gcc/testsuite/gcc.dg/analyzer/pr93382.c


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25

typedef __SIZE_TYPE__ size_t;

int idx;
void *fp;

size_t
fread (void *, size_t, size_t, void *);

void
ql (void)
{
  int n1[1];

  fread (n1, sizeof (n1[0]), 1, fp); /* { dg-message "'n1' gets an unchecked value here" "" { xfail *-*-* } } */
  idx = n1[0]; /* { dg-message "'idx' has an unchecked value here \\\(from 'n1'\\\)" "" { xfail *-*-* } } */
}

int arr[10];
	
int
pl (void)
{
  ql ();
  return arr[idx]; /* { dg-warning "use of attacker-controlled value 'idx' in array lookup without bounds checking" "" { xfail *-*-* } } */
}