smatch_function_hooks.c

   1 /*
   2  * Copyright (C) 2009 Dan Carpenter.
   3  *
   4  * This program is free software; you can redistribute it and/or
   5  * modify it under the terms of the GNU General Public License
   6  * as published by the Free Software Foundation; either version 2
   7  * of the License, or (at your option) any later version.
   8  *
   9  * This program is distributed in the hope that it will be useful,
  10  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  11  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  12  * GNU General Public License for more details.
  13  *
  14  * You should have received a copy of the GNU General Public License
  15  * along with this program; if not, see http://www.gnu.org/copyleft/gpl.txt
  16  */
  17
  18 /*
  19  * There are several types of function hooks:
  20  * add_function_hook()        - For any time a function is called.
  21  * add_function_assign_hook() - foo = the_function().
  22  * add_implied_return_hook()  - Calculates the implied return value.
  23  * add_macro_assign_hook()    - foo = the_macro().
  24  * return_implies_state()     - For when a return value of 1 implies locked
  25  *                              and 0 implies unlocked. etc. etc.
  26  *
  27  */
  28
  29 #include <stdlib.h>
  30 #include <stdio.h>
  31 #include "smatch.h"
  32 #include "smatch_slist.h"
  33 #include "smatch_extra.h"
  34 #include "smatch_function_hashtable.h"
  35
  36 struct fcall_back {
  37         int type;
  38         struct data_range *range;
  39         union {
  40                 func_hook *call_back;
  41                 implication_hook *ranged;
  42                 implied_return_hook *implied_return;
  43         } u;
  44         void *info;
  45 };
  46
  47 ALLOCATOR(fcall_back, "call backs");
  48 DECLARE_PTR_LIST(call_back_list, struct fcall_back);
  49
  50 DEFINE_FUNCTION_HASHTABLE_STATIC(callback, struct fcall_back, struct call_back_list);
  51 static struct hashtable *func_hash;
  52
  53 int __in_fake_parameter_assign;
  54
  55 #define REGULAR_CALL       0
  56 #define RANGED_CALL        1
  57 #define ASSIGN_CALL        2
  58 #define IMPLIED_RETURN     3
  59 #define MACRO_ASSIGN       4
  60 #define MACRO_ASSIGN_EXTRA 5
  61
  62 struct return_implies_callback {
  63         int type;
  64         return_implies_hook *callback;
  65 };
  66 ALLOCATOR(return_implies_callback, "return_implies callbacks");
  67 DECLARE_PTR_LIST(db_implies_list, struct return_implies_callback);
  68 static struct db_implies_list *db_return_states_list;
  69
  70 typedef void (void_fn)(void);
  71 DECLARE_PTR_LIST(void_fn_list, void_fn *);
  72 static struct void_fn_list *return_states_before;
  73 static struct void_fn_list *return_states_after;
  74
  75 static struct fcall_back *alloc_fcall_back(int type, void *call_back,
  76                                            void *info)
  77 {
  78         struct fcall_back *cb;
  79
  80         cb = __alloc_fcall_back(0);
  81         cb->type = type;
  82         cb->u.call_back = call_back;
  83         cb->info = info;
  84         return cb;
  85 }
  86
  87 void add_function_hook(const char *look_for, func_hook *call_back, void *info)
  88 {
  89         struct fcall_back *cb;
  90
  91         cb = alloc_fcall_back(REGULAR_CALL, call_back, info);
  92         add_callback(func_hash, look_for, cb);
  93 }
  94
  95 void add_function_assign_hook(const char *look_for, func_hook *call_back,
  96                               void *info)
  97 {
  98         struct fcall_back *cb;
  99
 100         cb = alloc_fcall_back(ASSIGN_CALL, call_back, info);
 101         add_callback(func_hash, look_for, cb);
 102 }
 103
 104 static void register_funcs_from_file_helper(const char *file,
 105                                             func_hook *call_back, void *info,
 106                                             bool assign)
 107 {
 108         struct token *token;
 109         const char *func;
 110         char name[64];
 111
 112         snprintf(name, sizeof(name), "%s.%s", option_project_str, file);
 113         token = get_tokens_file(name);
 114         if (!token)
 115                 return;
 116         if (token_type(token) != TOKEN_STREAMBEGIN)
 117                 return;
 118         token = token->next;
 119         while (token_type(token) != TOKEN_STREAMEND) {
 120                 if (token_type(token) != TOKEN_IDENT)
 121                         return;
 122                 func = show_ident(token->ident);
 123                 if (assign)
 124                         add_function_assign_hook(func, call_back, info);
 125                 else
 126                         add_function_hook(func, call_back, info);
 127                 token = token->next;
 128         }
 129         clear_token_alloc();
 130 }
 131
 132 void register_func_hooks_from_file(const char *file,
 133                                    func_hook *call_back, void *info)
 134 {
 135         register_funcs_from_file_helper(file, call_back, info, false);
 136 }
 137
 138 void register_assign_hooks_from_file(const char *file,
 139                                      func_hook *call_back, void *info)
 140 {
 141         register_funcs_from_file_helper(file, call_back, info, true);
 142 }
 143
 144 void add_implied_return_hook(const char *look_for,
 145                              implied_return_hook *call_back,
 146                              void *info)
 147 {
 148         struct fcall_back *cb;
 149
 150         cb = alloc_fcall_back(IMPLIED_RETURN, call_back, info);
 151         add_callback(func_hash, look_for, cb);
 152 }
 153
 154 void add_macro_assign_hook(const char *look_for, func_hook *call_back,
 155                         void *info)
 156 {
 157         struct fcall_back *cb;
 158
 159         cb = alloc_fcall_back(MACRO_ASSIGN, call_back, info);
 160         add_callback(func_hash, look_for, cb);
 161 }
 162
 163 void add_macro_assign_hook_extra(const char *look_for, func_hook *call_back,
