smatch_function_hooks.c

   1 /*
   2  * Copyright (C) 2009 Dan Carpenter.
   3  *
   4  * This program is free software; you can redistribute it and/or
   5  * modify it under the terms of the GNU General Public License
   6  * as published by the Free Software Foundation; either version 2
   7  * of the License, or (at your option) any later version.
   8  *
   9  * This program is distributed in the hope that it will be useful,
  10  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  11  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  12  * GNU General Public License for more details.
  13  *
  14  * You should have received a copy of the GNU General Public License
  15  * along with this program; if not, see http://www.gnu.org/copyleft/gpl.txt
  16  */
  17
  18 /*
  19  * There are several types of function hooks:
  20  * add_function_hook()        - For any time a function is called.
  21  * add_function_assign_hook() - foo = the_function().
  22  * add_implied_return_hook()  - Calculates the implied return value.
  23  * add_macro_assign_hook()    - foo = the_macro().
  24  * return_implies_state()     - For when a return value of 1 implies locked
  25  *                              and 0 implies unlocked. etc. etc.
  26  *
  27  */
  28
  29 #include <stdlib.h>
  30 #include <stdio.h>
  31 #include "smatch.h"
  32 #include "smatch_slist.h"
  33 #include "smatch_extra.h"
  34 #include "smatch_function_hashtable.h"
  35
  36 struct fcall_back {
  37         int type;
  38         struct data_range *range;
  39         union {
  40                 func_hook *call_back;
  41                 implication_hook *ranged;
  42                 implied_return_hook *implied_return;
  43         } u;
  44         void *info;
  45 };
  46
  47 ALLOCATOR(fcall_back, "call backs");
  48 DECLARE_PTR_LIST(call_back_list, struct fcall_back);
  49
  50 DEFINE_FUNCTION_HASHTABLE_STATIC(callback, struct fcall_back, struct call_back_list);
  51 static struct hashtable *func_hash;
  52
  53 #define REGULAR_CALL       0
  54 #define RANGED_CALL        1
  55 #define ASSIGN_CALL        2
  56 #define IMPLIED_RETURN     3
  57 #define MACRO_ASSIGN       4
  58 #define MACRO_ASSIGN_EXTRA 5
  59
  60 struct return_implies_callback {
  61         int type;
  62         return_implies_hook *callback;
  63 };
  64 ALLOCATOR(return_implies_callback, "return_implies callbacks");
  65 DECLARE_PTR_LIST(db_implies_list, struct return_implies_callback);
  66 static struct db_implies_list *db_return_states_list;
  67
  68 typedef void (void_fn)(void);
  69 DECLARE_PTR_LIST(void_fn_list, void_fn *);
  70 static struct void_fn_list *return_states_before;
  71 static struct void_fn_list *return_states_after;
  72
  73 static struct fcall_back *alloc_fcall_back(int type, void *call_back,
  74                                            void *info)
  75 {
  76         struct fcall_back *cb;
  77
  78         cb = __alloc_fcall_back(0);
  79         cb->type = type;
  80         cb->u.call_back = call_back;
  81         cb->info = info;
  82         return cb;
  83 }
  84
  85 void add_function_hook(const char *look_for, func_hook *call_back, void *info)
  86 {
  87         struct fcall_back *cb;
  88
  89         cb = alloc_fcall_back(REGULAR_CALL, call_back, info);
  90         add_callback(func_hash, look_for, cb);
  91 }
  92
  93 void add_function_assign_hook(const char *look_for, func_hook *call_back,
  94                               void *info)
  95 {
  96         struct fcall_back *cb;
  97
  98         cb = alloc_fcall_back(ASSIGN_CALL, call_back, info);
  99         add_callback(func_hash, look_for, cb);
 100 }
 101
 102 void add_implied_return_hook(const char *look_for,
 103                              implied_return_hook *call_back,
 104                              void *info)
 105 {
 106         struct fcall_back *cb;
 107
 108         cb = alloc_fcall_back(IMPLIED_RETURN, call_back, info);
 109         add_callback(func_hash, look_for, cb);
 110 }
 111
 112 void add_macro_assign_hook(const char *look_for, func_hook *call_back,
 113                         void *info)
 114 {
 115         struct fcall_back *cb;
 116
 117         cb = alloc_fcall_back(MACRO_ASSIGN, call_back, info);
 118         add_callback(func_hash, look_for, cb);
 119 }
 120
 121 void add_macro_assign_hook_extra(const char *look_for, func_hook *call_back,
 122                         void *info)
 123 {
 124         struct fcall_back *cb;
 125
