
;
353 static void store_return_state(struct db_callback_info
*db_info
, struct smatch_state
*state
)
355 db_info
->ret_state
= state
;
358 static void set_return_state(struct expression
*expr
, struct db_callback_info
*db_info
)
360 struct smatch_state
*state
;
362 if (!db_info
->ret_state
)
365 state
= alloc_estate_rl(cast_rl(get_type(expr
), clone_rl(estate_rl(db_info
->ret_state
))));
366 set_extra_expr_mod(expr
, state
);
367 db_info
->ret_state
= NULL
;
370 static void handle_ret_equals_param(char *ret_string
, struct range_list
*rl
, struct expression
*call
)
374 struct expression
*arg
;
375 struct range_list
*orig
;
377 str
= strstr(ret_string
, "==$");
381 param
= strtoll(str
, NULL
, 10);
382 arg
= get_argument_from_call_expr(call
->args
, param
);
385 get_absolute_rl(arg
, &orig
);
386 rl
= rl_intersection(orig
, rl
);
389 set_extra_expr_nomod(arg
, alloc_estate_rl(rl
));
392 static int impossible_limit(struct expression
*expr
, int param
, char *key
, char *value
)
394 struct expression
*arg
;
395 struct smatch_state
*state
;
396 struct range_list
*passed
;
397 struct range_list
*limit
;
398 struct symbol
*compare_type
;
400 while (expr
->type
== EXPR_ASSIGNMENT
)
401 expr
= strip_expr(expr
->right
);
402 if (expr
->type
!= EXPR_CALL
)
405 arg
= get_argument_from_call_expr(expr
->args
, param
);
409 if (strcmp(key
, "$") == 0) {
410 if (!get_implied_rl(arg
, &passed
))
413 compare_type
= get_arg_type(expr
->fn
, param
);
418 name
= get_variable_from_key(arg
, key
, &sym
);
422 state
= get_state(SMATCH_EXTRA
, name
, sym
);
427 passed
= estate_rl(state
);
428 if (!passed
|| is_whole_rl(passed
)) {
433 compare_type
= get_member_type_from_key(arg
, key
);
436 passed
= cast_rl(compare_type
, passed
);
437 call_results_to_rl(expr
, compare_type
, value
, &limit
);
438 if (!limit
|| is_whole_rl(limit
))
440 if (possibly_true_rl(passed
, SPECIAL_EQUAL
, limit
))
442 if (option_debug
|| local_debug
)
443 sm_msg("impossible: %d '%s' limit '%s' == '%s'", param
, key
, show_rl(passed
), value
);
447 static int is_impossible_data(int type
, struct expression
*expr
, int param
, char *key
, char *value
)
449 if (type
== PARAM_LIMIT
&& impossible_limit(expr
, param
, key
, value
))
451 if (type
== COMPARE_LIMIT
&& param_compare_limit_is_impossible(expr
, param
, key
, value
))
456 static int db_compare_callback(void *_info
, int argc
, char **argv
, char **azColName
)
458 struct db_callback_info
*db_info
= _info
;
459 struct range_list
*var_rl
= db_info
->rl
;
460 struct range_list
*ret_range
;
463 struct return_implies_callback
*tmp
;
471 return_id
= atoi(argv
[0]);
472 type
= atoi(argv
[2]);
473 param
= atoi(argv
[3]);
477 if (db_info
->prev_return_id
!= -1 && type
== INTERNAL
) {
478 set_return_state(db_info
->var_expr
, db_info
);
479 stree
= __pop_fake_cur_stree();
482 merge_fake_stree(&db_info
->stree
, stree
);
484 __push_fake_cur_stree();
487 db_info
->prev_return_id
= return_id
;
491 if (type
== CULL_PATH
) {
496 if (is_impossible_data(type
, db_info
->expr
, param
, key
, value
)) {
501 call_results_to_rl(db_info
->expr
, get_type(strip_expr(db_info
->expr
)), argv
[1], &ret_range
);
502 ret_range
= cast_rl(get_type(db_info
->expr
), ret_range
);
504 ret_range
= alloc_whole_rl(get_type(db_info
->expr
));
506 comparison
= db_info
->comparison
;
508 comparison
= flip_comparison(comparison
);
510 if (db_info
->true_side
) {
511 if (!possibly_true_rl(var_rl
, comparison
, ret_range
))
513 if (type
== PARAM_LIMIT
)
514 param_limit_implications(db_info
->expr
, param
, key
, value
);
515 filter_by_comparison(&var_rl
, comparison
, ret_range
);
516 filter_by_comparison(&ret_range
