gcc/testsuite/gcc.dg/builtin-stringop-chk-5.c

   1 /* Test exercising -Wrawmem-overflow and -Wstringop-overflow warnings.  */
   2 /* { dg-do compile } */
   3 /* { dg-options "-O2 -Wstringop-overflow=1" } */
   4
   5 #define offsetof(type, mem)   __builtin_offsetof (type, mem)
   6
   7 /* Return the number of bytes from member MEM of TYPE to the end
   8    of object OBJ.  */
   9 #define offsetfrom(type, obj, mem) (sizeof (obj) - offsetof (type, mem))
  10
  11
  12 typedef __SIZE_TYPE__ size_t;
  13 extern void* memcpy (void*, const void*, size_t);
  14 extern void* memset (void*, int, __SIZE_TYPE__);
  15
  16
  17 struct A { char a, b; };
  18 struct B { struct A a; char c, d; };
  19
  20 /* Function to call to "escape" pointers from tests below to prevent
  21    GCC from assuming the values of the objects they point to stay
  22    the unchanged.  */
  23 void escape (void*, ...);
  24
  25 /* Function to "generate" a random number each time it's called.  Declared
  26    (but not defined) and used to prevent GCC from making assumptions about
  27    their values based on the variables uses in the tested expressions.  */
  28 size_t random_unsigned_value (void);
  29
  30 /* Return a random unsigned value between MIN and MAX.  */
  31
  32 static inline size_t
  33 range (size_t min, size_t max)
  34 {
  35   const size_t val = random_unsigned_value ();
  36   return val < min || max < val ? min : val;
  37 }
  38
  39 /* Verify that writing past the end of a local array is diagnosed.  */
  40
  41 void test_memop_warn_local (const void *src)
  42 {
  43   size_t n;
  44
  45   n = range (8, 32);
  46
  47   struct A a[2];
  48
  49   memcpy (a, src, n);   /* { dg-warning "writing between 8 and 32 bytes into a region of size 4 overflows the destination" } */
  50   escape (a, src);
  51
  52   /* At -Wrawmem-overflow=1 the destination is considered to be
  53      the whole array and its size is therefore sizeof a.  */
  54   memcpy (&a[0], src, n);   /* { dg-warning "writing between 8 and 32 bytes into a region of size 4 overflows the destination" } */
  55   escape (a, src);
  56
  57   /* Verify the same as above but by writing into the first mmeber
  58      of the first element of the array.  */
  59   memcpy (&a[0].a, src, n);   /* { dg-warning "writing between 8 and 32 bytes into a region of size 4 overflows the destination" } */
  60   escape (a, src);
  61
  62   n = range (12, 32);
  63
  64   struct B b[2];
  65
  66   memcpy (&b[0], src, n);   /* { dg-warning "writing between 12 and 32 bytes into a region of size 8 overflows the destination" } */
  67   escape (b);
  68
  69   /* The following idiom of clearing multiple members of a struct is
  70      used in a few places in the Linux kernel.  Verify that a warning
  71      is issued for it when it writes past the end of the array object.  */
  72   memset (&b[0].a.b, 0, offsetfrom (struct B, b, a.b) + 1);   /* { dg-warning "writing 8 bytes into a region of size 7" } */
  73   escape (b);
  74
  75   memset (&b->a.b, 0, offsetfrom (struct B, b, a.b) + 1);   /* { dg-warning "writing 8 bytes into a region of size 7" } */
  76   escape (b);
  77
  78   memset (&b[0].c, 0, offsetfrom (struct B, b, c) + 1);   /* { dg-warning "writing 7 bytes into a region of size 6" } */
  79   escape (b);
  80
  81   memset (&b->c, 0, offsetfrom (struct B, b, c) + 1);   /* { dg-warning "writing 7 bytes into a region of size 6" } */
  82   escape (b);
  83
  84   memset (&b[0].d, 0, offsetfrom (struct B, b, d) + 1);   /* { dg-warning "writing 6 bytes into a region of size 5" } */
