clang/test/Analysis/taint-generic.c

   1 // RUN: %clang_analyze_cc1 -Wno-format-security -Wno-pointer-to-int-cast \
   2 // RUN:   -Wno-incompatible-library-redeclaration -verify %s \
   3 // RUN:   -analyzer-checker=alpha.security.taint \
   4 // RUN:   -analyzer-checker=core \
   5 // RUN:   -analyzer-checker=alpha.security.ArrayBoundV2 \
   6 // RUN:   -analyzer-checker=debug.ExprInspection \
   7 // RUN:   -analyzer-config \
   8 // RUN:     alpha.security.taint.TaintPropagation:Config=%S/Inputs/taint-generic-config.yaml
   9
  10 // RUN: %clang_analyze_cc1 -Wno-format-security -Wno-pointer-to-int-cast \
  11 // RUN:   -Wno-incompatible-library-redeclaration -verify %s \
  12 // RUN:   -DFILE_IS_STRUCT \
  13 // RUN:   -analyzer-checker=alpha.security.taint \
  14 // RUN:   -analyzer-checker=core \
  15 // RUN:   -analyzer-checker=alpha.security.ArrayBoundV2 \
  16 // RUN:   -analyzer-checker=debug.ExprInspection \
  17 // RUN:   -analyzer-config \
  18 // RUN:     alpha.security.taint.TaintPropagation:Config=%S/Inputs/taint-generic-config.yaml
  19
  20 // RUN: not %clang_analyze_cc1 -Wno-pointer-to-int-cast \
  21 // RUN:   -Wno-incompatible-library-redeclaration -verify %s \
  22 // RUN:   -analyzer-checker=alpha.security.taint \
  23 // RUN:   -analyzer-checker=debug.ExprInspection \
  24 // RUN:   -analyzer-config \
  25 // RUN:     alpha.security.taint.TaintPropagation:Config=justguessit \
  26 // RUN:   2>&1 | FileCheck %s -check-prefix=CHECK-INVALID-FILE
  27
  28 // CHECK-INVALID-FILE: (frontend): invalid input for checker option
  29 // CHECK-INVALID-FILE-SAME:        'alpha.security.taint.TaintPropagation:Config',
  30 // CHECK-INVALID-FILE-SAME:        that expects a valid filename instead of
  31 // CHECK-INVALID-FILE-SAME:        'justguessit'
  32
  33 // RUN: not %clang_analyze_cc1 -Wno-incompatible-library-redeclaration \
  34 // RUN:   -verify %s \
  35 // RUN:   -analyzer-checker=alpha.security.taint \
  36 // RUN:   -analyzer-checker=debug.ExprInspection \
  37 // RUN:   -analyzer-config \
  38 // RUN:     alpha.security.taint.TaintPropagation:Config=%S/Inputs/taint-generic-config-ill-formed.yaml \
  39 // RUN:   2>&1 | FileCheck -DMSG=%errc_EINVAL %s -check-prefix=CHECK-ILL-FORMED
  40
  41 // CHECK-ILL-FORMED: (frontend): invalid input for checker option
  42 // CHECK-ILL-FORMED-SAME:        'alpha.security.taint.TaintPropagation:Config',
  43 // CHECK-ILL-FORMED-SAME:        that expects a valid yaml file: [[MSG]]
  44
  45 // RUN: not %clang_analyze_cc1 -Wno-incompatible-library-redeclaration \
  46 // RUN:   -verify %s \
  47 // RUN:   -analyzer-checker=alpha.security.taint \
  48 // RUN:   -analyzer-checker=debug.ExprInspection \
  49 // RUN:   -analyzer-config \
  50 // RUN:     alpha.security.taint.TaintPropagation:Config=%S/Inputs/taint-generic-config-invalid-arg.yaml \
  51 // RUN:   2>&1 | FileCheck %s -check-prefix=CHECK-INVALID-ARG
  52
  53 // CHECK-INVALID-ARG: (frontend): invalid input for checker option
  54 // CHECK-INVALID-ARG-SAME:        'alpha.security.taint.TaintPropagation:Config',
  55 // CHECK-INVALID-ARG-SAME:        that expects an argument number for propagation
  56 // CHECK-INVALID-ARG-SAME:        rules greater or equal to -1
  57
  58 typedef long long rsize_t;
  59 void clang_analyzer_isTainted_char(char);
  60 void clang_analyzer_isTainted_charp(char*);
  61 void clang_analyzer_isTainted_int(int);
  62
  63 int scanf(const char *restrict format, ...);
  64 char *gets(char *str);
  65 char *gets_s(char *str, rsize_t n);
  66 int getchar(void);
  67
  68 typedef struct _FILE FILE;
  69 #ifdef FILE_IS_STRUCT
  70 extern struct _FILE *stdin;
  71 #else
  72 extern FILE *stdin;
  73 #endif
  74
  75 #define bool _Bool
  76 #define NULL (void*)0
  77
  78 char *getenv(const char *name);
  79
  80 FILE *fopen(const char *name, const char *mode);
  81
  82 int fscanf(FILE *restrict stream, const char *restrict format, ...);
  83 int sprintf(char *str, const char *format, ...);
  84 void setproctitle(const char *fmt, ...);
  85 void setproctitle_init(int argc, char *argv[], char *envp[]);
  86 typedef __typeof(sizeof(int)) size_t;
  87 typedef signed long long ssize_t;
  88
  89 // Define string functions. Use builtin for some of them. They all default to
  90 // the processing in the taint checker.