, flip_comparison(comparison
), var_rl
);
518 if (!possibly_false_rl(var_rl
, comparison
, ret_range
))
520 if (type
== PARAM_LIMIT
)
521 param_limit_implications(db_info
->expr
, param
, key
, value
);
522 filter_by_comparison(&var_rl
, negate_comparison(comparison
), ret_range
);
523 filter_by_comparison(&ret_range
, flip_comparison(negate_comparison(comparison
)), var_rl
);
526 handle_ret_equals_param(argv
[1], ret_range
, db_info
->expr
);
528 if (type
== INTERNAL
)
529 set_state(-1, "unnull_path", NULL
, &true_state
);
531 FOR_EACH_PTR(db_info
->callbacks
, tmp
) {
532 if (tmp
->type
== type
)
533 tmp
->callback(db_info
->expr
, param
, key
, value
);
534 } END_FOR_EACH_PTR(tmp
);
536 store_return_state(db_info
, alloc_estate_rl(clone_rl(var_rl
)));
540 static void compare_db_return_states_callbacks(struct expression
*left
, int comparison
, struct expression
*right
, struct stree
*implied_true
, struct stree
*implied_false
)
542 struct stree
*orig_states
;
544 struct stree
*true_states
;
545 struct stree
*false_states
;
547 struct db_callback_info db_info
= {};
548 struct expression
*var_expr
;
549 struct expression
*call_expr
;
550 struct range_list
*rl
;
553 orig_states
= clone_stree(__get_cur_stree());
555 /* legacy cruft. need to fix call_implies_callbacks(). */
559 if (left
->type
!= EXPR_CALL
) {
565 get_absolute_rl(var_expr
, &rl
);
567 db_info
.comparison
= comparison
;
568 db_info
.expr
= call_expr
;
570 db_info
.left
= call_on_left
;
571 db_info
.callbacks
= db_return_states_list
;
572 db_info
.var_expr
= var_expr
;
574 call_return_states_before_hooks();
576 db_info
.true_side
= 1;
577 db_info
.stree
= NULL
;
578 db_info
.prev_return_id
= -1;
579 __push_fake_cur_stree();
580 sql_select_return_states("return_id, return, type, parameter, key, value",
581 call_expr
, db_compare_callback
, &db_info
);
582 set_return_state(db_info
.var_expr
, &db_info
);
583 stree
= __pop_fake_cur_stree();
585 set_return_state(db_info
.var_expr
, &db_info
);
586 merge_fake_stree(&db_info
.stree
, stree
);
589 true_states
= db_info
.stree
;
590 if (db_info
.cull
&& !true_states
) {
591 __push_fake_cur_stree();
592 set_path_impossible();
593 true_states
= __pop_fake_cur_stree();
598 FOR_EACH_SM(orig_states
, sm
) {
599 __set_sm_cur_stree(sm
);
600 } END_FOR_EACH_SM(sm
);
602 db_info
.true_side
= 0;
603 db_info
.stree
= NULL
;
604 db_info
.prev_return_id
= -1;
606 __push_fake_cur_stree();
607 sql_select_return_states("return_id, return, type, parameter, key, value", call_expr
,
608 db_compare_callback
, &db_info
);
609 stree
= __pop_fake_cur_stree();
611 set_return_state(db_info
.var_expr
, &db_info
);
612 merge_fake_stree(&db_info
.stree
, stree
);
615 false_states
= db_info
.stree
;
616 if (db_info
.cull
&& !false_states
) {
617 __push_fake_cur_stree();
618 set_path_impossible();
619 false_states
= __pop_fake_cur_stree();
624 FOR_EACH_SM(orig_states
, sm
) {
625 __set_sm_cur_stree(sm
);
626 } END_FOR_EACH_SM(sm
);
628 free_stree(&orig_states
);
630 FOR_EACH_SM(true_states
, sm
) {
631 __set_true_false_sm(sm
, NULL
);
632 } END_FOR_EACH_SM(sm
);
633 FOR_EACH_SM(false_states
, sm
) {
634 __set_true_false_sm(NULL
, sm
);
635 } END_FOR_EACH_SM(sm
);
637 free_stree(&true_states
);
638 free_stree(&false_states
);
640 call_return_states_after_hooks(call_expr
);
642 FOR_EACH_SM(implied_true
, sm
) {
643 __set_true_false_sm(sm
, NULL
);
644 } END_FOR_EACH_SM(sm
);
645 FOR_EACH_SM(implied_false
, sm
) {
646 __set_true_false_sm(NULL
, sm
);
647 } END_FOR_EACH_SM(sm
);
650 void function_comparison(struct expression
*left
, int comparison
, struct expression
*right
)
652 struct expression
*var_expr
;
