incorrect-use-of-sizeof.yaml

rules:
  - id: raptor-incorrect-use-of-sizeof
    metadata:
      author: Marco Ivaldi <raptor@0xdeadbeef.info>
      references:
        - https://cwe.mitre.org/data/definitions/467
        - https://g.co/kgs/PCHQjJ
        - https://github.com/struct/mms
        - https://dustri.org/b/playing-with-weggli.html
      confidence: MEDIUM
      # NOTE: another relevant pattern would be sizeof('...'), but 
      # unfortunately that's currently not supported by Semgrep.
      # NOTE: see also cpp.correctness.sizeof-*.
    message: >-
      The code calls sizeof() on a malloced pointer type, which always
      returns the wordsize/8. This can produce an unexpected result if the
      programmer intended to determine how much memory has been allocated.
    severity: WARNING
    languages:
      - c
      - cpp
    pattern-either:
      # type-based patterns (some types are missing)
      - patterns:
        - pattern: sizeof((char * $PTR))
        - pattern-not: sizeof("...")
      - pattern: sizeof((int * $PTR))
      - pattern: sizeof((float * $PTR))
      - pattern: sizeof((double * $PTR))
      # other patterns (function calls are not covered)
      - patterns:
        - pattern: sizeof($PTR)
        - pattern-either:
          - pattern-inside: |
              $TYPE * $PTR;
              ...
          - pattern-inside: |
              $TYPE * $PTR = $EXPR;
              ...