11f5207bJohn Levon/*
21f5207bJohn Levon * Copyright (C) 2012 Oracle.
31f5207bJohn Levon *
41f5207bJohn Levon * This program is free software; you can redistribute it and/or
51f5207bJohn Levon * modify it under the terms of the GNU General Public License
61f5207bJohn Levon * as published by the Free Software Foundation; either version 2
71f5207bJohn Levon * of the License, or (at your option) any later version.
81f5207bJohn Levon *
91f5207bJohn Levon * This program is distributed in the hope that it will be useful,
101f5207bJohn Levon * but WITHOUT ANY WARRANTY; without even the implied warranty of
111f5207bJohn Levon * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
121f5207bJohn Levon * GNU General Public License for more details.
131f5207bJohn Levon *
141f5207bJohn Levon * You should have received a copy of the GNU General Public License
151f5207bJohn Levon * along with this program; if not, see http://www.gnu.org/copyleft/gpl.txt
161f5207bJohn Levon */
171f5207bJohn Levon
181f5207bJohn Levon/*
191f5207bJohn Levon * This is for functions like:
201f5207bJohn Levon *
211f5207bJohn Levon * int foo(int *x)
221f5207bJohn Levon * {
231f5207bJohn Levon * 	if (*x == 42) {
241f5207bJohn Levon *		*x = 0;
251f5207bJohn Levon *		return 1;
261f5207bJohn Levon *	}
271f5207bJohn Levon * 	return 0;
281f5207bJohn Levon * }
291f5207bJohn Levon *
301f5207bJohn Levon * If we return 1 that means the value of *x has been set to 0.  If we return
311f5207bJohn Levon * 0 then we have left *x alone.
321f5207bJohn Levon *
331f5207bJohn Levon */
341f5207bJohn Levon
351f5207bJohn Levon#include "scope.h"
361f5207bJohn Levon#include "smatch.h"
371f5207bJohn Levon#include "smatch_slist.h"
381f5207bJohn Levon#include "smatch_extra.h"
391f5207bJohn Levon
401f5207bJohn Levonstatic int my_id;
411f5207bJohn Levon
421f5207bJohn Levonstatic struct smatch_state *unmatched_state(struct sm_state *sm)
431f5207bJohn Levon{
441f5207bJohn Levon	return alloc_estate_empty();
451f5207bJohn Levon}
461f5207bJohn Levon
471f5207bJohn Levonstatic int parent_is_set(const char *name, struct symbol *sym, struct smatch_state *state)
481f5207bJohn Levon{
491f5207bJohn Levon	struct expression *faked;
501f5207bJohn Levon	char *left_name;
511f5207bJohn Levon	int ret = 0;
521f5207bJohn Levon	int len;
531f5207bJohn Levon
541f5207bJohn Levon	if (!__in_fake_assign)
551f5207bJohn Levon		return 0;
561f5207bJohn Levon	if (!is_whole_rl(estate_rl(state)))
571f5207bJohn Levon		return 0;
581f5207bJohn Levon	if (get_state(my_id, name, sym))
591f5207bJohn Levon		return 0;
601f5207bJohn Levon
611f5207bJohn Levon	faked = get_faked_expression();
621f5207bJohn Levon	if (!faked)
631f5207bJohn Levon		return 0;
641f5207bJohn Levon	if ((faked->type == EXPR_PREOP || faked->type == EXPR_POSTOP) &&
651f5207bJohn Levon	    (faked->op == SPECIAL_INCREMENT || faked->op == SPECIAL_DECREMENT)) {
661f5207bJohn Levon		faked = strip_expr(faked->unop);
671f5207bJohn Levon		if (faked->type == EXPR_SYMBOL)
681f5207bJohn Levon			return 1;
691f5207bJohn Levon		return 0;
701f5207bJohn Levon	}
711f5207bJohn Levon	if (faked->type != EXPR_ASSIGNMENT)
721f5207bJohn Levon		return 0;
731f5207bJohn Levon
741f5207bJohn Levon	left_name = expr_to_var(faked->left);
751f5207bJohn Levon	if (!left_name)
761f5207bJohn Levon		return 0;
771f5207bJohn Levon
781f5207bJohn Levon	len = strlen(left_name);
791f5207bJohn Levon	if (strncmp(name, left_name, len) == 0 && name[len] == '-')
801f5207bJohn Levon		ret = 1;
811f5207bJohn Levon	free_string(left_name);
821f5207bJohn Levon
831f5207bJohn Levon	return ret;
841f5207bJohn Levon}
851f5207bJohn Levon
861f5207bJohn Levonstatic void extra_mod_hook(const char *name, struct symbol *sym, struct expression *expr, struct smatch_state *state)
871f5207bJohn Levon{
881f5207bJohn Levon	if (parent_is_set(name, sym, state))
891f5207bJohn Levon		return;
901f5207bJohn Levon	if (get_param_num_from_sym(sym) < 0)
911f5207bJohn Levon		return;
921f5207bJohn Levon	set_state(my_id, name, sym, state);
931f5207bJohn Levon}
941f5207bJohn Levon
951f5207bJohn Levon/*
961f5207bJohn Levon * This function is is a dirty hack because extra_mod_hook is giving us a NULL
971f5207bJohn Levon *  sym instead of a vsl.