653 struct expression
*call_expr
;
654 struct stree
*implied_true
= NULL
;
655 struct stree
*implied_false
= NULL
;
656 struct range_list
*rl
;
663 /* legacy cruft. need to fix call_implies_callbacks(). */
667 if (left
->type
!= EXPR_CALL
) {
673 get_absolute_rl(var_expr
, &rl
);
675 if (rl_to_sval(rl
, &sval
))
676 call_implies_callbacks(comparison
, call_expr
, sval
, call_on_left
, &implied_true
, &implied_false
);
678 compare_db_return_states_callbacks(left
, comparison
, right
, implied_true
, implied_false
);
679 free_stree(&implied_true
);
680 free_stree(&implied_false
);
683 static void call_ranged_return_hooks(struct db_callback_info
*db_info
)
685 struct call_back_list
*call_backs
;
686 struct expression
*expr
;
687 struct fcall_back
*tmp
;
690 expr
= strip_expr(db_info
->expr
);
691 while (expr
->type
== EXPR_ASSIGNMENT
)
692 expr
= strip_expr(expr
->right
);
693 if (expr
->type
!= EXPR_CALL
||
694 expr
->fn
->type
!= EXPR_SYMBOL
)
697 fn
= expr
->fn
->symbol_name
->name
;
699 call_backs
= search_callback(func_hash
, fn
);
700 FOR_EACH_PTR(call_backs
, tmp
) {
701 struct range_list
*range_rl
= NULL
;
703 if (tmp
->type
!= RANGED_CALL
)
705 add_range(&range_rl
, tmp
->range
->min
, tmp
->range
->max
);
706 range_rl
= cast_rl(estate_type(db_info
->ret_state
), range_rl
);
707 if (possibly_true_rl(range_rl
, SPECIAL_EQUAL
, estate_rl(db_info
->ret_state
))) {
708 if (!possibly_true_rl(rl_invert(range_rl
), SPECIAL_EQUAL
, estate_rl(db_info
->ret_state
)))
709 (tmp
->u
.ranged
)(fn
, expr
, db_info
->expr
, tmp
->info
);
711 db_info
->handled
= -1;
713 } END_FOR_EACH_PTR(tmp
);
716 static int db_assign_return_states_callback(void *_info
, int argc
, char **argv
, char **azColName
)
718 struct db_callback_info
*db_info
= _info
;
719 struct range_list
*ret_range
;
722 struct return_implies_callback
*tmp
;
729 return_id
= atoi(argv
[0]);
730 type
= atoi(argv
[2]);
731 param
= atoi(argv
[3]);
735 if (db_info
->prev_return_id
!= -1 && type
== INTERNAL
) {
736 call_ranged_return_hooks(db_info
);
737 set_return_state(db_info
->expr
->left
, db_info
);
738 stree
= __pop_fake_cur_stree();
740 merge_fake_stree(&db_info
->stree
, stree
);
742 __push_fake_cur_stree();
745 db_info
->prev_return_id
= return_id
;
749 if (type
== CULL_PATH
) {
753 if (is_impossible_data(type
, db_info
->expr
, param
, key
, value
)) {
758 if (type
== PARAM_LIMIT
)
759 param_limit_implications(db_info
->expr
, param
, key
, value
);
761 db_info
->handled
= 1;
762 call_results_to_rl(db_info
->expr
->right
, get_type(strip_expr(db_info
->expr
->right
)), argv
[1], &ret_range
);
763 __add_comparison_info(db_info
->expr
->left
, strip_expr(db_info
->expr
->right
), argv
[1]);
765 ret_range
= alloc_whole_rl(get_type(strip_expr(db_info
->expr
->right
)));
766 ret_range
= cast_rl(get_type(db_info
->expr
->right
), ret_range
);
768 if (type
== INTERNAL
)
769 set_state(-1, "unnull_path", NULL
, &true_state
);
771 FOR_EACH_PTR(db_return_states_list
, tmp
) {
772 if (tmp
->type
== type
)
773 tmp
->callback(db_info
->expr
, param
, key
, value
);
774 } END_FOR_EACH_PTR(tmp
);
775 store_return_state(db_info
, alloc_estate_rl(ret_range
));
780 static int db_return_states_assign(struct expression
*expr
)
782 struct expression
*right
;
785 struct db_callback_info db_info
= {};
787 right
= strip_expr(expr
->right
);
789 db_info
.prev_return_id
= -1;
791 db_info
.stree
= NULL
;
794 call_return_states_before_hooks();
796 __push_fake_cur_stree();
797 sql_select_return_states("return_id, return, type, parameter, key, value",
798 right
, db_assign_return_states_callback
, &db_info
);
800 sm_msg("%s return_id %d return_ranges %s",
801 db_info
