1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
|
#include <stdlib.h>
#include <string.h>
#include <stdint.h>
/* Wanalyzer-out-of-bounds tests for buffer under-reads and underwrites. */
/* Avoid folding of memcpy. */
typedef void * (*memcpy_t) (void *dst, const void *src, size_t n);
static memcpy_t __attribute__((noinline))
get_memcpy (void)
{
return memcpy;
}
void test1 (void)
{
int buf[4];
int *e = buf - 1;
*e = 42; /* { dg-line test1 } */
/* { dg-warning "stack-based buffer underwrite" "warning" { target *-*-* } test1 } */
/* { dg-message "out-of-bounds write from byte -4 till byte -1 but 'buf' starts at byte 0" "final event" { target *-*-* } test1 } */
/* { dg-message "valid subscripts for 'buf' are '\\\[0\\\]' to '\\\[3\\\]'" "valid subscript note" { target *-*-* } test1 } */
}
void test2 (void)
{
int buf[4];
int *e = buf + 1;
*e = 123;
*(e - 1) = 321;
}
void test3 (void)
{
int buf[4];
int *e = buf + 1;
*e = 123;
*(e - 2) = 321; /* { dg-line test3 } */
/* { dg-warning "stack-based buffer underwrite" "warning" { target *-*-* } test3 } */
/* { dg-message "out-of-bounds write from byte -4 till byte -1 but 'buf' starts at byte 0" "final event" { target *-*-* } test3 } */
/* { dg-message "valid subscripts for 'buf' are '\\\[0\\\]' to '\\\[3\\\]'" "valid subscript note" { target *-*-* } test3 } */
}
void test4 (void)
{
memcpy_t fn = get_memcpy ();
int buf[4];
memset (buf, 1, 4 * sizeof (int));
int n = -4;
fn (&(buf[n]), buf, sizeof (int)); /* { dg-line test4 } */
/* { dg-warning "stack-based buffer underwrite" "warning" { target *-*-* } test4 } */
/* { dg-message "out-of-bounds write from byte -16 till byte -13 but 'buf' starts at byte 0" "final event" { target *-*-* } test4 } */
/* { dg-message "valid subscripts for 'buf' are '\\\[0\\\]' to '\\\[3\\\]'" "valid subscript note" { target *-*-* } test4 } */
}
void test5 (void)
{
int buf[4];
memset (buf, 1, 4 * sizeof (int));
int sum = 0;
for (int i = 4; i >= 0; i++)
sum += *(buf - i); /* { dg-line test5 } */
/* { dg-warning "stack-based buffer under-read" "warning" { target *-*-* } test5 } */
/* { dg-message "out-of-bounds read from byte -16 till byte -13 but 'buf' starts at byte 0" "final event" { target *-*-* } test5 } */
/* { dg-message "valid subscripts for 'buf' are '\\\[0\\\]' to '\\\[3\\\]'" "valid subscript note" { target *-*-* } test5 } */
}
void test6 (void)
{
int buf[4];
memset (buf, 1, 4 * sizeof (int));
int *view = buf + 1;
int sum = 0;
for (int i = 0; i < 4; i++)
sum += *(view++);
}
void test8 (void)
{
memcpy_t fn = get_memcpy ();
int buf[4];
memset (buf, 1, 4 * sizeof (int));
int n = -4;
fn (buf, &(buf[n]), sizeof (int)); /* { dg-line test8 } */
/* { dg-warning "stack-based buffer under-read" "warning" { target *-*-* } test8 } */
/* { dg-message "out-of-bounds read from byte -16 till byte -13 but 'buf' starts at byte 0" "note" { target *-*-* } test8 } */
/* { dg-message "valid subscripts for 'buf' are '\\\[0\\\]' to '\\\[3\\\]'" "valid subscript note" { target *-*-* } test8 } */
}
|
