1/* Modeling API uses and misuses via state machines.
2 Copyright (C) 2019-2024 Free Software Foundation, Inc.
3 Contributed by David Malcolm <dmalcolm@redhat.com>.
4
5This file is part of GCC.
6
7GCC is free software; you can redistribute it and/or modify it
8under the terms of the GNU General Public License as published by
9the Free Software Foundation; either version 3, or (at your option)
10any later version.
11
12GCC is distributed in the hope that it will be useful, but
13WITHOUT ANY WARRANTY; without even the implied warranty of
14MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
15General Public License for more details.
16
17You should have received a copy of the GNU General Public License
18along with GCC; see the file COPYING3. If not see
19<http://www.gnu.org/licenses/>. */
20
21#include "config.h"
22#define INCLUDE_MEMORY
23#include "system.h"
24#include "coretypes.h"
25#include "tree.h"
26#include "function.h"
27#include "basic-block.h"
28#include "gimple.h"
29#include "options.h"
30#include "function.h"
31#include "diagnostic-core.h"
32#include "pretty-print.h"
33#include "diagnostic.h"
34#include "tree-diagnostic.h"
35#include "analyzer/analyzer.h"
36#include "analyzer/analyzer-logging.h"
37#include "analyzer/sm.h"
38#include "analyzer/call-string.h"
39#include "analyzer/program-point.h"
40#include "analyzer/store.h"
41#include "analyzer/svalue.h"
42#include "analyzer/program-state.h"
43#include "analyzer/pending-diagnostic.h"
44
45#if ENABLE_ANALYZER
46
47namespace ana {
48
49/* Return true if VAR has pointer or reference type. */
50
51bool
52any_pointer_p (tree var)
53{
54 return POINTER_TYPE_P (TREE_TYPE (var));
55}
56
57/* Return true if SVAL has pointer or reference type. */
58
59bool
60any_pointer_p (const svalue *sval)
61{
62 if (!sval->get_type ())
63 return false;
64 return POINTER_TYPE_P (sval->get_type ());
65}
66
67/* class state_machine::state. */
68
69/* Base implementation of dump_to_pp vfunc. */
70
71void
72state_machine::state::dump_to_pp (pretty_printer *pp) const
73{
74 pp_string (pp, m_name);
75}
76
77/* Return a new json::string describing the state. */
78
79json::value *
80state_machine::state::to_json () const
81{
82 pretty_printer pp;
83 pp_format_decoder (&pp) = default_tree_printer;
84 dump_to_pp (pp: &pp);
85 return new json::string (pp_formatted_text (&pp));
86}
87
88/* class state_machine. */
89
90/* state_machine's ctor. */
91
92state_machine::state_machine (const char *name, logger *logger)
93: log_user (logger), m_name (name), m_next_state_id (0),
94 m_start (add_state (name: "start"))
95{
96}
97
98/* Add a state with name NAME to this state_machine.
99 The string is required to outlive the state_machine.
100
101 Return the state_t for the new state. */
102
103state_machine::state_t
104state_machine::add_state (const char *name)
105{
106 state *s = new state (name, alloc_state_id ());
107 m_states.safe_push (obj: s);
108 return s;
109}
110
111/* Get the state with name NAME, which must exist.
112 This is purely intended for use in selftests. */
113
114state_machine::state_t
115state_machine::get_state_by_name (const char *name) const
116{
117 unsigned i;
118 state *s;
119 FOR_EACH_VEC_ELT (m_states, i, s)
120 if (!strcmp (s1: name, s2: s->get_name ()))
121 return s;
122 /* Name not found. */
123 gcc_unreachable ();
124}
125
126/* Base implementation of state_machine::on_leak. */
127
128std::unique_ptr<pending_diagnostic>
129state_machine::on_leak (tree var ATTRIBUTE_UNUSED) const
130{
131 return NULL;
132}
133
134/* Dump a multiline representation of this state machine to PP. */
135
136void
137state_machine::dump_to_pp (pretty_printer *pp) const
138{
139 unsigned i;
140 state *s;
141 FOR_EACH_VEC_ELT (m_states, i, s)
142 {
143 pp_printf (pp, " state %i: ", i);
144 s->dump_to_pp (pp);
145 pp_newline (pp);
146 }
147}
148
149/* Return a new json::object of the form
150 {"name" : str,
151 "states" : [str]}. */
152
153json::object *
154state_machine::to_json () const
155{
156 json::object *sm_obj = new json::object ();
157
158 sm_obj->set (key: "name", v: new json::string (m_name));
159 {
160 json::array *states_arr = new json::array ();
161 unsigned i;
162 state *s;
163 FOR_EACH_VEC_ELT (m_states, i, s)
164 states_arr->append (v: s->to_json ());
165 sm_obj->set (key: "states", v: states_arr);
166 }
167
168 return sm_obj;
169}
170
171/* class sm_context. */
172
173const region_model *
174sm_context::get_old_region_model () const
175{
176 if (const program_state *old_state = get_old_program_state ())
177 return old_state->m_region_model;
178 else
179 return NULL;
180}
181
182/* Create instances of the various state machines, each using LOGGER,
183 and populate OUT with them. */
184
185void
186make_checkers (auto_delete_vec <state_machine> &out, logger *logger)
187{
188 out.safe_push (obj: make_malloc_state_machine (logger));
189 out.safe_push (obj: make_fileptr_state_machine (logger));
190 out.safe_push (obj: make_fd_state_machine (logger));
191 out.safe_push (obj: make_taint_state_machine (logger));
192 out.safe_push (obj: make_sensitive_state_machine (logger));
193 out.safe_push (obj: make_signal_state_machine (logger));
194 out.safe_push (obj: make_va_list_state_machine (logger));
195
196 /* We only attempt to run the pattern tests if it might have been manually
197 enabled (for DejaGnu purposes). */
198 if (flag_analyzer_checker)
199 out.safe_push (obj: make_pattern_test_state_machine (logger));
200
201 if (flag_analyzer_checker)
202 {
203 unsigned read_index, write_index;
204 state_machine **sm;
205
206 /* TODO: this leaks the machines
207 Would be nice to log the things that were removed. */
208 VEC_ORDERED_REMOVE_IF (out, read_index, write_index, sm,
209 0 != strcmp (flag_analyzer_checker,
210 (*sm)->get_name ()));
211 }
212}
213
214} // namespace ana
215
216#endif /* #if ENABLE_ANALYZER */
217

source code of gcc/analyzer/sm.cc