smatch_extra.c

   1 /*
   2  * sparse/smatch_extra.c
   3  *
   4  * Copyright (C) 2008 Dan Carpenter.
   5  *
   6  * Licensed under the Open Software License version 1.1
   7  *
   8  */
   9
  10 /*
  11  * smatch_extra.c is supposed to track the value of every variable.
  12  *
  13  */
  14
  15 #include <stdlib.h>
  16 #include <errno.h>
  17 #ifndef __USE_ISOC99
  18 #define __USE_ISOC99
  19 #endif
  20 #include <limits.h>
  21 #include "parse.h"
  22 #include "smatch.h"
  23 #include "smatch_slist.h"
  24 #include "smatch_extra.h"
  25
  26 static int my_id;
  27
  28 struct string_list *__ignored_macros = NULL;
  29 static int in_warn_on_macro()
  30 {
  31         struct statement *stmt;
  32         char *tmp;
  33         char *macro;
  34
  35         stmt = get_current_statement();
  36         if (!stmt)
  37                 return 0;
  38         macro = get_macro_name(stmt->pos);
  39         if (!macro)
  40                 return 0;
  41
  42         FOR_EACH_PTR(__ignored_macros, tmp) {
  43                 if (!strcmp(tmp, macro))
  44                         return 1;
  45         } END_FOR_EACH_PTR(tmp);
  46         return 0;
  47 }
  48
  49 typedef void (mod_hook)(const char *name, struct symbol *sym, struct smatch_state *state);
  50 DECLARE_PTR_LIST(void_fn_list, mod_hook *);
  51 static struct void_fn_list *extra_mod_hooks;
  52 void add_extra_mod_hook(mod_hook *fn)
  53 {
  54         mod_hook **p = malloc(sizeof(mod_hook *));
  55         *p = fn;
  56         add_ptr_list(&extra_mod_hooks, p);
  57 }
  58
  59 void call_extra_mod_hooks(const char *name, struct symbol *sym, struct smatch_state *state)
  60 {
  61         mod_hook **fn;
  62
  63         FOR_EACH_PTR(extra_mod_hooks, fn) {
  64                 (*fn)(name, sym, state);
  65         } END_FOR_EACH_PTR(fn);
  66 }
  67
  68 struct sm_state *set_extra_mod(const char *name, struct symbol *sym, struct smatch_state *state)
  69 {
  70         if (in_warn_on_macro())
  71                 return NULL;
  72         remove_from_equiv(name, sym);
  73         call_extra_mod_hooks(name, sym, state);
  74         return set_state(SMATCH_EXTRA, name, sym, state);
  75 }
  76
  77 struct sm_state *set_extra_expr_mod(struct expression *expr, struct smatch_state *state)
  78 {
  79         struct symbol *sym;
  80         char *name;
  81         struct sm_state *ret = NULL;
  82
  83         expr = strip_expr(expr);
  84         name = expr_to_var_sym(expr, &sym);
  85         if (!name || !sym)
  86                 goto free;
  87         ret = set_extra_mod(name, sym, state);
  88 free:
  89         free_string(name);
  90         return ret;
  91 }
  92
  93 void set_extra_nomod(const char *name, struct symbol *sym, struct smatch_state *state)
  94 {
  95         struct relation *rel;
  96         struct smatch_state *orig_state;
  97
  98         orig_state = get_state(SMATCH_EXTRA, name, sym);
  99
 100         if (!estate_related(orig_state)) {
 101                 set_state(SMATCH_EXTRA, name, sym, state);
 102                 return;
 103         }
 104
 105         set_related(state, estate_related(orig_state));
 106         FOR_EACH_PTR(estate_related(orig_state), rel) {
 107                 if (option_debug_related)
 108                         sm_msg("updating related %s to %s", rel->name, state->name);
 109                 set_state(SMATCH_EXTRA, rel->name, rel->sym, state);
 110         } END_FOR_EACH_PTR(rel);
 111 }
 112
 113 /*
 114  * This is for return_implies_state() hooks which modify a SMATCH_EXTRA state
 115  */
 116 void set_extra_expr_nomod(struct expression *expr, struct smatch_state *state)
 117 {
 118         char *name;
 119         struct symbol *sym;
 120
 121         name = expr_to_var_sym(expr, &sym);
 122         if (!name || !sym)
 123                 goto free;
 124         set_extra_nomod(name, sym, state);
 125 free:
 126         free_string(name);
 127
 128 }
 129
 130 static void set_extra_true_false(const char *name, struct symbol *sym,
 131                         struct smatch_state *true_state,
 132                         struct smatch_state *false_state)
 133 {
 134         struct relation *rel;
 135         struct smatch_state *orig_state;
 136
 137         if (in_warn_on_macro())
 138                 return;
 139
 140         orig_state = get_state(SMATCH_EXTRA, name, sym);
 141
 142         if (!estate_related(orig_state)) {
 143                 set_true_false_states(SMATCH_EXTRA, name, sym, true_state, false_state);
 144                 return;
 145         }
 146
 147         if (true_state)
 148                 set_related(true_state, estate_related(orig_state));
 149         if (false_state)
 150                 set_related(false_state, estate_related(orig_state));
 151
 152         FOR_EACH_PTR(estate_related(orig_state), rel) {
 153                 set_true_false_states(SMATCH_EXTRA, rel->name, rel->sym,
 154                                 true_state, false_state);
 155         } END_FOR_EACH_PTR(rel);
 156 }
 157
 158 static void set_extra_expr_true_false(struct expression *expr,
 159                 struct smatch_state *true_state,
 160                 struct smatch_state *false_state)
 161 {
 162         char *name;
 163         struct symbol *sym;
 164
 165         expr = strip_expr(expr);
 166         name = expr_to_var_sym(expr, &sym);
 167         if (!name || !sym)
 168                 goto free;
 169         set_extra_true_false(name, sym, true_state, false_state);
 170 free:
 171         free_string(name);
 172 }
 173
 174 static struct sm_state *handle_canonical_while_count_down(struct statement *loop)
 175 {
 176         struct expression *iter_var;
 177         struct expression *condition;
 178         struct sm_state *sm;
 179         struct smatch_state *estate;
 180         sval_t start;
 181
 182         condition = strip_expr(loop->iterator_pre_condition);
 183         if (!condition)
 184                 return NULL;
 185         if (condition->type != EXPR_PREOP && condition->type != EXPR_POSTOP)
 186                 return NULL;
 187         if (condition->op != SPECIAL_DECREMENT)
 188                 return NULL;
 189
 190         iter_var = condition->unop;
 191         sm = get_sm_state_expr(SMATCH_EXTRA, iter_var);
 192         if (!sm)
 193                 return NULL;
 194         if (sval_cmp_val(estate_min(sm->state), 0) < 0)
 195                 return NULL;
 196         start = estate_max(sm->state);
 197         if  (sval_cmp_val(start, 0) <= 0)
 198                 return NULL;
 199         if (!sval_is_max(start))
 200                 start.value--;
 201
 202         if (condition->type == EXPR_PREOP) {
 203                 estate = alloc_estate_range(sval_type_val(start.type, 1), start);
 204                 if (estate_has_hard_max(sm->state))
 205                         estate_set_hard_max(estate);
 206                 set_extra_expr_mod(iter_var, estate);
 207         }