981f5207bJohn Levon */
991f5207bJohn Levonstatic void match_array_assignment(struct expression *expr)
1001f5207bJohn Levon{
1011f5207bJohn Levon	struct expression *array, *offset;
1021f5207bJohn Levon	char *name;
1031f5207bJohn Levon	struct symbol *sym;
1041f5207bJohn Levon	struct range_list *rl;
1051f5207bJohn Levon	sval_t sval;
1061f5207bJohn Levon	char buf[256];
1071f5207bJohn Levon
1081f5207bJohn Levon	if (__in_fake_assign)
1091f5207bJohn Levon		return;
1101f5207bJohn Levon
1111f5207bJohn Levon	if (!is_array(expr->left))
1121f5207bJohn Levon		return;
1131f5207bJohn Levon	array = get_array_base(expr->left);
1141f5207bJohn Levon	offset = get_array_offset(expr->left);
1151f5207bJohn Levon
1161f5207bJohn Levon	/* These are handled by extra_mod_hook() */
1171f5207bJohn Levon	if (get_value(offset, &sval))
1181f5207bJohn Levon		return;
1191f5207bJohn Levon	name = expr_to_var_sym(array, &sym);
1201f5207bJohn Levon	if (!name || !sym)
1211f5207bJohn Levon		goto free;
1221f5207bJohn Levon	if (get_param_num_from_sym(sym) < 0)
1231f5207bJohn Levon		goto free;
1241f5207bJohn Levon	get_absolute_rl(expr->right, &rl);
1251f5207bJohn Levon	rl = cast_rl(get_type(expr->left), rl);
1261f5207bJohn Levon
1271f5207bJohn Levon	snprintf(buf, sizeof(buf), "*%s", name);
1281f5207bJohn Levon	set_state(my_id, buf, sym, alloc_estate_rl(rl));
1291f5207bJohn Levonfree:
1301f5207bJohn Levon	free_string(name);
1311f5207bJohn Levon}
1321f5207bJohn Levon
133c85f09cJohn Levonstatic char *get_two_dots(const char *name)
134c85f09cJohn Levon{
135c85f09cJohn Levon	static char buf[80];
136c85f09cJohn Levon	int i, cnt = 0;
137c85f09cJohn Levon
138c85f09cJohn Levon	for (i = 0; i < sizeof(buf); i++) {
139c85f09cJohn Levon		if (name[i] == '.') {
140c85f09cJohn Levon			cnt++;
141c85f09cJohn Levon			if (cnt >= 2) {
142c85f09cJohn Levon				buf[i] = '\0';
143c85f09cJohn Levon				return buf;
144c85f09cJohn Levon			}
145c85f09cJohn Levon		}
146c85f09cJohn Levon		buf[i] = name[i];
147c85f09cJohn Levon	}
148c85f09cJohn Levon	return NULL;
149c85f09cJohn Levon}
150c85f09cJohn Levon
1511f5207bJohn Levon/*
1521f5207bJohn Levon * This relies on the fact that these states are stored so that
1531f5207bJohn Levon * foo->bar is before foo->bar->baz.