 164                         void *info)
 165 {
 166         struct fcall_back *cb;
 167
 168         cb = alloc_fcall_back(MACRO_ASSIGN_EXTRA, call_back, info);
 169         add_callback(func_hash, look_for, cb);
 170 }
 171
 172 void return_implies_state(const char *look_for, long long start, long long end,
 173                          implication_hook *call_back, void *info)
 174 {
 175         struct fcall_back *cb;
 176
 177         cb = alloc_fcall_back(RANGED_CALL, call_back, info);
 178         cb->range = alloc_range_perm(ll_to_sval(start), ll_to_sval(end));
 179         add_callback(func_hash, look_for, cb);
 180 }
 181
 182 void return_implies_state_sval(const char *look_for, sval_t start, sval_t end,
 183                          implication_hook *call_back, void *info)
 184 {
 185         struct fcall_back *cb;
 186
 187         cb = alloc_fcall_back(RANGED_CALL, call_back, info);
 188         cb->range = alloc_range_perm(start, end);
 189         add_callback(func_hash, look_for, cb);
 190 }
 191
 192 void select_return_states_hook(int type, return_implies_hook *callback)
 193 {
 194         struct return_implies_callback *cb = __alloc_return_implies_callback(0);
 195
 196         cb->type = type;
 197         cb->callback = callback;
 198         add_ptr_list(&db_return_states_list, cb);
 199 }
 200
 201 void select_return_states_before(void_fn *fn)
 202 {
 203         void_fn **p = malloc(sizeof(void_fn *));
 204         *p = fn;
 205         add_ptr_list(&return_states_before, p);
 206 }
 207
 208 void select_return_states_after(void_fn *fn)
 209 {
 210         void_fn **p = malloc(sizeof(void_fn *));
 211         *p = fn;
 212         add_ptr_list(&return_states_after, p);
 213 }
 214
 215 static void call_return_states_before_hooks(void)
 216 {
 217         void_fn **fn;
 218
 219         FOR_EACH_PTR(return_states_before, fn) {
 220                 (*fn)();
 221         } END_FOR_EACH_PTR(fn);
 222 }
 223
 224 static void call_return_states_after_hooks(struct expression *expr)
 225 {
 226         void_fn **fn;
 227
 228         FOR_EACH_PTR(return_states_after, fn) {
 229                 (*fn)();
 230         } END_FOR_EACH_PTR(fn);
 231         __pass_to_client(expr, FUNCTION_CALL_HOOK_AFTER_DB);
 232 }
 233
 234 static int call_call_backs(struct call_back_list *list, int type,
 235                             const char *fn, struct expression *expr)
 236 {
 237         struct fcall_back *tmp;
 238         int handled = 0;
 239
 240         FOR_EACH_PTR(list, tmp) {
 241                 if (tmp->type == type) {
 242                         (tmp->u.call_back)(fn, expr, tmp->info);
 243                         handled = 1;
 244                 }
 245         } END_FOR_EACH_PTR(tmp);
 246
 247         return handled;
 248 }
 249
 250 static void call_ranged_call_backs(struct call_back_list *list,
 251                                 const char *fn, struct expression *call_expr,
 252                                 struct expression *assign_expr)
 253 {
 254         struct fcall_back *tmp;
 255
 256         FOR_EACH_PTR(list, tmp) {
 257                 (tmp->u.ranged)(fn, call_expr, assign_expr, tmp->info);
 258         } END_FOR_EACH_PTR(tmp);
 259 }
 260
 261 static struct call_back_list *get_same_ranged_call_backs(struct call_back_list *list,
 262                                                 struct data_range *drange)
 263 {
 264         struct call_back_list *ret = NULL;
 265         struct fcall_back *tmp;
 266
 267         FOR_EACH_PTR(list, tmp) {
 268                 if (tmp->type != RANGED_CALL)
 269                         continue;
 270                 if (ranges_equiv(tmp->range, drange))
 271                         add_ptr_list(&ret, tmp);
 272         } END_FOR_EACH_PTR(tmp);
 273         return ret;
 274 }
 275
 276 static int in_list_exact_sval(struct range_list *list, struct data_range *drange)
 277 {
 278         struct data_range *tmp;
 279
 280         FOR_EACH_PTR(list, tmp) {
 281                 if (ranges_equiv(tmp, drange))
 282                         return 1;
 283         } END_FOR_EACH_PTR(tmp);
 284         return 0;
 285 }
 286
 287 static int assign_ranged_funcs(const char *fn, struct expression *expr,
 288                                  struct call_back_list *call_backs)
 289 {
 290         struct fcall_back *tmp;
 291         struct sm_state *sm;
 292         char *var_name;
 293         struct symbol *sym;
 294         struct smatch_state *estate;
 295         struct stree *tmp_stree;
 296         struct stree *final_states = NULL;
 297         struct range_list *handled_ranges = NULL;
 298         struct call_back_list *same_range_call_backs = NULL;
 299         struct range_list *rl;
 300         int handled = 0;
 301
 302         if (!call_backs)
 303                 return 0;
 304
 305         var_name = expr_to_var_sym(expr->left, &sym);
 306         if (!var_name || !sym)
 307                 goto free;
 308
 309         FOR_EACH_PTR(call_backs, tmp) {
 310                 if (tmp->type != RANGED_CALL)
 311                         continue;
 312
 313                 if (in_list_exact_sval(handled_ranges, tmp->range))
 314                         continue;
 315                 __push_fake_cur_stree();
 316                 tack_on(&handled_ranges, tmp->range);
 317
 318                 same_range_call_backs = get_same_ranged_call_backs(call_backs, tmp->range);
 319                 call_ranged_call_backs(same_range_call_backs, fn, expr->right, expr);
 320                 __free_ptr_list((struct ptr_list **)&same_range_call_backs);
 321
 322                 rl = alloc_rl(tmp->range->min, tmp->range->max);
 323                 rl = cast_rl(get_type(expr->left), rl);
 324                 estate = alloc_estate_rl(rl);
 325                 set_extra_mod(var_name, sym, expr->left, estate);
 326
 327                 tmp_stree = __pop_fake_cur_stree();
 328                 merge_fake_stree(&final_states, tmp_stree);
 329                 free_stree(&tmp_stree);
 330                 handled = 1;