 208         if (condition->type == EXPR_POSTOP) {
 209                 estate = alloc_estate_range(sval_type_val(start.type, 0), start);
 210                 if (estate_has_hard_max(sm->state))
 211                         estate_set_hard_max(estate);
 212                 set_extra_expr_mod(iter_var, estate);
 213         }
 214         return get_sm_state_expr(SMATCH_EXTRA, iter_var);
 215 }
 216
 217 static struct sm_state *handle_canonical_for_inc(struct expression *iter_expr,
 218                                                 struct expression *condition)
 219 {
 220         struct expression *iter_var;
 221         struct sm_state *sm;
 222         struct smatch_state *estate;
 223         sval_t start, end, dummy;
 224
 225         iter_var = iter_expr->unop;
 226         sm = get_sm_state_expr(SMATCH_EXTRA, iter_var);
 227         if (!sm)
 228                 return NULL;
 229         if (!estate_get_single_value(sm->state, &start))
 230                 return NULL;
 231         if (get_implied_max(condition->right, &end))
 232                 end = sval_cast(get_type(iter_var), end);
 233         else
 234                 end = sval_type_max(get_type(iter_var));
 235
 236         if (get_sm_state_expr(SMATCH_EXTRA, condition->left) != sm)
 237                 return NULL;
 238
 239         switch (condition->op) {
 240         case SPECIAL_NOTEQUAL:
 241         case '<':
 242                 if (!sval_is_min(end))
 243                         end.value--;
 244                 break;
 245         case SPECIAL_LTE:
 246                 break;
 247         default:
 248                 return NULL;
 249         }
 250         if (sval_cmp(end, start) < 0)
 251                 return NULL;
 252         estate = alloc_estate_range(start, end);
 253         if (get_hard_max(condition->right, &dummy))
 254                 estate_set_hard_max(estate);
 255         set_extra_expr_mod(iter_var, estate);
 256         return get_sm_state_expr(SMATCH_EXTRA, iter_var);
 257 }
 258
 259 static struct sm_state *handle_canonical_for_dec(struct expression *iter_expr,
 260                                                 struct expression *condition)
 261 {
 262         struct expression *iter_var;
 263         struct sm_state *sm;
 264         struct smatch_state *estate;
 265         sval_t start, end;
 266
 267         iter_var = iter_expr->unop;
 268         sm = get_sm_state_expr(SMATCH_EXTRA, iter_var);
 269         if (!sm)
 270                 return NULL;
 271         if (!estate_get_single_value(sm->state, &start))
 272                 return NULL;
 273         if (!get_implied_min(condition->right, &end))
 274                 end = sval_type_min(get_type(iter_var));
 275         if (get_sm_state_expr(SMATCH_EXTRA, condition->left) != sm)
 276                 return NULL;
 277
 278         switch (condition->op) {
 279         case SPECIAL_NOTEQUAL:
 280         case '>':
 281                 if (!sval_is_min(end) && !sval_is_max(end))
 282                         end.value++;
 283                 break;
 284         case SPECIAL_GTE:
 285                 break;
 286         default:
 287                 return NULL;
 288         }
 289         if (sval_cmp(end, start) > 0)
 290                 return NULL;
 291         estate = alloc_estate_range(end, start);
 292         estate_set_hard_max(estate);
 293         set_extra_expr_mod(iter_var, estate);
 294         return get_sm_state_expr(SMATCH_EXTRA, iter_var);
 295 }
 296
 297 static struct sm_state *handle_canonical_for_loops(struct statement *loop)
 298 {
 299         struct expression *iter_expr;
 300         struct expression *condition;
 301
 302         if (!loop->iterator_post_statement)
 303                 return NULL;
 304         if (loop->iterator_post_statement->type != STMT_EXPRESSION)
 305                 return NULL;
 306         iter_expr = loop->iterator_post_statement->expression;
 307         if (!loop->iterator_pre_condition)
 308                 return NULL;
 309         if (loop->iterator_pre_condition->type != EXPR_COMPARE)
 310                 return NULL;
 311         condition = loop->iterator_pre_condition;
 312
 313         if (iter_expr->op == SPECIAL_INCREMENT)
 314                 return handle_canonical_for_inc(iter_expr, condition);
 315         if (iter_expr->op == SPECIAL_DECREMENT)
 316                 return handle_canonical_for_dec(iter_expr, condition);
 317         return NULL;
 318 }
 319
 320 struct sm_state *__extra_handle_canonical_loops(struct statement *loop, struct state_list **slist)
 321 {
 322         struct sm_state *ret;
 323
 324         __push_fake_cur_slist();
 325         if (!loop->iterator_post_statement)
 326                 ret = handle_canonical_while_count_down(loop);
 327         else
 328                 ret = handle_canonical_for_loops(loop);
 329         *slist = __pop_fake_cur_slist();
 330         return ret;
 331 }
 332
 333 int __iterator_unchanged(struct sm_state *sm)
 334 {
 335         if (!sm)
 336                 return 0;
 337         if (get_sm_state(my_id, sm->name, sm->sym) == sm)
 338                 return 1;
 339         return 0;
 340 }
 341
 342 static void while_count_down_after(struct sm_state *sm, struct expression *condition)
 343 {
 344         sval_t after_value;
 345
 346         /* paranoid checking.  prolly not needed */
 347         condition = strip_expr(condition);
 348         if (!condition)
 349                 return;
 350         if (condition->type != EXPR_PREOP && condition->type != EXPR_POSTOP)
 351                 return;
 352         if (condition->op != SPECIAL_DECREMENT)
 353                 return;
 354         after_value = estate_min(sm->state);
 355         after_value.value--;
 356         set_extra_mod(sm->name, sm->sym, alloc_estate_sval(after_value));
 357 }
 358
 359 void __extra_pre_loop_hook_after(struct sm_state *sm,
 360                                 struct statement *iterator,
 361                                 struct expression *condition)
 362 {
 363         struct expression *iter_expr;
 364         sval_t limit;
 365         struct smatch_state *state;
 366
 367         if (!iterator) {
 368                 while_count_down_after(sm, condition);
 369                 return;
 370         }
 371
 372         iter_expr = iterator->expression;
 373
 374         if (condition->type != EXPR_COMPARE)
 375                 return;
 376         if (iter_expr->op == SPECIAL_INCREMENT) {
 377                 limit = sval_binop(estate_max(sm->state), '+',
 378                                    sval_type_val(estate_type(sm->state), 1));
 379         } else {
 380                 limit = sval_binop(estate_min(sm->state), '-',
 381                                    sval_type_val(estate_type(sm->state), 1));
 382         }
 383         if (!estate_has_hard_max(sm->state) && !__has_breaks()) {
 384                 if (iter_expr->op == SPECIAL_INCREMENT)
 385                         state = alloc_estate_range(estate_min(sm->state), limit);