 126         cb = alloc_fcall_back(MACRO_ASSIGN_EXTRA, call_back, info);
 127         add_callback(func_hash, look_for, cb);
 128 }
 129
 130 void return_implies_state(const char *look_for, long long start, long long end,
 131                          implication_hook *call_back, void *info)
 132 {
 133         struct fcall_back *cb;
 134
 135         cb = alloc_fcall_back(RANGED_CALL, call_back, info);
 136         cb->range = alloc_range_perm(ll_to_sval(start), ll_to_sval(end));
 137         add_callback(func_hash, look_for, cb);
 138 }
 139
 140 void select_return_states_hook(int type, return_implies_hook *callback)
 141 {
 142         struct return_implies_callback *cb = __alloc_return_implies_callback(0);
 143
 144         cb->type = type;
 145         cb->callback = callback;
 146         add_ptr_list(&db_return_states_list, cb);
 147 }
 148
 149 void select_return_states_before(void_fn *fn)
 150 {
 151         void_fn **p = malloc(sizeof(void_fn *));
 152         *p = fn;
 153         add_ptr_list(&return_states_before, p);
 154 }
 155
 156 void select_return_states_after(void_fn *fn)
 157 {
 158         void_fn **p = malloc(sizeof(void_fn *));
 159         *p = fn;
 160         add_ptr_list(&return_states_after, p);
 161 }
 162
 163 static void call_return_states_before_hooks(void)
 164 {
 165         void_fn **fn;
 166
 167         FOR_EACH_PTR(return_states_before, fn) {
 168                 (*fn)();
 169         } END_FOR_EACH_PTR(fn);
 170 }
 171
 172 static void call_return_states_after_hooks(void)
 173 {
 174         void_fn **fn;
 175
 176         FOR_EACH_PTR(return_states_after, fn) {
 177                 (*fn)();
 178         } END_FOR_EACH_PTR(fn);
 179 }
 180
 181 static int call_call_backs(struct call_back_list *list, int type,
 182                             const char *fn, struct expression *expr)
 183 {
 184         struct fcall_back *tmp;
 185         int handled = 0;
 186
 187         FOR_EACH_PTR(list, tmp) {
 188                 if (tmp->type == type) {
 189                         (tmp->u.call_back)(fn, expr, tmp->info);
 190                         handled = 1;
 191                 }
 192         } END_FOR_EACH_PTR(tmp);
 193
 194         return handled;
 195 }
 196
 197 static void call_ranged_call_backs(struct call_back_list *list,
 198                                 const char *fn, struct expression *call_expr,
 199                                 struct expression *assign_expr)
 200 {
 201         struct fcall_back *tmp;
 202
 203         FOR_EACH_PTR(list, tmp) {
 204                 (tmp->u.ranged)(fn, call_expr, assign_expr, tmp->info);
 205         } END_FOR_EACH_PTR(tmp);
 206 }
 207
 208 static struct call_back_list *get_same_ranged_call_backs(struct call_back_list *list,
 209                                                 struct data_range *drange)
 210 {
 211         struct call_back_list *ret = NULL;
 212         struct fcall_back *tmp;
 213
 214         FOR_EACH_PTR(list, tmp) {
 215                 if (tmp->type != RANGED_CALL)
 216                         continue;
 217                 if (ranges_equiv(tmp->range, drange))
 218                         add_ptr_list(&ret, tmp);
 219         } END_FOR_EACH_PTR(tmp);
 220         return ret;
 221 }
 222
 223 static int in_list_exact_sval(struct range_list *list, struct data_range *drange)
 224 {
 225         struct data_range *tmp;
 226
 227         FOR_EACH_PTR(list, tmp) {
 228                 if (ranges_equiv(tmp, drange))
 229                         return 1;
 230         } END_FOR_EACH_PTR(tmp);
 231         return 0;
 232 }
 233
 234 static int assign_ranged_funcs(const char *fn, struct expression *expr,
 235                                  struct call_back_list *call_backs)
 236 {
 237         struct fcall_back *tmp;
 238         struct sm_state *sm;
 239         char *var_name;
 240         struct symbol *sym;
 241         struct smatch_state *estate;
 242         struct stree *tmp_stree;
 243         struct stree *final_states = NULL;
 244         struct range_list *handled_ranges = NULL;
 245         struct call_back_list *same_range_call_backs = NULL;
 246         int handled = 0;
 247
 248         if (!call_backs)
 249                 return 0;
 250
 251         var_name = expr_to_var_sym(expr->left, &sym);
 252         if (!var_name || !sym)
 253                 goto free;
 254
 255         FOR_EACH_PTR(call_backs, tmp) {
 256                 if (tmp->type != RANGED_CALL)
 257                         continue;
 258
 259                 if (in_list_exact_sval(handled_ranges, tmp->range))
