?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
flow: fix some parent transition fallout
[smatch.git] / smatch_db.c
blobca24b7bf833acb2a889d32c18dfff202871ea7dc
1 /*
2 * Copyright (C) 2010 Dan Carpenter.
3 *
4 * This program is free software; you can redistribute it and/or
5 * modify it under the terms of the GNU General Public License
6 * as published by the Free Software Foundation; either version 2
7 * of the License, or (at your option) any later version.
8 *
9 * This program is distributed in the hope that it will be useful,
10 * but WITHOUT ANY WARRANTY; without even the implied warranty of
11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12 * GNU General Public License for more details.
13 *
14 * You should have received a copy of the GNU General Public License
15 * along with this program; if not, see http://www.gnu.org/copyleft/gpl.txt
16 */
17
18 #include <string.h>
19 #include <errno.h>
20 #include <sqlite3.h>
21 #include <unistd.h>
22 #include <ctype.h>
23 #include "smatch.h"
24 #include "smatch_slist.h"
25 #include "smatch_extra.h"
26
27 static sqlite3 *db;
28 static sqlite3 *mem_db;
29
30 static int return_id;
31
32 #define sql_insert(table, values...) \
33 do { \
34 if (!mem_db) \
35 break; \
36 if (__inline_fn) { \
37 char buf[1024]; \
38 char *err, *p = buf; \
39 int rc; \
40 \
41 p += snprintf(p, buf + sizeof(buf) - p, \
42 "insert into %s values (", #table); \
43 p += snprintf(p, buf + sizeof(buf) - p, values); \
44 p += snprintf(p, buf + sizeof(buf) - p, ");"); \
45 sm_debug("in-mem: %s\n", buf); \
46 rc = sqlite3_exec(mem_db, buf, NULL, NULL, &err); \
47 if (rc != SQLITE_OK) { \
48 fprintf(stderr, "SQL error #2: %s\n", err); \
49 fprintf(stderr, "SQL: '%s'\n", buf); \
50 parse_error = 1; \
51 } \
52 break; \
53 } \
54 if (option_info) { \
55 sm_prefix(); \
56 sm_printf("SQL: insert into " #table " values (" values); \
57 sm_printf(");\n"); \
58 } \
59 } while (0)
60
61 struct def_callback {
62 int hook_type;
63 void (*callback)(const char *name, struct symbol *sym, char *key, char *value);
64 };
65 ALLOCATOR(def_callback, "definition db hook callbacks");
66 DECLARE_PTR_LIST(callback_list, struct def_callback);
67 static struct callback_list *callbacks;
68
69 struct member_info_callback {
70 int owner;
71 void (*callback)(struct expression *call, int param, char *printed_name, struct sm_state *sm);
72 };
73 ALLOCATOR(member_info_callback, "caller_info callbacks");
74 DECLARE_PTR_LIST(member_info_cb_list, struct member_info_callback);
75 static struct member_info_cb_list *member_callbacks;
76
77 struct returned_state_callback {
78 void (*callback)(int return_id, char *return_ranges, struct expression *return_expr);
79 };
80 ALLOCATOR(returned_state_callback, "returned state callbacks");
81 DECLARE_PTR_LIST(returned_state_cb_list, struct returned_state_callback);
82 static struct returned_state_cb_list *returned_state_callbacks;
83
84 struct returned_member_callback {
85 int owner;
86 void (*callback)(int return_id, char *return_ranges, struct expression *expr, char *printed_name, struct smatch_state *state);
87 };
88 ALLOCATOR(returned_member_callback, "returned member callbacks");
89 DECLARE_PTR_LIST(returned_member_cb_list, struct returned_member_callback);
90 static struct returned_member_cb_list *returned_member_callbacks;
91
92 struct call_implies_callback {
93 int type;
94 void (*callback)(struct expression *arg, char *key, char *value);
95 };
96 ALLOCATOR(call_implies_callback, "call_implies callbacks");
97 DECLARE_PTR_LIST(call_implies_cb_list, struct call_implies_callback);
98 static struct call_implies_cb_list *call_implies_cb_list;
99
100 static int print_sql_output(void *unused, int argc, char **argv, char **azColName)
101 {
102 int i;
103
104 for (i = 0; i < argc; i++) {
105 if (i != 0)
106 printf(", ");
107 sm_printf("%s", argv[i]);
108 }
109 sm_printf("\n");
110 return 0;
111 }
112
113 void debug_sql(const char *sql)
114 {
115 if (!option_debug)
116 return;
117 sm_msg("%s", sql);
118 sql_exec(print_sql_output, NULL, sql);
119 }
120
121 void debug_mem_sql(const char *sql)
122 {
123 if (!option_debug)
124 return;
125 sm_msg("%s", sql);
126 sql_mem_exec(print_sql_output, NULL, sql);
127 }
128
129 void sql_exec(int (*callback)(void*, int, char**, char**), void *data, const char *sql)
130 {
131 char *err = NULL;
132 int rc;
133
134 if (option_no_db || !db)
135 return;
136
137 rc = sqlite3_exec(db, sql, callback, data, &err);
138 if (rc != SQLITE_OK && !parse_error) {
139 fprintf(stderr, "SQL error #2: %s\n", err);
140 fprintf(stderr, "SQL: '%s'\n", sql);
141 parse_error = 1;
142 }
143 }
144
145 void sql_mem_exec(int (*callback)(void*, int, char**, char**), void *data, const char *sql)
146 {
147 char *err = NULL;
148 int rc;
149
150 if (!mem_db)
151 return;
152
153 rc = sqlite3_exec(mem_db, sql, callback, data, &err);
154 if (rc != SQLITE_OK) {
155 fprintf(stderr, "SQL error #2: %s\n", err);
156 fprintf(stderr, "SQL: '%s'\n", sql);
157 parse_error = 1;
158 }
159 }
160
161 void sql_insert_return_states(int return_id, const char *return_ranges,
162 int type, int param, const char *key, const char *value)
163 {
164 if (key && strlen(key) >= 80)
165 return;
166 sql_insert(return_states, "'%s', '%s', %lu, %d, '%s', %d, %d, %d, '%s', '%s'",
167 get_base_file(), get_function(), (unsigned long)__inline_fn,
168 return_id, return_ranges, fn_static(), type, param, key, value);
169 }
170
171 static struct string_list *common_funcs;
172 static int is_common_function(const char *fn)
173 {
174 char *tmp;
175
176 if (strncmp(fn, "__builtin_", 10) == 0)
177 return 1;
178
179 FOR_EACH_PTR(common_funcs, tmp) {
180 if (strcmp(tmp, fn) == 0)
181 return 1;
182 } END_FOR_EACH_PTR(tmp);
183
184 return 0;
185 }
186
187 void sql_insert_caller_info(struct expression *call, int type,
188 int param, const char *key, const char *value)
189 {
190 char *fn;
191
192 if (!option_info && !__inline_call)
193 return;
194
195 if (key && strlen(key) >= 80)
196 return;
197
198 fn = get_fnptr_name(call->fn);
199 if (!fn)
200 return;
201
202 if (__inline_call) {
203 mem_sql(NULL, NULL,
204 "insert into caller_info values ('%s', '%s', '%s', %lu, %d, %d, %d, '%s', '%s');",
205 get_base_file(), get_function(), fn, (unsigned long)call,
206 is_static(call->fn), type, param, key, value);
207 }
208
209 if (!option_info)
210 return;
211
212 if (is_common_function(fn))
213 return;
214
215 sm_msg("SQL_caller_info: insert into caller_info values ("
216 "'%s', '%s', '%s', %%CALL_ID%%, %d, %d, %d, '%s', '%s');",