.cull
? "culled" : "merging",
802 db_info
.prev_return_id
,
803 db_info
.ret_state
? db_info
.ret_state
->name
: "'<empty>'");
806 call_ranged_return_hooks(&db_info
);
807 set_return_state(db_info
.expr
->left
, &db_info
);
808 stree
= __pop_fake_cur_stree();
810 merge_fake_stree(&db_info
.stree
, stree
);
813 if (!db_info
.stree
&& db_info
.cull
) /* this means we culled everything */
814 set_extra_expr_mod(expr
->left
, alloc_estate_whole(get_type(expr
->left
)));
815 FOR_EACH_SM(db_info
.stree
, sm
) {
817 } END_FOR_EACH_SM(sm
);
819 free_stree(&db_info
.stree
);
820 call_return_states_after_hooks(right
);
822 return db_info
.handled
;
825 static int handle_implied_return(struct expression
*expr
)
827 struct range_list
*rl
;
829 if (!get_implied_return(expr
->right
, &rl
))
831 rl
= cast_rl(get_type(expr
->left
), rl
);
832 set_extra_expr_mod(expr
->left
, alloc_estate_rl(rl
));
836 static void match_assign_call(struct expression
*expr
)
838 struct call_back_list
*call_backs
;
840 struct expression
*right
;
842 struct range_list
*rl
;
847 right
= strip_expr(expr
->right
);
848 if (right
->fn
->type
!= EXPR_SYMBOL
|| !right
->fn
->symbol
) {
849 handled
|= db_return_states_assign(expr
);
851 goto assigned_unknown
;
854 if (is_fake_call(right
)) {
855 set_extra_expr_mod(expr
->left
, alloc_estate_whole(get_type(expr
->left
)));
859 fn
= right
->fn
->symbol
->ident
->name
;
860 call_backs
= search_callback(func_hash
, (char *)fn
);
863 * The ordering here is sort of important.
864 * One example, of how this matters is that when we do:
868 * That is handled by smatch_common_functions.c and smatch_strlen.c.
869 * They use implied_return and function_assign_hook respectively.
870 * We want to get the implied return first before we do the function
871 * assignment hook otherwise we end up writing the wrong thing for len
872 * in smatch_extra.c because we assume that it already holds the
873 * strlen() when we haven't set it yet.
876 if (db_return_states_assign(expr
) == 1)
879 handled
= assign_ranged_funcs(fn
, expr
, call_backs
);
880 handled
|= handle_implied_return(expr
);
883 call_call_backs(call_backs
, ASSIGN_CALL
, fn
, expr
);
889 get_absolute_rl(expr
->right
, &rl
);
890 rl
= cast_rl(get_type(expr
->left
), rl
);
891 set_extra_expr_mod(expr
->left
, alloc_estate_rl(rl
));
894 static int db_return_states_callback(void *_info
, int argc
, char **argv
, char **azColName
)
896 struct db_callback_info
*db_info
= _info
;
897 struct range_list
*ret_range
;
900 struct return_implies_callback
*tmp
;
908 return_id
= atoi(argv
[0]);
909 type
= atoi(argv
[2]);
910 param
= atoi(argv
[3]);
914 if (db_info
->prev_return_id
!= -1 && type
== INTERNAL
) {
915 stree
= __pop_fake_cur_stree();
917 merge_fake_stree(&db_info
->stree
, stree
);
919 __push_fake_cur_stree();
923 db_info
->prev_return_id
= return_id
;
927 if (type
== CULL_PATH
) {
931 if (is_impossible_data(type
, db_info
->expr
, param
, key
, value
)) {
936 if (type
== PARAM_LIMIT
)
937 param_limit_implications(db_info
->expr
, param
, key
, value
);
939 call_results_to_rl(db_info
->expr
, get_type(strip_expr(db_info
->expr
)), argv
[1], &ret_range
);
940 ret_range
= cast_rl(get_type(db_info
->expr
), ret_range
);
942 if (type
== INTERNAL
)
943 set_state(-1, "unnull_path", NULL
, &true_state
);
945 FOR_EACH_PTR(db_return_states_list
, tmp
) {
946 if (tmp
->type
== type
)
947 tmp
->callback(db_info
->expr
, param
, key
, value
);
948 } END_FOR_EACH_PTR(tmp
);
951 * We want to store the return values so that we can split the strees
952 * in smatch_db.c. This uses set_state() directly because it's not a
953 * real smatch_extra state.