 260                         continue;
 261                 __push_fake_cur_stree();
 262                 tack_on(&handled_ranges, tmp->range);
 263
 264                 same_range_call_backs = get_same_ranged_call_backs(call_backs, tmp->range);
 265                 call_ranged_call_backs(same_range_call_backs, fn, expr->right, expr);
 266                 __free_ptr_list((struct ptr_list **)&same_range_call_backs);
 267
 268                 estate = alloc_estate_range(tmp->range->min, tmp->range->max);
 269                 set_extra_mod(var_name, sym, estate);
 270
 271                 tmp_stree = __pop_fake_cur_stree();
 272                 merge_fake_stree(&final_states, tmp_stree);
 273                 free_stree(&tmp_stree);
 274                 handled = 1;
 275         } END_FOR_EACH_PTR(tmp);
 276
 277         FOR_EACH_SM(final_states, sm) {
 278                 __set_sm_cur_stree(sm);
 279         } END_FOR_EACH_SM(sm);
 280
 281         free_stree(&final_states);
 282 free:
 283         free_string(var_name);
 284         return handled;
 285 }
 286
 287 static void call_implies_callbacks(int comparison, struct expression *expr, sval_t sval, int left, struct stree **implied_true, struct stree **implied_false)
 288 {
 289         struct call_back_list *call_backs;
 290         struct fcall_back *tmp;
 291         const char *fn;
 292         struct data_range *value_range;
 293         struct stree *true_states = NULL;
 294         struct stree *false_states = NULL;
 295         struct stree *tmp_stree;
 296
 297         *implied_true = NULL;
 298         *implied_false = NULL;
 299         if (expr->fn->type != EXPR_SYMBOL || !expr->fn->symbol)
 300                 return;
 301         fn = expr->fn->symbol->ident->name;
 302         call_backs = search_callback(func_hash, (char *)expr->fn->symbol->ident->name);
 303         if (!call_backs)
 304                 return;
 305         value_range = alloc_range(sval, sval);
 306
 307         /* set true states */
 308         __push_fake_cur_stree();
 309         FOR_EACH_PTR(call_backs, tmp) {
 310                 if (tmp->type != RANGED_CALL)
 311                         continue;
 312                 if (!true_comparison_range_LR(comparison, tmp->range, value_range, left))
 313                         continue;
 314                 (tmp->u.ranged)(fn, expr, NULL, tmp->info);
 315         } END_FOR_EACH_PTR(tmp);
 316         tmp_stree = __pop_fake_cur_stree();
 317         merge_fake_stree(&true_states, tmp_stree);
 318         free_stree(&tmp_stree);
 319
 320         /* set false states */
 321         __push_fake_cur_stree();
 322         FOR_EACH_PTR(call_backs, tmp) {
 323                 if (tmp->type != RANGED_CALL)
 324                         continue;
 325                 if (!false_comparison_range_LR(comparison, tmp->range, value_range, left))
 326                         continue;
 327                 (tmp->u.ranged)(fn, expr, NULL, tmp->info);
 328         } END_FOR_EACH_PTR(tmp);
 329         tmp_stree = __pop_fake_cur_stree();
 330         merge_fake_stree(&false_states, tmp_stree);
 331         free_stree(&tmp_stree);
 332
 333         *implied_true = true_states;
 334         *implied_false = false_states;
 335 }
 336
 337 struct db_callback_info {
 338         int true_side;
 339         int comparison;
 340         struct expression *expr;
 341         struct range_list *rl;
 342         int left;
 343         struct stree *stree;
 344         struct db_implies_list *callbacks;
 345         int prev_return_id;
 346         int cull;
 347         struct smatch_state *ret_state;
 348         struct expression *var_expr;
 349 };
 350
 351 static void store_return_state(struct db_callback_info *db_info, struct smatch_state *state)
 352 {
 353         db_info->ret_state = state;
 354 }
 355
 356 static void set_return_state(struct expression *expr, struct db_callback_info *db_info)
 357 {
 358         if (!db_info->ret_state)
 359                 return;
 360
 361         set_extra_expr_mod(expr, db_info->ret_state);
 362         db_info->ret_state = NULL;
 363 }
 364
 365 static void handle_ret_equals_param(char *ret_string, struct range_list *rl, struct expression *call)
 366 {
 367         char *str;
 368         long long param;
 369         struct expression *arg;
 370         struct range_list *orig;
 371
 372         str = strstr(ret_string, "==$");
 373         if (!str)
 374                 return;
 375         str += 3;
