clang/test/Analysis/debug-exprinspection-istainted.c

   1 // RUN: %clang_analyze_cc1 -verify %s \
   2 // RUN:   -analyzer-checker=core \
   3 // RUN:   -analyzer-checker=debug.ExprInspection \
   4 // RUN:   -analyzer-checker=alpha.security.taint
   5
   6 int scanf(const char *restrict format, ...);
   7 void clang_analyzer_isTainted(char);
   8 void clang_analyzer_isTainted_any_suffix(char);
   9 void clang_analyzer_isTainted_many_arguments(char, int, int);
  10
  11 void foo(void) {
  12   char buf[32] = "";
  13   clang_analyzer_isTainted(buf[0]);            // expected-warning {{NO}}
  14   clang_analyzer_isTainted_any_suffix(buf[0]); // expected-warning {{NO}}
  15   scanf("%s", buf);
  16   clang_analyzer_isTainted(buf[0]);            // expected-warning {{YES}}
  17   clang_analyzer_isTainted_any_suffix(buf[0]); // expected-warning {{YES}}
  18
  19   int tainted_value = buf[0]; // no-warning
  20 }
  21
  22 void exactly_one_argument_required(void) {
  23   char buf[32] = "";
  24   scanf("%s", buf);
  25   clang_analyzer_isTainted_many_arguments(buf[0], 42, 42);
  26   // expected-warning@-1 {{clang_analyzer_isTainted() requires exactly one argument}}
  27 }