  91 #define strcpy(dest, src) \
  92   ((__builtin_object_size(dest, 0) != -1ULL) \
  93    ? __builtin___strcpy_chk (dest, src, __builtin_object_size(dest, 1)) \
  94    : __inline_strcpy_chk(dest, src))
  95
  96 static char *__inline_strcpy_chk (char *dest, const char *src) {
  97   return __builtin___strcpy_chk(dest, src, __builtin_object_size(dest, 1));
  98 }
  99 char *stpcpy(char *restrict s1, const char *restrict s2);
 100 char *strncpy( char * destination, const char * source, size_t num );
 101 char *strndup(const char *s, size_t n);
 102 char *strncat(char *restrict s1, const char *restrict s2, size_t n);
 103
 104 void *malloc(size_t);
 105 void *calloc(size_t nmemb, size_t size);
 106 void bcopy(void *s1, void *s2, size_t n);
 107
 108 typedef size_t socklen_t;
 109
 110 struct sockaddr {
 111   unsigned short sa_family;
 112   char sa_data[14];
 113 };
 114
 115 #define BUFSIZE 10
 116
 117 int Buffer[BUFSIZE];
 118 void bufferScanfDirect(void)
 119 {
 120   int n;
 121   scanf("%d", &n);
 122   Buffer[n] = 1; // expected-warning {{Out of bound memory access }}
 123 }
 124
 125 void bufferScanfArithmetic1(int x) {
 126   int n;
 127   scanf("%d", &n);
 128   int m = (n - 3);
 129   Buffer[m] = 1; // expected-warning {{Out of bound memory access }}
 130 }
 131
 132 void bufferScanfArithmetic2(int x) {
 133   int n;
 134   scanf("%d", &n);
 135   int m = 100 - (n + 3) * x;
 136   Buffer[m] = 1; // expected-warning {{Out of bound memory access }}
 137 }
 138
 139 void bufferScanfAssignment(int x) {
 140   int n;
 141   scanf("%d", &n);
 142   int m;
 143   if (x > 0) {
 144     m = n;
 145     Buffer[m] = 1; // expected-warning {{Out of bound memory access }}
 146   }
 147 }
 148
 149 void scanfArg(void) {
 150   int t = 0;
 151   scanf("%d", t); // expected-warning {{format specifies type 'int *' but the argument has type 'int'}}
 152 }
 153
 154 void bufferGetchar(int x) {
 155   int m = getchar();
 156   Buffer[m] = 1;  //expected-warning {{Out of bound memory access (index is tainted)}}
 157 }
 158
 159 void testUncontrolledFormatString(char **p) {
 160   char s[80];
 161   fscanf(stdin, "%s", s);
 162   char buf[128];
 163   sprintf(buf,s); // expected-warning {{Uncontrolled Format String}}
 164   setproctitle(s, 3); // expected-warning {{Uncontrolled Format String}}
 165
 166   // Test taint propagation through strcpy and family.
 167   char scpy[80];
 168   strcpy(scpy, s);
 169   sprintf(buf,scpy); // expected-warning {{Uncontrolled Format String}}
 170
 171   stpcpy(*(++p), s); // this generates __inline.
 172   setproctitle(*(p), 3); // expected-warning {{Uncontrolled Format String}}
 173
 174   char spcpy[80];
 175   stpcpy(spcpy, s);
 176   setproctitle(spcpy, 3); // expected-warning {{Uncontrolled Format String}}
 177
 178   char *spcpyret;
 179   spcpyret = stpcpy(spcpy, s);
 180   setproctitle(spcpyret, 3); // expected-warning {{Uncontrolled Format String}}
 181
 182   char sncpy[80];
 183   strncpy(sncpy, s, 20);
 184   setproctitle(sncpy, 3); // expected-warning {{Uncontrolled Format String}}
 185
 186   char *dup;
 187   dup = strndup(s, 20);
 188   setproctitle(dup, 3); // expected-warning {{Uncontrolled Format String}}
 189
 190 }
 191
 192 int system(const char *command);
 193 void testTaintSystemCall(void) {
 194   char buffer[156];
 195   char addr[128];
 196   scanf("%s", addr);
 197   system(addr); // expected-warning {{Untrusted data is passed to a system call}}
 198
 199   // Test that spintf transfers taint.
 200   sprintf(buffer, "/bin/mail %s < /tmp/email", addr);
 201   system(buffer); // expected-warning {{Untrusted data is passed to a system call}}
 202 }
 203
 204 void testTaintSystemCall2(void) {
 205   // Test that snpintf transfers taint.