217 get_base_file(), get_function(), fn, is_static(call->fn),
218 type, param, key, value);
219
220 free_string(fn);
221 }
222
223 void sql_insert_function_ptr(const char *fn, const char *struct_name)
224 {
225 sql_insert(function_ptr, "'%s', '%s', '%s', 0", get_base_file(), fn,
226 struct_name);
227 }
228
229 void sql_insert_call_implies(int type, int param, const char *key, const char *value)
230 {
231 sql_insert(call_implies, "'%s', '%s', %lu, %d, %d, %d, '%s', %s", get_base_file(),
232 get_function(), (unsigned long)__inline_fn, fn_static(),
233 type, param, key, value);
234 }
235
236 void sql_insert_function_type_size(const char *member, const char *ranges)
237 {
238 sql_insert(function_type_size, "'%s', '%s', '%s', '%s'", get_base_file(), get_function(), member, ranges);
239 }
240
241 void sql_insert_local_values(const char *name, const char *value)
242 {
243 sql_insert(local_values, "'%s', '%s', '%s'", get_base_file(), name, value);
244 }
245
246 void sql_insert_function_type_value(const char *type, const char *value)
247 {
248 sql_insert(function_type_value, "'%s', '%s', '%s', '%s'", get_base_file(), get_function(), type, value);
249 }
250
251 void sql_insert_function_type(int param, const char *value)
252 {
253 sql_insert(function_type, "'%s', '%s', %d, %d, '%s'",
254 get_base_file(), get_function(), fn_static(), param, value);
255 }
256
257 void sql_insert_parameter_name(int param, const char *value)
258 {
259 sql_insert(parameter_name, "'%s', '%s', %d, %d, '%s'",
260 get_base_file(), get_function(), fn_static(), param, value);
261 }
262
263 void sql_insert_data_info(struct expression *data, int type, const char *value)
264 {
265 char *data_name;
266
267 data_name = get_data_info_name(data);
268 if (!data_name)
269 return;
270 sql_insert(data_info, "'%s', '%s', %d, '%s'",
271 is_static(data) ? get_base_file() : "extern",
272 data_name, type, value);
273 }
274
275 void sql_insert_data_info_var_sym(const char *var, struct symbol *sym, int type, const char *value)
276 {
277 sql_insert(data_info, "'%s', '%s', %d, '%s'",
278 (sym->ctype.modifiers & MOD_STATIC) ? get_base_file() : "extern",
279 var, type, value);
280 }
281
282 char *get_static_filter(struct symbol *sym)
283 {
284 static char sql_filter[1024];
285
286 /* This can only happen on buggy code. Return invalid SQL. */
287 if (!sym) {
288 sql_filter[0] = '\0';
289 return sql_filter;
290 }
291
292 if (sym->ctype.modifiers & MOD_STATIC) {
293 snprintf(sql_filter, sizeof(sql_filter),
294 "file = '%s' and function = '%s' and static = '1'",
295 get_base_file(), sym->ident->name);
296 } else {
297 snprintf(sql_filter, sizeof(sql_filter),
298 "function = '%s' and static = '0'", sym->ident->name);
299 }
300
301 return sql_filter;
302 }
303
304 static int get_row_count(void *_row_count, int argc, char **argv, char **azColName)
305 {
306 int *row_count = _row_count;
307
308 *row_count = 0;
309 if (argc != 1)
310 return 0;
311 *row_count = atoi(argv[0]);
312 return 0;
313 }
314
315 static void sql_select_return_states_pointer(const char *cols,
316 struct expression *call, int (*callback)(void*, int, char**, char**), void *info)
317 {
318 char *ptr;
319 int return_count;
320
321 ptr = get_fnptr_name(call->fn);
322 if (!ptr)
323 return;
324
325 run_sql(get_row_count, &return_count,
326 "select count(*) from return_states join function_ptr "
327 "where return_states.function == function_ptr.function and "
328 "ptr = '%s' and searchable = 1 and type = %d;", ptr, INTERNAL);
329 /* The magic number 100 is just from testing on the kernel. */
330 if (return_count > 100)
331 return;
332
333 run_sql(callback, info,
334 "select %s from return_states join function_ptr where "
335 "return_states.function == function_ptr.function and ptr = '%s' "
336 "and searchable = 1 "
337 "order by function_ptr.file, return_states.file, return_id, type;",
338 cols, ptr);
339 }
340
341 static int is_local_symbol(struct expression *expr)
342 {
343 if (expr->type != EXPR_SYMBOL)
344 return 0;
345 if (expr->symbol->ctype.modifiers & (MOD_NONLOCAL | MOD_STATIC | MOD_ADDRESSABLE))
346 return 0;
347 return 1;
348 }
349
350 void sql_select_return_states(const char *cols, struct expression *call,
351 int (*callback)(void*, int, char**, char**), void *info)
352 {
353 int row_count;
354
355 if (is_fake_call(call))
356 return;
357
358 if (call->fn->type != EXPR_SYMBOL || !call->fn->symbol || is_local_symbol(call->fn)) {
359 sql_select_return_states_pointer(cols, call, callback, info);
360 return;
361 }
362
363 if (inlinable(call->fn)) {
364 mem_sql(callback, info,
365 "select %s from return_states where call_id = '%lu' order by return_id, type;",
366 cols, (unsigned long)call);
367 return;
368 }
369
370 run_sql(get_row_count, &row_count, "select count(*) from return_states where %s;",
371 get_static_filter(call->fn->symbol));
372 if (row_count > 3000)
373 return;
374
375 run_sql(callback, info, "select %s from return_states where %s order by file, return_id, type;",
376 cols, get_static_filter(call->fn->symbol));
377 }
378
379 void sql_select_call_implies(const char *cols, struct expression *call,
380 int (*callback)(void*, int, char**, char**))
381 {
382 if (call->fn->type != EXPR_SYMBOL || !call->fn->symbol)
383 return;
384
385 if (inlinable(call->fn)) {
386 mem_sql(callback, call,
387 "select %s from call_implies where call_id = '%lu';",
388 cols, (unsigned long)call);
389 return;
390 }
391
392 run_sql(callback, call, "select %s from call_implies where %s;",
393 cols, get_static_filter(call->fn->symbol));
394 }
395
396 void sql_select_caller_info(const char *cols, struct symbol *sym,
397 int (*callback)(void*, int, char**, char**))
398 {
399 if (__inline_fn) {
400 mem_sql(callback, NULL,
401 "select %s from caller_info where call_id = %lu;",
402 cols, (unsigned long)__inline_fn);
403 return;
404 }
405
406 run_sql(callback, NULL,
407 "select %s from caller_info where %s order by call_id;",
408 cols, get_static_filter(sym));
409 }
410
411 void select_caller_info_hook(void (*callback)(const char *name, struct symbol *sym, char *key, char *value), int type)
412 {
413 struct def_callback *def_callback = __alloc_def_callback(0);
414
415 def_callback->hook_type = type;
416 def_callback->callback = callback;
417 add_ptr_list(&callbacks, def_callback);
418 }
419
420 /*
421 * These call backs are used when the --info option is turned on to print struct
422 * member information. For example foo->bar could have a state in
423 * smatch_extra.c and also check_user.c.