1541f5207bJohn Levon */
1551f5207bJohn Levonstatic int parent_set(struct string_list *list, const char *name)
1561f5207bJohn Levon{
1571f5207bJohn Levon	char *tmp;
1581f5207bJohn Levon	int len;
1591f5207bJohn Levon	int ret;
1601f5207bJohn Levon
1611f5207bJohn Levon	FOR_EACH_PTR(list, tmp) {
1621f5207bJohn Levon		len = strlen(tmp);
1631f5207bJohn Levon		ret = strncmp(tmp, name, len);
1641f5207bJohn Levon		if (ret < 0)
1651f5207bJohn Levon			continue;
1661f5207bJohn Levon		if (ret > 0)
1671f5207bJohn Levon			return 0;
1681f5207bJohn Levon		if (name[len] == '-')
1691f5207bJohn Levon			return 1;
1701f5207bJohn Levon	} END_FOR_EACH_PTR(tmp);
1711f5207bJohn Levon
1721f5207bJohn Levon	return 0;
1731f5207bJohn Levon}
1741f5207bJohn Levon
175c85f09cJohn Levonstatic void print_return_value_param_helper(int return_id, char *return_ranges, struct expression *expr, int limit)
1761f5207bJohn Levon{
1771f5207bJohn Levon	struct sm_state *sm;
1781f5207bJohn Levon	struct smatch_state *extra;
1791f5207bJohn Levon	int param;
1801f5207bJohn Levon	struct range_list *rl;
1811f5207bJohn Levon	const char *param_name;
1821f5207bJohn Levon	struct string_list *set_list = NULL;
1831f5207bJohn Levon	char *math_str;
1841f5207bJohn Levon	char buf[256];
185c85f09cJohn Levon	char two_dot[80] = "";
186c85f09cJohn Levon	int count = 0;
1871f5207bJohn Levon
1881f5207bJohn Levon	FOR_EACH_MY_SM(my_id, __get_cur_stree(), sm) {
1891f5207bJohn Levon		if (!estate_rl(sm->state))
1901f5207bJohn Levon			continue;
191c85f09cJohn Levon		extra = __get_state(SMATCH_EXTRA, sm->name, sm->sym);
1921f5207bJohn Levon		if (extra) {
1931f5207bJohn Levon			rl = rl_intersection(estate_rl(sm->state), estate_rl(extra));
1941f5207bJohn Levon			if (!rl)
1951f5207bJohn Levon				continue;
1961f5207bJohn Levon		} else {
1971f5207bJohn Levon			rl = estate_rl(sm->state);
1981f5207bJohn Levon		}
1991f5207bJohn Levon
2001f5207bJohn Levon		param = get_param_num_from_sym(sm->sym);
2011f5207bJohn Levon		if (param < 0)
2021f5207bJohn Levon			continue;
2031f5207bJohn Levon		param_name = get_param_name(sm);
2041f5207bJohn Levon		if (!param_name)
2051f5207bJohn Levon			continue;
2061f5207bJohn Levon		if (strcmp(param_name, "$") == 0) {
2071f5207bJohn Levon			insert_string(&set_list, (char *)sm->name);
2081f5207bJohn Levon			continue;
2091f5207bJohn Levon		}
210efe51d0John Levon		if (is_recursive_member(param_name)) {
211efe51d0John Levon			insert_string(&set_list, (char *)sm->name);
212efe51d0John Levon			continue;
213efe51d0John Levon		}
2141f5207bJohn Levon
215efe51d0John Levon		if (is_ignored_kernel_data(param_name)) {
2161f5207bJohn Levon			insert_string(&set_list, (char *)sm->name);
2171f5207bJohn Levon			continue;
2181f5207bJohn Levon		}
219c85f09cJohn Levon		if (limit) {
220c85f09cJohn Levon			char *new = get_two_dots(param_name);
221c85f09cJohn Levon
222c85f09cJohn Levon			if (new) {
223c85f09cJohn Levon				if (strcmp(new, two_dot) == 0)
224c85f09cJohn Levon					continue;
225c85f09cJohn Levon				strncpy(two_dot, new, sizeof(two_dot));
226c85f09cJohn Levon				sql_insert_return_states(return_id, return_ranges,
227c85f09cJohn Levon					 PARAM_SET, param, new, "s64min-s64max");
228c85f09cJohn Levon				continue;
229c85f09cJohn Levon			}
230c85f09cJohn Levon		}
2311f5207bJohn Levon
2321f5207bJohn Levon		math_str = get_value_in_terms_of_parameter_math_var_sym(sm->name, sm->sym);
2331f5207bJohn Levon		if (math_str) {
2341f5207bJohn Levon			snprintf(buf, sizeof(buf), "%s[%s]", show_rl(rl), math_str);
2351f5207bJohn Levon			insert_string(&set_list, (char *)sm->name);
2361f5207bJohn Levon			sql_insert_return_states(return_id, return_ranges,
2371f5207bJohn Levon					param_has_filter_data(sm) ? PARAM_ADD : PARAM_SET,
2381f5207bJohn Levon					param, param_name, buf);
2391f5207bJohn Levon			continue;
2401f5207bJohn Levon		}
2411f5207bJohn Levon
2421f5207bJohn Levon		/* no useful information here. */
2431f5207bJohn Levon		if (is_whole_rl(rl) && parent_set(set_list, sm->name))
