gcc/testsuite/gcc.dg/analyzer/taint-size-1.c

   1 #include "analyzer-decls.h"
   2 #include <stdio.h>
   3 #include <stdlib.h>
   4 #include <string.h>
   5
   6 struct foo
   7 {
   8   size_t sz;
   9 };
  10
  11 char buf[100];
  12 char buf2[100];
  13
  14 /* memset with tainted size.  */
  15
  16 void test_1 (FILE *f)
  17 {
  18   struct foo tmp;
  19   if (1 == fread(&tmp, sizeof(tmp), 1, f)) { /* { dg-message "\\(\[0-9\]+\\) 'tmp' gets an unchecked value here" "event: tmp gets unchecked value" { xfail *-*-* } } */
  20                                              /* { dg-message "\\(\[0-9\]+\\) following 'true' branch\\.\\.\\." "event: following true branch" { target *-*-* } .-1 } */
  21     __analyzer_dump_state ("taint", tmp.sz); /* { dg-warning "state: 'tainted'" } */
  22     /* { dg-message "\\(\[0-9\]+\\) \\.\\.\\.to here" "event: to here" { target *-*-* } .-1 } */
  23
  24     memset (buf, 0, tmp.sz); /* { dg-warning "use of attacker-controlled value 'tmp\\.sz' as size without upper-bounds checking" "warning" } */
  25     /* { dg-message "23: \\(\[0-9\]+\\) 'tmp.i' has an unchecked value here \\(from 'tmp'\\)" "event: tmp.i has an unchecked value" { xfail *-*-* } .-1 } */
  26     /* { dg-message "\\(\[0-9\]+\\) use of attacker-controlled value 'tmp\\.sz' as size without upper-bounds checking" "final event" { target *-*-* } .-2 } */
  27
  28     // TOOD: better messages for state changes
  29   }
  30 }
  31
  32 /* memcpy with tainted size.  */
  33
  34 void __attribute__((tainted_args))
  35 test_2 (size_t sz)
  36 {
  37   memcpy (buf, buf2, sz); /* { dg-warning "use of attacker-controlled value 'sz' as size without upper-bounds checking" } */
  38 }
  39
  40 /* __attribute__ alloc_size with tainted size.  */
  41
  42 extern void* (*my_alloc)(size_t) __attribute__ ((alloc_size (1)));
  43
  44 void * __attribute__((tainted_args))
  45 test_attr_alloc_size (size_t sz)
  46 {
  47   return my_alloc (sz); /* { dg-warning "use of attacker-controlled value 'sz' as allocation size without upper-bounds checking" } */
  48 }