424 */
425 void add_member_info_callback(int owner, void (*callback)(struct expression *call, int param, char *printed_name, struct sm_state *sm))
426 {
427 struct member_info_callback *member_callback = __alloc_member_info_callback(0);
428
429 member_callback->owner = owner;
430 member_callback->callback = callback;
431 add_ptr_list(&member_callbacks, member_callback);
432 }
433
434 void add_split_return_callback(void (*fn)(int return_id, char *return_ranges, struct expression *returned_expr))
435 {
436 struct returned_state_callback *callback = __alloc_returned_state_callback(0);
437
438 callback->callback = fn;
439 add_ptr_list(&returned_state_callbacks, callback);
440 }
441
442 void add_returned_member_callback(int owner, void (*callback)(int return_id, char *return_ranges, struct expression *expr, char *printed_name, struct smatch_state *state))
443 {
444 struct returned_member_callback *member_callback = __alloc_returned_member_callback(0);
445
446 member_callback->owner = owner;
447 member_callback->callback = callback;
448 add_ptr_list(&returned_member_callbacks, member_callback);
449 }
450
451 void select_call_implies_hook(int type, void (*callback)(struct expression *arg, char *key, char *value))
452 {
453 struct call_implies_callback *cb = __alloc_call_implies_callback(0);
454
455 cb->type = type;
456 cb->callback = callback;
457 add_ptr_list(&call_implies_cb_list, cb);
458 }
459
460 struct return_info {
461 struct expression *static_returns_call;
462 struct symbol *return_type;
463 struct range_list *return_range_list;
464 };
465
466 static int db_return_callback(void *_ret_info, int argc, char **argv, char **azColName)
467 {
468 struct return_info *ret_info = _ret_info;
469 struct range_list *rl;
470 struct expression *call_expr = ret_info->static_returns_call;
471
472 if (argc != 1)
473 return 0;
474 call_results_to_rl(call_expr, ret_info->return_type, argv[0], &rl);
475 ret_info->return_range_list = rl_union(ret_info->return_range_list, rl);
476 return 0;
477 }
478
479 struct range_list *db_return_vals(struct expression *expr)
480 {
481 struct return_info ret_info = {};
482 char buf[64];
483 struct sm_state *sm;
484
485 if (is_fake_call(expr))
486 return NULL;
487
488 snprintf(buf, sizeof(buf), "return %p", expr);
489 sm = get_sm_state(SMATCH_EXTRA, buf, NULL);
490 if (sm)
491 return clone_rl(estate_rl(sm->state));
492 ret_info.static_returns_call = expr;
493 ret_info.return_type = get_type(expr);
494 if (!ret_info.return_type)
495 return NULL;
496
497 if (expr->fn->type != EXPR_SYMBOL || !expr->fn->symbol)
498 return NULL;
499
500 ret_info.return_range_list = NULL;
501 if (inlinable(expr->fn)) {
502 mem_sql(db_return_callback, &ret_info,
503 "select distinct return from return_states where call_id = '%lu';",
504 (unsigned long)expr);
505 } else {
506 run_sql(db_return_callback, &ret_info,
507 "select distinct return from return_states where %s;",
508 get_static_filter(expr->fn->symbol));
509 }
510 return ret_info.return_range_list;
511 }
512
513 struct range_list *db_return_vals_from_str(const char *fn_name)
514 {
515 struct return_info ret_info;
516
517 ret_info.static_returns_call = NULL;
518 ret_info.return_type = &llong_ctype;
519 ret_info.return_range_list = NULL;
520
521 run_sql(db_return_callback, &ret_info,
522 "select distinct return from return_states where function = '%s';",
523 fn_name);
524 return ret_info.return_range_list;
525 }
526
527 static void match_call_marker(struct expression *expr)
528 {
529 /*
530 * we just want to record something in the database so that if we have
531 * two calls like: frob(4); frob(some_unkown); then on the receiving
532 * side we know that sometimes frob is called with unknown parameters.
533 */
534
535 sql_insert_caller_info(expr, INTERNAL, -1, "%call_marker%", "");
536 }
537
538 static void print_struct_members(struct expression *call, struct expression *expr, int param, struct stree *stree,
539 void (*callback)(struct expression *call, int param, char *printed_name, struct sm_state *sm))
540 {
541 struct sm_state *sm;
542 char *name;
543 struct symbol *sym;
544 int len;
545 char printed_name[256];
546 int is_address = 0;
547
548 expr = strip_expr(expr);
549 if (expr->type == EXPR_PREOP && expr->op == '&') {
550 expr = strip_expr(expr->unop);
551 is_address = 1;
552 }
553
554 name = expr_to_var_sym(expr, &sym);
555 if (!name || !sym)
556 goto free;
557
558 len = strlen(name);
559 FOR_EACH_SM(stree, sm) {
560 if (sm->sym != sym)
561 continue;
562 if (strcmp(name, sm->name) == 0) {
563 if (is_address)
564 snprintf(printed_name, sizeof(printed_name), "*$");
565 else /* these are already handled. fixme: handle them here */
566 continue;
567 } else if (sm->name[0] == '*' && strcmp(name, sm->name + 1) == 0) {
568 snprintf(printed_name, sizeof(printed_name), "*$");
569 } else if (strncmp(name, sm->name, len) == 0) {
570 if (isalnum(sm->name[len]))
571 continue;
572 if (is_address)
573 snprintf(printed_name, sizeof(printed_name), "$->%s", sm->name + len + 1);
574 else
575 snprintf(printed_name, sizeof(printed_name), "$%s", sm->name + len);
576 } else {
577 continue;
578 }
579 callback(call, param, printed_name, sm);
580 } END_FOR_EACH_SM(sm);
581 free:
582 free_string(name);
583 }
584
585 static void match_call_info(struct expression *call)
586 {
587 struct member_info_callback *cb;
588 struct expression *arg;
589 struct stree *stree;
590 char *name;
591 int i;
592
593 name = get_fnptr_name(call->fn);
594 if (!name)
595 return;
596
597 FOR_EACH_PTR(member_callbacks, cb) {
598 stree = get_all_states_stree(cb->owner);
599 i = 0;
600 FOR_EACH_PTR(call->args, arg) {
601 print_struct_members(call, arg, i, stree, cb->callback);
602 i++;
603 } END_FOR_EACH_PTR(arg);
604 free_stree(&stree);
605 } END_FOR_EACH_PTR(cb);
606
607 free_string(name);
608 }
609
610 static int get_param(int param, char **name, struct symbol **sym)
611 {
612 struct symbol *arg;
613 int i;
614
615 i = 0;
616 FOR_EACH_PTR(cur_func_sym->ctype.base_type->arguments, arg) {
617 /*
618 * this is a temporary hack to work around a bug (I think in sparse?)
619 * 2.6.37-rc1:fs/reiserfs/journal.o
620 * If there is a function definition without parameter name found
621 * after a function implementation then it causes a crash.