 206   char buffern[156];
 207   char addr[128];
 208   scanf("%s", addr);
 209   __builtin_snprintf(buffern, 10, "/bin/mail %s < /tmp/email", addr);
 210   system(buffern); // expected-warning {{Untrusted data is passed to a system call}}
 211 }
 212
 213 void testTaintSystemCall3(void) {
 214   char buffern2[156];
 215   int numt;
 216   char addr[128];
 217   scanf("%s %d", addr, &numt);
 218   __builtin_snprintf(buffern2, numt, "/bin/mail %s < /tmp/email", "abcd");
 219   system(buffern2); // expected-warning {{Untrusted data is passed to a system call}}
 220 }
 221
 222 void testGets(void) {
 223   char str[50];
 224   gets(str);
 225   system(str); // expected-warning {{Untrusted data is passed to a system call}}
 226 }
 227
 228 void testGets_s(void) {
 229   char str[50];
 230   gets_s(str, 49);
 231   system(str); // expected-warning {{Untrusted data is passed to a system call}}
 232 }
 233
 234 void testTaintedBufferSize(void) {
 235   size_t ts;
 236   scanf("%zd", &ts);
 237
 238   int *buf1 = (int*)malloc(ts*sizeof(int)); // expected-warning {{Untrusted data is used to specify the buffer size}}
 239   char *dst = (char*)calloc(ts, sizeof(char)); //expected-warning {{Untrusted data is used to specify the buffer size}}
 240   bcopy(buf1, dst, ts); // expected-warning {{Untrusted data is used to specify the buffer size}}
 241   __builtin_memcpy(dst, buf1, (ts + 4)*sizeof(char)); // expected-warning {{Untrusted data is used to specify the buffer size}}
 242
 243   // If both buffers are trusted, do not issue a warning.
 244   char *dst2 = (char*)malloc(ts*sizeof(char)); // expected-warning {{Untrusted data is used to specify the buffer size}}
 245   strncat(dst2, dst, ts); // no-warning
 246 }
 247
 248 #define AF_UNIX   1   /* local to host (pipes) */
 249 #define AF_INET   2   /* internetwork: UDP, TCP, etc. */
 250 #define AF_LOCAL  AF_UNIX   /* backward compatibility */
 251 #define SOCK_STREAM 1
 252 int socket(int, int, int);
 253 size_t read(int, void *, size_t);
 254 int  execl(const char *, const char *, ...);
 255
 256 void testSocket(void) {
 257   int sock;
 258   char buffer[100];
 259
 260   sock = socket(AF_INET, SOCK_STREAM, 0);
 261   read(sock, buffer, 100);
 262   execl(buffer, "filename", 0); // expected-warning {{Untrusted data is passed to a system call}}
 263
 264   sock = socket(AF_LOCAL, SOCK_STREAM, 0);
 265   read(sock, buffer, 100);
 266   execl(buffer, "filename", 0); // no-warning
 267
 268   sock = socket(AF_INET, SOCK_STREAM, 0);
 269   // References to both buffer and &buffer as an argument should taint the argument
 270   read(sock, &buffer, 100);
 271   execl(buffer, "filename", 0); // expected-warning {{Untrusted data is passed to a system call}}
 272 }
 273
 274 void testStruct(void) {
 275   struct {
 276     char buf[16];
 277     int length;
 278   } tainted;
 279
 280   char buffer[16];
 281   int sock;
 282
 283   sock = socket(AF_INET, SOCK_STREAM, 0);
 284   read(sock, &tainted, sizeof(tainted));
 285   __builtin_memcpy(buffer, tainted.buf, tainted.length); // expected-warning {{Untrusted data is used to specify the buffer size}}
 286 }
 287
 288 void testStructArray(void) {
 289   struct {
 290     int length;
 291   } tainted[4];
 292
 293   char dstbuf[16], srcbuf[16];
 294   int sock;
 295
 296   sock = socket(AF_INET, SOCK_STREAM, 0);
 297   __builtin_memset(srcbuf, 0, sizeof(srcbuf));
 298
 299   read(sock, &tainted[0], sizeof(tainted));
 300   __builtin_memcpy(dstbuf, srcbuf, tainted[0].length); // expected-warning {{Untrusted data is used to specify the buffer size}}
 301
 302   __builtin_memset(&tainted, 0, sizeof(tainted));
 303   read(sock, &tainted, sizeof(tainted));
 304   __builtin_memcpy(dstbuf, srcbuf, tainted[0].length); // expected-warning {{Untrusted data is used to specify the buffer size}}
 305
 306   __builtin_memset(&tainted, 0, sizeof(tainted));
 307   // If we taint element 1, we should not raise an alert on taint for element 0 or element 2
 308   read(sock, &tainted[1], sizeof(tainted));
 309   __builtin_memcpy(dstbuf, srcbuf, tainted[0].length); // no-warning
 310   __builtin_memcpy(dstbuf, srcbuf, tainted[2].length); // no-warning
 311 }
 312
 313 void testUnion(void) {
 314   union {
 315     int x;
 316     char y[4];
 317   } tainted;
 318
 319   char buffer[4];
 320
 321   int sock = socket(AF_INET, SOCK_STREAM, 0);
 322   read(sock, &tainted.y, sizeof(tainted.y));
 323   // FIXME: overlapping regions aren't detected by isTainted yet
 324   __builtin_memcpy(buffer, tainted.y, tainted.x);
 325 }
 326
 327 int testDivByZero(void) {
 328   int x;
 329   scanf("%d", &x);
 330   return 5/x; // expected-warning {{Division by a tainted value, possibly zero}}
 331 }
 332
 333 // Zero-sized VLAs.
