1 /* Test whether buffer overflow warnings for __*_chk builtins
2 are emitted properly. */
3 /* { dg-do compile } */
4 /* { dg-options "-O2 -Wno-format -std=gnu99 -ftrack-macro-expansion=0" } */
5 // { dg-skip-if "packed attribute missing for t" { "epiphany-*-*" } }
7 extern void abort (void);
9 #include "../gcc.c-torture/execute/builtins/chk.h"
11 #define va_list __builtin_va_list
12 #define va_start __builtin_va_start
13 #define va_end __builtin_va_end
24 char *p
= &buf1
[10], *q
;
26 memcpy (&buf2
[19], "ab", 1);
27 memcpy (&buf2
[19], "ab", 2); /* { dg-warning "writing 2 bytes into a region of size 1" "memcpy" } */
28 vx
= mempcpy (&buf2
[19], "ab", 1);
29 vx
= mempcpy (&buf2
[19], "ab", 2); /* { dg-warning "writing 2 " "mempcpy" } */
30 memmove (&buf2
[18], &buf1
[10], 2);
31 memmove (&buf2
[18], &buf1
[10], 3); /* { dg-warning "writing 3 " "memmove" } */
32 memset (&buf2
[16], 'a', 4);
33 memset (&buf2
[15], 'b', 6); /* { dg-warning "writing 6 " "memset" } */
34 strcpy (&buf2
[18], "a");
35 strcpy (&buf2
[18], "ab"); /* { dg-warning "writing 3 " "strcpy" } */
36 vx
= stpcpy (&buf2
[18], "a");
37 vx
= stpcpy (&buf2
[18], "ab"); /* { dg-warning "writing 3" "stpcpy" } */
38 strncpy (&buf2
[18], "a", 2);
39 strncpy (&buf2
[18], "a", 3); /* { dg-warning "specified bound 3 exceeds destination size 2" "strncpy" } */
40 strncpy (&buf2
[18], "abc", 2);
41 strncpy (&buf2
[18], "abc", 3); /* { dg-warning "writing 3 " "strncpy" } */
42 memset (buf2
, '\0', sizeof (buf2
));
43 strcat (&buf2
[18], "a");
44 memset (buf2
, '\0', sizeof (buf2
));
45 strcat (&buf2
[18], "ab"); /* { dg-warning "writing 3 " "strcat" } */
46 sprintf (&buf2
[18], "%s", buf1
);
47 sprintf (&buf2
[18], "%s", "a");
48 sprintf (&buf2
[18], "%s", "ab"); /* { dg-warning "writing 3 " "sprintf" } */
49 sprintf (&buf2
[18], "a");
50 sprintf (&buf2
[18], "ab"); /* { dg-warning "writing 3 " "sprintf" } */
51 snprintf (&buf2
[18], 2, "%d", x
);
52 /* N argument to snprintf is the size of the buffer.
53 Although this particular call wouldn't overflow buf2,
54 incorrect buffer size was passed to it and therefore
55 we want a warning and runtime failure. */
56 snprintf (&buf2
[18], 3, "%d", x
); /* { dg-warning "specified bound 3 exceeds destination size 2" "snprintf" } */
58 vsprintf (&buf2
[18], "a", ap
);
62 vsprintf (&buf2
[18], "ab", ap
); /* { dg-warning "writing 3" "vsprintf" } */
65 vsnprintf (&buf2
[18], 2, "%s", ap
);
68 /* See snprintf above. */
69 vsnprintf (&buf2
[18], 3, "%s", ap
); /* { dg-warning "specified bound 3 exceeds destination size 2" "vsnprintf" } */
74 q
= strcpy (p
, ""); /* { dg-warning "writing 1 " "strcpy" } */
76 /* This invokes undefined behavior, since we are past the end of buf1. */
78 memset (p
, 'd', 1); /* { dg-warning "writing 1 " "memset" } */
81 memset (q
, 'd', 1); /* { dg-warning "writing 1 " "memset" } */
86 char *str
= "ABCDEFG";
87 typedef struct { char b
[16]; } H
;
89 /* Some brown paper bag bugs found in real applications.
90 This test is here merely for amusement. */
96 strncpy (&c
, str
, 3); /* { dg-warning "specified bound 3 exceeds destination size 1" "strncpy" } */
98 struct { char b
[4]; } x
;
99 sprintf (x
.b
, "%s", "ABCD"); /* { dg-warning "writing 5" "sprintf" } */
102 memcpy (&i
, &h
, sizeof (h
)); /* { dg-warning "writing 16 " "memcpy" } */
104 unsigned char buf
[21];
105 memset (buf
+ 16, 0, 8); /* { dg-warning "writing 8 " "memset" } */
107 typedef struct { __INT32_TYPE__ i
, j
, k
, l
; } S
;
109 memset (s
, 0, sizeof (S
) * 3); /* { dg-warning "writing 48 " "memset" } */
111 struct T
{ char a
[8]; char b
[4]; char c
[10]; } t
;
112 stpcpy (t
.c
,"Testing..."); /* { dg-warning "writing" "stpcpy" } */
116 memset (b1
, 0, sizeof (b1
));
117 memset (b2
, 0, sizeof (b1
)); /* { dg-warning "writing 7" "memset" } */