gcc/testsuite/c-c++-common/analyzer/attr-tainted_args-1.c

   1 #include "../../gcc.dg/analyzer/analyzer-decls.h"
   2
   3 struct arg_buf
   4 {
   5   int i;
   6   int j;
   7 };
   8
   9 /* Example of marking a function as tainted.  */
  10
  11 void __attribute__((tainted_args))
  12 test_1 (int i, void *p, char *q)
  13 {
  14   /* There should be a single enode,
  15      for the "tainted" entry to the function.  */
  16   __analyzer_dump_exploded_nodes (0); /* { dg-warning "1 processed enode" } */
  17
  18   __analyzer_dump_state ("taint", i); /* { dg-warning "state: 'tainted'" } */
  19   __analyzer_dump_state ("taint", p); /* { dg-warning "state: 'tainted'" } */
  20   __analyzer_dump_state ("taint", q); /* { dg-warning "state: 'tainted'" } */
  21   __analyzer_dump_state ("taint", *q); /* { dg-warning "state: 'tainted'" } */
  22
  23   struct arg_buf *args = (struct arg_buf *) p;
  24   __analyzer_dump_state ("taint", args->i); /* { dg-warning "state: 'tainted'" } */
  25   __analyzer_dump_state ("taint", args->j); /* { dg-warning "state: 'tainted'" } */
  26 }
  27
  28 /* Example of marking a callback field as tainted.  */
  29
  30 struct s2
  31 {
  32   void (*cb) (int, void *, char *)
  33     __attribute__((tainted_args));
  34 };
  35
  36 /* Function not marked as tainted.  */
  37
  38 void
  39 test_2a (int i, void *p, char *q)
  40 {
  41   /* There should be a single enode,
  42      for the normal entry to the function.  */
  43   __analyzer_dump_exploded_nodes (0); /* { dg-warning "1 processed enode" } */
  44
  45   __analyzer_dump_state ("taint", i); /* { dg-warning "state: 'start'" } */
  46   __analyzer_dump_state ("taint", p); /* { dg-warning "state: 'start'" } */
  47   __analyzer_dump_state ("taint", q); /* { dg-warning "state: 'start'" } */
  48
  49   struct arg_buf *args = (struct arg_buf *) p;
  50   __analyzer_dump_state ("taint", args->i); /* { dg-warning "state: 'start'" } */
  51   __analyzer_dump_state ("taint", args->j); /* { dg-warning "state: 'start'" } */
  52 }
  53
  54 /* Function referenced via t2b.cb, marked as "tainted".  */
  55
  56 void
  57 test_2b (int i, void *p, char *q)
  58 {
  59   /* There should be two enodes
  60      for the direct call, and the "tainted" entry to the function.  */
  61   __analyzer_dump_exploded_nodes (0); /* { dg-warning "2 processed enodes" } */
  62 }
  63
  64 /* Callback used via t2c.cb, marked as "tainted".  */
  65 void
  66 __analyzer_test_2c (int i, void *p, char *q)
  67 {
  68   /* There should be a single enode,
  69      for the "tainted" entry to the function.  */
  70   __analyzer_dump_exploded_nodes (0); /* { dg-warning "1 processed enode" } */
  71
  72   __analyzer_dump_state ("taint", i); /* { dg-warning "state: 'tainted'" } */
  73   __analyzer_dump_state ("taint", p); /* { dg-warning "state: 'tainted'" } */
  74   __analyzer_dump_state ("taint", q); /* { dg-warning "state: 'tainted'" } */
  75 }
  76
  77 struct s2 t2b =
  78 {
  79   .cb = test_2b
  80 };
  81
  82 struct s2 t2c =
  83 {
  84   .cb = __analyzer_test_2c
  85 };