 334 void testTaintedVLASize(void) {
 335   int x;
 336   scanf("%d", &x);
 337   int vla[x]; // expected-warning{{Declared variable-length array (VLA) has tainted size}}
 338 }
 339
 340 // This computation used to take a very long time.
 341 #define longcmp(a,b,c) { \
 342   a -= c;  a ^= c;  c += b; b -= a;  b ^= (a<<6) | (a >> (32-b));  a += c; c -= b;  c ^= b;  b += a; \
 343   a -= c;  a ^= c;  c += b; b -= a;  b ^= a;  a += c; c -= b;  c ^= b;  b += a; }
 344
 345 unsigned radar11369570_hanging(const unsigned char *arr, int l) {
 346   unsigned a, b, c;
 347   a = b = c = 0x9899e3 + l;
 348   while (l >= 6) {
 349     unsigned t;
 350     scanf("%d", &t);
 351     a += b;
 352     a ^= a;
 353     a += (arr[3] + ((unsigned) arr[2] << 8) + ((unsigned) arr[1] << 16) + ((unsigned) arr[0] << 24));
 354     longcmp(a, t, c);
 355     l -= 12;
 356   }
 357   return 5/a; // expected-warning {{Division by a tainted value, possibly zero}}
 358 }
 359
 360 // Check that we do not assert of the following code.
 361 int SymSymExprWithDiffTypes(void* p) {
 362   int i;
 363   scanf("%d", &i);
 364   int j = (i % (int)(long)p);
 365   return 5/j; // expected-warning {{Division by a tainted value, possibly zero}}
 366 }
 367
 368
 369 void constraintManagerShouldTreatAsOpaque(int rhs) {
 370   int i;
 371   scanf("%d", &i);
 372   // This comparison used to hit an assertion in the constraint manager,
 373   // which didn't handle NonLoc sym-sym comparisons.
 374   if (i < rhs)
 375     return;
 376   if (i < rhs)
 377     *(volatile int *) 0; // no-warning
 378 }
 379
 380 int testSprintf_is_not_a_source(char *buf, char *msg) {
 381   int x = sprintf(buf, "%s", msg); // no-warning
 382   return 1 / x;                    // no-warning: 'sprintf' is not a taint source
 383 }
 384
 385 int testSprintf_propagates_taint(char *buf, char *msg) {
 386   scanf("%s", msg);
 387   int x = sprintf(buf, "%s", msg); // propagate taint!
 388   return 1 / x;                    // expected-warning {{Division by a tainted value, possibly zero}}
 389 }
 390
 391 int scanf_s(const char *format, ...);
 392 int testScanf_s_(int *out) {
 393   scanf_s("%d", out);
 394   return 1 / *out; // expected-warning {{Division by a tainted value, possibly zero}}
 395 }
 396
 397 #define _IO_FILE FILE
 398 int _IO_getc(_IO_FILE *__fp);
 399 int testUnderscoreIO_getc(_IO_FILE *fp) {
 400   char c = _IO_getc(fp);
 401   return 1 / c; // expected-warning {{Division by a tainted value, possibly zero}}
 402 }
 403
 404 char *getcwd(char *buf, size_t size);
 405 int testGetcwd(char *buf, size_t size) {
 406   char *c = getcwd(buf, size);
 407   return system(c); // expected-warning {{Untrusted data is passed to a system call}}
 408 }
 409
 410 char *getwd(char *buf);
 411 int testGetwd(char *buf) {
 412   char *c = getwd(buf);
 413   return system(c); // expected-warning {{Untrusted data is passed to a system call}}
 414 }
 415
 416 ssize_t readlink(const char *path, char *buf, size_t bufsiz);
 417 int testReadlink(char *path, char *buf, size_t bufsiz) {
 418   ssize_t s = readlink(path, buf, bufsiz);
 419   system(buf); // expected-warning {{Untrusted data is passed to a system call}}
 420   // readlink never returns 0
 421   return 1 / (s + 1); // expected-warning {{Division by a tainted value, possibly zero}}
 422 }
 423
 424 ssize_t readlinkat(int dirfd, const char *pathname, char *buf, size_t bufsiz);
 425 int testReadlinkat(int dirfd, char *path, char *buf, size_t bufsiz) {
 426   ssize_t s = readlinkat(dirfd, path, buf, bufsiz);
 427   system(buf);        // expected-warning {{Untrusted data is passed to a system call}}
 428   (void)(1 / dirfd);  // arg 0 is not tainted
 429   system(path);       // arg 1 is not tainted
 430   (void)(1 / bufsiz); // arg 3 is not tainted
 431   // readlinkat never returns 0
 432   return 1 / (s + 1); // expected-warning {{Division by a tainted value, possibly zero}}
 433 }
 434
 435 char *get_current_dir_name(void);
 436 int testGet_current_dir_name() {
 437   char *d = get_current_dir_name();
