Re: [Cocci] [PATCH] coccinelle: misc: add array_size_dup script to detect missed overlow checks

2020-06-18 Thread Julia Lawall
On Thu, 18 Jun 2020, Kees Cook wrote: > On Thu, Jun 18, 2020 at 09:56:18PM +0200, Julia Lawall wrote: > > @@ > > identifier i,fld; > > expression e; > > @@ > > > > \(\(i\|e.fld\|e->fld\) \& E\) > > > > The e will match all of the variants you are concerned about. > > Ah, I see! Okay, that's

Re: [Cocci] [PATCH] coccinelle: misc: add array_size_dup script to detect missed overlow checks

2020-06-18 Thread Kees Cook
On Thu, Jun 18, 2020 at 09:56:18PM +0200, Julia Lawall wrote: > @@ > identifier i,fld; > expression e; > @@ > > \(\(i\|e.fld\|e->fld\) \& E\) > > The e will match all of the variants you are concerned about. Ah, I see! Okay, that's good. And the "& E" part is to effectively collect it into E

Re: [Cocci] [PATCH] coccinelle: misc: add array_size_dup script to detect missed overlow checks

2020-06-18 Thread Julia Lawall
On Thu, 18 Jun 2020, Kees Cook wrote: > On Wed, Jun 17, 2020 at 08:54:03PM +0200, Julia Lawall wrote: > > > > > > On Wed, 17 Jun 2020, Kees Cook wrote: > > > > > On Mon, Jun 15, 2020 at 01:20:45PM +0300, Denis Efremov wrote: > > > > +@as@ > > > > +expression E1, E2; > > > > +@@ > > > > + > > >

Re: [Cocci] [PATCH] coccinelle: misc: add array_size_dup script to detect missed overlow checks

2020-06-18 Thread Kees Cook
On Wed, Jun 17, 2020 at 08:54:03PM +0200, Julia Lawall wrote: > > > On Wed, 17 Jun 2020, Kees Cook wrote: > > > On Mon, Jun 15, 2020 at 01:20:45PM +0300, Denis Efremov wrote: > > > +@as@ > > > +expression E1, E2; > > > +@@ > > > + > > > +array_size(E1, E2) > > > > BTW, is there a way yet in

Re: [Cocci] [PATCH] coccinelle: misc: add array_size_dup script to detect missed overlow checks

2020-06-17 Thread Julia Lawall
On Wed, 17 Jun 2020, Denis Efremov wrote: > > > On 6/17/20 11:30 PM, Julia Lawall wrote: > > > > > > On Mon, 15 Jun 2020, Denis Efremov wrote: > > > >> Detect an opencoded expression that is used before or after > >> array_size()/array3_size()/struct_size() to compute the same size. > > > >

Re: [Cocci] [PATCH] coccinelle: misc: add array_size_dup script to detect missed overlow checks

2020-06-17 Thread Denis Efremov
On 6/17/20 11:30 PM, Julia Lawall wrote: > > > On Mon, 15 Jun 2020, Denis Efremov wrote: > >> Detect an opencoded expression that is used before or after >> array_size()/array3_size()/struct_size() to compute the same size. > > This would benefit from the assignemnt operator metavariables

Re: [Cocci] [PATCH] coccinelle: misc: add array_size_dup script to detect missed overlow checks

2020-06-17 Thread Julia Lawall
On Mon, 15 Jun 2020, Denis Efremov wrote: > Detect an opencoded expression that is used before or after > array_size()/array3_size()/struct_size() to compute the same size. This would benefit from the assignemnt operator metavariables as well. Also, it could be better to put the python rules

Re: [Cocci] [PATCH] coccinelle: misc: add array_size_dup script to detect missed overlow checks

2020-06-17 Thread Julia Lawall
On Wed, 17 Jun 2020, Julia Lawall wrote: > > > On Wed, 17 Jun 2020, Denis Efremov wrote: > > > > > > > > > Awesome! I'll take a look into this. :) > > > > > Here is another script for your #83 ticket. > > Currently, it issues 598 warnings. > > > > // SPDX-License-Identifier: GPL-2.0-only > >

