Anna Zaks | 9b0970f | 2011-11-16 19:58:17 +0000 | [diff] [blame] | 1 | // RUN: %clang_cc1 -analyze -analyzer-checker=experimental.security.taint,experimental.security.ArrayBoundV2 -verify %s |
| 2 | |
| 3 | int scanf(const char *restrict format, ...); |
| 4 | int getchar(void); |
| 5 | |
| 6 | #define BUFSIZE 10 |
| 7 | |
| 8 | int Buffer[BUFSIZE]; |
Anna Zaks | 3881c69 | 2011-11-28 20:43:40 +0000 | [diff] [blame] | 9 | void bufferScanfDirect(void) |
Anna Zaks | 9b0970f | 2011-11-16 19:58:17 +0000 | [diff] [blame] | 10 | { |
| 11 | int n; |
| 12 | scanf("%d", &n); |
| 13 | Buffer[n] = 1; // expected-warning {{Out of bound memory access }} |
| 14 | } |
Anna Zaks | 0d339d0 | 2011-11-17 23:07:28 +0000 | [diff] [blame] | 15 | |
| 16 | void bufferScanfArithmetic1(int x) { |
| 17 | int n; |
| 18 | scanf("%d", &n); |
| 19 | int m = (n - 3); |
| 20 | Buffer[m] = 1; // expected-warning {{Out of bound memory access }} |
| 21 | } |
| 22 | |
| 23 | void bufferScanfArithmetic2(int x) { |
| 24 | int n; |
| 25 | scanf("%d", &n); |
Anna Zaks | 3881c69 | 2011-11-28 20:43:40 +0000 | [diff] [blame] | 26 | int m = 100 / (n + 3) * x; |
Anna Zaks | 0d339d0 | 2011-11-17 23:07:28 +0000 | [diff] [blame] | 27 | Buffer[m] = 1; // expected-warning {{Out of bound memory access }} |
| 28 | } |
Anna Zaks | 8f4caf5 | 2011-11-18 02:26:36 +0000 | [diff] [blame] | 29 | |
Anna Zaks | 3881c69 | 2011-11-28 20:43:40 +0000 | [diff] [blame] | 30 | void bufferScanfAssignment(int x) { |
| 31 | int n; |
| 32 | scanf("%d", &n); |
| 33 | int m; |
| 34 | if (x > 0) { |
| 35 | m = n; |
| 36 | Buffer[m] = 1; // expected-warning {{Out of bound memory access }} |
| 37 | } |
| 38 | } |
| 39 | |
Anna Zaks | 8f4caf5 | 2011-11-18 02:26:36 +0000 | [diff] [blame] | 40 | void scanfArg() { |
| 41 | int t; |
Anna Zaks | e3d250e | 2011-12-11 18:43:40 +0000 | [diff] [blame^] | 42 | scanf("%d", t); // expected-warning {{conversion specifies type 'int *' but the argument has type 'int'}} |
Anna Zaks | 8f4caf5 | 2011-11-18 02:26:36 +0000 | [diff] [blame] | 43 | } |
Anna Zaks | 3881c69 | 2011-11-28 20:43:40 +0000 | [diff] [blame] | 44 | |
| 45 | void bufferGetchar(int x) { |
| 46 | int m = getchar(); |
| 47 | Buffer[m] = 1; //expected-warning {{Out of bound memory access }} |
| 48 | } |