 376         param = strtoll(str, NULL, 10);
 377         arg = get_argument_from_call_expr(call->args, param);
 378         if (!arg)
 379                 return;
 380         get_absolute_rl(arg, &orig);
 381         rl = rl_intersection(orig, rl);
 382         if (!rl)
 383                 return;
 384         set_extra_expr_nomod(arg, alloc_estate_rl(rl));
 385 }
 386
 387 static int impossible_limit(struct expression *expr, int param, char *key, char *value)
 388 {
 389         struct expression *arg;
 390         struct range_list *passed;
 391         struct range_list *limit;
 392         struct symbol *compare_type;
 393
 394         if (strcmp(key, "$") != 0)
 395                 return 0;
 396
 397         while (expr->type == EXPR_ASSIGNMENT)
 398                 expr = strip_expr(expr->right);
 399         if (expr->type != EXPR_CALL)
 400                 return 0;
 401
 402         arg = get_argument_from_call_expr(expr->args, param);
 403         if (!arg)
 404                 return 0;
 405         if (!get_implied_rl(arg, &passed))
 406                 return 0;
 407         if (!passed || is_whole_rl(passed))
 408                 return 0;
 409
 410         compare_type = get_arg_type(expr->fn, param);
 411         passed = cast_rl(compare_type, passed);
 412         call_results_to_rl(expr, compare_type, value, &limit);
 413         if (!limit || is_whole_rl(limit))
 414                 return 0;
 415         if (possibly_true_rl(passed, SPECIAL_EQUAL, limit))
 416                 return 0;
 417         if (option_debug || local_debug)
 418                 sm_msg("impossible: %d '%s' limit '%s' == '%s'", param, key, show_rl(passed), value);
 419         return 1;
 420 }
 421
 422 static int db_compare_callback(void *_info, int argc, char **argv, char **azColName)
 423 {
 424         struct db_callback_info *db_info = _info;
 425         struct range_list *var_rl = db_info->rl;
 426         struct range_list *ret_range;
 427         int type, param;
 428         char *key, *value;
 429         struct return_implies_callback *tmp;
 430         struct stree *stree;
 431         int return_id;
 432         int comparison;
 433
 434         if (argc != 6)
 435                 return 0;
 436
 437         return_id = atoi(argv[0]);
 438         type = atoi(argv[2]);
 439         param = atoi(argv[3]);
 440         key = argv[4];
 441         value = argv[5];
 442
 443         if (db_info->prev_return_id != -1 && return_id != db_info->prev_return_id) {
 444                 set_return_state(db_info->var_expr, db_info);
 445                 stree = __pop_fake_cur_stree();
 446
 447                 if (!db_info->cull)
 448                         merge_fake_stree(&db_info->stree, stree);
 449                 free_stree(&stree);
 450                 __push_fake_cur_stree();
 451                 db_info->cull = 0;
 452         }
 453         db_info->prev_return_id = return_id;
 454
 455         if (db_info->cull)
 456                 return 0;
 457         if (type == CULL_PATH) {
 458                 db_info->cull = 1;
 459                 return 0;
 460         }
 461         if (type == PARAM_LIMIT && impossible_limit(db_info->expr, param, key, value)) {
 462                 db_info->cull = 1;
 463                 return 0;
 464         }
 465
 466         call_results_to_rl(db_info->expr, get_type(strip_expr(db_info->expr)), argv[1], &ret_range);
 467         ret_range = cast_rl(get_type(db_info->expr), ret_range);
 468         if (!ret_range)
 469                 ret_range = alloc_whole_rl(get_type(db_info->expr));
 470
 471         comparison = db_info->comparison;
 472         if (db_info->left)
 473                 comparison = flip_comparison(comparison);
 474
 475         if (db_info->true_side) {
 476                 if (!possibly_true_rl(var_rl, comparison, ret_range))
 477                         return 0;
 478                 if (type == PARAM_LIMIT)
 479                         param_limit_implications(db_info->expr, param, key, value);
 480                 filter_by_comparison(&var_rl, comparison, ret_range);
 481                 filter_by_comparison(&ret_range, flip_comparison(comparison), var_rl);
 482         } else {
 483                 if (!possibly_false_rl(var_rl, comparison, ret_range))
 484                         return 0;
 485                 if (type == PARAM_LIMIT)
 486                         param_limit_implications(db_info->expr, param, key, value);
