gcc/testsuite/c-c++-common/analyzer/out-of-bounds-write-struct-arr.c

   1 #include <stdint.h>
   2
   3 struct st
   4 {
   5   char buf[16];
   6   int32_t x;
   7   int32_t y;
   8 };
   9
  10 struct st arr[10];
  11
  12 void struct_arr_write_x_element_before_start_far(int32_t x)
  13 {
  14   arr[-100].x = x; /* { dg-warning "buffer underwrite" "warning" } */
  15   /* { dg-message "out-of-bounds write from byte -2384 till byte -2381 but 'arr' starts at byte 0" "final event" { target *-*-* } .-1 } */
  16   /* { dg-message "valid subscripts for 'arr' are '\\\[0\\\]' to '\\\[9\\\]'" "valid subscript note" { target *-*-* } .-2 } */
  17 }
  18
  19 void struct_arr_write_x_element_before_start_near(int32_t x)
  20 {
  21   arr[-2].x = x; /* { dg-warning "buffer underwrite" "warning" } */
  22   /* { dg-message "out-of-bounds write from byte -32 till byte -29 but 'arr' starts at byte 0" "final event" { target *-*-* } .-1 } */
  23   /* { dg-message "valid subscripts for 'arr' are '\\\[0\\\]' to '\\\[9\\\]'" "valid subscript note" { target *-*-* } .-2 } */
  24 }
  25
  26 void struct_arr_write_x_element_before_start_off_by_one(int32_t x)
  27 {
  28   arr[-1].x = x; /* { dg-warning "buffer underwrite" "warning" } */
  29   /* { dg-message "out-of-bounds write from byte -8 till byte -5 but 'arr' starts at byte 0" "final event" { target *-*-* } .-1 } */
  30   /* { dg-message "valid subscripts for 'arr' are '\\\[0\\\]' to '\\\[9\\\]'" "valid subscript note" { target *-*-* } .-2 } */
  31 }
  32
  33 void struct_arr_write_x_element_at_start(int32_t x)
  34 {
  35   arr[0].x = x;
  36 }
  37
  38 void struct_arr_write_x_element_at_end(int32_t x)
  39 {
  40   arr[9].x = x;
  41 }
  42
  43 void struct_arr_write_x_element_after_end_off_by_one(int32_t x)
  44 {
  45   arr[10].x = x; /* { dg-warning "buffer overflow" "warning" } */
  46   /* { dg-message "out-of-bounds write from byte 256 till byte 259 but 'arr' ends at byte 240" "final event" { target *-*-* } .-1 } */
  47   /* { dg-message "write of 4 bytes to beyond the end of 'arr'" "num bad bytes note" { target *-*-* } .-2 } */
  48   /* { dg-message "valid subscripts for 'arr' are '\\\[0\\\]' to '\\\[9\\\]'" "valid subscript note" { target *-*-* } .-3 } */
  49 }
  50
  51 void struct_arr_write_x_element_after_end_near(int32_t x)
  52 {
  53   arr[11].x = x; /* { dg-warning "buffer overflow" "warning" } */
  54   /* { dg-message "out-of-bounds write from byte 280 till byte 283 but 'arr' ends at byte 240" "final event" { target *-*-* } .-1 } */
  55   /* { dg-message "write of 4 bytes to beyond the end of 'arr'" "num bad bytes note" { target *-*-* } .-2 } */
  56   /* { dg-message "valid subscripts for 'arr' are '\\\[0\\\]' to '\\\[9\\\]'" "valid subscript note" { target *-*-* } .-3 } */
  57 }
  58
  59 void struct_arr_write_x_element_after_end_far(int32_t x)
  60 {
  61   arr[100].x = x; /* { dg-warning "buffer overflow" "warning" } */
  62   /* { dg-message "out-of-bounds write from byte 2416 till byte 2419 but 'arr' ends at byte 240" "final event" { target *-*-* } .-1 } */
  63   /* { dg-message "write of 4 bytes to beyond the end of 'arr'" "num bad bytes note" { target *-*-* } .-2 } */
  64   /* { dg-message "valid subscripts for 'arr' are '\\\[0\\\]' to '\\\[9\\\]'" "valid subscript note" { target *-*-* } .-3 } */
  65 }