linux-kernel - Re: [PATCH] coccinelle: misc: add array_size_dup script to detect missed overflow checks

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:   Mon, 15 Jun 2020 14:25:20 +0200
From:   Markus Elfring <Markus.Elfring@....de>
To:     Denis Efremov <efremov@...ux.com>,
        Coccinelle <cocci@...teme.lip6.fr>,
        Gilles Muller <Gilles.Muller@...6.fr>,
        Julia Lawall <julia.lawall@...6.fr>,
        Masahiro Yamada <yamada.masahiro@...ionext.com>,
        Michal Marek <michal.lkml@...kovi.net>,
        Nicolas Palix <nicolas.palix@...g.fr>
Cc:     kernel-janitors@...r.kernel.org, linux-kernel@...r.kernel.org,
        Kees Cook <keescook@...omium.org>
Subject: Re: [PATCH] coccinelle: misc: add array_size_dup script to detect
 missed overflow checks

I suggest to avoid a typo in the previous patch subject.


…
> +virtual context
> +virtual report
> +virtual org

+virtual context, report, org

Is such a SmPL code variant more succinct?


…
> +@...next@
> +expression subE1 <= as.E1;
> +expression as.E1;
…

I propose to reduce the repetition of this SmPL key word.


…
> +  ... when != \(E1\|E2\|subE1\|subE2\)=E3
> +      when != \(E1\|E2\|subE1\|subE2\)+=E3
…

Can it make sense to express a constraint for a metavariable of
the type “assignment operator”?


> +      when != \(&E1\|&E2\|&subE1\|&subE2\)

How do you think about to use the following code exclusion specification?

+      when != & \(E1 \| E2 \| subE1 \| subE2\)


…
> +msg = "WARNING: same struct_size (line %s)" % (p1[0].line)
> +coccilib.org.print_todo(p2[0], msg)

I suggest once more to pass the desired message object directly as a function argument
(without using an extra Python variable).

Regards,
Markus