smatch_strlen.c

   1 /*
   2  * Copyright (C) 2013 Oracle.
   3  *
   4  * This program is free software; you can redistribute it and/or
   5  * modify it under the terms of the GNU General Public License
   6  * as published by the Free Software Foundation; either version 2
   7  * of the License, or (at your option) any later version.
   8  *
   9  * This program is distributed in the hope that it will be useful,
  10  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  11  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  12  * GNU General Public License for more details.
  13  *
  14  * You should have received a copy of the GNU General Public License
  15  * along with this program; if not, see http://www.gnu.org/copyleft/gpl.txt
  16  */
  17
  18 #include <stdlib.h>
  19 #include <errno.h>
  20 #include "parse.h"
  21 #include "smatch.h"
  22 #include "smatch_slist.h"
  23 #include "smatch_extra.h"
  24
  25 #define UNKNOWN_SIZE (-1)
  26
  27 static int my_strlen_id;
  28 /*
  29  * The trick with the my_equiv_id is that if we have:
  30  * foo = strlen(bar);
  31  * We don't know at that point what the strlen() is but we know it's equivalent
  32  * to "foo" so maybe we can find the value of "foo" later.
  33  */
  34 static int my_equiv_id;
  35
  36 static struct smatch_state *size_to_estate(int size)
  37 {
  38         sval_t sval;
  39
  40         sval.type = &int_ctype;
  41         sval.value = size;
  42
  43         return alloc_estate_sval(sval);
  44 }
  45
  46 static struct smatch_state *unmatched_strlen_state(struct sm_state *sm)
  47 {
  48         return size_to_estate(UNKNOWN_SIZE);
  49 }
  50
  51 static void set_strlen_undefined(struct sm_state *sm, struct expression *mod_expr)
  52 {
  53         set_state(sm->owner, sm->name, sm->sym, size_to_estate(UNKNOWN_SIZE));
  54 }
  55
  56 static void set_strlen_equiv_undefined(struct sm_state *sm, struct expression *mod_expr)
  57 {
  58         set_state(sm->owner, sm->name, sm->sym, &undefined);
  59 }
  60
  61 static void match_string_assignment(struct expression *expr)
  62 {
  63         struct range_list *rl;
  64
  65         if (expr->op != '=')
  66                 return;
  67         if (!get_implied_strlen(expr->right, &rl))
  68                 return;
  69         set_state_expr(my_strlen_id, expr->left, alloc_estate_rl(clone_rl(rl)));
  70 }
  71
  72 static void match_strlen(const char *fn, struct expression *expr, void *unused)
  73 {
  74         struct expression *right;
  75         struct expression *str;
  76         struct expression *len_expr;
  77         char *len_name;
  78         struct smatch_state *state;
  79
  80         right = strip_expr(expr->right);
  81         str = get_argument_from_call_expr(right->args, 0);
  82         len_expr = strip_expr(expr->left);
  83
  84         len_name = expr_to_var(len_expr);
  85         if (!len_name)
  86                 return;
  87
  88         state = __alloc_smatch_state(0);
  89         state->name = len_name;
  90         state->data = len_expr;
  91
  92         set_state_expr(my_equiv_id, str, state);
  93 }
  94
  95 static int get_strlen_from_string(struct expression *expr, struct range_list **rl)
  96 {
  97         sval_t sval;
  98         int len;
  99
 100         len = expr->string->length;
 101         sval = sval_type_val(&int_ctype, len - 1);
 102         *rl = alloc_rl(sval, sval);
 103         return 1;
 104 }
 105
 106
 107 static int get_strlen_from_state(struct expression *expr, struct range_list **rl)
 108 {
 109         struct smatch_state *state;
 110
 111         state = get_state_expr(my_strlen_id, expr);
 112         if (!state)
 113                 return 0;
 114         *rl = estate_rl(state);
 115         return 1;
 116 }
 117
 118 static int get_strlen_from_equiv(struct expression *expr, struct range_list **rl)
 119 {
 120         struct smatch_state *state;
 121
 122         state = get_state_expr(my_equiv_id, expr);
 123         if (!state || !state->data)
 124                 return 0;
 125         if (!get_implied_rl((struct expression *)state->data, rl))
 126                 return 0;
 127         return 1;
 128 }
 129
 130 int get_implied_strlen(struct expression *expr, struct range_list **rl)
 131 {
 132
 133         *rl = NULL;
 134
 135         switch (expr->type) {
 136         case EXPR_STRING:
 137                 return get_strlen_from_string(expr, rl);
 138         }
 139
 140         if (get_strlen_from_state(expr, rl))
 141                 return 1;
 142         if (get_strlen_from_equiv(expr, rl))
 143                 return 1;
 144         return 0;
 145 }
 146
 147 int get_size_from_strlen(struct expression *expr)
 148 {
 149         struct range_list *rl;
 150         sval_t max;
 151
 152         if (!get_implied_strlen(expr, &rl))
 153                 return 0;
 154         max = rl_max(rl);
 155         if (sval_is_negative(max) || sval_is_max(max))
 156                 return 0;
 157
 158         return max.value + 1; /* add one because strlen doesn't include the NULL */
 159 }
 160
 161 void set_param_strlen(const char *name, struct symbol *sym, char *key, char *value)
 162 {
 163         struct range_list *rl = NULL;
 164         struct smatch_state *state;
 165         char fullname[256];
 166
 167         if (strncmp(key, "$$", 2) != 0)
 168                 return;
 169
 170         snprintf(fullname, 256, "%s%s", name, key + 2);
 171
 172         str_to_rl(&int_ctype, value, &rl);
 173         if (!rl || is_whole_rl(rl))
 174                 return;
 175         state = alloc_estate_rl(rl);
 176         set_state(my_strlen_id, fullname, sym, state);
 177 }
 178
 179 static void match_call(struct expression *expr)
 180 {
 181         struct expression *arg;
 182         struct range_list *rl;
 183         int i;
 184
 185         i = 0;
 186         FOR_EACH_PTR(expr->args, arg) {
 187                 if (!get_implied_strlen(arg, &rl))
 188                         continue;
 189                 if (!is_whole_rl(rl))
 190                         sql_insert_caller_info(expr, STR_LEN, i, "$$", show_rl(rl));
 191                 i++;
 192         } END_FOR_EACH_PTR(arg);
 193 }
 194
 195 static void struct_member_callback(struct expression *call, int param, char *printed_name, struct smatch_state *state)
 196 {
 197         if (state == &merged)
 198                 return;
 199         sql_insert_caller_info(call, STR_LEN, param, printed_name, state->name);
 200 }
 201
 202 void register_strlen(int id)
 203 {
 204         my_strlen_id = id;
 205
 206         add_unmatched_state_hook(my_strlen_id, &unmatched_strlen_state);
 207
 208         select_caller_info_hook(set_param_strlen, STR_LEN);
 209         add_hook(&match_string_assignment, ASSIGNMENT_HOOK);
 210
 211         add_modification_hook(my_strlen_id, &set_strlen_undefined);
 212         add_merge_hook(my_strlen_id, &merge_estates);
 213         add_hook(&match_call, FUNCTION_CALL_HOOK);
 214         add_member_info_callback(my_strlen_id, struct_member_callback);
 215 }
 216
 217 void register_strlen_equiv(int id)
 218 {
 219         my_equiv_id = id;
 220         add_function_assign_hook("strlen", &match_strlen, NULL);
 221         add_modification_hook(my_equiv_id, &set_strlen_equiv_undefined);
 222 }
 223