 386                 else
 387                         state = alloc_estate_range(limit, estate_max(sm->state));
 388         } else {
 389                 state = alloc_estate_sval(limit);
 390         }
 391         if (!estate_has_hard_max(sm->state))
 392                 estate_clear_hard_max(state);
 393         set_extra_mod(sm->name, sm->sym, state);
 394 }
 395
 396 static struct state_list *unmatched_slist;
 397 static struct smatch_state *unmatched_state(struct sm_state *sm)
 398 {
 399         struct smatch_state *state;
 400
 401         if (unmatched_slist) {
 402                 state = get_state_slist(unmatched_slist, SMATCH_EXTRA, sm->name, sm->sym);
 403                 if (state)
 404                         return state;
 405         }
 406         return alloc_estate_whole(estate_type(sm->state));
 407 }
 408
 409 static void clear_the_pointed_at(struct expression *expr, struct state_list *slist)
 410 {
 411         char *name;
 412         struct symbol *sym;
 413         struct sm_state *tmp;
 414
 415         name = expr_to_var_sym(expr, &sym);
 416         if (!name || !sym)
 417                 goto free;
 418
 419         FOR_EACH_PTR(slist, tmp) {
 420                 if (tmp->name[0] != '*')
 421                         continue;
 422                 if (tmp->sym != sym)
 423                         continue;
 424                 if (strcmp(tmp->name + 1, name) != 0)
 425                         continue;
 426                 set_extra_mod(tmp->name, tmp->sym, alloc_estate_whole(estate_type(tmp->state)));
 427         } END_FOR_EACH_PTR(tmp);
 428
 429 free:
 430         free_string(name);
 431 }
 432
 433 static void match_function_call(struct expression *expr)
 434 {
 435         struct expression *arg;
 436         struct expression *tmp;
 437         struct state_list *slist;
 438
 439         /* if we have the db this is handled in smatch_function_hooks.c */
 440         if (!option_no_db)
 441                 return;
 442         if (inlinable(expr->fn))
 443                 return;
 444
 445         slist = get_all_states(SMATCH_EXTRA);
 446
 447         FOR_EACH_PTR(expr->args, arg) {
 448                 tmp = strip_expr(arg);
 449                 if (tmp->type == EXPR_PREOP && tmp->op == '&')
 450                         set_extra_expr_mod(tmp->unop, alloc_estate_whole(get_type(tmp->unop)));
 451                 else
 452                         clear_the_pointed_at(tmp, slist);
 453         } END_FOR_EACH_PTR(arg);
 454
 455         free_slist(&slist);
 456 }
 457
 458 static int types_equiv_or_pointer(struct symbol *one, struct symbol *two)
 459 {
 460         if (!one || !two)
 461                 return 0;
 462         if (one->type == SYM_PTR && two->type == SYM_PTR)
 463                 return 1;
 464         return types_equiv(one, two);
 465 }
 466
 467 static void match_vanilla_assign(struct expression *left, struct expression *right)
 468 {
 469         struct range_list *rl = NULL;
 470         struct symbol *right_sym;
 471         struct symbol *left_type;
 472         struct symbol *right_type;
 473         char *right_name = NULL;
 474         struct symbol *sym;
 475         char *name;
 476         sval_t tmp;
 477         struct smatch_state *state;
 478
 479         name = expr_to_var_sym(left, &sym);
 480         if (!name)
 481                 return;
 482
 483         left_type = get_type(left);
 484         right_type = get_type(right);
 485
 486         right_name = expr_to_var_sym(right, &right_sym);
 487         if (right_name && right_sym &&
 488             types_equiv_or_pointer(left_type, right_type)) {
 489                 set_equiv(left, right);
 490                 goto free;
 491         }
 492
 493         if (get_implied_rl(right, &rl)) {
 494                 rl = cast_rl(left_type, rl);
 495                 state = alloc_estate_rl(rl);
 496                 if (get_hard_max(right, &tmp))
 497                         estate_set_hard_max(state);
 498         } else {
 499                 rl = alloc_whole_rl(right_type);
 500                 rl = cast_rl(left_type, rl);
 501                 state = alloc_estate_rl(rl);
 502         }
 503         set_extra_mod(name, sym, state);
 504 free:
 505         free_string(right_name);
 506 }
 507
 508 static int op_remove_assign(int op)
 509 {
 510         switch (op) {
 511         case SPECIAL_ADD_ASSIGN:
 512                 return '+';
 513         case SPECIAL_SUB_ASSIGN:
 514                 return '-';
 515         case SPECIAL_MUL_ASSIGN:
 516                 return '*';
 517         case SPECIAL_DIV_ASSIGN:
 518                 return '/';
 519         case SPECIAL_MOD_ASSIGN:
 520                 return '%';
 521         case SPECIAL_AND_ASSIGN:
 522                 return '&';
 523         case SPECIAL_OR_ASSIGN:
 524                 return '|';
 525         case SPECIAL_XOR_ASSIGN:
 526                 return '^';
 527         case SPECIAL_SHL_ASSIGN:
 528                 return SPECIAL_LEFTSHIFT;
 529         case SPECIAL_SHR_ASSIGN:
 530                 return SPECIAL_RIGHTSHIFT;
 531         default:
 532                 return op;
 533         }
 534 }
 535
 536 static void match_assign(struct expression *expr)
 537 {
 538         struct range_list *rl = NULL;
 539         struct expression *left;
 540         struct expression *right;
 541         struct expression *binop_expr;
 542         struct symbol *left_type;
 543         struct symbol *right_type;
 544         struct symbol *sym;
 545         char *name;
 546         sval_t left_min, left_max;
 547         sval_t right_min, right_max;
 548         sval_t res_min, res_max;
 549
 550         left = strip_expr(expr->left);
 551
 552         right = strip_expr(expr->right);
 553         while (right->type == EXPR_ASSIGNMENT && right->op == '=')
 554                 right = strip_expr(right->left);
 555
 556         if (is_condition(expr->right))
 557                 return; /* handled in smatch_condition.c */
 558         if (expr->op == '=' && right->type == EXPR_CALL)
 559                 return; /* handled in smatch_function_hooks.c */
 560         if (expr->op == '=') {
 561                 match_vanilla_assign(left, right);
 562                 return;
 563         }
 564
 565         name = expr_to_var_sym(left, &sym);
 566         if (!name)
 567                 return;
 568
 569         left_type = get_type(left);
 570         right_type = get_type(right);
 571
 572         res_min = sval_type_min(right_type);
 573         res_max = sval_type_max(right_type);
 574
 575         switch (expr->op) {
 576         case SPECIAL_ADD_ASSIGN:
 577                 get_absolute_max(left, &left_max);
 578                 get_absolute_max(right, &right_max);
 579                 if (sval_binop_overflows(left_max, '+', right_max))
 580                         break;
 581                 if (get_implied_min(left, &left_min) &&
