linux-kernel - Re: coccinelle: api: add kzfree script

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Date:   Sat, 6 Jun 2020 08:00:26 +0200
From:   Markus Elfring <Markus.Elfring@....de>
To:     Julia Lawall <julia.lawall@...ia.fr>,
        Denis Efremov <efremov@...ux.com>,
        Coccinelle <cocci@...teme.lip6.fr>
Cc:     linux-kernel@...r.kernel.org, kernel-janitors@...r.kernel.org,
        Joe Perches <joe@...ches.com>
Subject: Re: coccinelle: api: add kzfree script

> Is avoiding transforming the case where E is not verified to be a pointer a concern?

I imagine that answers to this question have got consequences also on
the confidence level for such SmPL scripts.
The desire and requirement to specify data type restrictions (for expressions)
can influence data processing efforts in significant ways.

* If it would be accepted to choose a simpler source code search approach,
  there are corresponding risks to consider.

* If you would like to reduce the general possibility for false positives
  according to advanced software analysis, the amount of data processing
  will increase because information from header files will probably be needed.
  The run time characteristics will become more interesting then.
  Additional program execution parameters will be relevant for this use case.

Regards,
Markus