 331         } END_FOR_EACH_PTR(tmp);
 332
 333         FOR_EACH_SM(final_states, sm) {
 334                 __set_sm(sm);
 335         } END_FOR_EACH_SM(sm);
 336
 337         free_stree(&final_states);
 338 free:
 339         free_string(var_name);
 340         return handled;
 341 }
 342
 343 static void call_implies_callbacks(int comparison, struct expression *expr, sval_t sval, int left, struct stree **implied_true, struct stree **implied_false)
 344 {
 345         struct call_back_list *call_backs;
 346         struct fcall_back *tmp;
 347         const char *fn;
 348         struct data_range *value_range;
 349         struct stree *true_states = NULL;
 350         struct stree *false_states = NULL;
 351         struct stree *tmp_stree;
 352
 353         *implied_true = NULL;
 354         *implied_false = NULL;
 355         if (expr->fn->type != EXPR_SYMBOL || !expr->fn->symbol)
 356                 return;
 357         fn = expr->fn->symbol->ident->name;
 358         call_backs = search_callback(func_hash, (char *)expr->fn->symbol->ident->name);
 359         if (!call_backs)
 360                 return;
 361         value_range = alloc_range(sval, sval);
 362
 363         /* set true states */
 364         __push_fake_cur_stree();
 365         FOR_EACH_PTR(call_backs, tmp) {
 366                 if (tmp->type != RANGED_CALL)
 367                         continue;
 368                 if (!true_comparison_range_LR(comparison, tmp->range, value_range, left))
 369                         continue;
 370                 (tmp->u.ranged)(fn, expr, NULL, tmp->info);
 371         } END_FOR_EACH_PTR(tmp);
 372         tmp_stree = __pop_fake_cur_stree();
 373         merge_fake_stree(&true_states, tmp_stree);
 374         free_stree(&tmp_stree);
 375
 376         /* set false states */
 377         __push_fake_cur_stree();
 378         FOR_EACH_PTR(call_backs, tmp) {
 379                 if (tmp->type != RANGED_CALL)
 380                         continue;
 381                 if (!false_comparison_range_LR(comparison, tmp->range, value_range, left))
 382                         continue;
 383                 (tmp->u.ranged)(fn, expr, NULL, tmp->info);
 384         } END_FOR_EACH_PTR(tmp);
 385         tmp_stree = __pop_fake_cur_stree();
 386         merge_fake_stree(&false_states, tmp_stree);
 387         free_stree(&tmp_stree);
 388
 389         *implied_true = true_states;
 390         *implied_false = false_states;
 391 }
 392
 393 struct db_callback_info {
 394         int true_side;
 395         int comparison;
 396         struct expression *expr;
 397         struct range_list *rl;
 398         int left;
 399         struct stree *stree;
 400         struct stree *implied;
 401         struct db_implies_list *callbacks;
 402         int prev_return_id;
 403         int cull;
 404         int has_states;
 405         char *ret_str;
 406         struct smatch_state *ret_state;
 407         struct expression *var_expr;
 408         int handled;
 409 };
 410
 411 static void set_implied_states(struct db_callback_info *db_info)
 412 {
 413         struct sm_state *sm;
 414
 415         FOR_EACH_SM(db_info->implied, sm) {
 416                 __set_sm(sm);
 417         } END_FOR_EACH_SM(sm);
 418
 419         free_stree(&db_info->implied);
 420 }
 421
 422 static void store_return_state(struct db_callback_info *db_info, const char *ret_str, struct smatch_state *state)
 423 {
 424         db_info->ret_str = alloc_sname(ret_str),
 425         db_info->ret_state = state;
 426 }
 427
 428 static bool fake_a_param_assignment(struct expression *expr, const char *ret_str, struct smatch_state *orig)
 429 {
 430         struct expression *arg, *left, *right, *tmp, *fake_assign;
 431         char *p;
 432         int param;
 433         char buf[256];
 434         char *str;
 435
 436         if (expr->type != EXPR_ASSIGNMENT || expr->op != '=')
 437                 return false;
 438         left = expr->left;
 439         right = expr->right;
 440
 441         while (right->type == EXPR_ASSIGNMENT)
 442                 right = strip_expr(right->right);
 443         if (!right || right->type != EXPR_CALL)
 444                 return false;
 445
 446         p = strchr(ret_str, '[');
 447         if (!p)
 448                 return false;
 449
 450         p++;
 451         if (p[0] == '=' && p[1] == '=')
 452                 p += 2;
 453         if (p[0] != '$')
 454                 return false;
 455
 456         snprintf(buf, sizeof(buf), "%s", p);
 457
 458         p = buf;
 459         p += 1;
 460         param = strtol(p, &p, 10);
 461
 462         p = strchr(p, ']');
 463         if (!p || *p != ']')
 464                 return false;
 465         *p = '\0';
 466
 467         arg = get_argument_from_call_expr(right->args, param);
 468         if (!arg)
 469                 return false;
 470
 471         /* There should be a get_other_name() function which returns an expr */
 472         tmp = get_assigned_expr(arg);
 473         if (tmp)
 474                 arg = tmp;
 475
 476         /*
 477          * This is a sanity check to prevent side effects from evaluating stuff
 478          * twice.
 479          */
 480         str = expr_to_chunk_sym_vsl(arg, NULL, NULL);
 481         if (!str)
 482                 return false;
 483         free_string(str);
 484
 485         right = gen_expression_from_key(arg, buf);
 486         if (!right)  /* Mostly fails for binops like [$0 + 4032] */
 487                 return false;
 488         fake_assign = assign_expression(left, '=', right);
 489         __in_fake_parameter_assign++;
 490         __split_expr(fake_assign);
 491         __in_fake_parameter_assign--;
 492
 493         /*
 494          * If the return is "0-65531[$0->nla_len - 4]" the faked expression
 495          * is maybe (-4)-65531 but we know it is in the 0-65531 range so both
 496          * parts have to be considered.  We use _nomod() because it's not really
 497          * another modification, it's just a clarification.