955 snprintf(buf
, sizeof(buf
), "return %p", db_info
->expr
);
956 set_state(SMATCH_EXTRA
, buf
, NULL
, alloc_estate_rl(ret_range
));
961 static void db_return_states(struct expression
*expr
)
965 struct db_callback_info db_info
= {};
967 if (!__get_cur_stree()) /* no return functions */
970 db_info
.prev_return_id
= -1;
972 db_info
.stree
= NULL
;
974 call_return_states_before_hooks();
976 __push_fake_cur_stree();
978 sql_select_return_states("return_id, return, type, parameter, key, value",
979 expr
, db_return_states_callback
, &db_info
);
980 stree
= __pop_fake_cur_stree();
982 merge_fake_stree(&db_info
.stree
, stree
);
985 FOR_EACH_SM(db_info
.stree
, sm
) {
987 } END_FOR_EACH_SM(sm
);
989 free_stree(&db_info
.stree
);
990 call_return_states_after_hooks(expr
);
993 static int is_condition_call(struct expression
*expr
)
995 struct expression
*tmp
;
997 FOR_EACH_PTR_REVERSE(big_condition_stack
, tmp
) {
998 if (expr
== tmp
|| expr
->parent
== tmp
)
1000 if (tmp
->pos
.line
< expr
->pos
.line
)
1002 } END_FOR_EACH_PTR_REVERSE(tmp
);
1007 static void db_return_states_call(struct expression
*expr
)
1012 if (is_assigned_call(expr
))
1014 if (is_condition_call(expr
))
1016 db_return_states(expr
);
1019 static void match_function_call(struct expression
*expr
)
1021 struct call_back_list
*call_backs
;
1023 if (expr
->fn
->type
== EXPR_SYMBOL
&& expr
->fn
->symbol
) {
1024 call_backs
= search_callback(func_hash
, (char *)expr
->fn
->symbol
->ident
->name
);
1026 call_call_backs(call_backs
, REGULAR_CALL
,
1027 expr
->fn
->symbol
->ident
->name
, expr
);
1029 db_return_states_call(expr
);
1032 static void match_macro_assign(struct expression
*expr
)
1034 struct call_back_list
*call_backs
;
1036 struct expression
*right
;
1038 right
= strip_expr(expr
->right
);
1039 macro
= get_macro_name(right
->pos
);
1040 call_backs
= search_callback(func_hash
, (char *)macro
);
1043 call_call_backs(call_backs
, MACRO_ASSIGN
, macro
, expr
);
1044 call_call_backs(call_backs
, MACRO_ASSIGN_EXTRA
, macro
, expr
);
1047 int get_implied_return(struct expression
*expr
, struct range_list
**rl
)
1049 struct call_back_list
*call_backs
;
1050 struct fcall_back
*tmp
;
1056 expr
= strip_expr(expr
);
1057 fn
= expr_to_var(expr
->fn
);
1061 call_backs
= search_callback(func_hash
, fn
);
1063 FOR_EACH_PTR(call_backs
, tmp
) {
1064 if (tmp
->type
== IMPLIED_RETURN
) {
1065 (tmp
->u
.implied_return
)(expr
, tmp
->info
, rl
);
1068 } END_FOR_EACH_PTR(tmp
);
1075 void create_function_hook_hash(void)
1077 func_hash
= create_function_hashtable(5000);
1080 void register_function_hooks(int id
)
1082 add_hook(&match_function_call
, CALL_HOOK_AFTER_INLINE
);
1083 add_hook(&match_assign_call
, CALL_ASSIGNMENT_HOOK
);
1084 add_hook(&match_macro_assign
, MACRO_ASSIGNMENT_HOOK
);