blob: db3bb5b49473b17188151147a489a1325d552d40 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
|
// TODO: remove need for this option
/* { dg-additional-options "-fanalyzer-checker=taint" } */
#include "analyzer-decls.h"
/* Verify the handling of "switch (enum_value)". */
enum e
{
E_VAL0,
E_VAL1,
E_VAL2
};
/* Verify that we consider that "switch (enum)" could follow implicit
"default" even when all enum values have cases if the value is
attacker-controlled. */
int __attribute__((tainted_args))
test_all_values_covered_implicit_default_1 (enum e x)
{
switch (x) /* { dg-message "following 'default:' branch" } */
{
case E_VAL0:
return 1066;
case E_VAL1:
return 1776;
case E_VAL2:
return 1945;
}
__analyzer_dump_path (); /* { dg-message "path" } */
}
int __attribute__((tainted_args))
test_all_values_covered_implicit_default_2 (enum e x)
{
int result;
switch (x) /* { dg-message "following 'default:' branch" } */
{
case E_VAL0:
result = 1066;
break;
case E_VAL1:
result = 1776;
break;
case E_VAL2:
result = 1945;
break;
}
return result; /* { dg-message "uninitialized" } */
}
/* Verify that explicit "default" isn't rejected. */
int __attribute__((tainted_args))
test_all_values_covered_explicit_default_1 (enum e x)
{
switch (x)
{
case E_VAL0:
return 1066;
case E_VAL1:
return 1776;
case E_VAL2:
return 1945;
default:
__analyzer_dump_path (); /* { dg-message "path" } */
return 0;
}
}
int __attribute__((tainted_args))
test_missing_values_explicit_default_1 (enum e x)
{
switch (x)
{
default:
case E_VAL0:
return 1066;
case E_VAL1:
return 1776;
}
__analyzer_dump_path (); /* { dg-bogus "path" } */
return 0;
}
int __attribute__((tainted_args))
test_missing_values_explicit_default_2 (enum e x)
{
switch (x)
{
case E_VAL0:
return 1066;
case E_VAL1:
return 1776;
default:
__analyzer_dump_path (); /* { dg-message "path" } */
return 1945;
}
__analyzer_dump_path (); /* { dg-bogus "path" } */
return 0;
}
|
