diff --git a/scripts/find-mem-leak.cocci b/scripts/find-mem-leak.cocci
new file mode 100644
index 0000000..a3f7ca9
--- /dev/null
+++ b/scripts/find-mem-leak.cocci
@@ -0,0 +1,9 @@
+@@
+expression x, y;
+statement S;
+@@
+  x = polarssl_malloc(...);
+  y = polarssl_malloc(...);
+  ...
+* if (x == NULL || y == NULL)
+    S