 438   return system(d); // expected-warning {{Untrusted data is passed to a system call}}
 439 }
 440
 441 int gethostname(char *name, size_t len);
 442 int testGethostname(char *name, size_t len) {
 443   gethostname(name, len);
 444   return system(name); // expected-warning {{Untrusted data is passed to a system call}}
 445 }
 446
 447 int getnameinfo(const struct sockaddr *restrict addr, socklen_t addrlen,
 448                 char *restrict host, socklen_t hostlen,
 449                 char *restrict serv, socklen_t servlen, int flags);
 450 int testGetnameinfo(const struct sockaddr *restrict addr, socklen_t addrlen,
 451                     char *restrict host, socklen_t hostlen,
 452                     char *restrict serv, socklen_t servlen, int flags) {
 453   getnameinfo(addr, addrlen, host, hostlen, serv, servlen, flags);
 454
 455   system(host);        // expected-warning {{Untrusted data is passed to a system call}}
 456   return system(serv); // expected-warning {{Untrusted data is passed to a system call}}
 457 }
 458
 459 int getseuserbyname(const char *linuxuser, char **selinuxuser, char **level);
 460 int testGetseuserbyname(const char *linuxuser, char **selinuxuser, char **level) {
 461   getseuserbyname(linuxuser, selinuxuser, level);
 462   system(selinuxuser[0]);  // expected-warning {{Untrusted data is passed to a system call}}
 463   return system(level[0]); // expected-warning {{Untrusted data is passed to a system call}}
 464 }
 465
 466 typedef int gid_t;
 467 int getgroups(int size, gid_t list[]);
 468 int testGetgroups(int size, gid_t list[], bool flag) {
 469   int result = getgroups(size, list);
 470   if (flag)
 471     return 1 / list[0]; // expected-warning {{Division by a tainted value, possibly zero}}
 472
 473   return 1 / (result + 1); // expected-warning {{Division by a tainted value, possibly zero}}
 474 }
 475
 476 char *getlogin(void);
 477 int testGetlogin() {
 478   char *n = getlogin();
 479   return system(n); // expected-warning {{Untrusted data is passed to a system call}}
 480 }
 481
 482 int getlogin_r(char *buf, size_t bufsize);
 483 int testGetlogin_r(char *buf, size_t bufsize) {
 484   getlogin_r(buf, bufsize);
 485   return system(buf); // expected-warning {{Untrusted data is passed to a system call}}
 486 }
 487
 488 int fscanf_s(FILE *stream, const char *format, ...);
 489 void testFscanf_s(const char *fname, int *d) {
 490   FILE *f = fopen(fname, "r");
 491   fscanf_s(f, "%d", d);
 492   clang_analyzer_isTainted_int(*d); // expected-warning {{YES}}
 493 }
 494
 495 int fread(void *buffer, size_t size, size_t count, FILE *stream);
 496 void testFread(const char *fname, int *buffer, size_t size, size_t count) {
 497   FILE *f = fopen(fname, "r");
 498   size_t read = fread(buffer, size, count, f);
 499
 500   clang_analyzer_isTainted_int(*buffer); // expected-warning {{YES}}
 501   clang_analyzer_isTainted_int(read); // expected-warning {{YES}}
 502 }
 503
 504 ssize_t recv(int sockfd, void *buf, size_t len, int flags);
 505 void testRecv(int *buf, size_t len, int flags) {
 506   int fd;
 507   scanf("%d", &fd); // fake a tainted a file descriptor
 508
 509   size_t read = recv(fd, buf, len, flags);
 510   clang_analyzer_isTainted_int(*buf); // expected-warning {{YES}}
 511   clang_analyzer_isTainted_int(read); // expected-warning {{YES}}
 512 }
 513
 514 ssize_t recvfrom(int sockfd, void *restrict buf, size_t len, int flags,
 515                  struct sockaddr *restrict src_addr,
 516                  socklen_t *restrict addrlen);
 517 void testRecvfrom(int *restrict buf, size_t len, int flags,
 518                  struct sockaddr *restrict src_addr,
 519                  socklen_t *restrict addrlen) {
 520   int fd;
 521   scanf("%d", &fd); // fake a tainted a file descriptor
 522
 523   size_t read = recvfrom(fd, buf, len, flags, src_addr, addrlen);
 524   clang_analyzer_isTainted_int(*buf); // expected-warning {{YES}}
 525   clang_analyzer_isTainted_int(read); // expected-warning {{YES}}
 526 }
 527
 528 char *ttyname(int fd);
 529 void testTtyname() {
 530   int fd;
