I'm adding self tests to C++ code that ensures there are no NDEBUG
and Posix assert dependencies (the back story below). The first test looks for inclusion of <assert.h>
and <cassert>
:
FAILED=0
COUNT=$($EGREP -c '(assert.h|cassert)' *.h *.cpp)
if [[ "$COUNT" -ne "0" ]]; then
FAILED=1
echo "Found Posix assert headers" | tee -a "$TEST_RESULTS"
fi
Its producing:
************************************
Testing: No Posix assert
./cryptest.sh: line 1130: [[: 3way: value too great for base (error token is "3way")
...
When I debug it I see:
bash -x ./cryptest.sh
...
++ egrep -c '(assert.h|cassert)' 3way.h adler32.h aes.h ...
+ COUNT='3way.h:0
adler32.h:0
aes.h:0
...
So each file gets its own line and own count.
The grep
man page states the following. It does not discuss multi-line output.
-c, --count
Only a count of selected lines is written to standard output.
The behavior appears to have something to do with Output Control (form the man page) and -l, --files-with-matches
. I also tried the -L, --files-without-match
option. It produces a similar error.
My question is, how can I have grep
fold the results into one count?
Or maybe I should ask, is grep and egrep the right tool for the job? If grep and egrep are not the right tool, then what should I use?
This is a Bash shell script that executes on every platform we support. Every platform includes BSDs, Linux, OS X, Solaris and Unix (and all the mobile variants, like Android and iOS). We have to work to get what we need in terms of tools like grep
and egrep
:
GREP=grep
EGREP=egrep
SED=sed
AWK=awk
DISASS=objdump
DISASSARGS=("--disassemble")
...
# Fixup
if [[ "$IS_SOLARIS" -ne "0" ]]; then
IS_X64=$(isainfo 2>/dev/null | "$GREP" -i -c "amd64")
if [[ "$IS_X64" -ne "0" ]]; then
IS_X86=0
fi
# Need something more powerful than the non-Posix versions
if [[ (-e "/usr/gnu/bin/grep") ]]; then
GREP=/usr/gnu/bin/grep;
fi
if [[ (-e "/usr/gnu/bin/egrep") ]]; then
EGREP=/usr/gnu/bin/egrep;
fi
if [[ (-e "/usr/gnu/bin/sed") ]]; then
SED=/usr/gnu/bin/sed;
fi
if [[ (-e "/usr/gnu/bin/awk") ]]; then
AWK=/usr/gnu/bin/awk;
else
AWK=nawk;
fi
DISASS=dis
DISASSARGS=()
fi
...
Back story
Our project recently took CVE-2016-7420 due to users building the project with other tools, like Autotools and CMake. The CVE is a direct result of omitting -DNDEBUG
for release/production builds. The other tools don't configure the way we do, and we did not tell users either (1) they can't use other build tools, or (2) users must define -DNDEBUG
for release/production.
Our remediations are cutting much deeper than "simply define NDEBUG
for release/production" in documentation. We are gutting all dependencies on NDEBUG
and Posix assert
so folks cannot accidentally get into the configuration. We are also requiring users ask for a debug configuration by defining DEBUG
or _DEBUG
; otherwise, they get the release configuration.
While an assert
and the SIGART
that follows is usually annoying in release builds, considered benign in debug build, and taken for granted, we observe:
- We are a security library (we handle sensitive information)
- A failed assert egresses sensitive information to the file system (core files and crash reports)
- A failed assert egresses sensitive information to platform vendors like Apple (CrashReporter), Apport (Ubuntu), Microsoft (Windows Error Reporting)
- Companies like Apple, Google and Microsoft cooperate with government to mine the sensitive information
egrep -c <whatever> *.h *.c
bycat *.h *.c | egrep -c <whatever>
?grep
produces and figure out what extra processing it needs. One common approach for summing columns involves awk. Please show some effort of trying to solve the problemcat <files> | grep
becausegrep <files>
is the preferred way to do things on Unix and Linux. If that's the solution, then please post it as an answer so others can critique it.