 487                 filter_by_comparison(&var_rl, negate_comparison(comparison), ret_range);
 488                 filter_by_comparison(&ret_range, flip_comparison(negate_comparison(comparison)), var_rl);
 489         }
 490
 491         handle_ret_equals_param(argv[1], ret_range, db_info->expr);
 492
 493         FOR_EACH_PTR(db_info->callbacks, tmp) {
 494                 if (tmp->type == type)
 495                         tmp->callback(db_info->expr, param, key, value);
 496         } END_FOR_EACH_PTR(tmp);
 497
 498         store_return_state(db_info, alloc_estate_rl(clone_rl(var_rl)));
 499         return 0;
 500 }
 501
 502 static void compare_db_return_states_callbacks(struct expression *left, int comparison, struct expression *right, struct stree *implied_true, struct stree *implied_false)
 503 {
 504         struct stree *orig_states;
 505         struct stree *stree;
 506         struct stree *true_states;
 507         struct stree *false_states;
 508         struct sm_state *sm;
 509         struct db_callback_info db_info = {};
 510         struct expression *var_expr;
 511         struct expression *call_expr;
 512         struct range_list *rl;
 513         int call_on_left;
 514
 515         orig_states = clone_stree(__get_cur_stree());
 516
 517         /* legacy cruft.  need to fix call_implies_callbacks(). */
 518         call_on_left = 1;
 519         call_expr = left;
 520         var_expr = right;
 521         if (left->type != EXPR_CALL) {
 522                 call_on_left = 0;
 523                 call_expr = right;
 524                 var_expr = left;
 525         }
 526
 527         get_absolute_rl(var_expr, &rl);
 528
 529         db_info.comparison = comparison;
 530         db_info.expr = call_expr;
 531         db_info.rl = rl;
 532         db_info.left = call_on_left;
 533         db_info.callbacks = db_return_states_list;
 534         db_info.var_expr = var_expr;
 535
 536         call_return_states_before_hooks();
 537
 538         db_info.true_side = 1;
 539         db_info.stree = NULL;
 540         db_info.prev_return_id = -1;
 541         __push_fake_cur_stree();
 542         sql_select_return_states("return_id, return, type, parameter, key, value",
 543                                  call_expr, db_compare_callback, &db_info);
 544         set_return_state(db_info.var_expr, &db_info);
 545         stree = __pop_fake_cur_stree();
 546         if (!db_info.cull) {
 547                 set_return_state(db_info.var_expr, &db_info);
 548                 merge_fake_stree(&db_info.stree, stree);
 549         }
 550         free_stree(&stree);
 551         true_states = db_info.stree;
 552
 553         nullify_path();
 554         __unnullify_path();
 555         FOR_EACH_SM(orig_states, sm) {
 556                 __set_sm_cur_stree(sm);
 557         } END_FOR_EACH_SM(sm);
 558
 559         db_info.true_side = 0;
 560         db_info.stree = NULL;
 561         db_info.prev_return_id = -1;
 562         db_info.cull = 0;
 563         __push_fake_cur_stree();
 564         sql_select_return_states("return_id, return, type, parameter, key, value", call_expr,
 565                         db_compare_callback, &db_info);
 566         stree = __pop_fake_cur_stree();
 567         if (!db_info.cull) {
 568                 set_return_state(db_info.var_expr, &db_info);
 569                 merge_fake_stree(&db_info.stree, stree);
 570         }
 571         free_stree(&stree);
 572         false_states = db_info.stree;
 573
 574         nullify_path();
 575         __unnullify_path();
 576         FOR_EACH_SM(orig_states, sm) {
 577                 __set_sm_cur_stree(sm);
 578         } END_FOR_EACH_SM(sm);
 579
 580         free_stree(&orig_states);
 581
 582         FOR_EACH_SM(true_states, sm) {
 583                 __set_true_false_sm(sm, NULL);
 584         } END_FOR_EACH_SM(sm);
 585         FOR_EACH_SM(false_states, sm) {
 586                 __set_true_false_sm(NULL, sm);
 587         } END_FOR_EACH_SM(sm);
 588
 589         free_stree(&true_states);
 590         free_stree(&false_states);
 591
 592         call_return_states_after_hooks();
 593
 594         FOR_EACH_SM(implied_true, sm) {
 595                 __set_true_false_sm(sm, NULL);
 596         } END_FOR_EACH_SM(sm);
 597         FOR_EACH_SM(implied_false, sm) {
 598                 __set_true_false_sm(NULL, sm);
 599         } END_FOR_EACH_SM(sm);
 600 }
 601
 602 void function_comparison(struct expression *left, int comparison, struct expression *right)
 603 {
 604         struct expression *var_expr;