622 * int foo() {}
623 * int bar(char *);
624 */
625 if (arg->ident->name < (char *)100)
626 continue;
627 if (i == param) {
628 *name = arg->ident->name;
629 *sym = arg;
630 return TRUE;
631 }
632 i++;
633 } END_FOR_EACH_PTR(arg);
634
635 return FALSE;
636 }
637
638 static struct stree *final_states;
639 static int prev_func_id = -1;
640 static int caller_info_callback(void *unused, int argc, char **argv, char **azColName)
641 {
642 int func_id;
643 long type;
644 long param;
645 char *key;
646 char *value;
647 char *name = NULL;
648 struct symbol *sym = NULL;
649 struct def_callback *def_callback;
650 struct stree *stree;
651
652 if (argc != 5)
653 return 0;
654
655 func_id = atoi(argv[0]);
656 errno = 0;
657 type = strtol(argv[1], NULL, 10);
658 param = strtol(argv[2], NULL, 10);
659 if (errno)
660 return 0;
661 key = argv[3];
662 value = argv[4];
663
664
665 if (prev_func_id == -1)
666 prev_func_id = func_id;
667 if (func_id != prev_func_id) {
668 stree = __pop_fake_cur_stree();
669 merge_stree(&final_states, stree);
670 free_stree(&stree);
671 __push_fake_cur_stree();
672 __unnullify_path();
673 prev_func_id = func_id;
674 }
675
676 if (param >= 0 && !get_param(param, &name, &sym))
677 return 0;
678
679 FOR_EACH_PTR(callbacks, def_callback) {
680 if (def_callback->hook_type == type)
681 def_callback->callback(name, sym, key, value);
682 } END_FOR_EACH_PTR(def_callback);
683
684 return 0;
685 }
686
687 static void get_direct_callers(struct symbol *sym)
688 {
689 sql_select_caller_info("call_id, type, parameter, key, value", sym,
690 caller_info_callback);
691 }
692
693 static struct string_list *ptr_names_done;
694 static struct string_list *ptr_names;
695
696 static int get_ptr_name(void *unused, int argc, char **argv, char **azColName)
697 {
698 insert_string(&ptr_names, alloc_string(argv[0]));
699 return 0;
700 }
701
702 static char *get_next_ptr_name(void)
703 {
704 char *ptr;
705
706 FOR_EACH_PTR(ptr_names, ptr) {
707 if (list_has_string(ptr_names_done, ptr))
708 continue;
709 insert_string(&ptr_names_done, ptr);
710 return ptr;
711 } END_FOR_EACH_PTR(ptr);
712 return NULL;
713 }
714
715 static void get_ptr_names(const char *file, const char *name)
716 {
717 char sql_filter[1024];
718 int before, after;
719
720 if (file) {
721 snprintf(sql_filter, 1024, "file = '%s' and function = '%s';",
722 file, name);
723 } else {
724 snprintf(sql_filter, 1024, "function = '%s';", name);
725 }
726
727 before = ptr_list_size((struct ptr_list *)ptr_names);
728
729 run_sql(get_ptr_name, NULL,
730 "select distinct ptr from function_ptr where %s",
731 sql_filter);
732
733 after = ptr_list_size((struct ptr_list *)ptr_names);
734 if (before == after)
735 return;
736
737 while ((name = get_next_ptr_name()))
738 get_ptr_names(NULL, name);
739 }
740
741 static void match_data_from_db(struct symbol *sym)
742 {
743 struct sm_state *sm;
744 struct stree *stree;
745
746 if (!sym || !sym->ident)
747 return;
748
749 __push_fake_cur_stree();
750 __unnullify_path();
751 prev_func_id = -1;
752
753 if (!__inline_fn) {
754 char *ptr;
755
756 if (sym->ctype.modifiers & MOD_STATIC)
757 get_ptr_names(get_base_file(), sym->ident->name);
758 else
759 get_ptr_names(NULL, sym->ident->name);
760
761 if (ptr_list_size((struct ptr_list *)ptr_names) > 20) {
762 __free_ptr_list((struct ptr_list **)&ptr_names);
763 __free_ptr_list((struct ptr_list **)&ptr_names_done);
764 stree = __pop_fake_cur_stree();
765 free_stree(&stree);
766 return;
767 }
768
769 get_direct_callers(sym);
770
771 FOR_EACH_PTR(ptr_names, ptr) {
772 run_sql(caller_info_callback, NULL,
773 "select call_id, type, parameter, key, value"
774 " from caller_info where function = '%s' order by call_id",
775 ptr);
776 free_string(ptr);
777 } END_FOR_EACH_PTR(ptr);
778
779 __free_ptr_list((struct ptr_list **)&ptr_names);
780 __free_ptr_list((struct ptr_list **)&ptr_names_done);
781 } else {
782 get_direct_callers(sym);
783 }
784
785 stree = __pop_fake_cur_stree();
786 merge_stree(&final_states, stree);
787 free_stree(&stree);
788
789 FOR_EACH_SM(final_states, sm) {
790 __set_sm(sm);
791 } END_FOR_EACH_SM(sm);
792
793 free_stree(&final_states);
794 }
795
796 static int call_implies_callbacks(void *_call, int argc, char **argv, char **azColName)
797 {
798 struct expression *call_expr = _call;
799 struct call_implies_callback *cb;
800 struct expression *arg = NULL;
801 int type;
802 int param;
803
804 if (argc != 5)
805 return 0;
806
807 type = atoi(argv[1]);
808 param = atoi(argv[2]);
809
810 FOR_EACH_PTR(call_implies_cb_list, cb) {
811 if (cb->type != type)
812 continue;
813 if (param != -1) {
814 arg = get_argument_from_call_expr(call_expr->args, param);
815 if (!arg)
816 continue;
817 }
818 cb->callback(arg, argv[3], argv[4]);
819 } END_FOR_EACH_PTR(cb);
820
821 return 0;
822 }
823
824 static void match_call_implies(struct expression *expr)
825 {
826 sql_select_call_implies("function, type, parameter, key, value", expr,
827 call_implies_callbacks);
828 }
829
830 static void print_initializer_list(struct expression_list *expr_list,
831 struct symbol *struct_type)
832 {
833 struct expression *expr;
834 struct symbol *base_type;
835 char struct_name[256];
836
837 FOR_EACH_PTR(expr_list, expr) {
838 if (expr->type == EXPR_INDEX && expr->idx_expression && expr->idx_expression->type == EXPR_INITIALIZER) {
839 print_initializer_list(expr->idx_expression->expr_list, struct_type);
840 continue;
841 }
842 if (expr->type != EXPR_IDENTIFIER)
843 continue;
844 if (!expr->expr_ident)
845 continue;
846 if (!expr->ident_expression || !expr->ident_expression->symbol_name)
847 continue;
848 base_type = get_type(expr->ident_expression);
849 if (!base_type || base_type->type != SYM_FN)
850 continue;
851 snprintf(struct_name, sizeof(struct_name), "(struct %s)->%s",
852 struct_type->ident->name, expr->expr_ident->name);
853 sql_insert_function_ptr(expr->ident_expression->symbol_name->name,
854 struct_name);
855 } END_FOR_EACH_PTR(expr);
856 }
857
858 static void global_variable(struct symbol *sym)
859 {
860 struct symbol *struct_type;
861
862 if (!sym->ident)
863 return;
864 if (!sym->initializer || sym->initializer->type != EXPR_INITIALIZER)
865 return;
866 struct_type = get_base_type(sym);
867 if (!struct_type)
868 return;
869 if (struct_type->type == SYM_ARRAY) {
870 struct_type = get_base_type(struct_type);
871 if (!struct_type)
872 return;
873 }
874 if (struct_type->type != SYM_STRUCT || !struct_type->ident)
875 return;
876 print_initializer_list(sym->initializer->expr_list, struct_type);
877 }
878
879 static char *function_signature(void)
880 {
881 return type_to_str(get_real_base_type(cur_func_sym));
882 }
883
884 static void match_return_info(int return_id, char *return_ranges, struct expression *expr)
