1 // SPDX-License-Identifier: GPL-2.0-only 2 /// 3 /// Check for array_size(), array3_size(), struct_size() duplicates. 4 /// These patterns are detected: 5 /// 1. An opencoded expression is used before array_size() to compute the same size 6 /// 2. An opencoded expression is used after array_size() to compute the same size 7 /// From security point of view only first case is relevant. These functions 8 /// perform arithmetic overflow check. Thus, if we use an opencoded expression 9 /// before a call to the *_size() function we can miss an overflow. 10 /// 11 // Confidence: High 12 // Copyright: (C) 2020 Denis Efremov ISPRAS 13 // Options: --no-includes --include-headers --no-loops 14 15 virtual context 16 virtual report 17 virtual org 18 19 @as@ 20 expression E1, E2; 21 @@ 22 23 array_size(E1, E2) 24 25 @as_next@ 26 expression subE1 <= as.E1; 27 expression subE2 <= as.E2; 28 expression as.E1, as.E2, E3; 29 assignment operator aop; 30 position p1, p2; 31 @@ 32 33 * E1 * E2@p1 34 ... when != \(subE1\|subE2\) aop E3 35 when != &\(subE1\|subE2\) 36 * array_size(E1, E2)@p2 37 38 @script:python depends on report@ 39 p1 << as_next.p1; 40 p2 << as_next.p2; 41 @@ 42 43 msg = "WARNING: array_size is used later (line %s) to compute the same size" % (p2[0].line) 44 coccilib.report.print_report(p1[0], msg) 45 46 @script:python depends on org@ 47 p1 << as_next.p1; 48 p2 << as_next.p2; 49 @@ 50 51 msg = "WARNING: array_size is used later (line %s) to compute the same size" % (p2[0].line) 52 coccilib.org.print_todo(p1[0], msg) 53 54 @as_prev@ 55 expression subE1 <= as.E1; 56 expression subE2 <= as.E2; 57 expression as.E1, as.E2, E3; 58 assignment operator aop; 59 position p1, p2; 60 @@ 61 62 * array_size(E1, E2)@p1 63 ... when != \(subE1\|subE2\) aop E3 64 when != &\(subE1\|subE2\) 65 * E1 * E2@p2 66 67 @script:python depends on report@ 68 p1 << as_prev.p1; 69 p2 << as_prev.p2; 70 @@ 71 72 msg = "WARNING: array_size is already used (line %s) to compute the same size" % (p1[0].line) 73 coccilib.report.print_report(p2[0], msg) 74 75 @script:python depends on org@ 76 p1 << as_prev.p1; 77 p2 << as_prev.p2; 78 @@ 79 80 msg = "WARNING: array_size is already used (line %s) to compute the same size" % (p1[0].line) 81 coccilib.org.print_todo(p2[0], msg) 82 83 @as3@ 84 expression E1, E2, E3; 85 @@ 86 87 array3_size(E1, E2, E3) 88 89 @as3_next@ 90 expression subE1 <= as3.E1; 91 expression subE2 <= as3.E2; 92 expression subE3 <= as3.E3; 93 expression as3.E1, as3.E2, as3.E3, E4; 94 assignment operator aop; 95 position p1, p2; 96 @@ 97 98 * E1 * E2 * E3@p1 99 ... when != \(subE1\|subE2\|subE3\) aop E4 100 when != &\(subE1\|subE2\|subE3\) 101 * array3_size(E1, E2, E3)@p2 102 103 @script:python depends on report@ 104 p1 << as3_next.p1; 105 p2 << as3_next.p2; 106 @@ 107 108 msg = "WARNING: array3_size is used later (line %s) to compute the same size" % (p2[0].line) 109 coccilib.report.print_report(p1[0], msg) 110 111 @script:python depends on org@ 112 p1 << as3_next.p1; 113 p2 << as3_next.p2; 114 @@ 115 116 msg = "WARNING: array3_size is used later (line %s) to compute the same size" % (p2[0].line) 117 coccilib.org.print_todo(p1[0], msg) 118 119 @as3_prev@ 120 expression subE1 <= as3.E1; 121 expression subE2 <= as3.E2; 122 expression subE3 <= as3.E3; 123 expression as3.E1, as3.E2, as3.E3, E4; 124 assignment operator aop; 125 position p1, p2; 126 @@ 127 128 * array3_size(E1, E2, E3)@p1 129 ... when != \(subE1\|subE2\|subE3\) aop E4 130 when != &\(subE1\|subE2\|subE3\) 131 * E1 * E2 * E3@p2 132 133 @script:python depends on report@ 134 p1 << as3_prev.p1; 135 p2 << as3_prev.p2; 136 @@ 137 138 msg = "WARNING: array3_size is already used (line %s) to compute the same size" % (p1[0].line) 139 coccilib.report.print_report(p2[0], msg) 140 141 @script:python depends on org@ 142 p1 << as3_prev.p1; 143 p2 << as3_prev.p2; 144 @@ 145 146 msg = "WARNING: array3_size is already used (line %s) to compute the same size" % (p1[0].line) 147 coccilib.org.print_todo(p2[0], msg) 148 149 @ss@ 150 expression E1, E2, E3; 151 @@ 152 153 struct_size(E1, E2, E3) 154 155 @ss_next@ 156 expression subE3 <= ss.E3; 157 expression ss.E1, ss.E2, ss.E3, E4; 158 assignment operator aop; 159 position p1, p2; 160 @@ 161 162 * E1 * E2 + E3@p1 163 ... when != subE3 aop E4 164 when != &subE3 165 * struct_size(E1, E2, E3)@p2 166 167 @script:python depends on report@ 168 p1 << ss_next.p1; 169 p2 << ss_next.p2; 170 @@ 171 172 msg = "WARNING: struct_size is used later (line %s) to compute the same size" % (p2[0].line) 173 coccilib.report.print_report(p1[0], msg) 174 175 @script:python depends on org@ 176 p1 << ss_next.p1; 177 p2 << ss_next.p2; 178 @@ 179 180 msg = "WARNING: struct_size is used later (line %s) to compute the same size" % (p2[0].line) 181 coccilib.org.print_todo(p1[0], msg) 182 183 @ss_prev@ 184 expression subE3 <= ss.E3; 185 expression ss.E1, ss.E2, ss.E3, E4; 186 assignment operator aop; 187 position p1, p2; 188 @@ 189 190 * struct_size(E1, E2, E3)@p1 191 ... when != subE3 aop E4 192 when != &subE3 193 * E1 * E2 + E3@p2 194 195 @script:python depends on report@ 196 p1 << ss_prev.p1; 197 p2 << ss_prev.p2; 198 @@ 199 200 msg = "WARNING: struct_size is already used (line %s) to compute the same size" % (p1[0].line) 201 coccilib.report.print_report(p2[0], msg) 202 203 @script:python depends on org@ 204 p1 << ss_prev.p1; 205 p2 << ss_prev.p2; 206 @@ 207 208 msg = "WARNING: struct_size is already used (line %s) to compute the same size" % (p1[0].line) 209 coccilib.org.print_todo(p2[0], msg)
Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.