 582                     !sval_is_negative_min(left_min) &&
 583                     get_implied_min(right, &right_min) &&
 584                     !sval_is_negative_min(right_min)) {
 585                         res_min = sval_binop(left_min, '+', right_min);
 586                         res_min = sval_cast(right_type, res_min);
 587                 }
 588                 if (inside_loop())  /* we are assuming loops don't lead to wrapping */
 589                         break;
 590                 res_max = sval_binop(left_max, '+', right_max);
 591                 res_max = sval_cast(right_type, res_max);
 592                 break;
 593         case SPECIAL_SUB_ASSIGN:
 594                 if (get_implied_max(left, &left_max) &&
 595                     !sval_is_max(left_max) &&
 596                     get_implied_min(right, &right_min) &&
 597                     !sval_is_min(right_min)) {
 598                         res_max = sval_binop(left_max, '-', right_min);
 599                         res_max = sval_cast(right_type, res_max);
 600                 }
 601                 if (inside_loop())
 602                         break;
 603                 if (get_implied_min(left, &left_min) &&
 604                     !sval_is_min(left_min) &&
 605                     get_implied_max(right, &right_max) &&
 606                     !sval_is_max(right_max)) {
 607                         res_min = sval_binop(left_min, '-', right_max);
 608                         res_min = sval_cast(right_type, res_min);
 609                 }
 610                 break;
 611         case SPECIAL_AND_ASSIGN:
 612         case SPECIAL_MOD_ASSIGN:
 613                 binop_expr = binop_expression(expr->left,
 614                                               op_remove_assign(expr->op),
 615                                               expr->right);
 616                 if (get_implied_rl(binop_expr, &rl)) {
 617                         rl = cast_rl(left_type, rl);
 618                         set_extra_mod(name, sym, alloc_estate_rl(rl));
 619                         goto free;
 620                 }
 621         }
 622         rl = cast_rl(left_type, alloc_rl(res_min, res_max));
 623         set_extra_mod(name, sym, alloc_estate_rl(rl));
 624 free:
 625         free_string(name);
 626 }
 627
 628 static struct smatch_state *increment_state(struct smatch_state *state)
 629 {
 630         sval_t min = estate_min(state);
 631         sval_t max = estate_max(state);
 632
 633         if (!estate_rl(state))
 634                 return NULL;
 635
 636         if (inside_loop())
 637                 max = sval_type_max(max.type);
 638
 639         if (!sval_is_min(min) && !sval_is_max(min))
 640                 min.value++;
 641         if (!sval_is_min(max) && !sval_is_max(max))
 642                 max.value++;
 643         return alloc_estate_range(min, max);
 644 }
 645
 646 static struct smatch_state *decrement_state(struct smatch_state *state)
 647 {
 648         sval_t min = estate_min(state);
 649         sval_t max = estate_max(state);
 650
 651         if (!estate_rl(state))
 652                 return NULL;
 653
 654         if (inside_loop())
 655                 min = sval_type_min(min.type);
 656
 657         if (!sval_is_min(min) && !sval_is_max(min))
 658                 min.value--;
 659         if (!sval_is_min(max) && !sval_is_max(max))
 660                 max.value--;
 661         return alloc_estate_range(min, max);
 662 }
 663
 664 static void unop_expr(struct expression *expr)
 665 {
 666         struct smatch_state *state;
 667
 668         if (expr->smatch_flags & Handled)
 669                 return;
 670
 671         switch (expr->op) {
 672         case SPECIAL_INCREMENT:
 673                 state = get_state_expr(SMATCH_EXTRA, expr->unop);
 674                 state = increment_state(state);
 675                 if (!state)
 676                         state = alloc_estate_whole(get_type(expr));
 677                 set_extra_expr_mod(expr->unop, state);
 678                 break;
 679         case SPECIAL_DECREMENT:
 680                 state = get_state_expr(SMATCH_EXTRA, expr->unop);
 681                 state = decrement_state(state);
 682                 if (!state)
 683                         state = alloc_estate_whole(get_type(expr));
 684                 set_extra_expr_mod(expr->unop, state);
 685                 break;
 686         default:
 687                 return;
 688         }
 689 }
 690
 691 static void asm_expr(struct statement *stmt)
 692 {
 693
 694         struct expression *expr;
 695         struct symbol *type;
 696         int state = 0;
 697
 698         FOR_EACH_PTR(stmt->asm_outputs, expr) {
 699                 switch (state) {
 700                 case 0: /* identifier */
 701                 case 1: /* constraint */
 702                         state++;
 703                         continue;
 704                 case 2: /* expression */
 705                         state = 0;
 706                         type = get_type(strip_expr(expr));
 707                         set_extra_expr_mod(expr, alloc_estate_whole(type));
 708                         continue;
 709                 }
 710         } END_FOR_EACH_PTR(expr);
 711 }
 712
 713 static void delete_state_tracker(struct tracker *t)
 714 {
 715         remove_from_equiv(t->name, t->sym);
 716         delete_state(t->owner, t->name, t->sym);
 717 }
 718
 719 static void scoped_state_extra(const char *name, struct symbol *sym)
 720 {
 721         struct tracker *t;
 722
 723         t = alloc_tracker(SMATCH_EXTRA, name, sym);
 724         add_scope_hook((scope_hook *)&delete_state_tracker, t);
 725 }
 726
 727 static void match_declarations(struct symbol *sym)
 728 {
 729         const char *name;
 730
 731         if (sym->ident) {
 732                 name = sym->ident->name;
 733                 if (!sym->initializer) {
 734                         set_state(SMATCH_EXTRA, name, sym, alloc_estate_whole(get_real_base_type(sym)));
 735                         scoped_state_extra(name, sym);
 736                 }
 737         }
 738 }
 739
 740 static void check_dereference(struct expression *expr)
 741 {
 742         set_extra_expr_nomod(expr, alloc_estate_range(valid_ptr_min_sval, valid_ptr_max_sval));
 743 }
 744
 745 static void match_dereferences(struct expression *expr)
 746 {
 747         if (expr->type != EXPR_PREOP)
 748                 return;
 749         check_dereference(expr->unop);
 750 }
 751
 752 static void match_pointer_as_array(struct expression *expr)
 753 {
 754         if (!is_array(expr))
 755                 return;
 756         check_dereference(expr->unop->left);
 757 }
 758
 759 static void set_param_dereferenced(struct expression *arg, char *unused)
 760 {
 761         check_dereference(arg);
 762 }
 763
 764 static void match_function_def(struct symbol *sym)
 765 {
 766         struct symbol *arg;
 767
 768         FOR_EACH_PTR(sym->ctype.base_type->arguments, arg) {