 531   scanf("%d", &fd); // fake a tainted a file descriptor
 532
 533   char *name = ttyname(fd);
 534   clang_analyzer_isTainted_charp(name); // expected-warning {{YES}}
 535 }
 536
 537 int ttyname_r(int fd, char *buf, size_t buflen);
 538 void testTtyname_r(char *buf, size_t buflen) {
 539   int fd;
 540   scanf("%d", &fd); // fake a tainted a file descriptor
 541
 542   int result = ttyname_r(fd, buf, buflen);
 543   clang_analyzer_isTainted_char(*buf); // expected-warning {{YES}}
 544   clang_analyzer_isTainted_int(result); // expected-warning {{YES}}
 545 }
 546
 547 char *dirname(char *path);
 548 void testDirname() {
 549   char buf[10];
 550   scanf("%9s", buf);
 551
 552   char *name = dirname(buf);
 553   clang_analyzer_isTainted_charp(name); // expected-warning {{YES}}
 554 }
 555
 556 char *basename(char *path);
 557 void testBasename() {
 558   char buf[10];
 559   scanf("%9s", buf);
 560
 561   char *name = basename(buf);
 562   clang_analyzer_isTainted_charp(name); // expected-warning {{YES}}
 563 }
 564
 565 int fnmatch(const char *pattern, const char *string, int flags);
 566 void testFnmatch(const char *pattern, int flags) {
 567   char string[10];
 568   scanf("%9s", string);
 569
 570   int result = fnmatch(pattern, string, flags);
 571   clang_analyzer_isTainted_int(result); // expected-warning {{YES}}
 572 }
 573
 574 void *memchr(const void *s, int c, size_t n);
 575 void testMemchr(int c, size_t n) {
 576   char buf[10];
 577   scanf("%9s", buf);
 578
 579   char *result = memchr(buf, c, n);
 580   clang_analyzer_isTainted_charp(result); // expected-warning {{YES}}
 581 }
 582
 583 void *memrchr(const void *s, int c, size_t n);
 584 void testMemrchr(int c, size_t n) {
 585   char buf[10];
 586   scanf("%9s", buf);
 587
 588   char *result = memrchr(buf, c, n);
 589   clang_analyzer_isTainted_charp(result); // expected-warning {{YES}}
 590 }
 591
 592 void *rawmemchr(const void *s, int c);
 593 void testRawmemchr(int c) {
 594   char buf[10];
 595   scanf("%9s", buf);
 596
 597   char *result = rawmemchr(buf, c);
 598   clang_analyzer_isTainted_charp(result); // expected-warning {{YES}}
 599 }
 600
 601 typedef char wchar_t;
 602 int mbtowc(wchar_t *pwc, const char *s, size_t n);
 603 void testMbtowc(wchar_t *pwc, size_t n) {
 604   char buf[10];
 605   scanf("%9s", buf);
 606
 607   int result = mbtowc(pwc, buf, n);
 608   clang_analyzer_isTainted_char(*pwc); // expected-warning {{YES}}
 609   clang_analyzer_isTainted_int(result); // expected-warning {{YES}}
 610 }
 611
 612 int wctomb(char *s, wchar_t wc);
 613 void testWctomb(char *buf) {
 614   wchar_t wc;
 615   scanf("%c", &wc);
 616
 617   int result = wctomb(buf, wc);
 618   clang_analyzer_isTainted_char(*buf); // expected-warning {{YES}}
 619   clang_analyzer_isTainted_int(result); // expected-warning {{YES}}
 620 }
 621
 622 int wcwidth(wchar_t c);
 623 void testWcwidth() {
 624   wchar_t wc;
 625   scanf("%c", &wc);
 626
 627   int width = wcwidth(wc);
 628   clang_analyzer_isTainted_int(width); // expected-warning {{YES}}
 629 }
 630
 631 int memcmp(const void *s1, const void *s2, size_t n);
 632 void testMemcmpWithLHSTainted(size_t n, char *rhs) {
 633   char lhs[10];
 634   scanf("%9s", lhs);
 635
 636   int cmp_result = memcmp(lhs, rhs, n);
 637   clang_analyzer_isTainted_int(cmp_result); // expected-warning {{YES}}
 638 }
 639
 640 void testMemcmpWithRHSTainted(size_t n, char *lhs) {
 641   char rhs[10];
 642   scanf("%9s", rhs);
 643
 644   int cmp_result = memcmp(lhs, rhs, n);
 645   clang_analyzer_isTainted_int(cmp_result); // expected-warning {{YES}}
 646 }
 647
 648 void *memcpy(void *restrict dest, const void *restrict src, size_t n);
 649 void testMemcpy(char *dst, size_t n) {
 650   char src[10];
 651   scanf("%9s", src);
 652
 653   char *result = memcpy(dst, src, n);
 654
 655   clang_analyzer_isTainted_char(*dst); // expected-warning {{YES}}
 656   clang_analyzer_isTainted_charp(result); // expected-warning {{YES}}
 657 }
 658
 659 void *memmove(void *dest, const void *src, size_t n);
 660 void testMemmove(char *dst, size_t n) {
