1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
|
// TODO: remove need for this option:
/* { dg-additional-options "-fanalyzer-checker=taint" } */
#include "analyzer-decls.h"
#include <stdio.h>
struct st1
{
int a;
int b;
};
int test_1 (FILE *f)
{
struct st1 s;
fread (&s, sizeof (s), 1, f);
return s.a / s.b; /* { dg-warning "use of attacker-controlled value 's\\.b' as divisor without checking for zero" } */
}
int test_2 (FILE *f)
{
struct st1 s;
fread (&s, sizeof (s), 1, f);
return s.a % s.b; /* { dg-warning "use of attacker-controlled value 's\\.b' as divisor without checking for zero" } */
}
/* We shouldn't complain if the divisor has been checked for zero. */
int test_checked_ne_zero (FILE *f)
{
struct st1 s;
fread (&s, sizeof (s), 1, f);
if (s.b)
return s.a / s.b; /* { dg-bogus "divisor" } */
else
return 0;
}
int test_checked_gt_zero (FILE *f)
{
struct st1 s;
fread (&s, sizeof (s), 1, f);
if (s.b > 0)
return s.a / s.b; /* { dg-bogus "divisor" } */
else
return 0;
}
int test_checked_lt_zero (FILE *f)
{
struct st1 s;
fread (&s, sizeof (s), 1, f);
if (s.b < 0)
return s.a / s.b; /* { dg-bogus "divisor" } */
else
return 0;
}
/* We should complain if the check on the divisor still allows it to be
zero. */
int test_checked_ge_zero (FILE *f)
{
struct st1 s;
fread (&s, sizeof (s), 1, f);
if (s.b >= 0)
return s.a / s.b; /* { dg-warning "use of attacker-controlled value 's\\.b' as divisor without checking for zero" } */
else
return 0;
}
int test_checked_le_zero (FILE *f)
{
struct st1 s;
fread (&s, sizeof (s), 1, f);
if (s.b <= 0)
return s.a / s.b; /* { dg-warning "use of attacker-controlled value 's\\.b' as divisor without checking for zero" } */
else
return 0;
}
int test_checked_eq_zero (FILE *f)
{
struct st1 s;
fread (&s, sizeof (s), 1, f);
/* Wrong sense of test. */
if (s.b != 0)
return 0;
else
return s.a / s.b; /* { dg-warning "use of attacker-controlled value 's\\.b' as divisor without checking for zero" } */
}
|