 769                 if (!arg->ident)
 770                         continue;
 771                 set_state(my_id, arg->ident->name, arg, alloc_estate_whole(get_real_base_type(arg)));
 772         } END_FOR_EACH_PTR(arg);
 773 }
 774
 775 static sval_t add_one(sval_t sval)
 776 {
 777         sval.value++;
 778         return sval;
 779 }
 780
 781 static sval_t sub_one(sval_t sval)
 782 {
 783         sval.value--;
 784         return sval;
 785 }
 786
 787 static void handle_comparison(struct symbol *type, struct expression *left, int op, struct expression *right)
 788 {
 789         struct range_list *left_orig;
 790         struct range_list *left_true;
 791         struct range_list *left_false;
 792         struct range_list *right_orig;
 793         struct range_list *right_true;
 794         struct range_list *right_false;
 795         struct smatch_state *left_true_state;
 796         struct smatch_state *left_false_state;
 797         struct smatch_state *right_true_state;
 798         struct smatch_state *right_false_state;
 799         sval_t min, max, dummy;
 800         int left_postop = 0;
 801         int right_postop = 0;
 802
 803         if (left->op == SPECIAL_INCREMENT || left->op == SPECIAL_DECREMENT) {
 804                 if (left->type == EXPR_POSTOP) {
 805                         left->smatch_flags |= Handled;
 806                         left_postop = left->op;
 807                 }
 808                 left = strip_expr(left->unop);
 809         }
 810         while (left->type == EXPR_ASSIGNMENT)
 811                 left = strip_expr(left->left);
 812
 813         if (right->op == SPECIAL_INCREMENT || right->op == SPECIAL_DECREMENT) {
 814                 if (right->type == EXPR_POSTOP) {
 815                         right->smatch_flags |= Handled;
 816                         right_postop = right->op;
 817                 }
 818                 right = strip_expr(right->unop);
 819         }
 820
 821         if (get_implied_rl(left, &left_orig)) {
 822                 left_orig = cast_rl(type, left_orig);
 823         } else {
 824                 min = sval_type_min(get_type(left));
 825                 max = sval_type_max(get_type(left));
 826                 left_orig = cast_rl(type, alloc_rl(min, max));
 827         }
 828
 829         if (get_implied_rl(right, &right_orig)) {
 830                 right_orig = cast_rl(type, right_orig);
 831         } else {
 832                 min = sval_type_min(get_type(right));
 833                 max = sval_type_max(get_type(right));
 834                 right_orig = cast_rl(type, alloc_rl(min, max));
 835         }
 836         min = sval_type_min(type);
 837         max = sval_type_max(type);
 838
 839         left_true = clone_rl(left_orig);
 840         left_false = clone_rl(left_orig);
 841         right_true = clone_rl(right_orig);
 842         right_false = clone_rl(right_orig);
 843
 844         switch (op) {
 845         case '<':
 846         case SPECIAL_UNSIGNED_LT:
 847                 left_true = remove_range(left_orig, rl_max(right_orig), max);
 848                 if (!sval_is_min(rl_min(right_orig))) {
 849                         left_false = remove_range(left_orig, min, sub_one(rl_min(right_orig)));
 850                 }
 851
 852                 right_true = remove_range(right_orig, min, rl_min(left_orig));
 853                 if (!sval_is_max(rl_max(left_orig)))
 854                         right_false = remove_range(right_orig, add_one(rl_max(left_orig)), max);
 855                 break;
 856         case SPECIAL_UNSIGNED_LTE:
 857         case SPECIAL_LTE:
 858                 if (!sval_is_max(rl_max(right_orig)))
 859                         left_true = remove_range(left_orig, add_one(rl_max(right_orig)), max);
 860                 left_false = remove_range(left_orig, min, rl_min(right_orig));
 861
 862                 if (!sval_is_min(rl_min(left_orig)))
 863                         right_true = remove_range(right_orig, min, sub_one(rl_min(left_orig)));
 864                 right_false = remove_range(right_orig, rl_max(left_orig), max);
 865
 866                 if (sval_cmp(rl_min(left_orig), rl_min(right_orig)) == 0)
 867                         left_false = remove_range(left_false, rl_min(left_orig), rl_min(left_orig));
 868                 if (sval_cmp(rl_max(left_orig), rl_max(right_orig)) == 0)
 869                         right_false = remove_range(right_false, rl_max(left_orig), rl_max(left_orig));
 870                 break;
 871         case SPECIAL_EQUAL:
 872                 if (!sval_is_max(rl_max(right_orig))) {
 873                         left_true = remove_range(left_true, add_one(rl_max(right_orig)), max);
 874                 }
 875                 if (!sval_is_min(rl_min(right_orig))) {
 876                         left_true = remove_range(left_true, min, sub_one(rl_min(right_orig)));
 877                 }
 878                 if (sval_cmp(rl_min(right_orig), rl_max(right_orig)) == 0)
 879                         left_false = remove_range(left_orig, rl_min(right_orig), rl_min(right_orig));
 880
 881                 if (!sval_is_max(rl_max(left_orig)))
 882                         right_true = remove_range(right_true, add_one(rl_max(left_orig)), max);
 883                 if (!sval_is_min(rl_min(left_orig)))
 884                         right_true = remove_range(right_true, min, sub_one(rl_min(left_orig)));
 885                 if (sval_cmp(rl_min(left_orig), rl_max(left_orig)) == 0)
 886                         right_false = remove_range(right_orig, rl_min(left_orig), rl_min(left_orig));
 887                 break;
 888         case SPECIAL_UNSIGNED_GTE:
 889         case SPECIAL_GTE:
 890                 if (!sval_is_min(rl_min(right_orig)))
 891                         left_true = remove_range(left_orig, min, sub_one(rl_min(right_orig)));
 892                 left_false = remove_range(left_orig, rl_max(right_orig), max);
 893
 894                 if (!sval_is_max(rl_max(left_orig)))
 895                         right_true = remove_range(right_orig, add_one(rl_max(left_orig)), max);
 896                 right_false = remove_range(right_orig, min, rl_min(left_orig));
 897
 898                 if (sval_cmp(rl_min(left_orig), rl_min(right_orig)) == 0)
 899                         right_false = remove_range(right_false, rl_min(left_orig), rl_min(left_orig));
 900                 if (sval_cmp(rl_max(left_orig), rl_max(right_orig)) == 0)
 901                         left_false = remove_range(left_false, rl_max(left_orig), rl_max(left_orig));
 902                 break;
 903         case '>':
 904         case SPECIAL_UNSIGNED_GT:
 905                 left_true = remove_range(left_orig, min, rl_min(right_orig));
 906                 if (!sval_is_max(rl_max(right_orig)))
 907                         left_false = remove_range(left_orig, add_one(rl_max(right_orig)), max);
 908
 909                 right_true = remove_range(right_orig, rl_max(left_orig), max);