 498          *
 499          */
 500         if (estate_rl(orig)) {
 501                 struct smatch_state *faked;
 502                 struct range_list *rl;
 503
 504                 faked = get_extra_state(left);
 505                 if (estate_rl(faked)) {
 506                         rl = rl_intersection(estate_rl(faked), estate_rl(orig));
 507                         if (rl)
 508                                 set_extra_expr_nomod(expr, alloc_estate_rl(rl));
 509                 }
 510         }
 511
 512         return true;
 513 }
 514
 515 static void set_fresh_mtag_returns(struct db_callback_info *db_info)
 516 {
 517         struct expression *expr = db_info->expr->left;
 518         struct smatch_state *state;
 519
 520         if (!db_info->ret_state)
 521                 return;
 522
 523         state = alloc_estate_rl(cast_rl(get_type(expr), clone_rl(estate_rl(db_info->ret_state))));
 524         state = get_mtag_return(db_info->expr, state);
 525         if (!state)
 526                 return;
 527
 528         set_real_absolute(expr, state);
 529         set_extra_expr_mod(expr, state);
 530
 531         db_info->ret_state = NULL;
 532         db_info->ret_str = NULL;
 533 }
 534
 535 static void set_return_assign_state(struct db_callback_info *db_info)
 536 {
 537         struct expression *expr = db_info->expr->left;
 538         struct smatch_state *state;
 539
 540         if (!db_info->ret_state)
 541                 return;
 542
 543         state = alloc_estate_rl(cast_rl(get_type(expr), clone_rl(estate_rl(db_info->ret_state))));
 544         if (!fake_a_param_assignment(db_info->expr, db_info->ret_str, state))
 545                 set_extra_expr_mod(expr, state);
 546
 547         db_info->ret_state = NULL;
 548         db_info->ret_str = NULL;
 549 }
 550
 551 static void set_other_side_state(struct db_callback_info *db_info)
 552 {
 553         struct expression *expr = db_info->var_expr;
 554         struct smatch_state *state;
 555
 556         if (!db_info->ret_state)
 557                 return;
 558
 559         state = alloc_estate_rl(cast_rl(get_type(expr), clone_rl(estate_rl(db_info->ret_state))));
 560         set_extra_expr_nomod(expr, state);
 561         db_info->ret_state = NULL;
 562         db_info->ret_str = NULL;
 563 }
 564
 565 static void handle_ret_equals_param(char *ret_string, struct range_list *rl, struct expression *call)
 566 {
 567         char *str;
 568         long long param;
 569         struct expression *arg;
 570         struct range_list *orig;
 571
 572         str = strstr(ret_string, "==$");
 573         if (!str)
 574                 return;
 575         str += 3;
 576         param = strtoll(str, NULL, 10);
 577         arg = get_argument_from_call_expr(call->args, param);
 578         if (!arg)
 579                 return;
 580         get_absolute_rl(arg, &orig);
 581         rl = rl_intersection(orig, rl);
 582         if (!rl)
 583                 return;
 584         set_extra_expr_nomod(arg, alloc_estate_rl(rl));
 585 }
 586
 587 static int impossible_limit(struct expression *expr, int param, char *key, char *value)
 588 {
 589         struct expression *arg;
 590         struct smatch_state *state;
 591         struct range_list *passed;
 592         struct range_list *limit;
 593         struct symbol *compare_type;
 594
 595         while (expr->type == EXPR_ASSIGNMENT)
 596                 expr = strip_expr(expr->right);
 597         if (expr->type != EXPR_CALL)
 598                 return 0;
 599
 600         arg = get_argument_from_call_expr(expr->args, param);
 601         if (!arg)
 602                 return 0;
 603
 604         if (strcmp(key, "$") == 0) {
 605                 if (!get_implied_rl(arg, &passed))
 606                         return 0;
 607
 608                 compare_type = get_arg_type(expr->fn, param);
 609         } else {
 610                 char *name;
 611                 struct symbol *sym;
 612
 613                 name = get_variable_from_key(arg, key, &sym);
 614                 if (!name || !sym)
 615                         return 0;
 616
 617                 state = get_state(SMATCH_EXTRA, name, sym);
 618                 if (!state) {
 619                         free_string(name);
 620                         return 0;
 621                 }
 622                 passed = estate_rl(state);
 623                 if (!passed || is_whole_rl(passed)) {
 624                         free_string(name);
 625                         return 0;
 626                 }
 627
 628                 compare_type = get_member_type_from_key(arg, key);
 629         }
 630
 631         passed = cast_rl(compare_type, passed);
 632         call_results_to_rl(expr, compare_type, value, &limit);
 633         if (!limit || is_whole_rl(limit))
 634                 return 0;
 635         if (possibly_true_rl(passed, SPECIAL_EQUAL, limit))
 636                 return 0;
 637         if (option_debug || local_debug)
 638                 sm_msg("impossible: %d '%s' limit '%s' == '%s'", param, key, show_rl(passed), value);
 639         return 1;
 640 }
 641
 642 static int is_impossible_data(int type, struct expression *expr, int param, char *key, char *value)
 643 {
 644         if (type == PARAM_LIMIT && impossible_limit(expr, param, key, value))
 645                 return 1;
 646         if (type == COMPARE_LIMIT && param_compare_limit_is_impossible(expr, param, key, value)) {
 647                 if (local_debug)
 648                         sm_msg("param_compare_limit_is_impossible: %d %s %s", param, key, value);
 649                 return 1;
 650         }
 651         return 0;
 652 }
 653
 654 static int func_type_mismatch(struct expression *expr, const char *value)
 655 {
 656         struct symbol *type;
 657
 658         /* This makes faking returns easier */
 659         if (!value || value[0] == '\0')
 660                 return 0;
 661
 662         while (expr->type == EXPR_ASSIGNMENT)
 663                 expr = strip_expr(expr->right);
 664
 665         /*
 666          * Short cut:  We only care about function pointers that are struct
 667          * members.
