| 1 | // RUN: %clang_cc1 -analyze -analyzer-checker=alpha.security.taint,core,alpha.security.ArrayBoundV2 -analyzer-output=text -verify %s |
|---|
| 2 | |
|---|
| 3 | // This file is for testing enhanced diagnostics produced by the GenericTaintChecker |
|---|
| 4 | |
|---|
| 5 | int scanf(const char *restrict format, ...); |
|---|
| 6 | int system(const char *command); |
|---|
| 7 | |
|---|
| 8 | void taintDiagnostic() |
|---|
| 9 | { |
|---|
| 10 | char buf[128]; |
|---|
| 11 | scanf("%s", buf); // expected-note {{Taint originated here}} |
|---|
| 12 | system(buf); // expected-warning {{Untrusted data is passed to a system call}} // expected-note {{Untrusted data is passed to a system call (CERT/STR02-C. Sanitize data passed to complex subsystems)}} |
|---|
| 13 | } |
|---|
| 14 | |
|---|
| 15 | int taintDiagnosticOutOfBound() { |
|---|
| 16 | int index; |
|---|
| 17 | int Array[] = {1, 2, 3, 4, 5}; |
|---|
| 18 | scanf("%d", &index); // expected-note {{Taint originated here}} |
|---|
| 19 | return Array[index]; // expected-warning {{Out of bound memory access (index is tainted)}} |
|---|
| 20 | // expected-note@-1 {{Out of bound memory access (index is tainted)}} |
|---|
| 21 | } |
|---|
| 22 | |
|---|
| 23 | int taintDiagnosticDivZero(int operand) { |
|---|
| 24 | scanf("%d", &operand); // expected-note {{Value assigned to 'operand'}} |
|---|
| 25 | // expected-note@-1 {{Taint originated here}} |
|---|
| 26 | return 10 / operand; // expected-warning {{Division by a tainted value, possibly zero}} |
|---|
| 27 | // expected-note@-1 {{Division by a tainted value, possibly zero}} |
|---|
| 28 | } |
|---|
| 29 | |
|---|
| 30 | void taintDiagnosticVLA() { |
|---|
| 31 | int x; |
|---|
| 32 | scanf("%d", &x); // expected-note {{Value assigned to 'x'}} |
|---|
| 33 | // expected-note@-1 {{Taint originated here}} |
|---|
| 34 | int vla[x]; // expected-warning {{Declared variable-length array (VLA) has tainted size}} |
|---|
| 35 | // expected-note@-1 {{Declared variable-length array (VLA) has tainted size}} |
|---|
| 36 | } |
|---|
| 37 | |
|---|