2441f5207bJohn Levon			continue;
2451f5207bJohn Levon		insert_string(&set_list, (char *)sm->name);
2461f5207bJohn Levon
2471f5207bJohn Levon		sql_insert_return_states(return_id, return_ranges,
2481f5207bJohn Levon					 param_has_filter_data(sm) ? PARAM_ADD : PARAM_SET,
2491f5207bJohn Levon					 param, param_name, show_rl(rl));
250c85f09cJohn Levon		if (limit && ++count > limit)
251c85f09cJohn Levon			break;
2521f5207bJohn Levon
2531f5207bJohn Levon	} END_FOR_EACH_SM(sm);
2541f5207bJohn Levon
2551f5207bJohn Levon	free_ptr_list((struct ptr_list **)&set_list);
2561f5207bJohn Levon}
2571f5207bJohn Levon
258c85f09cJohn Levonstatic void print_return_value_param(int return_id, char *return_ranges, struct expression *expr)
259c85f09cJohn Levon{
260c85f09cJohn Levon	print_return_value_param_helper(return_id, return_ranges, expr, 0);
261c85f09cJohn Levon}
262c85f09cJohn Levon
263c85f09cJohn Levonvoid print_limited_param_set(int return_id, char *return_ranges, struct expression *expr)
264c85f09cJohn Levon{
265c85f09cJohn Levon	print_return_value_param_helper(return_id, return_ranges, expr, 1000);
266c85f09cJohn Levon}
267c85f09cJohn Levon
268c85f09cJohn Levonstatic int possibly_empty(struct sm_state *sm)
269c85f09cJohn Levon{
270c85f09cJohn Levon	struct sm_state *tmp;
271c85f09cJohn Levon
272c85f09cJohn Levon	FOR_EACH_PTR(sm->possible, tmp) {
273c85f09cJohn Levon		if (strcmp(tmp->name, "") == 0)
274c85f09cJohn Levon			return 1;
275c85f09cJohn Levon	} END_FOR_EACH_PTR(tmp);
276c85f09cJohn Levon	return 0;
277c85f09cJohn Levon}
278c85f09cJohn Levon
2791f5207bJohn Levonint param_was_set_var_sym(const char *name, struct symbol *sym)
2801f5207bJohn Levon{
2811f5207bJohn Levon	struct sm_state *sm;
282c85f09cJohn Levon	char buf[80];
283c85f09cJohn Levon	int len, i;
2841f5207bJohn Levon
285c85f09cJohn Levon	if (!name)
286c85f09cJohn Levon		return 0;
287c85f09cJohn Levon
288c85f09cJohn Levon	len = strlen(name);
289c85f09cJohn Levon	if (len >= sizeof(buf))
290c85f09cJohn Levon		len = sizeof(buf) - 1;
291c85f09cJohn Levon
292c85f09cJohn Levon	for (i = 0; i <= len; i++) {
293c85f09cJohn Levon		if (name[i] != '-' && name[i] != '\0')
2941f5207bJohn Levon			continue;
295c85f09cJohn Levon
296c85f09cJohn Levon		memcpy(buf, name, i);
297c85f09cJohn Levon		buf[i] = '\0';
298c85f09cJohn Levon
299c85f09cJohn Levon		sm = get_sm_state(my_id, buf, sym);
300c85f09cJohn Levon		if (!sm)
3011f5207bJohn Levon			continue;
302c85f09cJohn Levon		if (possibly_empty(sm))
303c85f09cJohn Levon			continue;
304c85f09cJohn Levon		return 1;
305c85f09cJohn Levon	}
306c85f09cJohn Levon
307c85f09cJohn Levon	if (name[0] == '*')
308c85f09cJohn Levon		return param_was_set_var_sym(name + 1, sym);
3091f5207bJohn Levon
3101f5207bJohn Levon	return 0;
3111f5207bJohn Levon}
3121f5207bJohn Levon
3131f5207bJohn Levonint param_was_set(struct expression *expr)
3141f5207bJohn Levon{
3151f5207bJohn Levon	char *name;
3161f5207bJohn Levon	struct symbol *sym;
3171f5207bJohn Levon	int ret = 0;
3181f5207bJohn Levon
3191f5207bJohn Levon	name = expr_to_var_sym(expr, &sym);
3201f5207bJohn Levon	if (!name || !sym)
3211f5207bJohn Levon		goto free;
3221f5207bJohn Levon
3231f5207bJohn Levon	ret = param_was_set_var_sym(name, sym);
3241f5207bJohn Levonfree:
3251f5207bJohn Levon	free_string(name);
3261f5207bJohn Levon	return ret;
3271f5207bJohn Levon}
3281f5207bJohn Levon
3291f5207bJohn Levonvoid register_param_set(int id)
3301f5207bJohn Levon{
3311f5207bJohn Levon	my_id = id;
3321f5207bJohn Levon
333efe51d0John Levon	set_dynamic_states(my_id);
3341f5207bJohn Levon	add_extra_mod_hook(&extra_mod_hook);
3351f5207bJohn Levon	add_hook(match_array_assignment, ASSIGNMENT_HOOK);
3361f5207bJohn Levon	add_unmatched_state_hook(my_id, &unmatched_state);
3371f5207bJohn Levon	add_merge_hook(my_id, &merge_estates);
3381f5207bJohn Levon	add_split_return_callback(&print_return_value_param);
3391f5207bJohn Levon}
3401f5207bJohn Levon
341