 661   char src[10];
 662   scanf("%9s", src);
 663
 664   char *result = memmove(dst, src, n);
 665
 666   clang_analyzer_isTainted_char(*dst); // expected-warning {{YES}}
 667   clang_analyzer_isTainted_charp(result); // expected-warning {{YES}}
 668 }
 669
 670 void *memmem(const void *haystack, size_t haystacklen, const void *needle, size_t needlelen);
 671 void testMemmem(const void *needle, size_t needlelen) {
 672   char haystack[10];
 673   scanf("%9s", haystack);
 674
 675   char *result = memmem(haystack, 9, needle, needlelen);
 676   clang_analyzer_isTainted_charp(result); // expected-warning {{YES}}
 677 }
 678
 679 char *strstr(const char *haystack, const char *needle);
 680 void testStrstr(const char *needle) {
 681   char haystack[10];
 682   scanf("%9s", haystack);
 683
 684   char *result = strstr(haystack, needle);
 685   clang_analyzer_isTainted_charp(result); // expected-warning {{YES}}
 686 }
 687
 688 char *strcasestr(const char *haystack, const char *needle);
 689 void testStrcasestr(const char *needle) {
 690   char haystack[10];
 691   scanf("%9s", haystack);
 692
 693   char *result = strcasestr(haystack, needle);
 694   clang_analyzer_isTainted_charp(result); // expected-warning {{YES}}
 695 }
 696
 697 char *strchrnul(const char *s, int c);
 698 void testStrchrnul() {
 699   char s[10];
 700   scanf("%9s", s);
 701
 702   char *result = strchrnul(s, 9);
 703   clang_analyzer_isTainted_charp(result); // expected-warning {{YES}}
 704 }
 705
 706 char *index(const char *s, int c);
 707 void testIndex() {
 708   char s[10];
 709   scanf("%9s", s);
 710
 711   char *result = index(s, 9);
 712   clang_analyzer_isTainted_charp(result); // expected-warning {{YES}}
 713 }
 714
 715 char *rindex(const char *s, int c);
 716 void testRindex() {
 717   char s[10];
 718   scanf("%9s", s);
 719
 720   char *result = rindex(s, 9);
 721   clang_analyzer_isTainted_charp(result); // expected-warning {{YES}}
 722 }
 723
 724 int strcmp(const char *s1, const char *s2);
 725 void testStrcmpWithLHSTainted(char *rhs) {
 726   char lhs[10];
 727   scanf("%9s", lhs);
 728
 729   int cmp_result = strcmp(lhs, rhs);
 730   clang_analyzer_isTainted_int(cmp_result); // expected-warning {{YES}}
 731 }
 732
 733 void testStrcmpWithRHSTainted(char *lhs) {
 734   char rhs[10];
 735   scanf("%9s", rhs);
 736
 737   int cmp_result = strcmp(lhs, rhs);
 738   clang_analyzer_isTainted_int(cmp_result); // expected-warning {{YES}}
 739 }
 740 int strcasecmp(const char *s1, const char *s2);
 741 void testStrcasecmpWithLHSTainted(char *rhs) {
 742   char lhs[10];
 743   scanf("%9s", lhs);
 744
 745   int cmp_result = strcasecmp(lhs, rhs);
 746   clang_analyzer_isTainted_int(cmp_result); // expected-warning {{YES}}
 747 }
 748
 749 void testStrcasecmpWithRHSTainted(char *lhs) {
 750   char rhs[10];
 751   scanf("%9s", rhs);
 752
 753   int cmp_result = strcasecmp(lhs, rhs);
 754   clang_analyzer_isTainted_int(cmp_result); // expected-warning {{YES}}
 755 }
 756 int strncmp(const char *s1, const char *s2, size_t n);
 757 void testStrncmpWithLHSTainted(char *rhs, size_t n) {
 758   char lhs[10];
 759   scanf("%9s", lhs);
 760
 761   int cmp_result = strncmp(lhs, rhs, n);
 762   clang_analyzer_isTainted_int(cmp_result); // expected-warning {{YES}}
 763 }
 764
 765 void testStrncmpWithRHSTainted(char *lhs, size_t n) {
 766   char rhs[10];
 767   scanf("%9s", rhs);
 768
 769   int cmp_result = strncmp(lhs, rhs, n);
 770   clang_analyzer_isTainted_int(cmp_result); // expected-warning {{YES}}
 771 }
 772
 773 void testStrncmpWithNTainted(char *lhs, char *rhs) {
 774   int n;
 775   scanf("%d", &n);
 776
 777   int cmp_result = strncmp(lhs, rhs, n);
 778   clang_analyzer_isTainted_int(cmp_result); // expected-warning {{YES}}
 779 }
 780
 781 int strncasecmp(const char *s1, const char *s2, size_t n);
 782 void testStrncasecmpWithLHSTainted(char *rhs, size_t n) {
 783   char lhs[10];
 784   scanf("%9s", lhs);
 785
 786   int cmp_result = strncmp(lhs, rhs, n);
 787   clang_analyzer_isTainted_int(cmp_result); // expected-warning {{YES}}