 910                 if (!sval_is_min(rl_min(left_orig)))
 911                         right_false = remove_range(right_orig, min, sub_one(rl_min(left_orig)));
 912                 break;
 913         case SPECIAL_NOTEQUAL:
 914                 if (!sval_is_max(rl_max(right_orig)))
 915                         left_false = remove_range(left_false, add_one(rl_max(right_orig)), max);
 916                 if (!sval_is_min(rl_min(right_orig)))
 917                         left_false = remove_range(left_false, min, sub_one(rl_min(right_orig)));
 918                 if (sval_cmp(rl_min(right_orig), rl_max(right_orig)) == 0)
 919                         left_true = remove_range(left_orig, rl_min(right_orig), rl_min(right_orig));
 920
 921                 if (!sval_is_max(rl_max(left_orig)))
 922                         right_false = remove_range(right_false, add_one(rl_max(left_orig)), max);
 923                 if (!sval_is_min(rl_min(left_orig)))
 924                         right_false = remove_range(right_false, min, sub_one(rl_min(left_orig)));
 925                 if (sval_cmp(rl_min(left_orig), rl_max(left_orig)) == 0)
 926                         right_true = remove_range(right_orig, rl_min(left_orig), rl_min(left_orig));
 927                 break;
 928         default:
 929                 return;
 930         }
 931
 932         left_true = rl_truncate_cast(get_type(left), left_true);
 933         left_false = rl_truncate_cast(get_type(left), left_false);
 934         right_true = rl_truncate_cast(get_type(right), right_true);
 935         right_false = rl_truncate_cast(get_type(right), right_false);
 936
 937         left_true_state = alloc_estate_rl(left_true);
 938         left_false_state = alloc_estate_rl(left_false);
 939         right_true_state = alloc_estate_rl(right_true);
 940         right_false_state = alloc_estate_rl(right_false);
 941
 942         switch (op) {
 943         case '<':
 944         case SPECIAL_UNSIGNED_LT:
 945         case SPECIAL_UNSIGNED_LTE:
 946         case SPECIAL_LTE:
 947                 if (get_hard_max(right, &dummy))
 948                         estate_set_hard_max(left_true_state);
 949                 if (get_hard_max(left, &dummy))
 950                         estate_set_hard_max(right_false_state);
 951                 break;
 952         case '>':
 953         case SPECIAL_UNSIGNED_GT:
 954         case SPECIAL_UNSIGNED_GTE:
 955         case SPECIAL_GTE:
 956                 if (get_hard_max(left, &dummy))
 957                         estate_set_hard_max(right_true_state);
 958                 if (get_hard_max(right, &dummy))
 959                         estate_set_hard_max(left_false_state);
 960                 break;
 961         }
 962
 963         if (get_hard_max(left, &dummy)) {
 964                 estate_set_hard_max(left_true_state);
 965                 estate_set_hard_max(left_false_state);
 966         }
 967         if (get_hard_max(right, &dummy)) {
 968                 estate_set_hard_max(right_true_state);
 969                 estate_set_hard_max(right_false_state);
 970         }
 971
 972         if (left_postop == SPECIAL_INCREMENT) {
 973                 left_true_state = increment_state(left_true_state);
 974                 left_false_state = increment_state(left_false_state);
 975         }
 976         if (left_postop == SPECIAL_DECREMENT) {
 977                 left_true_state = decrement_state(left_true_state);
 978                 left_false_state = decrement_state(left_false_state);
 979         }
 980         if (right_postop == SPECIAL_INCREMENT) {
 981                 right_true_state = increment_state(right_true_state);
 982                 right_false_state = increment_state(right_false_state);
 983         }
 984         if (right_postop == SPECIAL_DECREMENT) {
 985                 right_true_state = decrement_state(right_true_state);
 986                 right_false_state = decrement_state(right_false_state);
 987         }
 988
 989         set_extra_expr_true_false(left, left_true_state, left_false_state);
 990         set_extra_expr_true_false(right, right_true_state, right_false_state);
 991 }
 992
 993 static int opposite_op(int op)
 994 {
 995         switch (op) {
 996         case '+':
 997                 return '-';
 998         case '-':
 999                 return '+';
1000         }
1001         return 0;
1002 }
1003
1004 static int is_simple_math(struct expression *expr)
1005 {
1006         if (!expr)
1007                 return 0;
1008         if (expr->type != EXPR_BINOP)
1009                 return 0;
1010         if (!opposite_op(expr->op))
1011                 return 0;
1012         return 1;
1013 }
1014
1015 static void move_known_values(struct expression **left_p, struct expression **right_p)
1016 {
1017         struct expression *left = *left_p;
1018         struct expression *right = *right_p;
1019         sval_t sval;
1020
1021         if (get_implied_value(left, &sval)) {
1022                 if (!is_simple_math(right))
1023                         return;
1024                 if (right->op == '+' && get_value(right->left, &sval)) {
1025                         *left_p = binop_expression(left, opposite_op(right->op), right->left);
1026                         *right_p = right->right;
1027                         return;
1028                 }
1029                 if (get_value(right->right, &sval)) {
1030                         *left_p = binop_expression(left, opposite_op(right->op), right->right);
1031                         *right_p = right->left;
1032                         return;
1033                 }
1034                 return;
1035         }
1036         if (get_implied_value(right, &sval)) {
1037                 if (!is_simple_math(left))
1038                         return;
1039                 if (left->op == '+' && get_value(left->left, &sval)) {
1040                         *right_p = binop_expression(right, opposite_op(left->op), left->left);
1041                         *left_p = left->right;
1042                         return;
1043                 }
1044
1045                 if (get_value(left->right, &sval)) {
1046                         *right_p = binop_expression(right, opposite_op(left->op), left->right);
1047                         *left_p = left->left;
1048                         return;
1049                 }
1050                 return;
1051         }
1052 }
1053
1054 static int match_func_comparison(struct expression *expr)
1055 {
1056         struct expression *left = strip_expr(expr->left);
1057         struct expression *right = strip_expr(expr->right);
1058         sval_t sval;
1059
1060         /*
1061          * fixme: think about this harder. We should always be trying to limit
1062          * the non-call side as well.  If we can't determine the limitter does
1063          * that mean we aren't querying the database and are missing important
1064          * information?
