gcc/testsuite/gcc.dg/builtin-stringop-chk-1.c

   1 /* Test whether buffer overflow warnings for __*_chk builtins
   2    are emitted properly.  */
   3 /* { dg-do compile } */
   4 /* { dg-options "-O2 -Wno-format -std=gnu99 -ftrack-macro-expansion=0" } */
   5 /* { dg-additional-options "-mstructure-size-boundary=8" { target arm*-*-* } } */
   6 // { dg-skip-if "packed attribute missing for t" { "epiphany-*-*" } { "*" } { "" } }
   7
   8 extern void abort (void);
   9
  10 #include "../gcc.c-torture/execute/builtins/chk.h"
  11
  12 #define va_list    __builtin_va_list
  13 #define va_start   __builtin_va_start
  14 #define va_end     __builtin_va_end
  15
  16 volatile void *vx;
  17 char buf1[20];
  18 int x;
  19
  20 void
  21 test (int arg, ...)
  22 {
  23   char buf2[20];
  24   va_list ap;
  25   char *p = &buf1[10], *q;
  26
  27   memcpy (&buf2[19], "ab", 1);
  28   memcpy (&buf2[19], "ab", 2); /* { dg-warning "writing 2 bytes into a region of size 1" "memcpy" } */
  29   vx = mempcpy (&buf2[19], "ab", 1);
  30   vx = mempcpy (&buf2[19], "ab", 2); /* { dg-warning "writing 2 " "mempcpy" } */
  31   memmove (&buf2[18], &buf1[10], 2);
  32   memmove (&buf2[18], &buf1[10], 3); /* { dg-warning "writing 3 " "memmove" } */
  33   memset (&buf2[16], 'a', 4);
  34   memset (&buf2[15], 'b', 6); /* { dg-warning "writing 6 " "memset" } */
  35   strcpy (&buf2[18], "a");
  36   strcpy (&buf2[18], "ab"); /* { dg-warning "writing 3 " "strcpy" } */
  37   vx = stpcpy (&buf2[18], "a");
  38   vx = stpcpy (&buf2[18], "ab"); /* { dg-warning "writing 3" "stpcpy" } */
  39   strncpy (&buf2[18], "a", 2);
  40   strncpy (&buf2[18], "a", 3); /* { dg-warning "specified bound 3 exceeds destination size 2" "strncpy" } */
  41   strncpy (&buf2[18], "abc", 2);
  42   strncpy (&buf2[18], "abc", 3); /* { dg-warning "writing 3 " "strncpy" } */
  43   memset (buf2, '\0', sizeof (buf2));
  44   strcat (&buf2[18], "a");
  45   memset (buf2, '\0', sizeof (buf2));
  46   strcat (&buf2[18], "ab"); /* { dg-warning "writing 3 " "strcat" } */
  47   sprintf (&buf2[18], "%s", buf1);
  48   sprintf (&buf2[18], "%s", "a");
  49   sprintf (&buf2[18], "%s", "ab"); /* { dg-warning "writing 3 " "sprintf" } */
  50   sprintf (&buf2[18], "a");
  51   sprintf (&buf2[18], "ab"); /* { dg-warning "writing 3 " "sprintf" } */
  52   snprintf (&buf2[18], 2, "%d", x);
  53   /* N argument to snprintf is the size of the buffer.
  54      Although this particular call wouldn't overflow buf2,
  55      incorrect buffer size was passed to it and therefore
  56      we want a warning and runtime failure.  */
  57   snprintf (&buf2[18], 3, "%d", x); /* { dg-warning "specified bound 3 exceeds destination size 2" "snprintf" } */
  58   va_start (ap, arg);
  59   vsprintf (&buf2[18], "a", ap);
  60   va_end (ap);
  61
  62   va_start (ap, arg);
  63   vsprintf (&buf2[18], "ab", ap); /* { dg-warning "writing 3" "vsprintf" } */
  64   va_end (ap);
  65   va_start (ap, arg);
  66   vsnprintf (&buf2[18], 2, "%s", ap);
  67   va_end (ap);
  68   va_start (ap, arg);
  69   /* See snprintf above.  */
  70   vsnprintf (&buf2[18], 3, "%s", ap); /* { dg-warning "specified bound 3 exceeds destination size 2" "vsnprintf" } */
  71   va_end (ap);
  72
  73   p = p + 10;
  74   memset (p, 'd', 0);
  75   q = strcpy (p, ""); /* { dg-warning "writing 1 " "strcpy" } */
  76
  77   /* This invokes undefined behavior, since we are past the end of buf1.  */
  78   p = p + 10;
  79   memset (p, 'd', 1); /* { dg-warning "writing 1 " "memset" } */
  80
  81   memset (q, 'd', 0);
  82   memset (q, 'd', 1); /* { dg-warning "writing 1 " "memset" } */
  83   q = q - 10;
  84   memset (q, 'd', 10);
  85 }
  86
  87 char *str = "ABCDEFG";
  88 typedef struct { char b[16]; } H;
  89
  90 /* Some brown paper bag bugs found in real applications.
  91    This test is here merely for amusement.  */
  92
  93 void
  94 test2 (const H h)
  95 {
  96   char c;
  97   strncpy (&c, str, 3); /* { dg-warning "specified bound 3 exceeds destination size 1" "strncpy" } */
  98
  99   struct { char b[4]; } x;
 100   sprintf (x.b, "%s", "ABCD"); /* { dg-warning "writing 5" "sprintf" } */
 101
 102   unsigned int i;
 103   memcpy (&i, &h, sizeof (h)); /* { dg-warning "writing 16 " "memcpy" } */
 104
 105   unsigned char buf[21];
 106   memset (buf + 16, 0, 8); /* { dg-warning "writing 8 " "memset" } */
 107
 108   typedef struct { __INT32_TYPE__ i, j, k, l; } S;
 109   S *s[3];
 110   memset (s, 0, sizeof (S) * 3); /* { dg-warning "writing 48 " "memset" } */
 111
 112   struct T { char a[8]; char b[4]; char c[10]; } t;
 113   stpcpy (t.c,"Testing..."); /* { dg-warning "writing" "stpcpy" } */
 114
 115   char b1[7];
 116   char b2[4];
 117   memset (b1, 0, sizeof (b1));
 118   memset (b2, 0, sizeof (b1)); /* { dg-warning "writing 7" "memset" } */
 119 }