I'm adding self tests to C++ code that ensures there are no
NDEBUG and Posix assert dependencies (the back story below). The first test looks for inclusion of
FAILED=0 COUNT=$($EGREP -c '(assert.h|cassert)' *.h *.cpp) if [[ "$COUNT" -ne "0" ]]; then FAILED=1 echo "Found Posix assert headers" | tee -a "$TEST_RESULTS" fi
************************************ Testing: No Posix assert ./cryptest.sh: line 1130: [[: 3way: value too great for base (error token is "3way") ...
When I debug it I see:
bash -x ./cryptest.sh ... ++ egrep -c '(assert.h|cassert)' 3way.h adler32.h aes.h ... + COUNT='3way.h:0 adler32.h:0 aes.h:0 ...
So each file gets its own line and own count.
grep man page states the following. It does not discuss multi-line output.
-c, --count Only a count of selected lines is written to standard output.
The behavior appears to have something to do with Output Control (form the man page) and
-l, --files-with-matches. I also tried the
-L, --files-without-match option. It produces a similar error.
My question is, how can I have
grep fold the results into one count?
Or maybe I should ask, is grep and egrep the right tool for the job? If grep and egrep are not the right tool, then what should I use?
This is a Bash shell script that executes on every platform we support. Every platform includes BSDs, Linux, OS X, Solaris and Unix (and all the mobile variants, like Android and iOS). We have to work to get what we need in terms of tools like
GREP=grep EGREP=egrep SED=sed AWK=awk DISASS=objdump DISASSARGS=("--disassemble") ... # Fixup if [[ "$IS_SOLARIS" -ne "0" ]]; then IS_X64=$(isainfo 2>/dev/null | "$GREP" -i -c "amd64") if [[ "$IS_X64" -ne "0" ]]; then IS_X86=0 fi # Need something more powerful than the non-Posix versions if [[ (-e "/usr/gnu/bin/grep") ]]; then GREP=/usr/gnu/bin/grep; fi if [[ (-e "/usr/gnu/bin/egrep") ]]; then EGREP=/usr/gnu/bin/egrep; fi if [[ (-e "/usr/gnu/bin/sed") ]]; then SED=/usr/gnu/bin/sed; fi if [[ (-e "/usr/gnu/bin/awk") ]]; then AWK=/usr/gnu/bin/awk; else AWK=nawk; fi DISASS=dis DISASSARGS=() fi ...
Our project recently took CVE-2016-7420 due to users building the project with other tools, like Autotools and CMake. The CVE is a direct result of omitting
-DNDEBUG for release/production builds. The other tools don't configure the way we do, and we did not tell users either (1) they can't use other build tools, or (2) users must define
-DNDEBUG for release/production.
Our remediations are cutting much deeper than "simply define
NDEBUG for release/production" in documentation. We are gutting all dependencies on
NDEBUG and Posix
assert so folks cannot accidentally get into the configuration. We are also requiring users ask for a debug configuration by defining
_DEBUG; otherwise, they get the release configuration.
assert and the
SIGART that follows is usually annoying in release builds, considered benign in debug build, and taken for granted, we observe:
- We are a security library (we handle sensitive information)
- A failed assert egresses sensitive information to the file system (core files and crash reports)
- A failed assert egresses sensitive information to platform vendors like Apple (CrashReporter), Apport (Ubuntu), Microsoft (Windows Error Reporting)
- Companies like Apple, Google and Microsoft cooperate with government to mine the sensitive information