qapi script: add event support
[qemu.git] / scripts / coverity-model.c
1 /* Coverity Scan model
2 *
3 * Copyright (C) 2014 Red Hat, Inc.
4 *
5 * Authors:
6 * Markus Armbruster <armbru@redhat.com>
7 * Paolo Bonzini <pbonzini@redhat.com>
8 *
9 * This work is licensed under the terms of the GNU GPL, version 2 or, at your
10 * option, any later version. See the COPYING file in the top-level directory.
11 */
12
13
14 /*
15 * This is the source code for our Coverity user model file. The
16 * purpose of user models is to increase scanning accuracy by explaining
17 * code Coverity can't see (out of tree libraries) or doesn't
18 * sufficiently understand. Better accuracy means both fewer false
19 * positives and more true defects. Memory leaks in particular.
20 *
21 * - A model file can't import any header files. Some built-in primitives are
22 * available but not wchar_t, NULL etc.
23 * - Modeling doesn't need full structs and typedefs. Rudimentary structs
24 * and similar types are sufficient.
25 * - An uninitialized local variable signifies that the variable could be
26 * any value.
27 *
28 * The model file must be uploaded by an admin in the analysis settings of
29 * http://scan.coverity.com/projects/378
30 */
31
32 #define NULL ((void *)0)
33
34 typedef unsigned char uint8_t;
35 typedef char int8_t;
36 typedef unsigned int uint32_t;
37 typedef int int32_t;
38 typedef long ssize_t;
39 typedef unsigned long long uint64_t;
40 typedef long long int64_t;
41 typedef _Bool bool;
42
43 /* exec.c */
44
45 typedef struct AddressSpace AddressSpace;
46 typedef uint64_t hwaddr;
47
48 static void __write(uint8_t *buf, ssize_t len)
49 {
50 int first, last;
51 __coverity_negative_sink__(len);
52 if (len == 0) return;
53 buf[0] = first;
54 buf[len-1] = last;
55 __coverity_writeall__(buf);
56 }
57
58 static void __read(uint8_t *buf, ssize_t len)
59 {
60 __coverity_negative_sink__(len);
61 if (len == 0) return;
62 int first = buf[0];
63 int last = buf[len-1];
64 }
65
66 bool address_space_rw(AddressSpace *as, hwaddr addr, uint8_t *buf,
67 int len, bool is_write)
68 {
69 bool result;
70
71 // TODO: investigate impact of treating reads as producing
72 // tainted data, with __coverity_tainted_data_argument__(buf).
73 if (is_write) __write(buf, len); else __read(buf, len);
74
75 return result;
76 }
77
78 /* Tainting */
79
80 typedef struct {} name2keysym_t;
81 static int get_keysym(const name2keysym_t *table,
82 const char *name)
83 {
84 int result;
85 if (result > 0) {
86 __coverity_tainted_string_sanitize_content__(name);
87 return result;
88 } else {
89 return 0;
90 }
91 }
92
93 /* glib memory allocation functions.
94 *
95 * Note that we ignore the fact that g_malloc of 0 bytes returns NULL,
96 * and g_realloc of 0 bytes frees the pointer.
97 *
98 * Modeling this would result in Coverity flagging a lot of memory
99 * allocations as potentially returning NULL, and asking us to check
100 * whether the result of the allocation is NULL or not. However, the
101 * resulting pointer should never be dereferenced anyway, and in fact
102 * it is not in the vast majority of cases.
103 *
104 * If a dereference did happen, this would suppress a defect report
105 * for an actual null pointer dereference. But it's too unlikely to
106 * be worth wading through the false positives, and with some luck
107 * we'll get a buffer overflow reported anyway.
108 */
109
110 void *malloc(size_t);
111 void *calloc(size_t, size_t);
112 void *realloc(void *, size_t);
113 void free(void *);
114
115 void *
116 g_malloc(size_t n_bytes)
117 {
118 void *mem;
119 __coverity_negative_sink__(n_bytes);
120 mem = malloc(n_bytes == 0 ? 1 : n_bytes);
121 if (!mem) __coverity_panic__();
122 return mem;
123 }
124
125 void *
126 g_malloc0(size_t n_bytes)
127 {
128 void *mem;
129 __coverity_negative_sink__(n_bytes);
130 mem = calloc(1, n_bytes == 0 ? 1 : n_bytes);
131 if (!mem) __coverity_panic__();
132 return mem;
133 }
134
135 void g_free(void *mem)
136 {
137 free(mem);
138 }
139
140 void *g_realloc(void * mem, size_t n_bytes)
141 {
142 __coverity_negative_sink__(n_bytes);
143 mem = realloc(mem, n_bytes == 0 ? 1 : n_bytes);
144 if (!mem) __coverity_panic__();
145 return mem;
146 }
147
148 void *g_try_malloc(size_t n_bytes)
149 {
150 __coverity_negative_sink__(n_bytes);
151 return malloc(n_bytes == 0 ? 1 : n_bytes);
152 }
153
154 void *g_try_malloc0(size_t n_bytes)
155 {
156 __coverity_negative_sink__(n_bytes);
157 return calloc(1, n_bytes == 0 ? 1 : n_bytes);
158 }
159
160 void *g_try_realloc(void *mem, size_t n_bytes)
161 {
162 __coverity_negative_sink__(n_bytes);
163 return realloc(mem, n_bytes == 0 ? 1 : n_bytes);
164 }
165
166 /* Other glib functions */
167
168 typedef struct _GIOChannel GIOChannel;
169 GIOChannel *g_io_channel_unix_new(int fd)
170 {
171 GIOChannel *c = g_malloc0(sizeof(GIOChannel));
172 __coverity_escape__(fd);
173 return c;
174 }
175
176 void g_assertion_message_expr(const char *domain,
177 const char *file,
178 int line,
179 const char *func,
180 const char *expr)
181 {
182 __coverity_panic__();
183 }