 668          *
 669          */
 670         if (expr->fn->type == EXPR_SYMBOL)
 671                 return 0;
 672
 673         type = get_type(expr->fn);
 674         if (!type)
 675                 return 0;
 676         if (type->type == SYM_PTR)
 677                 type = get_real_base_type(type);
 678
 679         if (strcmp(type_to_str(type), value) == 0)
 680                 return 0;
 681
 682         return 1;
 683 }
 684
 685 static int db_compare_callback(void *_info, int argc, char **argv, char **azColName)
 686 {
 687         struct db_callback_info *db_info = _info;
 688         struct range_list *var_rl = db_info->rl;
 689         struct range_list *ret_range;
 690         int type, param;
 691         char *ret_str, *key, *value;
 692         struct return_implies_callback *tmp;
 693         struct stree *stree;
 694         int return_id;
 695         int comparison;
 696
 697         if (argc != 6)
 698                 return 0;
 699
 700         return_id = atoi(argv[0]);
 701         ret_str = argv[1];
 702         type = atoi(argv[2]);
 703         param = atoi(argv[3]);
 704         key = argv[4];
 705         value = argv[5];
 706
 707         db_info->has_states = 1;
 708         if (db_info->prev_return_id != -1 && type == INTERNAL) {
 709                 set_other_side_state(db_info);
 710                 set_implied_states(db_info);
 711                 stree = __pop_fake_cur_stree();
 712                 if (!db_info->cull)
 713                         merge_fake_stree(&db_info->stree, stree);
 714                 free_stree(&stree);
 715                 __push_fake_cur_stree();
 716                 db_info->cull = 0;
 717         }
 718         db_info->prev_return_id = return_id;
 719
 720         if (type == INTERNAL && func_type_mismatch(db_info->expr, value))
 721                 db_info->cull = 1;
 722         if (db_info->cull)
 723                 return 0;
 724         if (type == CULL_PATH) {
 725                 db_info->cull = 1;
 726                 return 0;
 727         }
 728
 729         if (is_impossible_data(type, db_info->expr, param, key, value)) {
 730                 db_info->cull = 1;
 731                 return 0;
 732         }
 733
 734         call_results_to_rl(db_info->expr, get_type(strip_expr(db_info->expr)), ret_str, &ret_range);
 735         ret_range = cast_rl(get_type(db_info->expr), ret_range);
 736         if (!ret_range)
 737                 ret_range = alloc_whole_rl(get_type(db_info->expr));
 738
 739         comparison = db_info->comparison;
 740         if (db_info->left)
 741                 comparison = flip_comparison(comparison);
 742
 743         if (db_info->true_side) {
 744                 if (!possibly_true_rl(var_rl, comparison, ret_range))
 745                         return 0;
 746                 if (type == PARAM_LIMIT)
 747                         param_limit_implications(db_info->expr, param, key, value, &db_info->implied);
 748                 filter_by_comparison(&var_rl, comparison, ret_range);
 749                 filter_by_comparison(&ret_range, flip_comparison(comparison), var_rl);
 750         } else {
 751                 if (!possibly_false_rl(var_rl, comparison, ret_range))
 752                         return 0;
 753                 if (type == PARAM_LIMIT)
 754                         param_limit_implications(db_info->expr, param, key, value, &db_info->implied);
 755                 filter_by_comparison(&var_rl, negate_comparison(comparison), ret_range);
 756                 filter_by_comparison(&ret_range, flip_comparison(negate_comparison(comparison)), var_rl);
 757         }
 758
 759         handle_ret_equals_param(ret_str, ret_range, db_info->expr);
 760
 761         if (type == INTERNAL) {
 762                 set_state(-1, "unnull_path", NULL, &true_state);
 763                 __add_return_comparison(strip_expr(db_info->expr), ret_str);
 764                 __add_return_to_param_mapping(db_info->expr, ret_str);
 765                 store_return_state(db_info, ret_str, alloc_estate_rl(clone_rl(var_rl)));
 766         }
 767
 768         FOR_EACH_PTR(db_info->callbacks, tmp) {
 769                 if (tmp->type == type)
 770                         tmp->callback(db_info->expr, param, key, value);
 771         } END_FOR_EACH_PTR(tmp);
 772
 773         return 0;
 774 }
 775
 776 static void compare_db_return_states_callbacks(struct expression *left, int comparison, struct expression *right, struct stree *implied_true, struct stree *implied_false)
 777 {
 778         struct stree *orig_states;
 779         struct stree *stree;
 780         struct stree *true_states;
 781         struct stree *false_states;
 782         struct sm_state *sm;
 783         struct db_callback_info db_info = {};
 784         struct expression *var_expr;
 785         struct expression *call_expr;
 786         struct range_list *rl;
 787         int call_on_left;
 788
 789         orig_states = clone_stree(__get_cur_stree());
 790
 791         /* legacy cruft.  need to fix call_implies_callbacks(). */
 792         call_on_left = 1;
 793         call_expr = left;
 794         var_expr = right;
 795         if (left->type != EXPR_CALL) {
 796                 call_on_left = 0;
 797                 call_expr = right;
 798                 var_expr = left;
 799         }
 800
 801         get_absolute_rl(var_expr, &rl);
 802
 803         db_info.comparison = comparison;
 804         db_info.expr = call_expr;
 805         db_info.rl = rl;
 806         db_info.left = call_on_left;
 807         db_info.callbacks = db_return_states_list;
 808         db_info.var_expr = var_expr;
 809
 810         call_return_states_before_hooks();
 811
 812         db_info.true_side = 1;
 813         db_info.stree = NULL;
 814         db_info.prev_return_id = -1;
 815         __push_fake_cur_stree();
 816         sql_select_return_states("return_id, return, type, parameter, key, value",
 817                                  call_expr, db_compare_callback, &db_info);
 818         set_other_side_state(&db_info);
 819         set_implied_states(&db_info);
 820         stree = __pop_fake_cur_stree();
 821         if (!db_info.cull)
 822                 merge_fake_stree(&db_info.stree, stree);
 823         free_stree(&stree);
 824         true_states = db_info.stree;
 825         if (!true_states && db_info.has_states) {
 826                 __push_fake_cur_stree();
 827                 set_path_impossible();
 828                 true_states = __pop_fake_cur_stree();
 829         }
 830
 831         nullify_path();
 832         __unnullify_path();
 833         FOR_EACH_SM(orig_states, sm) {
 834                 __set_sm_cur_stree(sm);
 835         } END_FOR_EACH_SM(sm);
 836
 837         db_info.true_side = 0;
 838         db_info.stree = NULL;
 839         db_info.prev_return_id = -1;
 840         db_info.cull = 0;
 841         __push_fake_cur_stree();
 842         sql_select_return_states("return_id, return, type, parameter, key, value", call_expr,
