/*
 * Copyright (C) 2014 Oracle.
 *
 * This program is free software; you can redistribute it and/or
 * modify it under the terms of the GNU General Public License
 * as published by the Free Software Foundation; either version 2
 * of the License, or (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program; if not, see http://www.gnu.org/copyleft/gpl.txt
 */

/*
 * Looks for integers that we get from the user which can be attacked
 * with an integer overflow.
 *
 */

#include "smatch.h"
#include "smatch_slist.h"

static int my_id;

static void match_condition(struct expression *expr)
{
	struct expression *left, *right;
	struct symbol *type;
	char *right_name;
	char *left_name;

	if (expr->type != EXPR_COMPARE)
		return;
	if (expr->op != '<')
		return;

	type = get_type(expr);
	if (!type_signed(type))
		return;

	left = strip_expr(expr->left);
	right = strip_expr(expr->right);

	if (left->type != EXPR_BINOP) {
		left = get_assigned_expr(left);
		left = strip_expr(left);
		if (!left || left->type != EXPR_BINOP)
			return;
	}

	if (left->op != '+' && left->op != '*' && left->op != SPECIAL_LEFTSHIFT)
		return;

	if (has_variable(left, right) == 1) {
		left_name = expr_to_str(left);
		right_name = expr_to_str(right);
		sm_warning("signed overflow undefined. '%s %s %s'", left_name, show_special(expr->op), right_name);
		free_string(left_name);
		free_string(right_name);
	}
}

static void match_binop(struct expression *expr)
{
	sval_t left_val, right_min;
	char *str;

	if (expr->op != '-')
		return;

	if (!get_value(expr->left, &left_val))
		return;

	switch (left_val.uvalue) {
	case SHRT_MAX:
	case USHRT_MAX:
	case INT_MAX:
	case UINT_MAX:
	case LLONG_MAX:
	case ULLONG_MAX:
		break;
	default:
		return;
	}

	get_absolute_min(expr->right, &right_min);
	if (!sval_is_negative(right_min))
		return;

	str = expr_to_str(expr);
	sm_warning("potential negative subtraction from max '%s'", str);
	free_string(str);
}

void check_signed_integer_overflow_check(int id)
{
	my_id = id;

	if (option_project == PROJ_KERNEL) {
		/* The kernel uses -fno-strict-overflow so it's fine */
		return;
	}

	add_hook(&match_condition, CONDITION_HOOK);
	add_hook(&match_binop, BINOP_HOOK);
}