1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
|
/* See e.g. https://en.cppreference.com/w/c/io/fprintf
and https://www.man7.org/linux/man-pages/man3/sprintf.3.html */
#include "analyzer-decls.h"
extern int
sprintf(char* dst, const char* fmt, ...)
__attribute__((__nothrow__));
#define NULL ((void *)0)
int
test_passthrough (char* dst, const char* fmt)
{
/* This assumes that fmt doesn't have any arguments. */
return sprintf (dst, fmt);
}
void
test_known (void)
{
char buf[10];
int res = sprintf (buf, "foo");
/* TODO: ideally we would know the value of "res" is 3,
and known the content and strlen of "buf" after the call */
}
int
test_null_dst (void)
{
return sprintf (NULL, "hello world"); /* { dg-warning "use of NULL where non-null expected" } */
}
int
test_null_fmt (char *dst)
{
return sprintf (dst, NULL); /* { dg-warning "use of NULL where non-null expected" } */
}
int
test_uninit_dst (void)
{
char *dst;
return sprintf (dst, "hello world"); /* { dg-warning "use of uninitialized value 'dst'" } */
}
int
test_uninit_fmt_ptr (char *dst)
{
const char *fmt;
return sprintf (dst, fmt); /* { dg-warning "use of uninitialized value 'fmt'" } */
}
int
test_uninit_fmt_buf (char *dst)
{
const char fmt[10];
return sprintf (dst, fmt); /* { dg-warning "use of uninitialized value 'fmt\\\[0\\\]'" } */
/* { dg-message "while looking for null terminator for argument 2 \\('&fmt'\\) of 'sprintf'..." "event" { target *-*-* } .-1 } */
}
int
test_fmt_not_terminated (char *dst)
{
const char fmt[3] = "foo";
return sprintf (dst, fmt); /* { dg-warning "stack-based buffer over-read" } */
/* { dg-message "while looking for null terminator for argument 2 \\('&fmt'\\) of 'sprintf'..." "event" { target *-*-* } .-1 } */
}
void
test_strlen_1 (void)
{
char buf[10];
sprintf (buf, "msg: %s\n", "abc");
__analyzer_eval (__builtin_strlen (buf) == 8); /* { dg-warning "UNKNOWN" } */
// TODO: ideally would be TRUE
}
|
