linux-kernel - Re: [PATCH] coccinelle: misc: add array_size_dup script to detect missed overlow checks

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <202006171103.327F86B1C@keescook>
Date:   Wed, 17 Jun 2020 11:15:05 -0700
From:   Kees Cook <keescook@...omium.org>
To:     Julia Lawall <Julia.Lawall@...6.fr>
Cc:     cocci@...teme.lip6.fr, linux-kernel@...r.kernel.org,
        Denis Efremov <efremov@...ux.com>,
        "Gustavo A. R. Silva" <garsilva@...eddedor.com>
Subject: Re: [PATCH] coccinelle: misc: add array_size_dup script to detect
 missed overlow checks

On Mon, Jun 15, 2020 at 01:20:45PM +0300, Denis Efremov wrote:
> +@as@
> +expression E1, E2;
> +@@
> +
> +array_size(E1, E2)

BTW, is there a way yet in Coccinelle to match a fully qualified (?)
identifier? For example, if I have two lines in C:

A)
	array_size(variable, 5);
B)
	array_size(instance->member.size, 5);
C)
	array_size(instance->member.size + 1, 5);
D)
	array_size(function_call(variable), 5);


This matches A, B, C, and D:

@@
expression ARG1;
expression ARG2;
@@

array_size(ARG1, ARG2);


This matches only A:

@@
identifier ARG1;
expression ARG2;
@@

array_size(ARG1, ARG2);


How do I get something to match A and B but not C and D (i.e. I do not
want to match any operations, function calls, etc, only a variable,
which may be identified through dereference, array index, or struct
member access.)


-- 
Kees Cook