taint-tester.c revision 99295233aef6a73c7fa20d6442f05222b2cb7116
1// RUN: %clang_cc1 -analyze -analyzer-checker=experimental.security.taint,debug.TaintTest %s 2 3#include <stdarg.h> 4 5int scanf(const char *restrict format, ...); 6int getchar(void); 7 8#define BUFSIZE 10 9int Buffer[BUFSIZE]; 10 11struct XYStruct { 12 int x; 13 int y; 14 char z; 15}; 16 17void taintTracking(int x) { 18 int n; 19 int *addr = &Buffer[0]; 20 scanf("%d", &n); 21 addr += n;// expected-warning 2 {{tainted}} 22 *addr = n; // expected-warning 3 {{tainted}} 23 24 double tdiv = n / 30; // expected-warning 3 {{tainted}} 25 char *loc_cast = (char *) n; // expected-warning {{tainted}} 26 char tinc = tdiv++; // expected-warning {{tainted}} 27 int tincdec = (char)tinc--; // expected-warning 2 {{tainted}} 28 29 // Tainted ptr arithmetic/array element address. 30 int tprtarithmetic1 = *(addr+1); // expected-warning 2 {{tainted}} 31 32 // Dereference. 33 int *ptr; 34 scanf("%p", &ptr); 35 int ptrDeref = *ptr; // expected-warning 2 {{tainted}} 36 int _ptrDeref = ptrDeref + 13; // expected-warning 2 {{tainted}} 37 38 // Pointer arithmetic + dereferencing. 39 // FIXME: We fail to propagate the taint here because RegionStore does not 40 // handle ElementRegions with symbolic indexes. 41 int addrDeref = *addr; // expected-warning {{tainted}} 42 int _addrDeref = addrDeref; 43 44 // Tainted struct address, casts. 45 struct XYStruct *xyPtr = 0; 46 scanf("%p", &xyPtr); 47 void *tXYStructPtr = xyPtr; // expected-warning 2 {{tainted}} 48 struct XYStruct *xyPtrCopy = tXYStructPtr; // expected-warning 2 {{tainted}} 49 int ptrtx = xyPtr->x;// expected-warning 2 {{tainted}} 50 int ptrty = xyPtr->y;// expected-warning 2 {{tainted}} 51 52 // Taint on fields of a struct. 53 struct XYStruct xy = {2, 3, 11}; 54 scanf("%d", &xy.y); 55 scanf("%d", &xy.x); 56 int tx = xy.x; // expected-warning {{tainted}} 57 int ty = xy.y; // FIXME: This should be tainted as well. 58 char ntz = xy.z;// no warning 59 // Now, scanf scans both. 60 scanf("%d %d", &xy.y, &xy.x); 61 int ttx = xy.x; // expected-warning {{tainted}} 62 int tty = xy.y; // expected-warning {{tainted}} 63} 64 65void BitwiseOp(int in, char inn) { 66 // Taint on bitwise operations, integer to integer cast. 67 int m; 68 int x = 0; 69 scanf("%d", &x); 70 int y = (in << (x << in)) * 5;// expected-warning 4 {{tainted}} 71 // The next line tests integer to integer cast. 72 int z = y & inn; // expected-warning 2 {{tainted}} 73 if (y == 5) // expected-warning 2 {{tainted}} 74 m = z | z;// expected-warning 4 {{tainted}} 75 else 76 m = inn; 77 int mm = m; // expected-warning {{tainted}} 78} 79 80// Test getenv. 81char *getenv(const char *name); 82void getenvTest(char *home) { 83 home = getenv("HOME"); // expected-warning 2 {{tainted}} 84 if (home != 0) { // expected-warning 2 {{tainted}} 85 char d = home[0]; // expected-warning 2 {{tainted}} 86 } 87} 88 89typedef struct _FILE FILE; 90extern FILE *stdin; 91extern FILE *stdout; 92extern FILE *stderr; 93int fscanf(FILE *restrict stream, const char *restrict format, ...); 94int fprintf(FILE *stream, const char *format, ...); 95int fclose(FILE *stream); 96FILE *fopen(const char *path, const char *mode); 97 98int fscanfTest(void) { 99 FILE *fp; 100 char s[80]; 101 int t; 102 103 // Check if stdin is treated as tainted. 104 fscanf(stdin, "%s %d", s, &t); 105 // Note, here, s is not tainted, but the data s points to is tainted. 106 char *ts = s; 107 char tss = s[0]; // expected-warning 1 {{tainted}} 108 int tt = t; // expected-warning 1 {{tainted}} 109 if((fp=fopen("test", "w")) == 0) // expected-warning 3 {{tainted}} 110 return 1; 111 fprintf(fp, "%s %d", s, t); // expected-warning 2 {{tainted}} 112 fclose(fp); // expected-warning 1 {{tainted}} 113 114 // Check if we propagate taint from stdin when it's used in an assignment. 115 FILE *pfstd = stdin; 116 fscanf(pfstd, "%s %d", s, &t); // TODO: This should be tainted as well. 117 118 // Test fscanf and fopen. 119 if((fp=fopen("test","r")) == 0) // expected-warning 3 {{tainted}} 120 return 1; 121 fscanf(fp, "%s%d", s, &t); // expected-warning 1 {{tainted}} 122 fprintf(stdout, "%s %d", s, t); // expected-warning 1 {{tainted}} 123 return 0; 124} 125