gcc/testsuite/gcc.dg/plugin/taint-CVE-2011-0521-3-fixed.c

   1 /* { dg-do compile } */
   2 /* { dg-require-effective-target analyzer } */
   3 /* { dg-additional-options "-Wno-pedantic" } */
   4
   5 /* See notes in this header.  */
   6 #include "taint-CVE-2011-0521.h"
   7
   8 /* Adapted from drivers/media/dvb/ttpci/av7110_ca.c  */
   9
  10 int dvb_ca_ioctl(struct file *file, unsigned int cmd, void *parg)
  11 {
  12         struct dvb_device *dvbdev = file->private_data;
  13         struct av7110 *av7110 = dvbdev->priv;
  14         unsigned long arg = (unsigned long) parg;
  15
  16         /* case CA_GET_SLOT_INFO:  */
  17         {
  18                 ca_slot_info_t *info=(ca_slot_info_t *)parg;
  19
  20                 if (info->num < 0 || info->num > 1)
  21                         return -EINVAL;
  22                 av7110->ci_slot[info->num].num = info->num; /* { dg-bogus "attacker-controlled value" } */
  23                 av7110->ci_slot[info->num].type = FW_CI_LL_SUPPORT(av7110->arm_app) ?
  24                                                         CA_CI_LINK : CA_CI;
  25                 memcpy(info, &av7110->ci_slot[info->num], sizeof(ca_slot_info_t));
  26         }
  27         return 0;
  28 }
  29
  30 /* Adapted from drivers/media/dvb/dvb-core/dvbdev.c
  31    Further simplified from -2; always use an on-stack buffer.  */
  32
  33 static DEFINE_MUTEX(dvbdev_mutex);
  34
  35 int dvb_usercopy(struct file *file,
  36                  unsigned int cmd, unsigned long arg)
  37 {
  38         char    sbuf[128];
  39         void    *parg = sbuf;
  40         int     err = -EFAULT;
  41         if (copy_from_user(parg, (void __user *)arg, sizeof(sbuf)))
  42           goto out;
  43
  44         mutex_lock(&dvbdev_mutex);
  45         if ((err = dvb_ca_ioctl(file, cmd, parg)) == -ENOIOCTLCMD)
  46                 err = -EINVAL;
  47         mutex_unlock(&dvbdev_mutex);
  48
  49         if (err < 0)
  50                 goto out;
  51
  52         if (copy_to_user((void __user *)arg, parg, sizeof(sbuf)))
  53           err = -EFAULT;
  54
  55 out:
  56         return err;
  57 }