1065          */
1066
1067         if (left->type == EXPR_CALL) {
1068                 if (get_implied_value(left, &sval)) {
1069                         handle_comparison(get_type(expr), left, expr->op, right);
1070                         return 1;
1071                 }
1072                 if (!get_implied_value(right, &sval))
1073                         return 1;
1074                 function_comparison(expr->op, left, sval, 1);
1075                 return 1;
1076         }
1077
1078         if (right->type == EXPR_CALL) {
1079                 if (get_implied_value(right, &sval)) {
1080                         handle_comparison(get_type(expr), left, expr->op, right);
1081                         return 1;
1082                 }
1083                 if (!get_implied_value(left, &sval))
1084                         return 1;
1085                 function_comparison(expr->op, right, sval, 0);
1086                 return 1;
1087         }
1088
1089         return 0;
1090 }
1091
1092 static void match_comparison(struct expression *expr)
1093 {
1094         struct expression *left_orig = strip_expr(expr->left);
1095         struct expression *right_orig = strip_expr(expr->right);
1096         struct expression *left, *right;
1097         struct expression *prev;
1098         struct symbol *type;
1099
1100         if (match_func_comparison(expr))
1101                 return;
1102
1103         type = get_type(expr);
1104         if (!type)
1105                 type = &llong_ctype;
1106
1107         left = left_orig;
1108         right = right_orig;
1109         move_known_values(&left, &right);
1110         handle_comparison(type, left, expr->op, right);
1111
1112         prev = get_assigned_expr(left_orig);
1113         if (is_simple_math(prev) && has_variable(prev, left_orig) == 0) {
1114                 left = prev;
1115                 right = right_orig;
1116                 move_known_values(&left, &right);
1117                 handle_comparison(type, left, expr->op, right);
1118         }
1119
1120         prev = get_assigned_expr(right_orig);
1121         if (is_simple_math(prev) && has_variable(prev, right_orig) == 0) {
1122                 left = left_orig;
1123                 right = prev;
1124                 move_known_values(&left, &right);
1125                 handle_comparison(type, left, expr->op, right);
1126         }
1127 }
1128
1129 static void handle_AND_condition(struct expression *expr)
1130 {
1131         struct range_list *rl = NULL;
1132         sval_t known;
1133
1134         if (get_implied_value(expr->left, &known) && known.value > 0) {
1135                 known.value--;
1136                 get_absolute_rl(expr->right, &rl);
1137                 rl = remove_range(rl, sval_type_val(known.type, 0), known);
1138                 set_extra_expr_true_false(expr->right, alloc_estate_rl(rl), NULL);
1139                 return;
1140         }
1141
1142         if (get_implied_value(expr->right, &known) && known.value > 0) {
1143                 known.value--;
1144                 get_absolute_rl(expr->left, &rl);
1145                 rl = remove_range(rl, sval_type_val(known.type, 0), known);
1146                 set_extra_expr_true_false(expr->left, alloc_estate_rl(rl), NULL);
1147                 return;
1148         }
1149 }
1150
1151 /* this is actually hooked from smatch_implied.c...  it's hacky, yes */
1152 void __extra_match_condition(struct expression *expr)
1153 {
1154         struct symbol *sym;
1155         char *name;
1156         struct smatch_state *pre_state;
1157         struct smatch_state *true_state;
1158         struct smatch_state *false_state;
1159
1160         expr = strip_expr(expr);
1161         switch (expr->type) {
1162         case EXPR_CALL:
1163                 function_comparison(SPECIAL_NOTEQUAL, expr, ll_to_sval(0), 1);
1164                 return;
1165         case EXPR_PREOP:
1166         case EXPR_SYMBOL:
1167         case EXPR_DEREF: {
1168                 sval_t zero;
1169
1170                 zero = sval_blank(expr);
1171                 zero.value = 0;
1172
1173                 name = expr_to_var_sym(expr, &sym);
1174                 if (!name)
1175                         return;
1176                 pre_state = get_state(my_id, name, sym);
1177                 true_state = estate_filter_sval(pre_state, zero);
1178                 if (possibly_true(expr, SPECIAL_EQUAL, zero_expr()))
1179                         false_state = alloc_estate_sval(zero);
1180                 else
1181                         false_state = alloc_estate_empty();
1182                 set_extra_true_false(name, sym, true_state, false_state);
1183                 free_string(name);
1184                 return;
1185         }
1186         case EXPR_COMPARE:
1187                 match_comparison(expr);
1188                 return;
1189         case EXPR_ASSIGNMENT:
1190                 __extra_match_condition(expr->left);
1191                 return;
1192         case EXPR_BINOP:
1193                 if (expr->op == '&')
1194                         handle_AND_condition(expr);
1195                 return;
1196         }
1197 }
1198
1199 /* returns 1 if it is not possible for expr to be value, otherwise returns 0 */
1200 int implied_not_equal(struct expression *expr, long long val)
1201 {
1202         return !possibly_false(expr, SPECIAL_NOTEQUAL, value_expr(val));
1203 }
1204
1205 static void struct_member_callback(struct expression *call, int param, char *printed_name, struct smatch_state *state)
1206 {
1207         if (estate_is_whole(state))
1208                 return;
1209         sql_insert_caller_info(call, PARAM_VALUE, param, printed_name, state->name);
1210 }
1211
1212 static void db_limited_before(void)
1213 {
1214         unmatched_slist = clone_slist(__get_cur_slist());
1215 }
1216
1217 static void db_limited_after(void)
1218 {
1219         free_slist(&unmatched_slist);
1220 }
1221
1222 static void db_param_limit_filter(struct expression *expr, int param, char *key, char *value, int mod)
1223 {
1224         struct expression *arg;
1225         char *name;
1226         struct symbol *sym;
1227         struct sm_state *sm;
1228         struct symbol *type;
1229         struct range_list *rl;
1230         struct range_list *limit;
1231         struct range_list *new;
1232
1233         while (expr->type == EXPR_ASSIGNMENT)
1234                 expr = strip_expr(expr->right);
1235         if (expr->type != EXPR_CALL)
1236                 return;
1237
1238         arg = get_argument_from_call_expr(expr->args, param);
1239         if (!arg)
1240                 return;
1241
1242         name = get_variable_from_key(arg, key, &sym);
1243         if (!name || !sym)
