1*1f5207b7SJohn Levon /*
2*1f5207b7SJohn Levon * Copyright (C) 2012 Oracle.
3*1f5207b7SJohn Levon *
4*1f5207b7SJohn Levon * This program is free software; you can redistribute it and/or
5*1f5207b7SJohn Levon * modify it under the terms of the GNU General Public License
6*1f5207b7SJohn Levon * as published by the Free Software Foundation; either version 2
7*1f5207b7SJohn Levon * of the License, or (at your option) any later version.
8*1f5207b7SJohn Levon *
9*1f5207b7SJohn Levon * This program is distributed in the hope that it will be useful,
10*1f5207b7SJohn Levon * but WITHOUT ANY WARRANTY; without even the implied warranty of
11*1f5207b7SJohn Levon * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12*1f5207b7SJohn Levon * GNU General Public License for more details.
13*1f5207b7SJohn Levon *
14*1f5207b7SJohn Levon * You should have received a copy of the GNU General Public License
15*1f5207b7SJohn Levon * along with this program; if not, see http://www.gnu.org/copyleft/gpl.txt
16*1f5207b7SJohn Levon */
17*1f5207b7SJohn Levon
18*1f5207b7SJohn Levon #include "smatch.h"
19*1f5207b7SJohn Levon
20*1f5207b7SJohn Levon static int my_id;
21*1f5207b7SJohn Levon
22*1f5207b7SJohn Levon STATE(size_in_bytes);
23*1f5207b7SJohn Levon
set_undefined(struct sm_state * sm,struct expression * mod_expr)24*1f5207b7SJohn Levon static void set_undefined(struct sm_state *sm, struct expression *mod_expr)
25*1f5207b7SJohn Levon {
26*1f5207b7SJohn Levon if (sm->state == &size_in_bytes)
27*1f5207b7SJohn Levon set_state(my_id, sm->name, sm->sym, &undefined);
28*1f5207b7SJohn Levon }
29*1f5207b7SJohn Levon
is_sizeof(struct expression * expr)30*1f5207b7SJohn Levon static int is_sizeof(struct expression *expr)
31*1f5207b7SJohn Levon {
32*1f5207b7SJohn Levon return (expr->type == EXPR_SIZEOF);
33*1f5207b7SJohn Levon }
34*1f5207b7SJohn Levon
is_macro(struct expression * expr,const char * macro_name)35*1f5207b7SJohn Levon static int is_macro(struct expression *expr, const char *macro_name)
36*1f5207b7SJohn Levon {
37*1f5207b7SJohn Levon char *name;
38*1f5207b7SJohn Levon struct expression *outside_expr;
39*1f5207b7SJohn Levon
40*1f5207b7SJohn Levon /* check that we aren't inside the macro itself */
41*1f5207b7SJohn Levon outside_expr = last_ptr_list((struct ptr_list *)big_expression_stack);
42*1f5207b7SJohn Levon if (outside_expr && positions_eq(expr->pos, outside_expr->pos))
43*1f5207b7SJohn Levon return 0;
44*1f5207b7SJohn Levon
45*1f5207b7SJohn Levon name = get_macro_name(expr->pos);
46*1f5207b7SJohn Levon if (name && strcmp(name, macro_name) == 0)
47*1f5207b7SJohn Levon return 1;
48*1f5207b7SJohn Levon return 0;
49*1f5207b7SJohn Levon }
50*1f5207b7SJohn Levon
is_size_in_bytes(struct expression * expr)51*1f5207b7SJohn Levon static int is_size_in_bytes(struct expression *expr)
52*1f5207b7SJohn Levon {
53*1f5207b7SJohn Levon if (is_sizeof(expr))
54*1f5207b7SJohn Levon return 1;
55*1f5207b7SJohn Levon
56*1f5207b7SJohn Levon if (is_macro(expr, "offsetof"))
57*1f5207b7SJohn Levon return 1;
58*1f5207b7SJohn Levon if (is_macro(expr, "PAGE_SIZE"))
59*1f5207b7SJohn Levon return 1;
60*1f5207b7SJohn Levon
61*1f5207b7SJohn Levon if (get_state_expr(my_id, expr) == &size_in_bytes)
62*1f5207b7SJohn Levon return 1;
63*1f5207b7SJohn Levon
64*1f5207b7SJohn Levon return 0;
65*1f5207b7SJohn Levon }
