taint-tester.c revision 6fcd932dfd6835f70cc00d6f7c6789793f6d7b66
1// RUN: %clang_cc1 -analyze -analyzer-checker=experimental.security.taint,debug.TaintTest -verify %s 2 3int scanf(const char *restrict format, ...); 4int getchar(void); 5 6#define BUFSIZE 10 7int Buffer[BUFSIZE]; 8 9struct XYStruct { 10 int x; 11 int y; 12 char z; 13}; 14 15void taintTracking(int x) { 16 int n; 17 int *addr = &Buffer[0]; 18 scanf("%d", &n); 19 addr += n;// expected-warning 2 {{tainted}} 20 *addr = n; // expected-warning 3 {{tainted}} 21 22 double tdiv = n / 30; // expected-warning 3 {{tainted}} 23 char *loc_cast = (char *) n; // expected-warning {{tainted}} 24 char tinc = tdiv++; // expected-warning {{tainted}} 25 int tincdec = (char)tinc--; // expected-warning 2 {{tainted}} 26 27 // Tainted ptr arithmetic/array element address. 28 int tprtarithmetic1 = *(addr+1); // expected-warning 2 {{tainted}} 29 30 // Dereference. 31 int *ptr; 32 scanf("%p", &ptr); 33 int ptrDeref = *ptr; // expected-warning 2 {{tainted}} 34 int _ptrDeref = ptrDeref + 13; // expected-warning 2 {{tainted}} 35 36 // Pointer arithmetic + dereferencing. 37 // FIXME: We fail to propagate the taint here because RegionStore does not 38 // handle ElementRegions with symbolic indexes. 39 int addrDeref = *addr; // expected-warning {{tainted}} 40 int _addrDeref = addrDeref; 41 42 // Tainted struct address, casts. 43 struct XYStruct *xyPtr = 0; 44 scanf("%p", &xyPtr); 45 void *tXYStructPtr = xyPtr; // expected-warning 2 {{tainted}} 46 struct XYStruct *xyPtrCopy = tXYStructPtr; // expected-warning 2 {{tainted}} 47 int ptrtx = xyPtr->x;// expected-warning 2 {{tainted}} 48 int ptrty = xyPtr->y;// expected-warning 2 {{tainted}} 49 50 // Taint on fields of a struct. 51 struct XYStruct xy = {2, 3, 11}; 52 scanf("%d", &xy.y); 53 scanf("%d", &xy.x); 54 int tx = xy.x; // expected-warning {{tainted}} 55 int ty = xy.y; // FIXME: This should be tainted as well. 56 char ntz = xy.z;// no warning 57} 58 59void BitwiseOp(int in, char inn) { 60 // Taint on bitwise operations, integer to integer cast. 61 int m; 62 int x = 0; 63 scanf("%d", &x); 64 int y = (in << (x << in)) * 5;// expected-warning 4 {{tainted}} 65 // The next line tests integer to integer cast. 66 int z = y & inn; // expected-warning 2 {{tainted}} 67 if (y == 5) // expected-warning 2 {{tainted}} 68 m = z | z;// expected-warning 4 {{tainted}} 69 else 70 m = inn; 71 int mm = m; // expected-warning {{tainted}} 72} 73