gcc/testsuite/c-c++-common/analyzer/taint-alloc-3.c

   1 /* { dg-skip-if "requires hosted libstdc++ for stdlib malloc" { ! hostedlib } } */
   2
   3 #include "analyzer-decls.h"
   4 #include <stdio.h>
   5 #include <stdlib.h>
   6 #include <string.h>
   7
   8 /* malloc with tainted size from a syscall.  */
   9
  10 void *p;
  11
  12 void __attribute__((tainted_args))
  13 test_1 (size_t sz) /* { dg-message "\\(1\\) function 'test_1' marked with '__attribute__\\(\\(tainted_args\\)\\)'" } */
  14 {
  15   /* TODO: should have a message saying why "sz" is tainted, e.g.
  16      "treating 'sz' as attacker-controlled because 'test_1' is marked with '__attribute__((tainted_args))'"  */
  17
  18   p = malloc (sz); /* { dg-warning "use of attacker-controlled value 'sz' as allocation size without upper-bounds checking" "warning" } */
  19   /* { dg-message "\\(\[0-9\]+\\) use of attacker-controlled value 'sz' as allocation size without upper-bounds checking" "final event" { target *-*-* } .-1 } */
  20 }