66*1f5207b7SJohn Levon
match_binop(struct expression * expr)67*1f5207b7SJohn Levon static void match_binop(struct expression *expr)
68*1f5207b7SJohn Levon {
69*1f5207b7SJohn Levon struct symbol *type;
70*1f5207b7SJohn Levon char *name;
71*1f5207b7SJohn Levon int size;
72*1f5207b7SJohn Levon
73*1f5207b7SJohn Levon if (expr->op != '+')
74*1f5207b7SJohn Levon return;
75*1f5207b7SJohn Levon type = get_pointer_type(expr->left);
76*1f5207b7SJohn Levon if (!type)
77*1f5207b7SJohn Levon return;
78*1f5207b7SJohn Levon if (type_bits(type) <= 8) /* ignore void, bool and char pointers*/
79*1f5207b7SJohn Levon return;
80*1f5207b7SJohn Levon if (!is_size_in_bytes(expr->right))
81*1f5207b7SJohn Levon return;
82*1f5207b7SJohn Levon
83*1f5207b7SJohn Levon /* if we know it's within bounds then don't complain */
84*1f5207b7SJohn Levon size = get_array_size(expr->left);
85*1f5207b7SJohn Levon if (size) {
86*1f5207b7SJohn Levon sval_t max;
87*1f5207b7SJohn Levon
88*1f5207b7SJohn Levon get_absolute_max(expr->right, &max);
89*1f5207b7SJohn Levon if (max.uvalue < size)
90*1f5207b7SJohn Levon return;
91*1f5207b7SJohn Levon }
92*1f5207b7SJohn Levon
93*1f5207b7SJohn Levon name = expr_to_str(expr->left);
94*1f5207b7SJohn Levon sm_warning("potential pointer math issue ('%s' is a %d bit pointer)",
95*1f5207b7SJohn Levon name, type_bits(type));
96*1f5207b7SJohn Levon free_string(name);
97*1f5207b7SJohn Levon }
98*1f5207b7SJohn Levon
match_assign(struct expression * expr)99*1f5207b7SJohn Levon static void match_assign(struct expression *expr)
100*1f5207b7SJohn Levon {
101*1f5207b7SJohn Levon if (expr->op != '=')
102*1f5207b7SJohn Levon return;
103*1f5207b7SJohn Levon
104*1f5207b7SJohn Levon if (!is_size_in_bytes(expr->right))
105*1f5207b7SJohn Levon return;
106*1f5207b7SJohn Levon set_state_expr(my_id, expr->left, &size_in_bytes);
107*1f5207b7SJohn Levon }
108*1f5207b7SJohn Levon
check_assign(struct expression * expr)109*1f5207b7SJohn Levon static void check_assign(struct expression *expr)
110*1f5207b7SJohn Levon {
111*1f5207b7SJohn Levon struct symbol *type;
112*1f5207b7SJohn Levon char *name;
113*1f5207b7SJohn Levon
114*1f5207b7SJohn Levon if (expr->op != SPECIAL_ADD_ASSIGN && expr->op != SPECIAL_SUB_ASSIGN)
115*1f5207b7SJohn Levon return;
116*1f5207b7SJohn Levon
117*1f5207b7SJohn Levon type = get_pointer_type(expr->left);
118*1f5207b7SJohn Levon if (!type)
119*1f5207b7SJohn Levon return;
120*1f5207b7SJohn Levon if (type_bits(type) == 8 || type_bits(type) == -1)
121*1f5207b7SJohn Levon return;
122*1f5207b7SJohn Levon if (!is_size_in_bytes(expr->right))
123*1f5207b7SJohn Levon return;
124*1f5207b7SJohn Levon name = expr_to_var(expr->left);
125*1f5207b7SJohn Levon sm_warning("potential pointer math issue ('%s' is a %d bit pointer)",
126*1f5207b7SJohn Levon name, type_bits(type));
127*1f5207b7SJohn Levon free_string(name);
128*1f5207b7SJohn Levon }
129*1f5207b7SJohn Levon
check_pointer_math(int id)130*1f5207b7SJohn Levon void check_pointer_math(int id)
131*1f5207b7SJohn Levon {
132*1f5207b7SJohn Levon my_id = id;
133*1f5207b7SJohn Levon add_hook(&match_binop, BINOP_HOOK);
134*1f5207b7SJohn Levon add_hook(&match_assign, ASSIGNMENT_HOOK);
135*1f5207b7SJohn Levon add_hook(&check_assign, ASSIGNMENT_HOOK);
136*1f5207b7SJohn Levon add_modification_hook(my_id, &set_undefined);
137*1f5207b7SJohn Levon }
138