 605         struct expression *call_expr;
 606         struct stree *implied_true = NULL;
 607         struct stree *implied_false = NULL;
 608         struct range_list *rl;
 609         sval_t sval;
 610         int call_on_left;
 611
 612         /* legacy cruft.  need to fix call_implies_callbacks(). */
 613         call_on_left = 1;
 614         call_expr = left;
 615         var_expr = right;
 616         if (left->type != EXPR_CALL) {
 617                 call_on_left = 0;
 618                 call_expr = right;
 619                 var_expr = left;
 620         }
 621
 622         get_absolute_rl(var_expr, &rl);
 623
 624         if (rl_to_sval(rl, &sval))
 625                 call_implies_callbacks(comparison, call_expr, sval, call_on_left, &implied_true, &implied_false);
 626
 627         compare_db_return_states_callbacks(left, comparison, right, implied_true, implied_false);
 628         free_stree(&implied_true);
 629         free_stree(&implied_false);
 630 }
 631
 632 static int db_assign_return_states_callback(void *_info, int argc, char **argv, char **azColName)
 633 {
 634         struct db_callback_info *db_info = _info;
 635         struct range_list *ret_range;
 636         int type, param;
 637         char *key, *value;
 638         struct return_implies_callback *tmp;
 639         struct stree *stree;
 640         int return_id;
 641
 642         if (argc != 6)
 643                 return 0;
 644
 645         return_id = atoi(argv[0]);
 646         type = atoi(argv[2]);
 647         param = atoi(argv[3]);
 648         key = argv[4];
 649         value = argv[5];
 650
 651         if (db_info->prev_return_id != -1 && return_id != db_info->prev_return_id) {
 652                 set_return_state(db_info->expr->left, db_info);
 653                 stree = __pop_fake_cur_stree();
 654                 if (!db_info->cull)
 655                         merge_fake_stree(&db_info->stree, stree);
 656                 free_stree(&stree);
 657                 __push_fake_cur_stree();
 658                 db_info->cull = 0;
 659         }
 660         db_info->prev_return_id = return_id;
 661
 662         if (db_info->cull)
 663                 return 0;
 664         if (type == CULL_PATH) {
 665                 db_info->cull = 1;
 666                 return 0;
 667         }
 668         if (type == PARAM_LIMIT && impossible_limit(db_info->expr, param, key, value)) {
 669                 db_info->cull = 1;
 670                 return 0;
 671         }
 672
 673         call_results_to_rl(db_info->expr->right, get_type(strip_expr(db_info->expr->right)), argv[1], &ret_range);
 674         __add_comparison_info(db_info->expr->left, strip_expr(db_info->expr->right), argv[1]);
 675         if (!ret_range)
 676                 ret_range = alloc_whole_rl(get_type(strip_expr(db_info->expr->right)));
 677         ret_range = cast_rl(get_type(db_info->expr->right), ret_range);
 678
 679         FOR_EACH_PTR(db_return_states_list, tmp) {
 680                 if (tmp->type == type)
 681                         tmp->callback(db_info->expr, param, key, value);
 682         } END_FOR_EACH_PTR(tmp);
 683         ret_range = cast_rl(get_type(db_info->expr->left), ret_range);
 684         store_return_state(db_info, alloc_estate_rl(ret_range));
 685
 686         return 0;
 687 }
 688
 689 static int db_return_states_assign(struct expression *expr)
 690 {
 691         struct expression *right;
 692         struct sm_state *sm;
 693         struct stree *stree;
 694         int handled = 0;
 695         struct db_callback_info db_info = {};
 696
 697         right = strip_expr(expr->right);
 698
 699         db_info.prev_return_id = -1;
 700         db_info.expr = expr;
 701         db_info.stree = NULL;
 702
 703         call_return_states_before_hooks();
 704
 705         __push_fake_cur_stree();
 706         sql_select_return_states("return_id, return, type, parameter, key, value",
 707                         right, db_assign_return_states_callback, &db_info);
 708         if (option_debug) {
 709                 sm_msg("%s return_id %d return_ranges %s",
 710                         db_info.cull ? "culled" : "merging",
 711                         db_info.prev_return_id,
 712                         db_info.ret_state ? db_info.ret_state->name : "'<empty'");
 713         }
 714         set_return_state(db_info.expr->left, &db_info);
 715         stree = __pop_fake_cur_stree();
 716         if (!db_info.cull)