Re: [Cocci] [PATCH] coccinelle: misc: add array_size_dup script to detect missed overlow checks

2020-06-17 Thread Julia Lawall
On Wed, 17 Jun 2020, Denis Efremov wrote: > > > > > Awesome! I'll take a look into this. :) > > > Here is another script for your #83 ticket. > Currently, it issues 598 warnings. > > // SPDX-License-Identifier: GPL-2.0-only > /// > /// Check for missing overflow checks in allocation functions.

Re: [Cocci] [PATCH] coccinelle: misc: add array_size_dup script to detect missed overlow checks

2020-06-17 Thread Julia Lawall
On Wed, 17 Jun 2020, Kees Cook wrote: > On Mon, Jun 15, 2020 at 01:20:45PM +0300, Denis Efremov wrote: > > +@as@ > > +expression E1, E2; > > +@@ > > + > > +array_size(E1, E2) > > BTW, is there a way yet in Coccinelle to match a fully qualified (?) > identifier? For example, if I have two lines

Re: [Cocci] [PATCH] coccinelle: misc: add array_size_dup script to detect missed overlow checks

2020-06-17 Thread Kees Cook
On Mon, Jun 15, 2020 at 01:20:45PM +0300, Denis Efremov wrote: > +@as@ > +expression E1, E2; > +@@ > + > +array_size(E1, E2) BTW, is there a way yet in Coccinelle to match a fully qualified (?) identifier? For example, if I have two lines in C: A) array_size(variable, 5); B)

Re: [Cocci] [PATCH] coccinelle: misc: add array_size_dup script to detect missed overlow checks

2020-06-17 Thread Denis Efremov
> > Awesome! I'll take a look into this. :) > Here is another script for your #83 ticket. Currently, it issues 598 warnings. // SPDX-License-Identifier: GPL-2.0-only /// /// Check for missing overflow checks in allocation functions. /// Low confidence because it's pointless to check for

Re: [Cocci] [PATCH] coccinelle: misc: add array_size_dup script to detect missed overlow checks

2020-06-17 Thread Denis Efremov
> > > Awesome! I'll take a look into this. :) > It would be helpful to get a feedback from you after. What kind of warnings are helpful and what are not? "duplicate calls" and "opencoded expression after array_size()" look doubtful to me. I think that maintainers will not like these patches.

Re: [Cocci] [PATCH] coccinelle: misc: add array_size_dup script to detect missed overlow checks

2020-06-15 Thread Gustavo A. R. Silva
On 6/15/20 13:35, Denis Efremov wrote: > > > On 6/15/20 9:23 PM, Kees Cook wrote: >> On Mon, Jun 15, 2020 at 01:20:45PM +0300, Denis Efremov wrote: >>> Detect an opencoded expression that is used before or after >>> array_size()/array3_size()/struct_size() to compute the same size. >>> >>>

Re: [Cocci] [PATCH] coccinelle: misc: add array_size_dup script to detect missed overlow checks

2020-06-15 Thread Denis Efremov
On 6/15/20 9:23 PM, Kees Cook wrote: > On Mon, Jun 15, 2020 at 01:20:45PM +0300, Denis Efremov wrote: >> Detect an opencoded expression that is used before or after >> array_size()/array3_size()/struct_size() to compute the same size. >> >> Cc: Kees Cook >> Signed-off-by: Denis Efremov > >

Re: [Cocci] [PATCH] coccinelle: misc: add array_size_dup script to detect missed overlow checks

2020-06-15 Thread Kees Cook
On Mon, Jun 15, 2020 at 01:20:45PM +0300, Denis Efremov wrote: > Detect an opencoded expression that is used before or after > array_size()/array3_size()/struct_size() to compute the same size. > > Cc: Kees Cook > Signed-off-by: Denis Efremov Oh, very cool! How much does this find currently?