1 /* { dg-skip-if "requires hosted libstdc++ for stdlib realloc" { ! hostedlib } } */
3 #include "analyzer-decls.h"
8 /* realloc with tainted size. */
12 void __attribute__((tainted_args
))
13 test_1 (size_t sz
) /* { dg-message "\\(1\\) function 'test_1' marked with '__attribute__\\(\\(tainted_args\\)\\)'" } */
17 __analyzer_dump_state ("taint", sz
); /* { dg-warning "state: 'tainted'" } */
19 q
= realloc (p
, sz
); /* { dg-warning "use of attacker-controlled value 'sz' as allocation size without upper-bounds checking" } */
20 } /* { dg-warning "leak of 'q'" } */