check_cast_assign.c

/*
 * Copyright (C) 2012 Oracle.
 *
 * This program is free software; you can redistribute it and/or
 * modify it under the terms of the GNU General Public License
 * as published by the Free Software Foundation; either version 2
 * of the License, or (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program; if not, see http://www.gnu.org/copyleft/gpl.txt
 */

#include "smatch.h"
#include "smatch_extra.h"
#include "smatch_slist.h"

static int my_id;

static struct symbol *get_cast_type(struct expression *expr)
{
	if (!expr || expr->type != EXPR_PREOP || expr->op != '*')
		return NULL;
	expr = strip_parens(expr->unop);
	if (expr->type != EXPR_CAST)
		return NULL;
	return get_pointer_type(expr);
}

static void match_overflow(struct expression *expr)
{
	struct expression *ptr;
	struct symbol *type;
	int cast_size;
	int data_size;

	type = get_cast_type(expr->left);
	if (!type)
		return;
	cast_size = type_bytes(type);

	ptr = strip_expr(expr->left->unop);
	data_size = get_array_size_bytes_min(ptr);
	if (data_size <= 0)
		return;
	if (data_size >= cast_size)
		return;
	sm_warning("potential memory corrupting cast %d vs %d bytes",
	       cast_size, data_size);
}

void check_cast_assign(int id)
{
	my_id = id;
	add_hook(&match_overflow, ASSIGNMENT_HOOK);
}