1*1f5207b7SJohn Levon /* 2*1f5207b7SJohn Levon * Copyright (C) 2009 Dan Carpenter. 3*1f5207b7SJohn Levon * 4*1f5207b7SJohn Levon * This program is free software; you can redistribute it and/or 5*1f5207b7SJohn Levon * modify it under the terms of the GNU General Public License 6*1f5207b7SJohn Levon * as published by the Free Software Foundation; either version 2 7*1f5207b7SJohn Levon * of the License, or (at your option) any later version. 8*1f5207b7SJohn Levon * 9*1f5207b7SJohn Levon * This program is distributed in the hope that it will be useful, 10*1f5207b7SJohn Levon * but WITHOUT ANY WARRANTY; without even the implied warranty of 11*1f5207b7SJohn Levon * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 12*1f5207b7SJohn Levon * GNU General Public License for more details. 13*1f5207b7SJohn Levon * 14*1f5207b7SJohn Levon * You should have received a copy of the GNU General Public License 15*1f5207b7SJohn Levon * along with this program; if not, see http://www.gnu.org/copyleft/gpl.txt 16*1f5207b7SJohn Levon */ 17*1f5207b7SJohn Levon 18*1f5207b7SJohn Levon #include "smatch.h" 19*1f5207b7SJohn Levon #include "smatch_extra.h" 20*1f5207b7SJohn Levon 21*1f5207b7SJohn Levon static int my_id; 22*1f5207b7SJohn Levon 23*1f5207b7SJohn Levon STATE(derefed); 24*1f5207b7SJohn Levon 25*1f5207b7SJohn Levon static void underef(struct sm_state *sm, struct expression *mod_expr) 26*1f5207b7SJohn Levon { 27*1f5207b7SJohn Levon set_state(my_id, sm->name, sm->sym, &undefined); 28*1f5207b7SJohn Levon } 29*1f5207b7SJohn Levon 30*1f5207b7SJohn Levon static void match_dereference(struct expression *expr) 31*1f5207b7SJohn Levon { 32*1f5207b7SJohn Levon if (__in_fake_assign) 33*1f5207b7SJohn Levon return; 34*1f5207b7SJohn Levon 35*1f5207b7SJohn Levon if (expr->type != EXPR_PREOP) 36*1f5207b7SJohn Levon return; 37*1f5207b7SJohn Levon expr = strip_expr(expr->unop); 38*1f5207b7SJohn Levon if (!is_pointer(expr)) 39*1f5207b7SJohn Levon return; 40*1f5207b7SJohn Levon if (implied_not_equal(expr, 0)) 41*1f5207b7SJohn Levon return; 42*1f5207b7SJohn Levon 43*1f5207b7SJohn Levon if (is_impossible_path()) 44*1f5207b7SJohn Levon return; 45*1f5207b7SJohn Levon 46*1f5207b7SJohn Levon set_state_expr(my_id, expr, &derefed); 47*1f5207b7SJohn Levon } 48*1f5207b7SJohn Levon 49*1f5207b7SJohn Levon static void set_param_dereferenced(struct expression *call, struct expression *arg, char *key, char *unused) 50*1f5207b7SJohn Levon { 51*1f5207b7SJohn Levon struct symbol *sym; 52*1f5207b7SJohn Levon char *name; 53*1f5207b7SJohn Levon 54*1f5207b7SJohn Levon name = get_variable_from_key(arg, key, &sym); 55*1f5207b7SJohn Levon if (!name || !sym) 56*1f5207b7SJohn Levon goto free; 57*1f5207b7SJohn Levon 58*1f5207b7SJohn Levon if (implied_not_equal_name_sym(name, sym, 0)) 59*1f5207b7SJohn Levon goto free; 60*1f5207b7SJohn Levon set_state(my_id, name, sym, &derefed); 61*1f5207b7SJohn Levon 62*1f5207b7SJohn Levon free: 63*1f5207b7SJohn Levon free_string(name); 64*1f5207b7SJohn Levon } 65*1f5207b7SJohn Levon 66*1f5207b7SJohn Levon static void match_condition(struct expression *expr) 67*1f5207b7SJohn Levon { 68*1f5207b7SJohn Levon struct sm_state *sm; 69*1f5207b7SJohn Levon 70*1f5207b7SJohn Levon if (__in_pre_condition) 71*1f5207b7SJohn Levon return; 72*1f5207b7SJohn Levon 73*1f5207b7SJohn Levon if (get_macro_name(expr->pos)) 74*1f5207b7SJohn Levon return; 75*1f5207b7SJohn Levon 76*1f5207b7SJohn Levon if (!is_pointer(expr)) 77*1f5207b7SJohn Levon return; 78*1f5207b7SJohn Levon 79*1f5207b7SJohn Levon sm = get_sm_state_expr(my_id, expr); 80*1f5207b7SJohn Levon if (!sm || sm->state != &derefed) 81*1f5207b7SJohn Levon return; 82*1f5207b7SJohn Levon 83*1f5207b7SJohn Levon sm_warning("variable dereferenced before check '%s' (see line %d)", sm->name, sm->line); 84*1f5207b7SJohn Levon set_state_expr(my_id, expr, &undefined); 85*1f5207b7SJohn Levon } 86*1f5207b7SJohn Levon 87*1f5207b7SJohn Levon void check_deref_check(int id) 88*1f5207b7SJohn Levon { 89*1f5207b7SJohn Levon my_id = id; 90*1f5207b7SJohn Levon add_hook(&match_dereference, DEREF_HOOK); 91*1f5207b7SJohn Levon add_hook(&match_condition, CONDITION_HOOK); 92*1f5207b7SJohn Levon select_return_implies_hook(DEREFERENCE, &set_param_dereferenced); 93*1f5207b7SJohn Levon add_modification_hook(my_id, &underef); 94*1f5207b7SJohn Levon } 95