885 {
886 sql_insert_return_states(return_id, return_ranges, INTERNAL, -1, "", function_signature());
887 }
888
889 static void call_return_state_hooks_conditional(struct expression *expr)
890 {
891 struct returned_state_callback *cb;
892 struct range_list *rl;
893 char *return_ranges;
894 int final_pass_orig = final_pass;
895
896 __push_fake_cur_stree();
897
898 final_pass = 0;
899 __split_whole_condition(expr->conditional);
900 final_pass = final_pass_orig;
901
902 if (get_implied_rl(expr->cond_true, &rl))
903 rl = cast_rl(cur_func_return_type(), rl);
904 else
905 rl = cast_rl(cur_func_return_type(), alloc_whole_rl(get_type(expr->cond_true)));
906 return_ranges = show_rl(rl);
907 set_state(RETURN_ID, "return_ranges", NULL, alloc_estate_rl(rl));
908
909 return_id++;
910 FOR_EACH_PTR(returned_state_callbacks, cb) {
911 cb->callback(return_id, return_ranges, expr);
912 } END_FOR_EACH_PTR(cb);
913
914 __push_true_states();
915 __use_false_states();
916
917 if (get_implied_rl(expr->cond_false, &rl))
918 rl = cast_rl(cur_func_return_type(), rl);
919 else
920 rl = cast_rl(cur_func_return_type(), alloc_whole_rl(get_type(expr->cond_false)));
921 return_ranges = show_rl(rl);
922 set_state(RETURN_ID, "return_ranges", NULL, alloc_estate_rl(rl));
923
924 return_id++;
925 FOR_EACH_PTR(returned_state_callbacks, cb) {
926 cb->callback(return_id, return_ranges, expr);
927 } END_FOR_EACH_PTR(cb);
928
929 __merge_true_states();
930 __free_fake_cur_stree();
931 }
932
933 static void call_return_state_hooks_compare(struct expression *expr)
934 {
935 struct returned_state_callback *cb;
936 char *return_ranges;
937 int final_pass_orig = final_pass;
938 sval_t sval = { .type = &int_ctype };
939 sval_t ret;
940
941 if (!get_implied_value(expr, &ret))
942 ret.value = -1;
943
944 __push_fake_cur_stree();
945
946 final_pass = 0;
947 __split_whole_condition(expr);
948 final_pass = final_pass_orig;
949
950 if (ret.value != 0) {
951 return_ranges = alloc_sname("1");
952 sval.value = 1;
953 set_state(RETURN_ID, "return_ranges", NULL, alloc_estate_sval(sval));
954
955 return_id++;
956 FOR_EACH_PTR(returned_state_callbacks, cb) {
957 cb->callback(return_id, return_ranges, expr);
958 } END_FOR_EACH_PTR(cb);
959 }
960
961 __push_true_states();
962 __use_false_states();
963
964 if (ret.value != 1) {
965 return_ranges = alloc_sname("0");
966 sval.value = 0;
967 set_state(RETURN_ID, "return_ranges", NULL, alloc_estate_sval(sval));
968
969 return_id++;
970 FOR_EACH_PTR(returned_state_callbacks, cb) {
971 cb->callback(return_id, return_ranges, expr);
972 } END_FOR_EACH_PTR(cb);
973 }
974
975 __merge_true_states();
976 __free_fake_cur_stree();
977 }
978
979 static int ptr_in_list(struct sm_state *sm, struct state_list *slist)
980 {
981 struct sm_state *tmp;
982
983 FOR_EACH_PTR(slist, tmp) {
984 if (strcmp(tmp->state->name, sm->state->name) == 0)
985 return 1;
986 } END_FOR_EACH_PTR(tmp);
987
988 return 0;
989 }
990
991 static int split_possible_helper(struct sm_state *sm, struct expression *expr)
992 {
993 struct returned_state_callback *cb;
994 struct range_list *rl;
995 char *return_ranges;
996 struct sm_state *tmp;
997 int ret = 0;
998 int nr_possible, nr_states;
999 char *compare_str = NULL;
1000 char buf[128];
1001 struct state_list *already_handled = NULL;
1002
1003 if (!sm || !sm->merged)
1004 return 0;
1005
1006 if (too_many_possible(sm))
1007 return 0;
1008
1009 /* bail if it gets too complicated */
1010 nr_possible = ptr_list_size((struct ptr_list *)sm->possible);
1011 nr_states = stree_count(__get_cur_stree());
1012 if (nr_states * nr_possible >= 2000)
1013 return 0;
1014
1015 FOR_EACH_PTR(sm->possible, tmp) {
1016 if (tmp->merged)
1017 continue;
1018 if (ptr_in_list(tmp, already_handled))
1019 continue;
1020 add_ptr_list(&already_handled, tmp);
1021
1022 ret = 1;
1023 __push_fake_cur_stree();
1024
1025 overwrite_states_using_pool(sm, tmp);
1026
1027 rl = cast_rl(cur_func_return_type(), estate_rl(tmp->state));
1028 return_ranges = show_rl(rl);
1029 set_state(RETURN_ID, "return_ranges", NULL, alloc_estate_rl(clone_rl(rl)));
1030 compare_str = expr_lte_to_param(expr, -1);
1031 if (compare_str) {
1032 snprintf(buf, sizeof(buf), "%s%s", return_ranges, compare_str);
1033 return_ranges = alloc_sname(buf);
1034 }
1035
1036 return_id++;
1037 FOR_EACH_PTR(returned_state_callbacks, cb) {
1038 cb->callback(return_id, return_ranges, expr);
1039 } END_FOR_EACH_PTR(cb);
1040
1041 __free_fake_cur_stree();
1042 } END_FOR_EACH_PTR(tmp);
1043
1044 free_slist(&already_handled);
1045
1046 return ret;
1047 }
1048
1049 static int call_return_state_hooks_split_possible(struct expression *expr)
1050 {
1051 struct sm_state *sm;
1052
1053 if (!expr || expr_equal_to_param(expr, -1))
1054 return 0;
1055
1056 sm = get_sm_state_expr(SMATCH_EXTRA, expr);
1057 return split_possible_helper(sm, expr);
1058 }
1059
1060 static const char *get_return_ranges_str(struct expression *expr, struct range_list **rl_p)
1061 {
1062 struct range_list *rl;
1063 char *return_ranges;
1064 sval_t sval;
1065 char *compare_str;
1066 char *math_str;
1067 char buf[128];
1068
1069 *rl_p = NULL;
1070
1071 if (!expr)
1072 return alloc_sname("");
1073
1074 if (get_implied_value(expr, &sval)) {
1075 *rl_p = alloc_rl(sval, sval);
1076 return sval_to_str(sval);
1077 }
1078
1079 compare_str = expr_equal_to_param(expr, -1);
1080 math_str = get_value_in_terms_of_parameter_math(expr);
1081
1082 if (get_implied_rl(expr, &rl)) {
1083 rl = cast_rl(cur_func_return_type(), rl);
1084 return_ranges = show_rl(rl);
1085 } else if (get_imaginary_absolute(expr, &rl)){
1086 rl = cast_rl(cur_func_return_type(), rl);
1087 return alloc_sname(show_rl(rl));
1088 } else {
1089 rl = cast_rl(cur_func_return_type(), alloc_whole_rl(get_type(expr)));
1090 return_ranges = show_rl(rl);
1091 }
1092 *rl_p = rl;
1093
1094 if (compare_str) {
1095 snprintf(buf, sizeof(buf), "%s%s", return_ranges, compare_str);
1096 return alloc_sname(buf);
1097 }
1098
1099 if (math_str) {
1100 snprintf(buf, sizeof(buf), "%s[%s]", return_ranges, math_str);
1101 return alloc_sname(buf);
1102 }
1103
1104 compare_str = expr_lte_to_param(expr, -1);
1105 if (compare_str) {
1106 snprintf(buf, sizeof(buf), "%s%s", return_ranges, compare_str);
1107 return alloc_sname(buf);
1108 }
1109 return return_ranges;
1110 }
1111
1112 static int split_positive_from_negative(struct expression *expr)
1113 {
1114 struct returned_state_callback *cb;
1115 struct range_list *rl;
1116 const char *return_ranges;
1117 struct range_list *ret_rl;
1118 int undo;
1119
1120 /* We're going to print the states 3 times */
1121 if (stree_count(__get_cur_stree()) > 10000 / 3)
1122 return 0;
1123
1124 if (!get_implied_rl(expr, &rl) || !rl)
1125 return 0;
