一些函数有一个指针参数,指向结果的来源
调用函数应该被存储,但函数也要求
调用函数时,此指针指向用作输入值的某个值
(例如输入/输出参数)。
我想检测这样的函数被调用指向未初始化变量的情况。
Coccinelle 应该能够做到这一点,但是我很难做到这一点。
示例目标代码:
#include <string.h>
#include <stdio.h>
static void cartoon_random_generator(int *n)
{
switch (*n) {
case 4:
*n = 4; /* http://xkcd.com/221/ */
break;
case 9:
*n = 9; /* http://dilbert.com/strips/comic/2001-10-25/ */
break;
default:
fprintf(stderr, "*n was not initialized before calling this function\n");
break;
}
}
/* alternative links http://i.stack.imgur.com/VvTef.png and http://i.stack.imgur.com/u0iJ7.gif */
static void test(const char *cartoon)
{
// not ok, missing
{
int n1;
cartoon_random_generator(&n1);
printf("Random number = %d\n", n1);
}
// ok, declaration
{
int n2 = 4;
cartoon_random_generator(&n2);
printf("Random number = %d\n", n2);
}
// ok, statement
{
int n3;
n3 = 9;
cartoon_random_generator(&n3);
printf("Random number = %d\n", n3);
}
// both ok and not ok
{
int n4, n9;
n9 = 9;
//strcmp(cartoon, "XKCD") == 0 ? cartoon_random_generator(&n4) : cartoon_random_generator(&n9);
if (strcmp(cartoon, "XKCD") == 0)
cartoon_random_generator(&n4);
else
cartoon_random_generator(&n9);
printf("Random numbers = %d, %d\n", n4, n9);
}
}
我写了以下 coccinelle 脚本
/* It is an error to call cartoon_random_generator with an uninitialized
variable. Detect this. */
/*
* This rule matches an OK case where the in variable is initialized when
* declared. No action is performed for this rule other than giving p1 a value.
*/
@rule1@
position p1;
expression init_expression;
identifier n;
@@
int n = init_expression;
...
cartoon_random_generator@p1(&n)
/*
* This rule matches an OK case where the in variable is initialized in a
* separate statement. No action is performed for this rule other than
* giving p2 a value.
*/
@rule2@
position p2;
expression init_expression;
identifier n;
@@
int n;
...
n = init_expression;
...
cartoon_random_generator@p2(&n)
/* If neither rule1 or rule2 have matched so far,
* we have a variable that is uninitialized. */
@rule3@
position p3 != rule1.p1, rule2.p2;
identifier n;
@@
int n;
...
* cartoon_random_generator@p3(&n)
但没有考虑 rule2,我不明白为什么。运行它给出:
$ /opt/coccinelle/bin/spatch -sp_file cartoon_random.cocci cartoon_random.c
init_defs_builtins: /opt/coccinelle/share/coccinelle/standard.h
warning: rule3: inherited metavariable p2 not used in the -, +, or context code
HANDLING: cartoon_random.c
diff =
--- cartoon_random.c
+++ /tmp/cocci-output-7916-8df75b-cartoon_random.c
@@ -23,7 +23,6 @@ static void test(const char *cartoon)
{
int n1;
- cartoon_random_generator(&n1);
printf("Random number = %d\n", n1);
}
@@ -40,7 +39,6 @@ static void test(const char *cartoon)
int n3;
n3 = 9;
- cartoon_random_generator(&n3);
printf("Random number = %d\n", n3);
}
@@ -51,9 +49,7 @@ static void test(const char *cartoon)
n9 = 9;
//strcmp(cartoon, "XKCD") == 0 ? cartoon_random_generator(&n4) : cartoon_random_generator(&n9);
if (strcmp(cartoon, "XKCD") == 0)
- cartoon_random_generator(&n4);
else
- cartoon_random_generator(&n9);
printf("Random numbers = %d, %d\n", n4, n9);
}
}
最佳答案
我是 Coccinelle 用法的完全初学者,并且一直想了解它。您提出的问题是检测未初始化变量的一个相当好的要求,这让我进行了一些研究。在做了一些研究(并从 warning: rule3: inherited metavariable p2 not used in the -, +, or context code
获得线索)后,使您的 coccinelle 脚本工作的一种方法(可能有其他/更好的方法)是结合规则 1 和 2 并仅对元变量使用单一继承最终规则。这些线路上的东西:
@rule1@
position p1;
expression init_expression;
identifier n;
@@
(
int n = init_expression;
|
int n;
...
n = init_expression;
)
...
cartoon_random_generator@p1(&n)
@rule2@
position p2 != rule1.p1;
identifier n;
@@
int n;
...
* cartoon_random_generator@p2(&n)
在这种情况下看到的输出是:
$spatch -sp_file cartoon_random.cocci cartoon_random.c
init_defs_builtins: /usr/share/coccinelle/standard.h
HANDLING: cartoon_random.c
diff =
--- cartoon_random.c
+++ /tmp/cocci-output-7916-8df75b-cartoon_random.c
@@ -23,7 +23,6 @@ static void test(const char *cartoon)
{
int n1;
- cartoon_random_generator(&n1);
printf("Random number = %d\n", n1);
}
@@ -51,9 +50,6 @@ static void test(const char *cartoon)
n9 = 9;
//strcmp(cartoon, "XKCD") == 0 ? cartoon_random_generator(&n4) : cartoon_random_generator(&n9);
if (strcmp(cartoon, "XKCD") == 0)
- cartoon_random_generator(&n4);
else
cartoon_random_generator(&n9);
printf("Random numbers = %d, %d\n", n4, n9);
这是在 FC15 上使用从 Fedora 存储库安装的 coccinelle 软件包运行的。
希望这可以帮助!
关于c - 检测传递指向未初始化变量的指针,我们在Stack Overflow上找到一个类似的问题:https://stackoverflow.com/questions/7685898/