 843                         db_compare_callback, &db_info);
 844         set_other_side_state(&db_info);
 845         set_implied_states(&db_info);
 846         stree = __pop_fake_cur_stree();
 847         if (!db_info.cull)
 848                 merge_fake_stree(&db_info.stree, stree);
 849         free_stree(&stree);
 850         false_states = db_info.stree;
 851         if (!false_states && db_info.has_states) {
 852                 __push_fake_cur_stree();
 853                 set_path_impossible();
 854                 false_states = __pop_fake_cur_stree();
 855         }
 856
 857         nullify_path();
 858         __unnullify_path();
 859         FOR_EACH_SM(orig_states, sm) {
 860                 __set_sm_cur_stree(sm);
 861         } END_FOR_EACH_SM(sm);
 862
 863         free_stree(&orig_states);
 864
 865         FOR_EACH_SM(true_states, sm) {
 866                 __set_true_false_sm(sm, NULL);
 867         } END_FOR_EACH_SM(sm);
 868         FOR_EACH_SM(false_states, sm) {
 869                 __set_true_false_sm(NULL, sm);
 870         } END_FOR_EACH_SM(sm);
 871
 872         free_stree(&true_states);
 873         free_stree(&false_states);
 874
 875         call_return_states_after_hooks(call_expr);
 876
 877         FOR_EACH_SM(implied_true, sm) {
 878                 __set_true_false_sm(sm, NULL);
 879         } END_FOR_EACH_SM(sm);
 880         FOR_EACH_SM(implied_false, sm) {
 881                 __set_true_false_sm(NULL, sm);
 882         } END_FOR_EACH_SM(sm);
 883 }
 884
 885 void function_comparison(struct expression *left, int comparison, struct expression *right)
 886 {
 887         struct expression *var_expr;
 888         struct expression *call_expr;
 889         struct stree *implied_true = NULL;
 890         struct stree *implied_false = NULL;
 891         struct range_list *rl;
 892         sval_t sval;
 893         int call_on_left;
 894
 895         if (unreachable())
 896                 return;
 897
 898         /* legacy cruft.  need to fix call_implies_callbacks(). */
 899         call_on_left = 1;
 900         call_expr = left;
 901         var_expr = right;
 902         if (left->type != EXPR_CALL) {
 903                 call_on_left = 0;
 904                 call_expr = right;
 905                 var_expr = left;
 906         }
 907
 908         get_absolute_rl(var_expr, &rl);
 909
 910         if (rl_to_sval(rl, &sval))
 911                 call_implies_callbacks(comparison, call_expr, sval, call_on_left, &implied_true, &implied_false);
 912
 913         compare_db_return_states_callbacks(left, comparison, right, implied_true, implied_false);
 914         free_stree(&implied_true);
 915         free_stree(&implied_false);
 916 }
 917
 918 static void call_ranged_return_hooks(struct db_callback_info *db_info)
 919 {
 920         struct call_back_list *call_backs;
 921         struct expression *expr;
 922         struct fcall_back *tmp;
 923         char *fn;
 924
 925         expr = strip_expr(db_info->expr);
 926         while (expr->type == EXPR_ASSIGNMENT)
 927                 expr = strip_expr(expr->right);
 928         if (expr->type != EXPR_CALL ||
 929             expr->fn->type != EXPR_SYMBOL)
 930                 return;
 931
 932         fn = expr->fn->symbol_name->name;
 933
 934         call_backs = search_callback(func_hash, fn);
 935         FOR_EACH_PTR(call_backs, tmp) {
 936                 struct range_list *range_rl;
 937
 938                 if (tmp->type != RANGED_CALL)
 939                         continue;
 940                 range_rl = alloc_rl(tmp->range->min, tmp->range->max);
 941                 range_rl = cast_rl(estate_type(db_info->ret_state), range_rl);
 942                 if (possibly_true_rl(range_rl, SPECIAL_EQUAL, estate_rl(db_info->ret_state)))
 943                         (tmp->u.ranged)(fn, expr, db_info->expr, tmp->info);
 944         } END_FOR_EACH_PTR(tmp);
 945 }
 946
 947 static int db_assign_return_states_callback(void *_info, int argc, char **argv, char **azColName)
 948 {
 949         struct db_callback_info *db_info = _info;
 950         struct range_list *ret_range;
 951         int type, param;
 952         char *ret_str, *key, *value;
 953         struct return_implies_callback *tmp;
 954         struct stree *stree;
 955         int return_id;
 956
 957         if (argc != 6)
 958                 return 0;
 959
 960         return_id = atoi(argv[0]);
 961         ret_str = argv[1];
 962         type = atoi(argv[2]);
 963         param = atoi(argv[3]);
 964         key = argv[4];
 965         value = argv[5];
 966
 967         if (db_info->prev_return_id != -1 && type == INTERNAL) {
 968                 call_ranged_return_hooks(db_info);
 969                 set_return_assign_state(db_info);
 970                 set_implied_states(db_info);
 971                 stree = __pop_fake_cur_stree();
 972                 if (!db_info->cull)
 973                         merge_fake_stree(&db_info->stree, stree);
 974                 free_stree(&stree);
 975                 __push_fake_cur_stree();
 976                 db_info->cull = 0;
 977         }
 978         db_info->prev_return_id = return_id;
 979
 980         if (type == INTERNAL && func_type_mismatch(db_info->expr, value))
 981                 db_info->cull = 1;
 982         if (db_info->cull)
 983                 return 0;
 984         if (type == CULL_PATH) {
 985                 db_info->cull = 1;
 986                 return 0;
 987         }
 988         if (is_impossible_data(type, db_info->expr, param, key, value)) {
 989                 db_info->cull = 1;
 990                 return 0;
 991         }
 992
 993         if (type == PARAM_LIMIT)
 994                 param_limit_implications(db_info->expr, param, key, value, &db_info->implied);
 995
 996         db_info->handled = 1;
 997         call_results_to_rl(db_info->expr->right, get_type(strip_expr(db_info->expr->right)), ret_str, &ret_range);
 998         if (!ret_range)
 999                 ret_range = alloc_whole_rl(get_type(strip_expr(db_info->expr->right)));
1000         ret_range = cast_rl(get_type(db_info->expr->right), ret_range);
1001
1002         if (type == INTERNAL) {
1003                 set_state(-1, "unnull_path", NULL, &true_state);
1004                 __add_return_comparison(strip_expr(db_info->expr->right), ret_str);
1005                 __add_comparison_info(db_info->expr->left, strip_expr(db_info->expr->right), ret_str);
1006                 __add_return_to_param_mapping(db_info->expr, ret_str);
1007                 store_return_state(db_info, ret_str, alloc_estate_rl(ret_range));
1008                 set_fresh_mtag_returns(db_info);
1009         }
1010
1011         FOR_EACH_PTR(db_return_states_list, tmp) {
1012                 if (tmp->type == type)
1013                         tmp->callback(db_info->expr, param, key, value);
1014         } END_FOR_EACH_PTR(tmp);
1015
1016         return 0;
1017 }
1018
1019 static int db_return_states_assign(struct expression *expr)