1244                 goto free;
1245
1246         sm = get_sm_state(SMATCH_EXTRA, name, sym);
1247         type = get_member_type_from_key(arg, key);
1248         if (sm)
1249                 rl = estate_rl(sm->state);
1250         else
1251                 rl = alloc_whole_rl(type);
1252
1253         call_results_to_rl(expr, type, value, &limit);
1254         new = rl_intersection(rl, limit);
1255
1256         /* We want to preserve the implications here */
1257         if (sm && rl_equiv(estate_rl(sm->state), new)) {
1258                 __set_sm(sm);
1259         } else {
1260                 if (mod)
1261                         set_extra_mod(name, sym, alloc_estate_rl(new));
1262                 else
1263                         set_extra_nomod(name, sym, alloc_estate_rl(new));
1264         }
1265
1266 free:
1267         free_string(name);
1268 }
1269
1270 static void db_param_limit(struct expression *expr, int param, char *key, char *value)
1271 {
1272         db_param_limit_filter(expr, param, key, value, 0);
1273 }
1274
1275 static void db_param_filter(struct expression *expr, int param, char *key, char *value)
1276 {
1277         db_param_limit_filter(expr, param, key, value, 1);
1278 }
1279
1280 static void db_param_add(struct expression *expr, int param, char *key, char *value)
1281 {
1282         struct expression *arg;
1283         char *name;
1284         struct symbol *sym;
1285         struct symbol *type;
1286         struct smatch_state *state;
1287         struct range_list *added = NULL;
1288         struct range_list *new;
1289
1290         while (expr->type == EXPR_ASSIGNMENT)
1291                 expr = strip_expr(expr->right);
1292         if (expr->type != EXPR_CALL)
1293                 return;
1294
1295         arg = get_argument_from_call_expr(expr->args, param);
1296         if (!arg)
1297                 return;
1298         name = get_variable_from_key(arg, key, &sym);
1299         if (!name || !sym)
1300                 goto free;
1301
1302         type = get_member_type_from_key(arg, key);
1303         state = get_state(SMATCH_EXTRA, name, sym);
1304         if (state) {
1305                 call_results_to_rl(expr, type, value, &added);
1306                 new = rl_union(estate_rl(state), added);
1307         } else {
1308                 new = alloc_whole_rl(type);
1309         }
1310
1311         set_extra_mod(name, sym, alloc_estate_rl(new));
1312 free:
1313         free_string(name);
1314 }
1315
1316 static void db_returned_member_info(struct expression *expr, int param, char *key, char *value)
1317 {
1318         struct symbol *type;
1319         struct symbol *sym;
1320         char *name;
1321         struct range_list *rl;
1322
1323         if (expr->type != EXPR_ASSIGNMENT)
1324                 return;
1325
1326         name = return_state_to_var_sym(expr, param, key, &sym);
1327         if (!name || !sym)
1328                 goto free;
1329         type = get_member_type_from_key(expr->left, key);
1330         if (!type)
1331                 return;
1332         call_results_to_rl(expr->right, type, value, &rl);
1333         set_extra_mod(name, sym, alloc_estate_rl(rl));
1334
1335 free:
1336         free_string(name);
1337 }
1338
1339 static void returned_member_callback(int return_id, char *return_ranges, char *printed_name, struct smatch_state *state)
1340 {
1341         if (estate_is_whole(state))
1342                 return;
1343
1344         /* these are handled in smatch_param_filter/set/limit.c */
1345         if (printed_name[0] != '*' &&
1346             !strchr(printed_name, '.') && !strchr(printed_name, '-'))
1347                 return;
1348
1349         sql_insert_return_states(return_id, return_ranges, RETURN_VALUE, -1,
1350                         printed_name, state->name);
1351 }
1352
1353 static void match_call_info(struct expression *expr)
1354 {
1355         struct range_list *rl = NULL;
1356         struct expression *arg;
1357         struct symbol *type;
1358         int i = 0;
1359
1360         FOR_EACH_PTR(expr->args, arg) {
1361                 type = get_arg_type(expr->fn, i);
1362
1363                 if (get_implied_rl(arg, &rl))
1364                         rl = cast_rl(type, rl);
1365                 else
1366                         rl = cast_rl(type, alloc_whole_rl(get_type(arg)));
1367
1368                 sql_insert_caller_info(expr, PARAM_VALUE, i, "$$", show_rl(rl));
1369                 i++;
1370         } END_FOR_EACH_PTR(arg);
1371 }
1372
1373 static void set_param_value(const char *name, struct symbol *sym, char *key, char *value)
1374 {
1375         struct range_list *rl = NULL;
1376         struct smatch_state *state;
1377         struct symbol *type;
1378         char fullname[256];
1379
1380         if (strcmp(key, "*$$") == 0)
1381                 snprintf(fullname, sizeof(fullname), "*%s", name);
1382         else if (strncmp(key, "$$", 2) == 0)
1383                 snprintf(fullname, 256, "%s%s", name, key + 2);
1384         else
1385                 return;
1386
1387         type = get_member_type_from_key(symbol_expression(sym), key);
1388         str_to_rl(type, value, &rl);
1389         state = alloc_estate_rl(rl);
1390         set_state(SMATCH_EXTRA, fullname, sym, state);
1391 }
1392
1393 void register_smatch_extra(int id)
1394 {
1395         my_id = id;
1396
1397         add_merge_hook(my_id, &merge_estates);
1398         add_unmatched_state_hook(my_id, &unmatched_state);
1399         add_hook(&match_function_def, FUNC_DEF_HOOK);
1400         add_hook(&match_declarations, DECLARATION_HOOK);
1401         select_caller_info_hook(set_param_value, PARAM_VALUE);
1402         select_return_states_hook(RETURN_VALUE, &db_returned_member_info);
1403         select_return_states_before(&db_limited_before);
1404         select_return_states_hook(LIMITED_VALUE, &db_param_limit);
1405         select_return_states_hook(FILTER_VALUE, &db_param_filter);
1406         select_return_states_hook(ADDED_VALUE, &db_param_add);
1407         select_return_states_after(&db_limited_after);
1408 }
1409
1410 void register_smatch_extra_late(int id)
1411 {
1412         add_hook(&match_dereferences, DEREF_HOOK);
1413         add_hook(&match_pointer_as_array, OP_HOOK);
1414         select_call_implies_hook(DEREFERENCE, &set_param_dereferenced);
1415         add_hook(&match_function_call, FUNCTION_CALL_HOOK);
1416         add_hook(&match_assign, ASSIGNMENT_HOOK);
1417         add_hook(&unop_expr, OP_HOOK);
1418         add_hook(&asm_expr, ASM_HOOK);
1419
1420         add_hook(&match_call_info, FUNCTION_CALL_HOOK);
1421         add_member_info_callback(my_id, struct_member_callback);
1422         add_returned_member_callback(my_id, returned_member_callback);
1423 }