  85   escape (b);
  86
  87   memset (&b->d, 0, offsetfrom (struct B, b, d) + 1);   /* { dg-warning "writing 6 bytes into a region of size 5" } */
  88   escape (b);
  89
  90   /* Same as above but clearing just elements of the second element
  91      of the array.  */
  92   memset (&b[1].a.b, 0, offsetfrom (struct B, b[1], a.b) + 1);   /* { dg-warning "writing 4 bytes into a region of size 3" } */
  93   escape (b);
  94
  95   memset (&b[1].c, 0, offsetfrom (struct B, b[1], c) + 1);   /* { dg-warning "writing 3 bytes into a region of size 2" } */
  96   escape (b);
  97
  98   memset (&b[1].d, 0, offsetfrom (struct B, b[1], d) + 1);   /* { dg-warning "writing 2 bytes into a region of size 1" } */
  99   escape (b);
 100 }
 101
 102 /* Verify that writing past the end of a dynamically allocated array
 103    of known size is diagnosed.  */
 104
 105 void test_memop_warn_alloc (const void *src)
 106 {
 107   size_t n;
 108
 109   n = range (8, 32);
 110
 111   struct A *a = __builtin_malloc (sizeof *a * 2);
 112
 113   memcpy (a, src, n);   /* { dg-warning "writing between 8 and 32 bytes into a region of size 4 overflows the destination" "memcpy into allocated" { xfail *-*-*} } */
 114   escape (a, src);
 115
 116   /* At -Wrawmem-overflow=1 the destination is considered to be
 117      the whole array and its size is therefore sizeof a.  */
 118   memcpy (&a[0], src, n);   /* { dg-warning "writing between 8 and 32 bytes into a region of size 4 overflows the destination" "memcpy into allocated" { xfail *-*-*} } */
 119   escape (a, src);
 120
 121   /* Verify the same as above but by writing into the first mmeber
 122      of the first element of the array.  */
 123   memcpy (&a[0].a, src, n);   /* { dg-warning "writing between 8 and 32 bytes into a region of size 4 overflows the destination" "memcpy into allocated" { xfail *-*-*} } */
 124   escape (a, src);
 125
 126   n = range (12, 32);
 127
 128   struct B *b = __builtin_malloc (sizeof *b * 2);
 129
 130   memcpy (&b[0], src, n);   /* { dg-warning "writing between 12 and 32 bytes into a region of size 8 overflows the destination" "memcpy into allocated" { xfail *-*-*} } */
 131   escape (b);
 132
 133   /* The following idiom of clearing multiple members of a struct is
 134      used in a few places in the Linux kernel.  Verify that a warning
 135      is issued for it when it writes past the end of the array object.  */
 136   memset (&b[0].a.b, 0, offsetfrom (struct B, b, a.b) + 1);   /* { dg-warning "writing 8 bytes into a region of size 7" "memcpy into allocated" { xfail *-*-*} } */
 137   escape (b);
 138
 139   memset (&b->a.b, 0, offsetfrom (struct B, b, a.b) + 1);   /* { dg-warning "writing 8 bytes into a region of size 7" "memcpy into allocated" { xfail *-*-*} } */
 140   escape (b);
 141
 142   memset (&b[0].c, 0, offsetfrom (struct B, b, c) + 1);   /* { dg-warning "writing 7 bytes into a region of size 6" "memcpy into allocated" { xfail *-*-*} } */
 143   escape (b);
 144
 145   memset (&b->c, 0, offsetfrom (struct B, b, c) + 1);   /* { dg-warning "writing 7 bytes into a region of size 6" "memcpy into allocated" { xfail *-*-*} } */
 146   escape (b);
 147
 148   memset (&b[0].d, 0, offsetfrom (struct B, b, d) + 1);   /* { dg-warning "writing 6 bytes into a region of size 5" "memcpy into allocated" { xfail *-*-*} } */
 149   escape (b);
 150
 151   memset (&b->d, 0, offsetfrom (struct B, b, d) + 1);   /* { dg-warning "writing 6 bytes into a region of size 5" "memcpy into allocated" { xfail *-*-*} } */
