Detect an opencoded expression that is used before or after array_size()/array3_size()/struct_size() to compute the same size.
Cc: Gustavo A. R. Silva <garsi...@embeddedor.com> Cc: Kees Cook <keesc...@chromium.org> Signed-off-by: Denis Efremov <efre...@linux.com> --- Changes in v2: - python rules moved next to SmPL patterns - assignment operator used - struct_size patterns fixed to check only E3, since E1, E2 are sizeofs of a structure and a member of a structure Changes in v3: - s/overlow/overflow/ typo fixed (thanks, Markus) - \(&E1\|&E2\) changed to &\(E1\|E2\) - print strings breaks removed scripts/coccinelle/misc/array_size_dup.cocci | 297 +++++++++++++++++++ 1 file changed, 297 insertions(+) create mode 100644 scripts/coccinelle/misc/array_size_dup.cocci diff --git a/scripts/coccinelle/misc/array_size_dup.cocci b/scripts/coccinelle/misc/array_size_dup.cocci new file mode 100644 index 000000000000..d03740257e97 --- /dev/null +++ b/scripts/coccinelle/misc/array_size_dup.cocci @@ -0,0 +1,297 @@ +// SPDX-License-Identifier: GPL-2.0-only +/// +/// Check for array_size(), array3_size(), struct_size() duplicates. +/// Three types of patterns for these functions: +/// 1. An opencoded expression is used before array_size() to compute the same size +/// 2. An opencoded expression is used after array_size() to compute the same size +/// 3. Consecutive calls of array_size() with the same values +/// From security point of view only first case is relevant. These functions +/// perform arithmetic overflow check. Thus, if we use an opencoded expression +/// before a call to the *_size() function we can miss an overflow. +/// +// Confidence: High +// Copyright: (C) 2020 Denis Efremov ISPRAS +// Options: --no-includes --include-headers --no-loops + +virtual context +virtual report +virtual org + +@as@ +expression E1, E2; +@@ + +array_size(E1, E2) + +@as_next@ +expression subE1 <= as.E1; +expression subE2 <= as.E2; +expression as.E1, as.E2, E3; +assignment operator aop; +position p1, p2; +@@ + +* E1 * E2@p1 + ... when != \(E1\|E2\|subE1\|subE2\) aop E3 + when != &\(E1\|E2\|subE1\|subE2\) +* array_size(E1, E2)@p2 + +@script:python depends on report@ +p1 << as_next.p1; +p2 << as_next.p2; +@@ + +coccilib.report.print_report(p1[0], +f"WARNING: array_size is used down the code (line {p2[0].line}) to compute the same size") + +@script:python depends on org@ +p1 << as_next.p1; +p2 << as_next.p2; +@@ + +coccilib.org.print_todo(p1[0], +f"WARNING: array_size is used down the code (line {p2[0].line}) to compute the same size") + +@as_prev@ +expression subE1 <= as.E1; +expression subE2 <= as.E2; +expression as.E1, as.E2, E3; +assignment operator aop; +position p1, p2; +@@ + +* array_size(E1, E2)@p1 + ... when != \(E1\|E2\|subE1\|subE2\) aop E3 + when != &\(E1\|E2\|subE1\|subE2\) +* E1 * E2@p2 + +@script:python depends on report@ +p1 << as_prev.p1; +p2 << as_prev.p2; +@@ + +coccilib.report.print_report(p2[0], +f"WARNING: array_size is already used (line {p1[0].line}) to compute the same size") + +@script:python depends on org@ +p1 << as_prev.p1; +p2 << as_prev.p2; +@@ + +coccilib.org.print_todo(p2[0], +f"WARNING: array_size is already used (line {p1[0].line}) to compute the same size") + +@as_dup@ +expression subE1 <= as.E1; +expression subE2 <= as.E2; +expression as.E1, as.E2, E3; +assignment operator aop; +position p1, p2; +@@ + +* array_size(E1, E2)@p1 + ... when != \(E1\|E2\|subE1\|subE2\) aop E3 + when != &\(E1\|E2\|subE1\|subE2\) +* array_size(E1, E2)@p2 + +@script:python depends on report@ +p1 << as_dup.p1; +p2 << as_dup.p2; +@@ + +coccilib.report.print_report(p2[0], +f"WARNING: same array_size (line {p1[0].line})") + +@script:python depends on org@ +p1 << as_dup.p1; +p2 << as_dup.p2; +@@ + +coccilib.org.print_todo(p2[0], +f"WARNING: same array_size (line {p1[0].line})") + +@as3@ +expression E1, E2, E3; +@@ + +array3_size(E1, E2, E3) + +@as3_next@ +expression subE1 <= as3.E1; +expression subE2 <= as3.E2; +expression subE3 <= as3.E3; +expression as3.E1, as3.E2, as3.E3, E4; +assignment operator aop; +position p1, p2; +@@ + +* E1 * E2 * E3@p1 + ... when != \(E1\|E2\|E3\|subE1\|subE2\|subE3\) aop E4 + when != &\(E1\|E2\|E3\|subE1\|subE2\|subE3\) +* array3_size(E1, E2, E3)@p2 + +@script:python depends on report@ +p1 << as3_next.p1; +p2 << as3_next.p2; +@@ + +coccilib.report.print_report(p1[0], +f"WARNING: array3_size is used down the code (line {p2[0].line}) to compute the same size") + +@script:python depends on org@ +p1 << as3_next.p1; +p2 << as3_next.p2; +@@ + +coccilib.org.print_todo(p1[0], +f"WARNING: array3_size is used down the code (line {p2[0].line}) to compute the same size") + +@as3_prev@ +expression subE1 <= as3.E1; +expression subE2 <= as3.E2; +expression subE3 <= as3.E3; +expression as3.E1, as3.E2, as3.E3, E4; +assignment operator aop; +position p1, p2; +@@ + +* array3_size(E1, E2, E3)@p1 + ... when != \(E1\|E2\|E3\|subE1\|subE2\|subE3\) aop E4 + when != &\(E1\|E2\|E3\|subE1\|subE2\|subE3\) +* E1 * E2 * E3@p2 + +@script:python depends on report@ +p1 << as3_prev.p1; +p2 << as3_prev.p2; +@@ + +coccilib.report.print_report(p2[0], +f"WARNING: array3_size is already used (line {p1[0].line}) to compute the same size") + +@script:python depends on org@ +p1 << as3_prev.p1; +p2 << as3_prev.p2; +@@ + +coccilib.org.print_todo(p2[0], +f"WARNING: array3_size is already used (line {p1[0].line}) to compute the same size") + +@as3_dup@ +expression subE1 <= as3.E1; +expression subE2 <= as3.E2; +expression subE3 <= as3.E3; +expression as3.E1, as3.E2, as3.E3, E4; +assignment operator aop; +position p1, p2; +@@ + +* array3_size(E1, E2, E3)@p1 + ... when != \(E1\|E2\|E3\|subE1\|subE2\|subE3\) aop E4 + when != &\(E1\|E2\|E3\|subE1\|subE2\|subE3\) +* array3_size(E1, E2, E3)@p2 + +@script:python depends on report@ +p1 << as3_dup.p1; +p2 << as3_dup.p2; +@@ + +coccilib.report.print_report(p2[0], +f"WARNING: same array3_size (line {p1[0].line})") + +@script:python depends on org@ +p1 << as3_dup.p1; +p2 << as3_dup.p2; +@@ + +coccilib.org.print_todo(p2[0], +f"WARNING: same array3_size (line {p1[0].line})") + +@ss@ +expression E1, E2, E3; +@@ + +struct_size(E1, E2, E3) + +@ss_next@ +expression subE3 <= ss.E3; +expression ss.E1, ss.E2, ss.E3, E4; +assignment operator aop; +position p1, p2; +@@ + +* E1 * E2 + E3@p1 + ... when != \(E3\|subE3\) aop E4 + when != &\(E3\|subE3\) +* struct_size(E1, E2, E3)@p2 + +@script:python depends on report@ +p1 << ss_next.p1; +p2 << ss_next.p2; +@@ + +coccilib.report.print_report(p1[0], +f"WARNING: struct_size is used down the code (line {p2[0].line}) to compute the same size") + +@script:python depends on org@ +p1 << ss_next.p1; +p2 << ss_next.p2; +@@ + +coccilib.org.print_todo(p1[0], +f"WARNING: struct_size is used down the code (line {p2[0].line}) to compute the same size") + +@ss_prev@ +expression subE3 <= ss.E3; +expression ss.E1, ss.E2, ss.E3, E4; +assignment operator aop; +position p1, p2; +@@ + +* struct_size(E1, E2, E3)@p1 + ... when != \(E3\|subE3\) aop E4 + when != &\(E3\|subE3\) +* E1 * E2 + E3@p2 + +@script:python depends on report@ +p1 << ss_prev.p1; +p2 << ss_prev.p2; +@@ + +coccilib.report.print_report(p2[0], +f"WARNING: struct_size is already used (line {p1[0].line}) to compute the same size") + +@script:python depends on org@ +p1 << ss_prev.p1; +p2 << ss_prev.p2; +@@ + +coccilib.org.print_todo(p2[0], +f"WARNING: struct_size is already used (line {p1[0].line}) to compute the same size") + +@ss_dup@ +expression subE3 <= ss.E3; +expression ss.E1, ss.E2, ss.E3, E4; +assignment operator aop; +position p1, p2; +@@ + +* struct_size(E1, E2, E3)@p1 + ... when != \(E3\|subE3\) aop E4 + when != &\(E3\|subE3\) +* struct_size(E1, E2, E3)@p2 + +@script:python depends on report@ +p1 << ss_dup.p1; +p2 << ss_dup.p2; +@@ + +coccilib.report.print_report(p2[0], +f"WARNING: same struct_size (line {p1[0].line})") + +@script:python depends on org@ +p1 << ss_dup.p1; +p2 << ss_dup.p2; +@@ + +coccilib.org.print_todo(p2[0], +f"WARNING: same struct_size (line {p1[0].line})") -- 2.26.2 _______________________________________________ Cocci mailing list Cocci@systeme.lip6.fr https://systeme.lip6.fr/mailman/listinfo/cocci