 717                 merge_fake_stree(&db_info.stree, stree);
 718         free_stree(&stree);
 719
 720         FOR_EACH_SM(db_info.stree, sm) {
 721                 __set_sm_cur_stree(sm);
 722                 handled = 1;
 723         } END_FOR_EACH_SM(sm);
 724
 725         free_stree(&db_info.stree);
 726         call_return_states_after_hooks();
 727
 728         return handled;
 729 }
 730
 731 static int handle_implied_return(struct expression *expr)
 732 {
 733         struct range_list *rl;
 734
 735         if (!get_implied_return(expr->right, &rl))
 736                 return 0;
 737         rl = cast_rl(get_type(expr->left), rl);
 738         set_extra_expr_mod(expr->left, alloc_estate_rl(rl));
 739         return 1;
 740 }
 741
 742 static void match_assign_call(struct expression *expr)
 743 {
 744         struct call_back_list *call_backs;
 745         const char *fn;
 746         struct expression *right;
 747         int handled = 0;
 748         struct range_list *rl;
 749
 750         if (expr->op != '=')
 751                 return;
 752
 753         right = strip_expr(expr->right);
 754         if (right->fn->type != EXPR_SYMBOL || !right->fn->symbol) {
 755                 handled |= db_return_states_assign(expr);
 756                 if (!handled)
 757                         goto assigned_unknown;
 758                 return;
 759         }
 760         if (is_fake_call(right)) {
 761                 set_extra_expr_mod(expr->left, alloc_estate_whole(get_type(expr->left)));
 762                 return;
 763         }
 764
 765         fn = right->fn->symbol->ident->name;
 766
 767         /*
 768          * some of these conflict (they try to set smatch extra twice), so we
 769          * call them in order from least important to most important.
 770          */
 771
 772         call_backs = search_callback(func_hash, (char *)fn);
 773         call_call_backs(call_backs, ASSIGN_CALL, fn, expr);
 774
 775         handled |= db_return_states_assign(expr);
 776         handled |= assign_ranged_funcs(fn, expr, call_backs);
 777         handled |= handle_implied_return(expr);
 778
 779         if (handled)
 780                 return;
 781
 782 assigned_unknown:
 783         get_absolute_rl(expr->right, &rl);
 784         rl = cast_rl(get_type(expr->left), rl);
 785         set_extra_expr_mod(expr->left, alloc_estate_rl(rl));
 786 }
 787
 788 static int db_return_states_callback(void *_info, int argc, char **argv, char **azColName)
 789 {
 790         struct db_callback_info *db_info = _info;
 791         struct range_list *ret_range;
 792         int type, param;
 793         char *key, *value;
 794         struct return_implies_callback *tmp;
 795         struct stree *stree;
 796         int return_id;
 797         char buf[64];
 798
 799         if (argc != 6)
 800                 return 0;
 801
 802         return_id = atoi(argv[0]);
 803         type = atoi(argv[2]);
 804         param = atoi(argv[3]);
 805         key = argv[4];
 806         value = argv[5];
 807
 808         if (db_info->prev_return_id != -1 && return_id != db_info->prev_return_id) {
 809                 stree = __pop_fake_cur_stree();
 810                 if (!db_info->cull)
 811                         merge_fake_stree(&db_info->stree, stree);
 812                 free_stree(&stree);
 813                 __push_fake_cur_stree();
 814                 __unnullify_path();
 815                 db_info->cull = 0;
 816         }
 817         db_info->prev_return_id = return_id;
 818
 819         if (db_info->cull)
 820                 return 0;
 821         if (type == CULL_PATH) {
 822                 db_info->cull = 1;
 823                 return 0;
 824         }
 825         if (type == PARAM_LIMIT && impossible_limit(db_info->expr, param, key, value)) {
 826                 db_info->cull = 1;
 827                 return 0;
 828         }
 829
 830         call_results_to_rl(db_info->expr, get_type(strip_expr(db_info->expr)), argv[1], &ret_range);
 831         ret_range = cast_rl(get_type(db_info->expr), ret_range);
 832
 833         FOR_EACH_PTR(db_return_states_list, tmp) {
 834                 if (tmp->type == type)
 835                         tmp->callback(db_info->expr, param, key, value);
 836         } END_FOR_EACH_PTR(tmp);
 837
 838         /*
 839          * We want to store the return values so that we can split the strees
 840          * in smatch_db.c.  This uses set_state() directly because it's not a
 841          * real smatch_extra state.
