Return to Question

My question is, how can I have grep fold the results into one count?

The behavior appears to have something to do with Output Control (form the man page) and -l, --files-with-matches. I also tried the -L, --files-without-match option. It produces a similar error.

My question is, how can I have grep fold the results into one count?

Back story

Our remediations are cutting much deeper than "simply define NDEBUG for release/production" in documentation. We are gutting all dependencies on NDEBUG and Posix assert so folks cannot accidentally get into the configuration. We are also requiring users ask for a debug configuration by defining DEBUG or _DEBUG; otherwise, they get the release configuration.

This is a Bash shell script that executes on every platform we support. Every platform includes BSDs, Linux, OS X, Solaris and Unix (and all the mobile variants, like Android and iOS). We have to work to get what we need in terms of tools like grep and egrep:

GREP=grep EGREP=egrep SED=sed AWK=awk DISASS=objdump DISASSARGS=("--disassemble") ... # Fixup if [[ "$IS_SOLARIS" -ne "0" ]]; then IS_X64=$(isainfo 2>/dev/null | "$GREP" -i -c "amd64") if [[ "$IS_X64" -ne "0" ]]; then IS_X86=0 fi # Need something more powerful than the non-Posix versions if [[ (-e "/usr/gnu/bin/grep") ]]; then GREP=/usr/gnu/bin/grep; fi if [[ (-e "/usr/gnu/bin/egrep") ]]; then EGREP=/usr/gnu/bin/egrep; fi if [[ (-e "/usr/gnu/bin/sed") ]]; then SED=/usr/gnu/bin/sed; fi if [[ (-e "/usr/gnu/bin/awk") ]]; then AWK=/usr/gnu/bin/awk; else AWK=nawk; fi DISASS=dis DISASSARGS=() fi ... 

Back story

Our remediations are cutting much deeper than "simply define NDEBUG for release/production" in documentation. We are gutting all dependencies on NDEBUG and Posix assert so folks cannot accidentally get into the configuration. We are also requiring users ask for a debug configuration by defining DEBUG or _DEBUG; otherwise, they get the release configuration.

I'm adding self tests to C++ code that ensures there are no NDEBUG and Posix assert dependencies (the back story below). The first test looks for inclusion of <assert.h> and <cassert>:

FAILED=0 COUNT=$($EGREP -c '(assert.h|cassert)' *.h *.cpp) if [[ "$COUNT" -ne "0" ]]; then FAILED=1 echo "Found Posix assert headers" | tee -a "$TEST_RESULTS" fi 

Its producing:

************************************ Testing: No Posix assert ./cryptest.sh: line 1130: [[: 3way: value too great for base (error token is "3way") ... 

When I debug it I see:

bash -x ./cryptest.sh ... ++ egrep -c '(assert.h|cassert)' 3way.h adler32.h aes.... + COUNT='3way.h:0 adler32.h:0 aes.h:0 ... 

So each file gets its own line and own count.

The grep man page states the following. It does not discuss multi-line output.

-c, --count Only a count of selected lines is written to standard output. 

My question is, how can I have grep fold the results into one count?

Back story

Our project recently took CVE-2016-7420 due to users building the project with other tools, like Autotools and CMake. The CVE is a direct result of omitting -DNDEBUG for release/production builds. The other tools don't configure the way we do, and we did not tell users either (1) they can't use other build tools, or (2) users must define -DNDEBUG for release/production.

Our remediations are cutting much deeper than "simply define NDEBUG for release/production" in documentation. We are gutting all dependencies on NDEBUG and Posix assert so folks cannot accidentally get into the configuration. We are also requiring users ask for a debug configuration by defining DEBUG or _DEBUG; otherwise, they get the release configuration.

I'm adding self tests to C++ code that ensures there are no NDEBUG and Posix assert dependencies (the back story below). The first test looks for inclusion of <assert.h> and <cassert>:

FAILED=0 COUNT=$($EGREP -c '(assert.h|cassert)' *.h *.cpp) if [[ "$COUNT" -ne "0" ]]; then FAILED=1 echo "Found Posix assert headers" | tee -a "$TEST_RESULTS" fi 

Its producing:

************************************ Testing: No Posix assert ./cryptest.sh: line 1130: [[: 3way: value too great for base (error token is "3way") ... 

When I debug it I see:

bash -x ./cryptest.sh ... ++ egrep -c '(assert.h|cassert)' 3way.h adler32.h aes.h ... + COUNT='3way.h:0 adler32.h:0 aes.h:0 ... 

So each file gets its own line and own count.

The grep man page states the following. It does not discuss multi-line output.

-c, --count Only a count of selected lines is written to standard output. 

My question is, how can I have grep fold the results into one count?

Or maybe I should ask, is grep and egrep the right tool for the job? If grep and egrep are not the right tool, then what should I use?

Back story

Our project recently took CVE-2016-7420 due to users building the project with other tools, like Autotools and CMake. The CVE is a direct result of omitting -DNDEBUG for release/production builds. The other tools don't configure the way we do, and we did not tell users either (1) they can't use other build tools, or (2) users must define -DNDEBUG for release/production.

Our remediations are cutting much deeper than "simply define NDEBUG for release/production" in documentation. We are gutting all dependencies on NDEBUG and Posix assert so folks cannot accidentally get into the configuration. We are also requiring users ask for a debug configuration by defining DEBUG or _DEBUG; otherwise, they get the release configuration.

While an assert and the SIGART that follows is usually annoying in release builds, considered benign in debug build, and taken for granted, we observe:

• We are a security library (we handle sensitive information)
• A failed assert egresses sensitive information to the file system (core files and crash reports)
• A failed assert egresses sensitive information to platform vendors like Apple (CrashReporter), Apport (Ubuntu), Microsoft (Windows Error Reporting)
• Companies like Apple, Google and Microsoft cooperate with government to mine the sensitive information