From mboxrd@z Thu Jan 1 00:00:00 1970 From: okuznik@symas.com (=?utf-8?B?T25kxZllaiBLdXpuw61r?=) Date: Tue, 4 Jul 2017 17:56:56 +0100 Subject: [Cocci] Matching format strings In-Reply-To: References: <20170704151108.2mvifcg7cyhztbh5@eos.mistotebe.net> <20170704160123.lilble53tmv5t5va@eos.mistotebe.net> <20170704162732.urhtl54j3gbj3myh@eos.mistotebe.net> Message-ID: <20170704165655.yu7wwg7aomihs4of@eos.mistotebe.net> To: cocci@systeme.lip6.fr List-Id: cocci@systeme.lip6.fr On Tue, Jul 04, 2017 at 06:40:56PM +0200, Julia Lawall wrote: > On Tue, 4 Jul 2017, Ond?ej Kuzn?k wrote: >> My test file at the moment is https://github.com/openldap/openldap/blob/master/servers/slapd/back-asyncmeta/meta_result.c >> which calls snprintf in two places only and both code blocks are very >> short. Still, the spatch takes slightly over 1000 seconds to process the >> file with the below: >> >> @shortcut@ >> identifier buf; >> expression S, E, L; >> expression list args_before, args, args_after; >> expression format1, format2; >> @@ >> >> { >> -char buf[S]; >> -snprintf( buf, E, format1, args ); >> -Debug( L, format2, args_before, buf, args_after ); >> +Debug( L, "merged", args_before, args, args_after ); >> ... when != buf >> } >> >> I feel I'm missing something in how coccinelle works to be able to >> make its job easier here. > > It is searching though the control flow paths. In this case, one of the > blocks is: > > { > char buf[ SLAP_TEXT_BUFLEN ]; > > snprintf( buf, sizeof( buf ), > "%s meta_send_entry(\"%s\"): " > "slap_bv2undef_ad(%s): %s\n", > op->o_log_prefix, ent.e_name.bv_val, > mapped.bv_val, text ); > > Debug( LDAP_DEBUG_ANY, "%s", buf, 0, 0 ); > ( void )ber_scanf( &ber, "x" /* [W] */ ); > op->o_tmpfree( attr, op->o_tmpmemctx ); > continue; > } > > I think that it is drifting off into infinity due to the continue. Possibly, but "buf" is only declared in the local scope and by providing the scope parenthesis without the ellipsis after it, I was hoping coccinelle would be able to infer the scope and maybe even deduce that the continue always means the scope is left and that path can be ignored? But that's probably not that easy. > How about adding a timeout (eg --timeout 120) and then see how much is > left over. I get: timeout (we abort) Fatal error: exception Common.Timeout and no patch is produced, if I wait the 1028 seconds, I get the expected patch. I think that supports your hypothesis about trying to process the continue. Thanks, -- Ond?ej Kuzn?k Senior Software Engineer Symas Corporation http://www.symas.com Packaged, certified, and supported LDAP solutions powered by OpenLDAP