 842          */
 843         snprintf(buf, sizeof(buf), "return %p", db_info->expr);
 844         set_state(SMATCH_EXTRA, buf, NULL, alloc_estate_rl(ret_range));
 845
 846         return 0;
 847 }
 848
 849 static void db_return_states(struct expression *expr)
 850 {
 851         struct sm_state *sm;
 852         struct stree *stree;
 853         struct db_callback_info db_info = {};
 854
 855         if (!__get_cur_stree())  /* no return functions */
 856                 return;
 857
 858         db_info.prev_return_id = -1;
 859         db_info.expr = expr;
 860         db_info.stree = NULL;
 861
 862         call_return_states_before_hooks();
 863
 864         __push_fake_cur_stree();
 865         __unnullify_path();
 866         sql_select_return_states("return_id, return, type, parameter, key, value",
 867                         expr, db_return_states_callback, &db_info);
 868         stree = __pop_fake_cur_stree();
 869         if (!db_info.cull)
 870                 merge_fake_stree(&db_info.stree, stree);
 871         free_stree(&stree);
 872
 873         FOR_EACH_SM(db_info.stree, sm) {
 874                 __set_sm(sm);
 875         } END_FOR_EACH_SM(sm);
 876
 877         free_stree(&db_info.stree);
 878         call_return_states_after_hooks();
 879 }
 880
 881 static int is_condition_call(struct expression *expr)
 882 {
 883         struct expression *tmp;
 884
 885         FOR_EACH_PTR_REVERSE(big_condition_stack, tmp) {
 886                 if (expr == tmp || expr->parent == tmp)
 887                         return 1;
 888                 if (tmp->pos.line < expr->pos.line)
 889                         return 0;
 890         } END_FOR_EACH_PTR_REVERSE(tmp);
 891
 892         return 0;
 893 }
 894
 895 static void db_return_states_call(struct expression *expr)
 896 {
 897         if (is_assigned_call(expr))
 898                 return;
 899         if (is_condition_call(expr))
 900                 return;
 901         db_return_states(expr);
 902 }
 903
 904 static void match_function_call(struct expression *expr)
 905 {
 906         struct call_back_list *call_backs;
 907
 908         if (expr->fn->type == EXPR_SYMBOL && expr->fn->symbol) {
 909                 call_backs = search_callback(func_hash, (char *)expr->fn->symbol->ident->name);
 910                 if (call_backs)
 911                         call_call_backs(call_backs, REGULAR_CALL,
 912                                         expr->fn->symbol->ident->name, expr);
 913         }
 914         db_return_states_call(expr);
 915 }
 916
 917 static void match_macro_assign(struct expression *expr)
 918 {
 919         struct call_back_list *call_backs;
 920         const char *macro;
 921         struct expression *right;
 922
 923         right = strip_expr(expr->right);
 924         macro = get_macro_name(right->pos);
 925         call_backs = search_callback(func_hash, (char *)macro);
 926         if (!call_backs)
 927                 return;
 928         call_call_backs(call_backs, MACRO_ASSIGN, macro, expr);
 929         call_call_backs(call_backs, MACRO_ASSIGN_EXTRA, macro, expr);
 930 }
 931
 932 int get_implied_return(struct expression *expr, struct range_list **rl)
 933 {
 934         struct call_back_list *call_backs;
 935         struct fcall_back *tmp;
 936         int handled = 0;
 937         char *fn;
 938
 939         *rl = NULL;
 940
 941         expr = strip_expr(expr);
 942         fn = expr_to_var(expr->fn);
 943         if (!fn)
 944                 goto out;
 945
 946         call_backs = search_callback(func_hash, fn);
 947
 948         FOR_EACH_PTR(call_backs, tmp) {
 949                 if (tmp->type == IMPLIED_RETURN) {
 950                         (tmp->u.implied_return)(expr, tmp->info, rl);
 951                         handled = 1;
 952                 }
 953         } END_FOR_EACH_PTR(tmp);
 954
 955 out:
 956         free_string(fn);
 957         return handled;
 958 }
 959
 960 void create_function_hook_hash(void)
 961 {
 962         func_hash = create_function_hashtable(5000);
 963 }
 964
 965 void register_function_hooks(int id)
 966 {
 967         add_hook(&match_function_call, CALL_HOOK_AFTER_INLINE);
 968         add_hook(&match_assign_call, CALL_ASSIGNMENT_HOOK);
 969         add_hook(&match_macro_assign, MACRO_ASSIGNMENT_HOOK);
 970 }