2 * Copyright (C) 2015 Oracle.
4 * This program is free software; you can redistribute it and/or
5 * modify it under the terms of the GNU General Public License
6 * as published by the Free Software Foundation; either version 2
7 * of the License, or (at your option) any later version.
9 * This program is distributed in the hope that it will be useful,
10 * but WITHOUT ANY WARRANTY; without even the implied warranty of
11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12 * GNU General Public License for more details.
14 * You should have received a copy of the GNU General Public License
15 * along with this program; if not, see http://www.gnu.org/copyleft/gpl.txt
19 #include "smatch_slist.h"
20 #include "smatch_extra.h"
22 static bool is_non_null_array(struct expression
*expr
)
29 type
= get_type(expr
);
30 if (!type
|| type
->type
!= SYM_ARRAY
)
32 if (expr
->type
== EXPR_SYMBOL
)
34 if (implied_not_equal(expr
, 0))
37 /* verify that it's not the first member of the struct */
38 if (expr
->type
!= EXPR_DEREF
|| !expr
->member
)
40 sym
= expr_to_sym(expr
);
43 type
= get_real_base_type(sym
);
44 if (!type
|| type
->type
!= SYM_PTR
)
46 type
= get_real_base_type(type
);
47 if (type
->type
!= SYM_STRUCT
)
51 FOR_EACH_PTR(type
->symbol_list
, tmp
) {
55 if (strcmp(expr
->member
->name
, tmp
->ident
->name
) == 0) {
60 } END_FOR_EACH_PTR(tmp
);
65 int get_member_offset(struct symbol
*type
, const char *member_name
)
70 if (!type
|| type
->type
!= SYM_STRUCT
)
74 FOR_EACH_PTR(type
->symbol_list
, tmp
) {
75 offset
= ALIGN(offset
, tmp
->ctype
.alignment
);
77 strcmp(member_name
, tmp
->ident
->name
) == 0) {
80 offset
+= type_bytes(tmp
);
81 } END_FOR_EACH_PTR(tmp
);
85 int get_member_offset_from_deref(struct expression
*expr
)
91 if (expr
->type
!= EXPR_DEREF
) /* hopefully, this doesn't happen */
94 if (expr
->member_offset
>= 0)
95 return expr
->member_offset
;
97 member
= expr
->member
;
101 type
= get_type(expr
->deref
);
102 if (type_is_ptr(type
))
103 type
= get_real_base_type(type
);
104 if (!type
|| type
->type
!= SYM_STRUCT
)
107 offset
= get_member_offset(type
, member
->name
);
109 expr
->member_offset
= offset
;
113 static void add_offset_to_pointer(struct range_list
**rl
, int offset
)
115 sval_t min
, max
, remove
, sval
;
116 struct range_list
*orig
= *rl
;
119 * Ha ha. Treating zero as a special case means I'm correct at least a
120 * tiny fraction of the time. Which is better than nothing.
126 if (is_unknown_ptr(orig
))
130 * This function doesn't necessarily work how you might expect...
132 * Say you have s64min-(-1),1-s64max and you add 8 then I guess what
133 * we want to say is maybe something like 9-s64max. This shows that the
134 * min it could be is 9 which is potentially useful information. But
135 * if we start with (-12),5000000-57777777 and we add 8 then we'd want
136 * the result to be (-4),5000008-57777777 but (-4),5000000-57777777 is
137 * also probably acceptable. If you start with s64min-s64max then the
138 * result should be 8-s64max.
142 /* We do the math on void pointer type, because this isn't "&v + 16" it
143 * is &v->sixteenth_byte.
145 orig
= cast_rl(&ptr_ctype
, orig
);
146 min
= sval_type_min(&ptr_ctype
);
148 max
= sval_type_max(&ptr_ctype
);
150 if (!orig
|| is_whole_rl(orig
)) {
151 *rl
= alloc_rl(min
, max
);
156 max
.uvalue
= rl_max(orig
).uvalue
;
157 if (max
.uvalue
> sval_type_max(&ptr_ctype
).uvalue
- offset
) {
158 remove
= sval_type_max(&ptr_ctype
);
159 remove
.uvalue
-= offset
;
160 orig
= remove_range(orig
, remove
, max
);
163 sval
.type
= &int_ctype
;
166 *rl
= rl_binop(orig
, '+', alloc_rl(sval
, sval
));
169 static struct range_list
*where_allocated_rl(struct symbol
*sym
)
174 return alloc_rl(valid_ptr_min_sval
, valid_ptr_max_sval
);
177 int get_address_rl(struct expression
*expr
, struct range_list
**rl
)
179 expr
= strip_expr(expr
);
183 if (expr
->type
== EXPR_STRING
) {
184 *rl
= alloc_rl(valid_ptr_min_sval
, valid_ptr_max_sval
);
188 if (expr
->type
== EXPR_PREOP
&& expr
->op
== '&') {
189 struct expression
*unop
;
191 unop
= strip_expr(expr
->unop
);
192 if (unop
->type
== EXPR_SYMBOL
) {
193 *rl
= where_allocated_rl(unop
->symbol
);
197 if (is_array(unop
)) {
198 struct expression
*array
;
199 struct expression
*offset_expr
;
201 array
= get_array_base(unop
);
202 offset_expr
= get_array_offset(unop
);
204 if (implied_not_equal(array
, 0) ||
205 implied_not_equal(offset_expr
, 0)) {
206 *rl
= alloc_rl(valid_ptr_min_sval
, valid_ptr_max_sval
);
213 if (unop
->type
== EXPR_DEREF
&& unop
->member
) {
214 struct range_list
*unop_rl
;
217 offset
= get_member_offset_from_deref(unop
);
218 unop
= strip_expr(unop
->unop
);
219 if (unop
->type
== EXPR_PREOP
&& unop
->op
== '*')
220 unop
= strip_expr(unop
->unop
);
222 if (offset
>= 0 && get_implied_rl(unop
, &unop_rl
)) {
224 add_offset_to_pointer(rl
, offset
);
228 if (implied_not_equal(unop
, 0) || offset
> 0) {
229 *rl
= alloc_rl(valid_ptr_min_sval
, valid_ptr_max_sval
);
239 if (is_non_null_array(expr
)) {
240 *rl
= alloc_rl(array_min_sval
, array_max_sval
);