11f5207bJohn Levon/*
21f5207bJohn Levon * Copyright (C) 2010 Dan Carpenter.
31f5207bJohn Levon *
41f5207bJohn Levon * This program is free software; you can redistribute it and/or
51f5207bJohn Levon * modify it under the terms of the GNU General Public License
61f5207bJohn Levon * as published by the Free Software Foundation; either version 2
71f5207bJohn Levon * of the License, or (at your option) any later version.
81f5207bJohn Levon *
91f5207bJohn Levon * This program is distributed in the hope that it will be useful,
101f5207bJohn Levon * but WITHOUT ANY WARRANTY; without even the implied warranty of
121f5207bJohn Levon * GNU General Public License for more details.
131f5207bJohn Levon *
141f5207bJohn Levon * You should have received a copy of the GNU General Public License
151f5207bJohn Levon * along with this program; if not, see http://www.gnu.org/copyleft/gpl.txt
161f5207bJohn Levon */
171f5207bJohn Levon
181f5207bJohn Levon/*
191f5207bJohn Levon * This is like check_deref_check.c except that it complains about code like:
201f5207bJohn Levon * if (a)
211f5207bJohn Levon *        a->foo = 42;
221f5207bJohn Levon * a->bar = 7;
231f5207bJohn Levon *
241f5207bJohn Levon * Of course, Smatch has complained about these for forever but the problem is
251f5207bJohn Levon * the old scripts were too messy and complicated and generated too many false
261f5207bJohn Levon * positives.
271f5207bJohn Levon *
281f5207bJohn Levon * This check is supposed to be simpler because it only looks for one kind of
291f5207bJohn Levon * null dereference bug instead of every kind.  It also gets rid of the false
301f5207bJohn Levon * positives caused by the checks that happen inside macros.
311f5207bJohn Levon *
321f5207bJohn Levon */
331f5207bJohn Levon
341f5207bJohn Levon#include "smatch.h"
351f5207bJohn Levon#include "smatch_slist.h"
361f5207bJohn Levon#include "smatch_extra.h"
371f5207bJohn Levon
381f5207bJohn Levonstatic int my_id;
391f5207bJohn Levon
401f5207bJohn LevonSTATE(null);
411f5207bJohn LevonSTATE(ok);
421f5207bJohn Levon
431f5207bJohn Levonstatic void is_ok(struct sm_state *sm, struct expression *mod_expr)
441f5207bJohn Levon{
451f5207bJohn Levon	set_state(my_id, sm->name, sm->sym, &ok);
461f5207bJohn Levon}
471f5207bJohn Levon
481f5207bJohn Levonstatic void check_dereference(struct expression *expr)
491f5207bJohn Levon{
501f5207bJohn Levon	struct sm_state *sm;
511f5207bJohn Levon	struct sm_state *tmp;
521f5207bJohn Levon
531f5207bJohn Levon	if (__in_fake_assign)
541f5207bJohn Levon		return;
551f5207bJohn Levon
561f5207bJohn Levon	expr = strip_expr(expr);
571f5207bJohn Levon
581f5207bJohn Levon	sm = get_sm_state_expr(my_id, expr);
591f5207bJohn Levon	if (!sm)
601f5207bJohn Levon		return;
611f5207bJohn Levon	if (is_ignored(my_id, sm->name, sm->sym))
621f5207bJohn Levon		return;
631f5207bJohn Levon	if (implied_not_equal(expr, 0))
641f5207bJohn Levon		return;
651f5207bJohn Levon
661f5207bJohn Levon	FOR_EACH_PTR(sm->possible, tmp) {
671f5207bJohn Levon		if (tmp->state == &merged)
681f5207bJohn Levon			continue;
691f5207bJohn Levon		if (tmp->state == &ok)
701f5207bJohn Levon			continue;
711f5207bJohn Levon		if (tmp->state == &null) {
721f5207bJohn Levon			sm_error("we previously assumed '%s' could be null (see line %d)",
731f5207bJohn Levon			       tmp->name, tmp->line);
741f5207bJohn Levon			add_ignore(my_id, sm->name, sm->sym);
751f5207bJohn Levon			return;
761f5207bJohn Levon		}
771f5207bJohn Levon	} END_FOR_EACH_PTR(tmp);
781f5207bJohn Levon}
791f5207bJohn Levon
801f5207bJohn Levonstatic void check_dereference_name_sym(char *name, struct symbol *sym)
811f5207bJohn Levon{
821f5207bJohn Levon	struct sm_state *sm;