1126 if (is_whole_rl(rl) || is_whole_rl_non_zero(rl))
1127 return 0;
1128 /* Forget about INT_MAX and larger */
1129 if (rl_max(rl).value <= 0)
1130 return 0;
1131 if (!sval_is_negative(rl_min(rl)))
1132 return 0;
1133
1134 if (!assume(compare_expression(expr, '>', zero_expr())))
1135 return 0;
1136
1137 return_id++;
1138 return_ranges = get_return_ranges_str(expr, &ret_rl);
1139 set_state(RETURN_ID, "return_ranges", NULL, alloc_estate_rl(ret_rl));
1140 FOR_EACH_PTR(returned_state_callbacks, cb) {
1141 cb->callback(return_id, (char *)return_ranges, expr);
1142 } END_FOR_EACH_PTR(cb);
1143
1144 end_assume();
1145
1146 if (rl_has_sval(rl, sval_type_val(rl_type(rl), 0))) {
1147 undo = assume(compare_expression(expr, SPECIAL_EQUAL, zero_expr()));
1148
1149 return_id++;
1150 return_ranges = get_return_ranges_str(expr, &ret_rl);
1151 set_state(RETURN_ID, "return_ranges", NULL, alloc_estate_rl(ret_rl));
1152 FOR_EACH_PTR(returned_state_callbacks, cb) {
1153 cb->callback(return_id, (char *)return_ranges, expr);
1154 } END_FOR_EACH_PTR(cb);
1155
1156 if (undo)
1157 end_assume();
1158 }
1159
1160 undo = assume(compare_expression(expr, '<', zero_expr()));
1161
1162 return_id++;
1163 return_ranges = get_return_ranges_str(expr, &ret_rl);
1164 set_state(RETURN_ID, "return_ranges", NULL, alloc_estate_rl(ret_rl));
1165 FOR_EACH_PTR(returned_state_callbacks, cb) {
1166 cb->callback(return_id, (char *)return_ranges, expr);
1167 } END_FOR_EACH_PTR(cb);
1168
1169 if (undo)
1170 end_assume();
1171
1172 return 1;
1173 }
1174
1175 static int call_return_state_hooks_split_null_non_null(struct expression *expr)
1176 {
1177 struct returned_state_callback *cb;
1178 struct range_list *rl;
1179 struct range_list *nonnull_rl;
1180 sval_t null_sval;
1181 struct range_list *null_rl = NULL;
1182 char *return_ranges;
1183 struct smatch_state *state;
1184 int nr_states;
1185 int final_pass_orig = final_pass;
1186
1187 if (!expr || expr_equal_to_param(expr, -1))
1188 return 0;
1189 if (expr->type == EXPR_CALL)
1190 return 0;
1191 if (!is_pointer(expr))
1192 return 0;
1193
1194 state = get_state_expr(SMATCH_EXTRA, expr);
1195 if (!state || !estate_rl(state))
1196 return 0;
1197 if (estate_min(state).value == 0 && estate_max(state).value == 0)
1198 return 0;
1199 if (!rl_has_sval(estate_rl(state), sval_type_val(estate_type(state), 0)))
1200 return 0;
1201
1202 nr_states = stree_count(__get_cur_stree());
1203 if (option_info && nr_states >= 1500)
1204 return 0;
1205
1206 rl = estate_rl(state);
1207
1208 __push_fake_cur_stree();
1209
1210 final_pass = 0;
1211 __split_whole_condition(expr);
1212 final_pass = final_pass_orig;
1213
1214 nonnull_rl = rl_filter(rl, rl_zero());
1215 return_ranges = show_rl(nonnull_rl);
1216 set_state(RETURN_ID, "return_ranges", NULL, alloc_estate_rl(nonnull_rl));
1217
1218 return_id++;
1219 FOR_EACH_PTR(returned_state_callbacks, cb) {
1220 cb->callback(return_id, return_ranges, expr);
1221 } END_FOR_EACH_PTR(cb);
1222
1223 __push_true_states();
1224 __use_false_states();
1225
1226 return_ranges = alloc_sname("0");
1227 null_sval = sval_type_val(rl_type(rl), 0);
1228 add_range(&null_rl, null_sval, null_sval);
1229 set_state(RETURN_ID, "return_ranges", NULL, alloc_estate_rl(null_rl));
1230 return_id++;
1231 FOR_EACH_PTR(returned_state_callbacks, cb) {
1232 cb->callback(return_id, return_ranges, expr);
1233 } END_FOR_EACH_PTR(cb);
1234
1235 __merge_true_states();
1236 __free_fake_cur_stree();
1237
1238 return 1;
1239 }
1240
1241 static int call_return_state_hooks_split_success_fail(struct expression *expr)
1242 {
1243 struct range_list *rl;
1244 struct range_list *nonzero_rl;
1245 sval_t zero_sval;
1246 struct range_list *zero_rl = NULL;
1247 int nr_states;
1248 struct returned_state_callback *cb;
1249 char *return_ranges;
1250 int final_pass_orig = final_pass;
1251 sval_t val;
1252
1253 if (option_project != PROJ_KERNEL)
1254 return 0;
1255
1256 nr_states = stree_count(__get_cur_stree());
1257 if (nr_states > 1500)
1258 return 0;
1259
1260 if (get_value(expr, &val))
1261 return 0;
1262 if (!get_implied_rl(expr, &rl))
1263 return 0;
1264 if (rl_min(rl).value < -4095 || rl_min(rl).value >= 0)
1265 return 0;
1266 if (rl_max(rl).value != 0)
1267 return 0;
1268
1269 __push_fake_cur_stree();
1270
1271 final_pass = 0;
1272 __split_whole_condition(expr);
1273 final_pass = final_pass_orig;
1274
1275 nonzero_rl = rl_filter(rl, rl_zero());
1276 return_ranges = show_rl(nonzero_rl);
1277 set_state(RETURN_ID, "return_ranges", NULL, alloc_estate_rl(nonzero_rl));
1278
1279 return_id++;
1280 FOR_EACH_PTR(returned_state_callbacks, cb) {
1281 cb->callback(return_id, return_ranges, expr);
1282 } END_FOR_EACH_PTR(cb);
1283
1284 __push_true_states();
1285 __use_false_states();
1286
1287 return_ranges = alloc_sname("0");
1288 zero_sval = sval_type_val(rl_type(rl), 0);
1289 add_range(&zero_rl, zero_sval, zero_sval);
1290 set_state(RETURN_ID, "return_ranges", NULL, alloc_estate_rl(zero_rl));
1291 return_id++;
1292 FOR_EACH_PTR(returned_state_callbacks, cb) {
1293 cb->callback(return_id, return_ranges, expr);
1294 } END_FOR_EACH_PTR(cb);
1295
1296 __merge_true_states();
1297 __free_fake_cur_stree();
1298
1299 return 1;
1300 }
1301
1302 static int is_boolean(struct expression *expr)
1303 {
1304 struct range_list *rl;
1305
1306 if (!get_implied_rl(expr, &rl))
1307 return 0;
1308 if (rl_min(rl).value == 0 && rl_max(rl).value == 1)
1309 return 1;
1310 return 0;
1311 }
1312
1313 static int is_conditional(struct expression *expr)
1314 {
1315 if (!expr)
1316 return 0;
1317 if (expr->type == EXPR_CONDITIONAL || expr->type == EXPR_SELECT)
1318 return 1;
1319 return 0;
1320 }
1321
1322 static int splitable_function_call(struct expression *expr)
1323 {
1324 struct sm_state *sm;
1325 char buf[64];
1326
1327 if (!expr || expr->type != EXPR_CALL)
1328 return 0;
1329 snprintf(buf, sizeof(buf), "return %p", expr);
1330 sm = get_sm_state(SMATCH_EXTRA, buf, NULL);
1331 return split_possible_helper(sm, expr);
1332 }
1333
1334 static struct sm_state *find_bool_param(void)
1335 {
1336 struct stree *start_states;
1337 struct symbol *arg;
1338 struct sm_state *sm, *tmp;
1339 sval_t sval;
1340
1341 start_states = get_start_states();
1342
1343 FOR_EACH_PTR_REVERSE(cur_func_sym->ctype.base_type->arguments, arg) {
1344 if (!arg->ident)
1345 continue;
1346 sm = get_sm_state_stree(start_states, SMATCH_EXTRA, arg->ident->name, arg);
1347 if (!sm)
1348 continue;
1349 if (rl_min(estate_rl(sm->state)).value != 0 ||
1350 rl_max(estate_rl(sm->state)).value != 1)
1351 continue;
1352 goto found;
1353 } END_FOR_EACH_PTR_REVERSE(arg);
1354
1355 return NULL;
1356
1357 found:
1358 /*
1359 * Check if it's splitable. If not, then splitting it up is likely not
1360 * useful for the callers.