 152   escape (b);
 153
 154   /* Same as above but clearing just elements of the second element
 155      of the array.  */
 156   memset (&b[1].a.b, 0, offsetfrom (struct B, b[1], a.b) + 1);   /* { dg-warning "writing 4 bytes into a region of size 3" "memcpy into allocated" { xfail *-*-*} } */
 157   escape (b);
 158
 159   memset (&b[1].c, 0, offsetfrom (struct B, b[1], c) + 1);   /* { dg-warning "writing 3 bytes into a region of size 2" "memcpy into allocated" { xfail *-*-*} } */
 160   escape (b);
 161
 162   memset (&b[1].d, 0, offsetfrom (struct B, b[1], d) + 1);   /* { dg-warning "writing 2 bytes into a region of size 1" "memcpy into allocated" { xfail *-*-*} } */
 163   escape (b);
 164 }
 165
 166
 167 void test_memop_nowarn (const void *src)
 168 {
 169   struct B b[2];
 170
 171   size_t n = range (sizeof b, 32);
 172
 173   /* Verify that clearing the whole array is not diagnosed regardless
 174      of whether the expression pointing to its beginning is obtained
 175      from the array itself or its first member(s).  */
 176   memcpy (b, src, n);
 177   escape (b);
 178
 179   memcpy (&b[0], src, n);
 180   escape (b);
 181
 182   memcpy (&b[0].a, src, n);
 183   escape (b, src);
 184
 185   memcpy (&b[0].a.a, src, n);
 186   escape (b, src);
 187
 188   /* Clearing multiple elements of an array of structs.  */
 189   memset (&b[0].a.b, 0, sizeof b - offsetof (struct B, a.b));
 190   escape (b);
 191
 192   memset (&b->a.b, 0, sizeof b - offsetof (struct B, a.b));
 193   escape (b);
 194
 195   memset (&b[0].c, 0, sizeof b - offsetof (struct B, c));
 196   escape (b);
 197
 198   memset (&b->c, 0, sizeof b - offsetof (struct B, c));
 199   escape (b);
 200
 201   memset (&b[0].d, 0, sizeof b - offsetof (struct B, d));
 202   escape (b);
 203
 204   memset (&b->d, 0, sizeof b - offsetof (struct B, d));
 205   escape (b);
 206
 207   /* Same as above but clearing just elements of the second element
 208      of the array.  */
 209   memset (&b[1].a.b, 0, sizeof b[1] - offsetof (struct B, a.b));
 210   escape (b);
 211
 212   memset (&b[1].c, 0, sizeof b[1] - offsetof (struct B, c));
 213   escape (b);
 214
 215   memset (&b[1].d, 0, sizeof b[1] - offsetof (struct B, d));
 216   escape (b);
 217 }
 218
 219
 220 /* The foollowing function could specify in its API that it takes
 221    an array of exactly two elements, as shown below.  Verify that
 222    writing into both elements is not diagnosed.  */
 223 void test_memop_nowarn_arg (struct A[2], const void*);
 224
 225 void test_memop_nowarn_arg (struct A *a, const void *src)
 226 {
 227   memcpy (a, src, 2 * sizeof *a);
 228   escape (a, src);
 229
 230   memcpy (a, src, range (2 * sizeof *a, 123));
 231   escape (a, src);
 232 }
 233
 234
 235 struct C { char a[3], b; };
 236 struct D { struct C c; char d, e; };
 237
 238 extern char* strncpy (char*, const char*, __SIZE_TYPE__);
 239
 240 void test_stringop_warn (void)
 241 {
 242   size_t n = range (2 * sizeof (struct D) + 1, 33);
 243
 244   struct C c[2];
 245
 246   /* Similarly, at -Wstringop-overflow=1 the destination is considered
 247      to be the whole array and its size is therefore sizeof c.  */
 248   strncpy (c[0].a, "123", n);   /* { dg-warning "writing between 13 and 33 bytes into a region of size 8 overflows the destination" } */
 249
 250   escape (c);
 251 }
 252
 253
 254 void test_stringop_nowarn (void)
 255 {
 256   struct D d[2];
 257
 258   strncpy (d[0].c.a, "123", range (sizeof d, 32));
 259   escape (d);
 260 }