1#!/usr/bin/env perl 2 3# Find functions making recursive calls to themselves. 4# (Multiple recursion where a() calls b() which calls a() not covered.) 5# 6# When the recursion depth might depend on data controlled by the attacker in 7# an unbounded way, those functions should use interation instead. 8# 9# Typical usage: scripts/recursion.pl library/*.c 10# 11# Copyright The Mbed TLS Contributors 12# SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later 13# 14# This file is provided under the Apache License 2.0, or the 15# GNU General Public License v2.0 or later. 16# 17# ********** 18# Apache License 2.0: 19# 20# Licensed under the Apache License, Version 2.0 (the "License"); you may 21# not use this file except in compliance with the License. 22# You may obtain a copy of the License at 23# 24# http://www.apache.org/licenses/LICENSE-2.0 25# 26# Unless required by applicable law or agreed to in writing, software 27# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT 28# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 29# See the License for the specific language governing permissions and 30# limitations under the License. 31# 32# ********** 33# 34# ********** 35# GNU General Public License v2.0 or later: 36# 37# This program is free software; you can redistribute it and/or modify 38# it under the terms of the GNU General Public License as published by 39# the Free Software Foundation; either version 2 of the License, or 40# (at your option) any later version. 41# 42# This program is distributed in the hope that it will be useful, 43# but WITHOUT ANY WARRANTY; without even the implied warranty of 44# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 45# GNU General Public License for more details. 46# 47# You should have received a copy of the GNU General Public License along 48# with this program; if not, write to the Free Software Foundation, Inc., 49# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. 50# 51# ********** 52 53use warnings; 54use strict; 55 56use utf8; 57use open qw(:std utf8); 58 59# exclude functions that are ok: 60# - mpi_write_hlp: bounded by size of mbedtls_mpi, a compile-time constant 61# - x509_crt_verify_child: bounded by MBEDTLS_X509_MAX_INTERMEDIATE_CA 62my $known_ok = qr/mpi_write_hlp|x509_crt_verify_child/; 63 64my $cur_name; 65my $inside; 66my @funcs; 67 68die "Usage: $0 file.c [...]\n" unless @ARGV; 69 70while (<>) 71{ 72 if( /^[^\/#{}\s]/ && ! /\[.*]/ ) { 73 chomp( $cur_name = $_ ) unless $inside; 74 } elsif( /^{/ && $cur_name ) { 75 $inside = 1; 76 $cur_name =~ s/.* ([^ ]*)\(.*/$1/; 77 } elsif( /^}/ && $inside ) { 78 undef $inside; 79 undef $cur_name; 80 } elsif( $inside && /\b\Q$cur_name\E\([^)]/ ) { 81 push @funcs, $cur_name unless /$known_ok/; 82 } 83} 84 85print "$_\n" for @funcs; 86exit @funcs; 87