1361 */
1362 FOR_EACH_PTR(sm->possible, tmp) {
1363 if (is_merged(tmp))
1364 continue;
1365 if (!estate_get_single_value(tmp->state, &sval))
1366 return NULL;
1367 } END_FOR_EACH_PTR(tmp);
1368
1369 return sm;
1370 }
1371
1372 static int split_on_bool_sm(struct sm_state *sm, struct expression *expr)
1373 {
1374 struct returned_state_callback *cb;
1375 struct range_list *ret_rl;
1376 const char *return_ranges;
1377 struct sm_state *tmp;
1378 int ret = 0;
1379 int nr_possible, nr_states;
1380 char *compare_str = NULL;
1381 char buf[128];
1382 struct state_list *already_handled = NULL;
1383
1384 if (!sm || !sm->merged)
1385 return 0;
1386
1387 if (too_many_possible(sm))
1388 return 0;
1389
1390 /* bail if it gets too complicated */
1391 nr_possible = ptr_list_size((struct ptr_list *)sm->possible);
1392 nr_states = stree_count(__get_cur_stree());
1393 if (nr_states * nr_possible >= 2000)
1394 return 0;
1395
1396 FOR_EACH_PTR(sm->possible, tmp) {
1397 if (tmp->merged)
1398 continue;
1399 if (ptr_in_list(tmp, already_handled))
1400 continue;
1401 add_ptr_list(&already_handled, tmp);
1402
1403 ret = 1;
1404 __push_fake_cur_stree();
1405
1406 overwrite_states_using_pool(sm, tmp);
1407
1408 return_ranges = get_return_ranges_str(expr, &ret_rl);
1409 set_state(RETURN_ID, "return_ranges", NULL, alloc_estate_rl(ret_rl));
1410 compare_str = expr_lte_to_param(expr, -1);
1411 if (compare_str) {
1412 snprintf(buf, sizeof(buf), "%s%s", return_ranges, compare_str);
1413 return_ranges = alloc_sname(buf);
1414 }
1415
1416 return_id++;
1417 FOR_EACH_PTR(returned_state_callbacks, cb) {
1418 cb->callback(return_id, (char *)return_ranges, expr);
1419 } END_FOR_EACH_PTR(cb);
1420
1421 __free_fake_cur_stree();
1422 } END_FOR_EACH_PTR(tmp);
1423
1424 free_slist(&already_handled);
1425
1426 return ret;
1427 }
1428
1429 static int split_by_bool_param(struct expression *expr)
1430 {
1431 struct sm_state *start_sm, *sm;
1432 sval_t sval;
1433
1434 start_sm = find_bool_param();
1435 if (!start_sm)
1436 return 0;
1437 sm = get_sm_state(SMATCH_EXTRA, start_sm->name, start_sm->sym);
1438 if (!sm || estate_get_single_value(sm->state, &sval))
1439 return 0;
1440 return split_on_bool_sm(sm, expr);
1441 }
1442
1443 static int split_by_null_nonnull_param(struct expression *expr)
1444 {
1445 struct symbol *arg;
1446 struct sm_state *sm;
1447
1448 /* function must only take one pointer */
1449 if (ptr_list_size((struct ptr_list *)cur_func_sym->ctype.base_type->arguments) != 1)
1450 return 0;
1451 arg = first_ptr_list((struct ptr_list *)cur_func_sym->ctype.base_type->arguments);
1452 if (!arg->ident)
1453 return 0;
1454 if (get_real_base_type(arg)->type != SYM_PTR)
1455 return 0;
1456
1457 if (param_was_set_var_sym(arg->ident->name, arg))
1458 return 0;
1459 sm = get_sm_state(SMATCH_EXTRA, arg->ident->name, arg);
1460 if (!sm)
1461 return 0;
1462
1463 return split_on_bool_sm(sm, expr);
1464 }
1465
1466 static void call_return_state_hooks(struct expression *expr)
1467 {
1468 struct returned_state_callback *cb;
1469 struct range_list *ret_rl;
1470 const char *return_ranges;
1471 int nr_states;
1472 sval_t sval;
1473
1474 if (__path_is_null())
1475 return;
1476
1477 expr = strip_expr(expr);
1478
1479 if (is_impossible_path())
1480 goto vanilla;
1481
1482 if (expr && (expr->type == EXPR_COMPARE ||
1483 !get_implied_value(expr, &sval)) &&
1484 (is_condition(expr) || is_boolean(expr))) {
1485 call_return_state_hooks_compare(expr);
1486 return;
1487 } else if (is_conditional(expr)) {
1488 call_return_state_hooks_conditional(expr);
1489 return;
1490 } else if (call_return_state_hooks_split_possible(expr)) {
1491 return;
1492 } else if (call_return_state_hooks_split_null_non_null(expr)) {
1493 return;
1494 } else if (call_return_state_hooks_split_success_fail(expr)) {
1495 return;
1496 } else if (splitable_function_call(expr)) {
1497 return;
1498 } else if (split_positive_from_negative(expr)) {
1499 return;
1500 } else if (split_by_bool_param(expr)) {
1501 } else if (split_by_null_nonnull_param(expr)) {
1502 return;
1503 }
1504
1505 vanilla:
1506 return_ranges = get_return_ranges_str(expr, &ret_rl);
1507 set_state(RETURN_ID, "return_ranges", NULL, alloc_estate_rl(ret_rl));
1508
1509 return_id++;
1510 nr_states = stree_count(__get_cur_stree());
1511 if (nr_states >= 10000) {
1512 match_return_info(return_id, (char *)return_ranges, expr);
1513 return;
1514 }
1515 FOR_EACH_PTR(returned_state_callbacks, cb) {
1516 cb->callback(return_id, (char *)return_ranges, expr);
1517 } END_FOR_EACH_PTR(cb);
1518 }
1519
1520 static void print_returned_struct_members(int return_id, char *return_ranges, struct expression *expr)
1521 {
1522 struct returned_member_callback *cb;
1523 struct stree *stree;
1524 struct sm_state *sm;
1525 struct symbol *type;
1526 char *name;
1527 char member_name[256];
1528 int len;
1529
1530 type = get_type(expr);
1531 if (!type || type->type != SYM_PTR)
1532 return;
1533 name = expr_to_var(expr);
1534 if (!name)
1535 return;
1536
1537 member_name[sizeof(member_name) - 1] = '\0';
1538 strcpy(member_name, "$");
1539
1540 len = strlen(name);
1541 FOR_EACH_PTR(returned_member_callbacks, cb) {
1542 stree = __get_cur_stree();
1543 FOR_EACH_MY_SM(cb->owner, stree, sm) {
1544 if (sm->name[0] == '*' && strcmp(sm->name + 1, name) == 0) {
1545 strcpy(member_name, "*$");
1546 cb->callback(return_id, return_ranges, expr, member_name, sm->state);
1547 continue;
1548 }
1549 if (strncmp(sm->name, name, len) != 0)
1550 continue;
1551 if (strncmp(sm->name + len, "->", 2) != 0)
1552 continue;
1553 snprintf(member_name, sizeof(member_name), "$%s", sm->name + len);
1554 cb->callback(return_id, return_ranges, expr, member_name, sm->state);
1555 } END_FOR_EACH_SM(sm);
1556 } END_FOR_EACH_PTR(cb);
1557
1558 free_string(name);
1559 }
1560
1561 static void reset_memdb(struct symbol *sym)
1562 {
1563 mem_sql(NULL, NULL, "delete from caller_info;");
1564 mem_sql(NULL, NULL, "delete from return_states;");
1565 mem_sql(NULL, NULL, "delete from call_implies;");
1566 }
1567
1568 static void match_end_func_info(struct symbol *sym)
1569 {
1570 if (__path_is_null())
1571 return;
1572 call_return_state_hooks(NULL);
1573 }
1574
1575 static void match_after_func(struct symbol *sym)
1576 {
1577 if (!__inline_fn)
1578 reset_memdb(sym);
1579 }
1580
1581 static void init_memdb(void)
1582 {
1583 char *err = NULL;
1584 int rc;
1585 const char *schema_files[] = {
1586 "db/db.schema",
1587 "db/caller_info.schema",
1588 "db/return_states.schema",
1589 "db/function_type_size.schema",
1590 "db/type_size.schema",
1591 "db/call_implies.schema",
1592 "db/function_ptr.schema",
