search

nimble-code / Cobra

An interactive (fast) static source code analyzer
139 stars 31 forks source link

How to match any expression in two locations? #9

Closed TomMD closed 3 years ago

TomMD commented 3 years ago

Motivated by a use of memset() ; free() in linux-pam, I made a cobra pattern to detect these instances (which should use memset_s):

    cobra --cpp -pat '{ .* memset ( x:@ident , .* , .* ) .* free ( .*:x ) .* }

Sadly this does not work. The x identifier isn't usually an x at all but something like a->b->x or a->b->c->x etc. I've worked around the issue by allowing more false positives:

cobra --cpp -pat '{ .* memset ( .*x:@ident , .* , .* ) .* free ( .*:x ) .* }

That is, we now will complain about memset(a->x, 0, N); free(b->x);. Is there a more general match I should be using than ident which makes something akin to the first attempt work?

nimble-code commented 3 years ago

it's a good issue -- you can only bind a variable name to a token, not to a token sequence like a->b->x, which is what you want here. i don't see a better solution that what you tried here either.

by the way: the -- prefix (as in --cpp) passes arguments to an optional backend, which isn't used here which means that the argument is ignored. (use -cpp to enable preprocessing instead)