831f5207bJohn Levon	struct sm_state *tmp;
841f5207bJohn Levon
851f5207bJohn Levon	sm = get_sm_state(my_id, name, sym);
861f5207bJohn Levon	if (!sm)
871f5207bJohn Levon		return;
881f5207bJohn Levon	if (is_ignored(my_id, sm->name, sm->sym))
891f5207bJohn Levon		return;
901f5207bJohn Levon	if (implied_not_equal_name_sym(name, sym, 0))
911f5207bJohn Levon		return;
921f5207bJohn Levon
931f5207bJohn Levon	FOR_EACH_PTR(sm->possible, tmp) {
941f5207bJohn Levon		if (tmp->state == &merged)
951f5207bJohn Levon			continue;
961f5207bJohn Levon		if (tmp->state == &ok)
971f5207bJohn Levon			continue;
981f5207bJohn Levon		if (tmp->state == &null) {
991f5207bJohn Levon			sm_error("we previously assumed '%s' could be null (see line %d)",
1001f5207bJohn Levon			       tmp->name, tmp->line);
1011f5207bJohn Levon			add_ignore(my_id, sm->name, sm->sym);
1021f5207bJohn Levon			return;
1031f5207bJohn Levon		}
1041f5207bJohn Levon	} END_FOR_EACH_PTR(tmp);
1051f5207bJohn Levon}
1061f5207bJohn Levon
1071f5207bJohn Levonstatic void match_dereferences(struct expression *expr)
1081f5207bJohn Levon{
1091f5207bJohn Levon	if (expr->type != EXPR_PREOP)
1101f5207bJohn Levon		return;
1111f5207bJohn Levon	check_dereference(expr->unop);
1121f5207bJohn Levon}
1131f5207bJohn Levon
1141f5207bJohn Levonstatic void match_pointer_as_array(struct expression *expr)
1151f5207bJohn Levon{
1161f5207bJohn Levon	if (!is_array(expr))
1171f5207bJohn Levon		return;
1181f5207bJohn Levon	check_dereference(get_array_base(expr));
1191f5207bJohn Levon}
1201f5207bJohn Levon
1211f5207bJohn Levonstatic void set_param_dereferenced(struct expression *call, struct expression *arg, char *key, char *unused)
1221f5207bJohn Levon{
1231f5207bJohn Levon	struct symbol *sym;
1241f5207bJohn Levon	char *name;
1251f5207bJohn Levon
1261f5207bJohn Levon	name = get_variable_from_key(arg, key, &sym);
1271f5207bJohn Levon	if (!name || !sym)
1281f5207bJohn Levon		goto free;
1291f5207bJohn Levon
1301f5207bJohn Levon	check_dereference_name_sym(name, sym);
1311f5207bJohn Levonfree:
1321f5207bJohn Levon	free_string(name);
1331f5207bJohn Levon}
1341f5207bJohn Levon
1351f5207bJohn Levonstatic void match_condition(struct expression *expr)
1361f5207bJohn Levon{
1371f5207bJohn Levon	struct smatch_state *true_state = NULL;
138c85f09cJohn Levon	char *name;
1391f5207bJohn Levon
140c85f09cJohn Levon	name = get_macro_name(expr->pos);
141c85f09cJohn Levon	if (name &&
142c85f09cJohn Levon	    (strcmp(name, "likely") != 0 && strcmp(name, "unlikely") != 0))
1431f5207bJohn Levon		return;
1441f5207bJohn Levon
1451f5207bJohn Levon	if (!is_pointer(expr))
1461f5207bJohn Levon		return;
1471f5207bJohn Levon
1481f5207bJohn Levon	if (expr->type == EXPR_ASSIGNMENT) {
1491f5207bJohn Levon		match_condition(expr->right);
1501f5207bJohn Levon		match_condition(expr->left);
1511f5207bJohn Levon	}
1521f5207bJohn Levon
1531f5207bJohn Levon	if (implied_not_equal(expr, 0))
1541f5207bJohn Levon		return;
1551f5207bJohn Levon
1561f5207bJohn Levon	if (get_state_expr(my_id, expr))
1571f5207bJohn Levon		true_state = &ok;
1581f5207bJohn Levon
1591f5207bJohn Levon	set_true_false_states_expr(my_id, expr, true_state, &null);
1601f5207bJohn Levon}
1611f5207bJohn Levon
1621f5207bJohn Levonvoid check_check_deref(int id)
1631f5207bJohn Levon{
1641f5207bJohn Levon	my_id = id;
1651f5207bJohn Levon
1661f5207bJohn Levon	add_modification_hook(my_id, &is_ok);
1671f5207bJohn Levon	add_hook(&match_dereferences, DEREF_HOOK);
1681f5207bJohn Levon	add_hook(&match_pointer_as_array, OP_HOOK);
1691f5207bJohn Levon	select_return_implies_hook(DEREFERENCE, &set_param_dereferenced);
1701f5207bJohn Levon	add_hook(&match_condition, CONDITION_HOOK);
1711f5207bJohn Levon}