1593 "db/local_values.schema",
1594 "db/function_type_value.schema",
1595 "db/type_value.schema",
1596 "db/function_type.schema",
1597 "db/data_info.schema",
1598 "db/parameter_name.schema",
1599 };
1600 static char buf[4096];
1601 int fd;
1602 int ret;
1603 int i;
1604
1605 rc = sqlite3_open(":memory:", &mem_db);
1606 if (rc != SQLITE_OK) {
1607 printf("Error starting In-Memory database.");
1608 return;
1609 }
1610
1611 for (i = 0; i < ARRAY_SIZE(schema_files); i++) {
1612 fd = open_data_file(schema_files[i]);
1613 if (fd < 0) {
1614 mem_db = NULL;
1615 return;
1616 }
1617 ret = read(fd, buf, sizeof(buf));
1618 if (ret == sizeof(buf)) {
1619 printf("Schema file too large: %s (limit %zd bytes)",
1620 schema_files[i], sizeof(buf));
1621 }
1622 buf[ret] = '\0';
1623 rc = sqlite3_exec(mem_db, buf, NULL, NULL, &err);
1624 if (rc != SQLITE_OK) {
1625 fprintf(stderr, "SQL error #2: %s\n", err);
1626 fprintf(stderr, "%s\n", buf);
1627 }
1628 }
1629 }
1630
1631 void open_smatch_db(void)
1632 {
1633 int rc;
1634
1635 if (option_no_db)
1636 return;
1637
1638 init_memdb();
1639
1640 rc = sqlite3_open_v2("smatch_db.sqlite", &db, SQLITE_OPEN_READONLY, NULL);
1641 if (rc != SQLITE_OK) {
1642 option_no_db = 1;
1643 return;
1644 }
1645 return;
1646 }
1647
1648 static void register_common_funcs(void)
1649 {
1650 struct token *token;
1651 char *func;
1652 char filename[256];
1653
1654 if (option_project == PROJ_NONE)
1655 strcpy(filename, "common_functions");
1656 else
1657 snprintf(filename, 256, "%s.common_functions", option_project_str);
1658
1659 token = get_tokens_file(filename);
1660 if (!token)
1661 return;
1662 if (token_type(token) != TOKEN_STREAMBEGIN)
1663 return;
1664 token = token->next;
1665 while (token_type(token) != TOKEN_STREAMEND) {
1666 if (token_type(token) != TOKEN_IDENT)
1667 return;
1668 func = alloc_string(show_ident(token->ident));
1669 add_ptr_list(&common_funcs, func);
1670 token = token->next;
1671 }
1672 clear_token_alloc();
1673 }
1674
1675
1676 void register_definition_db_callbacks(int id)
1677 {
1678 add_hook(&match_call_info, FUNCTION_CALL_HOOK);
1679 add_hook(&global_variable, BASE_HOOK);
1680 add_hook(&global_variable, DECLARATION_HOOK);
1681 add_split_return_callback(match_return_info);
1682 add_split_return_callback(print_returned_struct_members);
1683 add_hook(&call_return_state_hooks, RETURN_HOOK);
1684 add_hook(&match_end_func_info, END_FUNC_HOOK);
1685 add_hook(&match_after_func, AFTER_FUNC_HOOK);
1686
1687 add_hook(&match_data_from_db, FUNC_DEF_HOOK);
1688 add_hook(&match_call_implies, CALL_HOOK_AFTER_INLINE);
1689
1690 register_common_funcs();
1691 }
1692
1693 void register_db_call_marker(int id)
1694 {
1695 add_hook(&match_call_marker, FUNCTION_CALL_HOOK);
1696 }
1697
1698 char *return_state_to_var_sym(struct expression *expr, int param, const char *key, struct symbol **sym)
1699 {
1700 struct expression *arg;
1701 char *name = NULL;
1702 char member_name[256];
1703
1704 *sym = NULL;
1705
1706 if (param == -1) {
1707 const char *star = "";
1708
1709 if (expr->type != EXPR_ASSIGNMENT)
1710 return NULL;
1711 name = expr_to_var_sym(expr->left, sym);
1712 if (!name)
1713 return NULL;
1714 if (key[0] == '*') {
1715 star = "*";
1716 key++;
1717 }
1718 if (strncmp(key, "$", 1) != 0)
1719 return name;
1720 snprintf(member_name, sizeof(member_name), "%s%s%s", star, name, key + 1);
1721 free_string(name);
1722 return alloc_string(member_name);
1723 }
1724
1725 while (expr->type == EXPR_ASSIGNMENT)
1726 expr = strip_expr(expr->right);
1727 if (expr->type != EXPR_CALL)
1728 return NULL;
1729
1730 arg = get_argument_from_call_expr(expr->args, param);
1731 if (!arg)
1732 return NULL;
1733
1734 return get_variable_from_key(arg, key, sym);
1735 }
1736
1737 char *get_variable_from_key(struct expression *arg, const char *key, struct symbol **sym)
1738 {
1739 char buf[256];
1740 char *tmp;
1741
1742 if (!arg)
1743 return NULL;
1744
1745 arg = strip_expr(arg);
1746
1747 if (strcmp(key, "$") == 0)
1748 return expr_to_var_sym(arg, sym);
1749
1750 if (strcmp(key, "*$") == 0) {
1751 if (arg->type == EXPR_PREOP && arg->op == '&') {
1752 arg = strip_expr(arg->unop);
1753 return expr_to_var_sym(arg, sym);
1754 } else {
1755 tmp = expr_to_var_sym(arg, sym);
1756 if (!tmp)
1757 return NULL;
1758 snprintf(buf, sizeof(buf), "*%s", tmp);
1759 free_string(tmp);
1760 return alloc_string(buf);
1761 }
1762 }
1763
1764 if (arg->type == EXPR_PREOP && arg->op == '&') {
1765 arg = strip_expr(arg->unop);
1766 tmp = expr_to_var_sym(arg, sym);
1767 if (!tmp)
1768 return NULL;
1769 snprintf(buf, sizeof(buf), "%s.%s", tmp, key + 3);
1770 return alloc_string(buf);
1771 }
1772
1773 tmp = expr_to_var_sym(arg, sym);
1774 if (!tmp)
1775 return NULL;
1776 snprintf(buf, sizeof(buf), "%s%s", tmp, key + 1);
1777 free_string(tmp);
1778 return alloc_string(buf);
1779 }
1780
1781 char *get_chunk_from_key(struct expression *arg, char *key, struct symbol **sym, struct var_sym_list **vsl)
1782 {
1783 *vsl = NULL;
1784
1785 if (strcmp("$", key) == 0)
1786 return expr_to_chunk_sym_vsl(arg, sym, vsl);
1787 return get_variable_from_key(arg, key, sym);
1788 }
1789
1790 const char *get_param_name_var_sym(const char *name, struct symbol *sym)
1791 {
1792 char *param_name;
1793 int name_len;
1794 static char buf[256];
1795
1796 if (!sym || !sym->ident)
1797 return NULL;
1798
1799 param_name = sym->ident->name;
1800 name_len = strlen(param_name);
1801
1802 if (strcmp(name, param_name) == 0) {
1803 return "$";
1804 } else if (name[name_len] == '-' && /* check for '-' from "->" */
1805 strncmp(name, param_name, name_len) == 0) {
1806 snprintf(buf, sizeof(buf), "$%s", name + name_len);
1807 return buf;
1808 } else if (name[0] == '*' && strcmp(name + 1, param_name) == 0) {
1809 return "*$";
1810 }
1811 return NULL;
1812 }
1813
1814 const char *get_param_name(struct sm_state *sm)
1815 {
1816 return get_param_name_var_sym(sm->name, sm->sym);
1817 }
1818
1819 char *get_data_info_name(struct expression *expr)
1820 {
1821 struct symbol *sym;
1822 char *name;
1823 char buf[256];
1824 char *ret = NULL;
1825
1826 expr = strip_expr(expr);
1827 name = get_member_name(expr);
1828 if (name)
1829 return name;
1830 name = expr_to_var_sym(expr, &sym);
1831 if (!name || !sym)
1832 goto free;
1833 if (!(sym->ctype.modifiers & MOD_TOPLEVEL))
1834 goto free;
1835 if (sym->ctype.modifiers & MOD_STATIC)
1836 snprintf(buf, sizeof(buf), "static %s", name);
1837 else
1838 snprintf(buf, sizeof(buf), "global %s", name);
1839 ret = alloc_sname(buf);
1840 free:
1841 free_string(name);
1842 return ret;
1843 }
Static analysis for C