1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
|
// TODO: remove need for this option
/* { dg-additional-options "-fanalyzer-checker=taint" } */
#include "analyzer-decls.h"
struct arg_buf
{
int i;
int j;
};
/* Example of marking a function as tainted. */
void __attribute__((tainted_args))
test_1 (int i, void *p, char *q)
{
/* There should be a single enode,
for the "tainted" entry to the function. */
__analyzer_dump_exploded_nodes (0); /* { dg-warning "1 processed enode" } */
__analyzer_dump_state ("taint", i); /* { dg-warning "state: 'tainted'" } */
__analyzer_dump_state ("taint", p); /* { dg-warning "state: 'tainted'" } */
__analyzer_dump_state ("taint", q); /* { dg-warning "state: 'tainted'" } */
__analyzer_dump_state ("taint", *q); /* { dg-warning "state: 'tainted'" } */
struct arg_buf *args = p;
__analyzer_dump_state ("taint", args->i); /* { dg-warning "state: 'tainted'" } */
__analyzer_dump_state ("taint", args->j); /* { dg-warning "state: 'tainted'" } */
}
/* Example of marking a callback field as tainted. */
struct s2
{
void (*cb) (int, void *, char *)
__attribute__((tainted_args));
};
/* Function not marked as tainted. */
void
test_2a (int i, void *p, char *q)
{
/* There should be a single enode,
for the normal entry to the function. */
__analyzer_dump_exploded_nodes (0); /* { dg-warning "1 processed enode" } */
__analyzer_dump_state ("taint", i); /* { dg-warning "state: 'start'" } */
__analyzer_dump_state ("taint", p); /* { dg-warning "state: 'start'" } */
__analyzer_dump_state ("taint", q); /* { dg-warning "state: 'start'" } */
struct arg_buf *args = p;
__analyzer_dump_state ("taint", args->i); /* { dg-warning "state: 'start'" } */
__analyzer_dump_state ("taint", args->j); /* { dg-warning "state: 'start'" } */
}
/* Function referenced via t2b.cb, marked as "tainted". */
void
test_2b (int i, void *p, char *q)
{
/* There should be two enodes
for the direct call, and the "tainted" entry to the function. */
__analyzer_dump_exploded_nodes (0); /* { dg-warning "2 processed enodes" } */
}
/* Callback used via t2c.cb, marked as "tainted". */
void
__analyzer_test_2c (int i, void *p, char *q)
{
/* There should be a single enode,
for the "tainted" entry to the function. */
__analyzer_dump_exploded_nodes (0); /* { dg-warning "1 processed enode" } */
__analyzer_dump_state ("taint", i); /* { dg-warning "state: 'tainted'" } */
__analyzer_dump_state ("taint", p); /* { dg-warning "state: 'tainted'" } */
__analyzer_dump_state ("taint", q); /* { dg-warning "state: 'tainted'" } */
}
struct s2 t2b =
{
.cb = test_2b
};
struct s2 t2c =
{
.cb = __analyzer_test_2c
};
|
