On Sun, Oct 01, 2023 at 02:22:17PM -0700, Kees Cook wrote:
> On Sun, Oct 01, 2023 at 02:05:46PM -0700, Kees Cook wrote:
> > On Sun, Oct 01, 2023 at 09:14:02PM +0200, Julia Lawall wrote:
> > > Kees,
> > >
> > > You can try the following.
> >
> > Cool! Yeah, this finds the example:
> >
> > drivers/comedi/drivers/rti800.c:74: struct comedi_lrange: field at offset 0
> > is the counter for the flex array
> > drivers/comedi/drivers/rti800.c:83: struct comedi_lrange: field at offset 0
> > is the counter for the flex array
> > drivers/comedi/drivers/rti800.c:92: struct comedi_lrange: field at offset 0
> > is the counter for the flex array
> >
> > I'll run it on the whole codebase...
>
> It found only the struct comedi_lrange instances, but that's good to
> know. :)
On a related note, why doesn't this work?
@allocated@
identifier STRUCT, ARRAY;
expression COUNT;
struct STRUCT *PTR;
identifier ALLOC;
type ELEMENT_TYPE;
@@
PTR = ALLOC(..., sizeof(\(*PTR\|struct STRUCT\)) +
COUNT *
sizeof(\(*PTR->ARRAY\|PTR->ARRAY[0]\|ELEMENT_TYPE\)), ...);
minus: parse error:
File "alloc.cocci", line 15, column 34, charpos = 485
around = 'struct',
whole content = PTR = ALLOC(..., sizeof(\(*PTR\|struct STRUCT\)) +
if I drop "struct", then it complains about ELEMENT_TYPE...
-Kees
--
Kees Cook