1020 {
1021         struct expression *right;
1022         struct sm_state *sm;
1023         struct stree *stree;
1024         struct db_callback_info db_info = {};
1025
1026         right = strip_expr(expr->right);
1027
1028         db_info.prev_return_id = -1;
1029         db_info.expr = expr;
1030         db_info.stree = NULL;
1031         db_info.handled = 0;
1032
1033         call_return_states_before_hooks();
1034
1035         __push_fake_cur_stree();
1036         sql_select_return_states("return_id, return, type, parameter, key, value",
1037                         right, db_assign_return_states_callback, &db_info);
1038         if (option_debug) {
1039                 sm_msg("%s return_id %d return_ranges %s",
1040                         db_info.cull ? "culled" : "merging",
1041                         db_info.prev_return_id,
1042                         db_info.ret_state ? db_info.ret_state->name : "'<empty>'");
1043         }
1044         if (db_info.handled)
1045                 call_ranged_return_hooks(&db_info);
1046         set_return_assign_state(&db_info);
1047         set_implied_states(&db_info);
1048         stree = __pop_fake_cur_stree();
1049         if (!db_info.cull)
1050                 merge_fake_stree(&db_info.stree, stree);
1051         free_stree(&stree);
1052
1053         if (!db_info.stree && db_info.cull) { /* this means we culled everything */
1054                 set_extra_expr_mod(expr->left, alloc_estate_whole(get_type(expr->left)));
1055                 set_path_impossible();
1056         }
1057         FOR_EACH_SM(db_info.stree, sm) {
1058                 __set_sm(sm);
1059         } END_FOR_EACH_SM(sm);
1060
1061         free_stree(&db_info.stree);
1062         call_return_states_after_hooks(right);
1063
1064         return db_info.handled;
1065 }
1066
1067 static int handle_implied_return(struct expression *expr)
1068 {
1069         struct range_list *rl;
1070
1071         if (!get_implied_return(expr->right, &rl))
1072                 return 0;
1073         rl = cast_rl(get_type(expr->left), rl);
1074         set_extra_expr_mod(expr->left, alloc_estate_rl(rl));
1075         return 1;
1076 }
1077
1078 static void match_assign_call(struct expression *expr)
1079 {
1080         struct call_back_list *call_backs;
1081         const char *fn;
1082         struct expression *right;
1083         int handled = 0;
1084         struct range_list *rl;
1085
1086         if (expr->op != '=')
1087                 return;
1088
1089         right = strip_expr(expr->right);
1090         if (right->fn->type != EXPR_SYMBOL || !right->fn->symbol) {
1091                 handled |= db_return_states_assign(expr);
1092                 if (!handled)
1093                         goto assigned_unknown;
1094                 return;
1095         }
1096         if (is_fake_call(right)) {
1097                 set_extra_expr_mod(expr->left, alloc_estate_whole(get_type(expr->left)));
1098                 return;
1099         }
1100
1101         fn = right->fn->symbol->ident->name;
1102         call_backs = search_callback(func_hash, (char *)fn);
1103
1104         /*
1105          * The ordering here is sort of important.
1106          * One example, of how this matters is that when we do:
1107          *
1108          *      len = strlen(str);
1109          *
1110          * That is handled by smatch_common_functions.c and smatch_strlen.c.
1111          * They use implied_return and function_assign_hook respectively.
1112          * We want to get the implied return first before we do the function
1113          * assignment hook otherwise we end up writing the wrong thing for len
1114          * in smatch_extra.c because we assume that it already holds the
1115          * strlen() when we haven't set it yet.
1116          */
1117
1118         if (db_return_states_assign(expr) == 1)
1119                 handled = 1;
1120         else
1121                 handled = assign_ranged_funcs(fn, expr, call_backs);
1122         handled |= handle_implied_return(expr);
1123
1124
1125         call_call_backs(call_backs, ASSIGN_CALL, fn, expr);
1126
1127         if (handled)
1128                 return;
1129
1130 assigned_unknown:
1131         get_absolute_rl(expr->right, &rl);
1132         rl = cast_rl(get_type(expr->left), rl);
1133         set_extra_expr_mod(expr->left, alloc_estate_rl(rl));
1134 }
1135
1136 static int db_return_states_callback(void *_info, int argc, char **argv, char **azColName)
1137 {
1138         struct db_callback_info *db_info = _info;
1139         struct range_list *ret_range;
1140         int type, param;
1141         char *ret_str, *key, *value;
1142         struct return_implies_callback *tmp;
1143         struct stree *stree;
1144         int return_id;
1145         char buf[64];
1146
1147         if (argc != 6)
1148                 return 0;
1149
1150         return_id = atoi(argv[0]);
1151         ret_str = argv[1];
1152         type = atoi(argv[2]);
1153         param = atoi(argv[3]);
1154         key = argv[4];
1155         value = argv[5];
1156
1157         if (db_info->prev_return_id != -1 && type == INTERNAL) {
1158                 call_ranged_return_hooks(db_info);
1159                 set_implied_states(db_info);
1160                 stree = __pop_fake_cur_stree();
1161                 if (!db_info->cull)
1162                         merge_fake_stree(&db_info->stree, stree);
1163                 free_stree(&stree);
1164                 __push_fake_cur_stree();
1165                 __unnullify_path();
1166                 db_info->cull = 0;
1167         }
1168         db_info->prev_return_id = return_id;
1169
1170         if (type == INTERNAL && func_type_mismatch(db_info->expr, value))
1171                 db_info->cull = 1;
1172         if (db_info->cull)
1173                 return 0;
1174         if (type == CULL_PATH) {
1175                 db_info->cull = 1;
1176                 return 0;
1177         }
1178         if (is_impossible_data(type, db_info->expr, param, key, value)) {
1179                 db_info->cull = 1;
1180                 return 0;
1181         }
1182
1183         if (type == PARAM_LIMIT)
1184                 param_limit_implications(db_info->expr, param, key, value, &db_info->implied);
1185
1186         call_results_to_rl(db_info->expr, get_type(strip_expr(db_info->expr)), ret_str, &ret_range);
1187         ret_range = cast_rl(get_type(db_info->expr), ret_range);
1188
1189         if (type == INTERNAL) {
1190                 struct smatch_state *state;
1191
1192                 set_state(-1, "unnull_path", NULL, &true_state);
1193                 __add_return_comparison(strip_expr(db_info->expr), ret_str);
1194                 __add_return_to_param_mapping(db_info->expr, ret_str);
1195                 /*
1196                  * We want to store the return values so that we can split the strees
1197                  * in smatch_db.c.  This uses set_state() directly because it's not a
1198                  * real smatch_extra state.
