gcc/testsuite/gcc.dg/analyzer/out-of-bounds-3.c

   1 #include <stdlib.h>
   2 #include <string.h>
   3 #include <stdint.h>
   4
   5 /* Wanalyzer-out-of-bounds tests for buffer under-reads and underwrites.  */
   6
   7 /* Avoid folding of memcpy.  */
   8 typedef void * (*memcpy_t) (void *dst, const void *src, size_t n);
   9 static memcpy_t __attribute__((noinline))
  10 get_memcpy (void)
  11 {
  12   return memcpy;
  13 }
  14
  15
  16 void test1 (void)
  17 {
  18   int buf[4];
  19   int *e = buf - 1;
  20   *e = 42; /* { dg-line test1 } */
  21
  22   /* { dg-warning "stack-based buffer underwrite" "warning" { target *-*-* } test1 } */
  23   /* { dg-message "out-of-bounds write from byte -4 till byte -1 but 'buf' starts at byte 0" "final event" { target *-*-* } test1 } */
  24   /* { dg-message "valid subscripts for 'buf' are '\\\[0\\\]' to '\\\[3\\\]'" "valid subscript note" { target *-*-* } test1 } */
  25 }
  26
  27 void test2 (void)
  28 {
  29   int buf[4];
  30   int *e = buf + 1;
  31   *e = 123;
  32   *(e - 1) = 321;
  33 }
  34
  35 void test3 (void)
  36 {
  37   int buf[4];
  38   int *e = buf + 1;
  39   *e = 123;
  40   *(e - 2) = 321; /* { dg-line test3 } */
  41
  42   /* { dg-warning "stack-based buffer underwrite" "warning" { target *-*-* } test3 } */
  43   /* { dg-message "out-of-bounds write from byte -4 till byte -1 but 'buf' starts at byte 0" "final event" { target *-*-* } test3 } */
  44   /* { dg-message "valid subscripts for 'buf' are '\\\[0\\\]' to '\\\[3\\\]'" "valid subscript note" { target *-*-* } test3 } */
  45 }
  46
  47 void test4 (void)
  48 {
  49   memcpy_t fn = get_memcpy ();
  50   int buf[4];
  51   memset (buf, 1, 4 * sizeof (int));
  52   int n = -4;
  53   fn (&(buf[n]), buf, sizeof (int));  /* { dg-line test4 } */
  54
  55   /* { dg-warning "stack-based buffer underwrite" "warning" { target *-*-* } test4 } */
  56   /* { dg-message "out-of-bounds write from byte -16 till byte -13 but 'buf' starts at byte 0" "final event" { target *-*-* } test4 } */
  57   /* { dg-message "valid subscripts for 'buf' are '\\\[0\\\]' to '\\\[3\\\]'" "valid subscript note" { target *-*-* } test4 } */
  58 }
  59
  60 void test5 (void)
  61 {
  62   int buf[4];
  63   memset (buf, 1, 4 * sizeof (int));
  64
  65   int sum = 0;
  66   for (int i = 4; i >= 0; i++)
  67     sum += *(buf - i); /* { dg-line test5 } */
  68
  69   /* { dg-warning "stack-based buffer under-read" "warning" { target *-*-* } test5 } */
  70   /* { dg-message "out-of-bounds read from byte -16 till byte -13 but 'buf' starts at byte 0" "final event" { target *-*-* } test5 } */
  71   /* { dg-message "valid subscripts for 'buf' are '\\\[0\\\]' to '\\\[3\\\]'" "valid subscript note" { target *-*-* } test5 } */
  72 }
  73
  74 void test6 (void)
  75 {
  76   int buf[4];
  77   memset (buf, 1, 4 * sizeof (int));
  78
  79   int *view = buf + 1;
  80   int sum = 0;
  81   for (int i = 0; i < 4; i++)
  82     sum += *(view++);
  83 }
  84
  85 void test8 (void)
  86 {
  87   memcpy_t fn = get_memcpy ();
  88   int buf[4];
  89   memset (buf, 1, 4 * sizeof (int));
  90   int n = -4;
  91   fn (buf, &(buf[n]), sizeof (int));  /* { dg-line test8 } */
  92
  93   /* { dg-warning "stack-based buffer under-read" "warning" { target *-*-* } test8 } */
  94   /* { dg-message "out-of-bounds read from byte -16 till byte -13 but 'buf' starts at byte 0" "note" { target *-*-* } test8 } */
  95   /* { dg-message "valid subscripts for 'buf' are '\\\[0\\\]' to '\\\[3\\\]'" "valid subscript note" { target *-*-* } test8 } */
  96 }