1199                  */
1200                 snprintf(buf, sizeof(buf), "return %p", db_info->expr);
1201                 state = alloc_estate_rl(ret_range);
1202                 set_state(SMATCH_EXTRA, buf, NULL, state);
1203                 store_return_state(db_info, ret_str, state);
1204         }
1205
1206         FOR_EACH_PTR(db_return_states_list, tmp) {
1207                 if (tmp->type == type)
1208                         tmp->callback(db_info->expr, param, key, value);
1209         } END_FOR_EACH_PTR(tmp);
1210
1211
1212         return 0;
1213 }
1214
1215 static void db_return_states(struct expression *expr)
1216 {
1217         struct sm_state *sm;
1218         struct stree *stree;
1219         struct db_callback_info db_info = {};
1220
1221         if (!__get_cur_stree())  /* no return functions */
1222                 return;
1223
1224         db_info.prev_return_id = -1;
1225         db_info.expr = expr;
1226         db_info.stree = NULL;
1227
1228         call_return_states_before_hooks();
1229
1230         __push_fake_cur_stree();
1231         __unnullify_path();
1232         sql_select_return_states("return_id, return, type, parameter, key, value",
1233                         expr, db_return_states_callback, &db_info);
1234         call_ranged_return_hooks(&db_info);
1235         set_implied_states(&db_info);
1236         stree = __pop_fake_cur_stree();
1237         if (!db_info.cull)
1238                 merge_fake_stree(&db_info.stree, stree);
1239         free_stree(&stree);
1240
1241         FOR_EACH_SM(db_info.stree, sm) {
1242                 __set_sm(sm);
1243         } END_FOR_EACH_SM(sm);
1244
1245         free_stree(&db_info.stree);
1246         call_return_states_after_hooks(expr);
1247 }
1248
1249 static int is_condition_call(struct expression *expr)
1250 {
1251         struct expression *tmp;
1252
1253         FOR_EACH_PTR_REVERSE(big_condition_stack, tmp) {
1254                 if (expr == tmp || expr_get_parent_expr(expr) == tmp)
1255                         return 1;
1256                 if (tmp->pos.line < expr->pos.line)
1257                         return 0;
1258         } END_FOR_EACH_PTR_REVERSE(tmp);
1259
1260         return 0;
1261 }
1262
1263 static void db_return_states_call(struct expression *expr)
1264 {
1265         if (unreachable())
1266                 return;
1267
1268         if (is_assigned_call(expr) || is_fake_assigned_call(expr))
1269                 return;
1270         if (is_condition_call(expr))
1271                 return;
1272         db_return_states(expr);
1273 }
1274
1275 static void match_function_call(struct expression *expr)
1276 {
1277         struct call_back_list *call_backs;
1278         struct expression *fn;
1279
1280         fn = strip_expr(expr->fn);
1281         if (fn->type == EXPR_SYMBOL && fn->symbol) {
1282                 call_backs = search_callback(func_hash, (char *)fn->symbol->ident->name);
1283                 if (call_backs)
1284                         call_call_backs(call_backs, REGULAR_CALL,
1285                                         fn->symbol->ident->name, expr);
1286         }
1287         db_return_states_call(expr);
1288 }
1289
1290 static void match_macro_assign(struct expression *expr)
1291 {
1292         struct call_back_list *call_backs;
1293         const char *macro;
1294         struct expression *right;
1295
1296         right = strip_expr(expr->right);
1297         macro = get_macro_name(right->pos);
1298         call_backs = search_callback(func_hash, (char *)macro);
1299         if (!call_backs)
1300                 return;
1301         call_call_backs(call_backs, MACRO_ASSIGN, macro, expr);
1302         call_call_backs(call_backs, MACRO_ASSIGN_EXTRA, macro, expr);
1303 }
1304
1305 int get_implied_return(struct expression *expr, struct range_list **rl)
1306 {
1307         struct call_back_list *call_backs;
1308         struct fcall_back *tmp;
1309         int handled = 0;
1310         char *fn;
1311
1312         *rl = NULL;
1313
1314         expr = strip_expr(expr);
1315         fn = expr_to_var(expr->fn);
1316         if (!fn)
1317                 goto out;
1318
1319         call_backs = search_callback(func_hash, fn);
1320
1321         FOR_EACH_PTR(call_backs, tmp) {
1322                 if (tmp->type == IMPLIED_RETURN)
1323                         handled |= (tmp->u.implied_return)(expr, tmp->info, rl);
1324         } END_FOR_EACH_PTR(tmp);
1325
1326 out:
1327         free_string(fn);
1328         return handled;
1329 }
1330
1331 struct range_list *get_range_implications(const char *fn)
1332 {
1333         struct call_back_list *call_backs;
1334         struct range_list *ret = NULL;
1335         struct fcall_back *tmp;
1336
1337         call_backs = search_callback(func_hash, (char *)fn);
1338
1339         FOR_EACH_PTR(call_backs, tmp) {
1340                 if (tmp->type != RANGED_CALL)
1341                         continue;
1342                 add_ptr_list(&ret, tmp->range);
1343         } END_FOR_EACH_PTR(tmp);
1344
1345         return ret;
1346 }
1347
1348 void create_function_hook_hash(void)
1349 {
1350         func_hash = create_function_hashtable(5000);
1351 }
1352
1353 void register_function_hooks(int id)
1354 {
1355         add_hook(&match_function_call, CALL_HOOK_AFTER_INLINE);
1356         add_hook(&match_assign_call, CALL_ASSIGNMENT_HOOK);
1357         add_hook(&match_macro_assign, MACRO_ASSIGNMENT_HOOK);
1358 }