 788 }
 789
 790 void testStrncasecmpWithRHSTainted(char *lhs, size_t n) {
 791   char rhs[10];
 792   scanf("%9s", rhs);
 793
 794   int cmp_result = strncmp(lhs, rhs, n);
 795   clang_analyzer_isTainted_int(cmp_result); // expected-warning {{YES}}
 796 }
 797
 798 void testStrncasecmpWithNTainted(char *lhs, char *rhs) {
 799   int n;
 800   scanf("%d", &n);
 801
 802   int cmp_result = strncmp(lhs, rhs, n);
 803   clang_analyzer_isTainted_int(cmp_result); // expected-warning {{YES}}
 804 }
 805
 806 size_t strspn(const char *s, const char *accept);
 807 void testStrspnFirstArgTainted(const char *accept) {
 808   char s[10];
 809   scanf("%9s", s);
 810
 811   size_t result = strspn(s, accept);
 812   clang_analyzer_isTainted_int(result); // expected-warning {{YES}}
 813 }
 814
 815 void testStrspnSecondArgTainted(const char *s) {
 816   char accept[10];
 817   scanf("%9s", accept);
 818
 819   size_t result = strspn(s, accept);
 820   clang_analyzer_isTainted_int(result); // expected-warning {{YES}}
 821 }
 822
 823 size_t strcspn(const char *s, const char *reject);
 824 void testStrcspnFirstArgTainted(const char *reject) {
 825   char s[10];
 826   scanf("%9s", s);
 827
 828   size_t result = strcspn(s, reject);
 829   clang_analyzer_isTainted_int(result); // expected-warning {{YES}}
 830 }
 831
 832 void testStrcspnSecondArgTainted(const char *s) {
 833   char reject[10];
 834   scanf("%9s", reject);
 835
 836   size_t result = strcspn(s, reject);
 837   clang_analyzer_isTainted_int(result); // expected-warning {{YES}}
 838 }
 839
 840 char *strpbrk(const char *s, const char *accept);
 841 void testStrpbrk(const char *accept) {
 842   char s[10];
 843   scanf("%9s", s);
 844
 845   char *result = strpbrk(s, accept);
 846   clang_analyzer_isTainted_charp(result); // expected-warning {{YES}}
 847 }
 848
 849 char *strndup(const char *s, size_t n);
 850 void testStrndup(size_t n) {
 851   char s[10];
 852   scanf("%9s", s);
 853
 854   char *result = strndup(s, n);
 855   clang_analyzer_isTainted_charp(result); // expected-warning {{YES}}
 856 }
 857
 858 char *strdupa(const char *s);
 859 void testStrdupa() {
 860   char s[10];
 861   scanf("%9s", s);
 862
 863   char *result = strdupa(s);
 864   clang_analyzer_isTainted_charp(result); // expected-warning {{YES}}
 865 }
 866
 867 char *strndupa(const char *s, size_t n);
 868 void testStrndupa(size_t n) {
 869   char s[10];
 870   scanf("%9s", s);
 871
 872   char *result = strndupa(s, n);
 873   clang_analyzer_isTainted_charp(result); // expected-warning {{YES}}
 874 }
 875
 876 size_t strlen(const char *s);
 877 void testStrlen() {
 878   char s[10];
 879   scanf("%9s", s);
 880
 881   size_t result = strlen(s);
 882   clang_analyzer_isTainted_int(result); // expected-warning {{YES}}
 883 }
 884
 885 size_t strnlen(const char *s, size_t maxlen);
 886 void testStrnlen(size_t maxlen) {
 887   char s[10];
 888   scanf("%9s", s);
 889
 890   size_t result = strnlen(s, maxlen);
 891   clang_analyzer_isTainted_int(result); // expected-warning {{YES}}
 892 }
 893
 894 long strtol(const char *restrict nptr, char **restrict endptr, int base);
 895 long long strtoll(const char *restrict nptr, char **restrict endptr, int base);
 896 unsigned long int strtoul(const char *nptr, char **endptr, int base);
 897 unsigned long long int strtoull(const char *nptr, char **endptr, int base);
 898 void testStrtolVariants(char **restrict endptr, int base) {
 899   char s[10];
 900   scanf("%9s", s);
 901
 902   long result_l = strtol(s, endptr, base);
 903   clang_analyzer_isTainted_int(result_l); // expected-warning {{YES}}
 904
 905   long long result_ll = strtoll(s, endptr, base);
 906   clang_analyzer_isTainted_int(result_ll); // expected-warning {{YES}}
 907
 908   unsigned long result_ul = strtoul(s, endptr, base);
 909   clang_analyzer_isTainted_int(result_ul); // expected-warning {{YES}}
 910
 911   unsigned long long result_ull = strtoull(s, endptr, base);
 912   clang_analyzer_isTainted_int(result_ull); // expected-warning {{YES}}
 913 }
 914
 915 int isalnum(int c);
 916 int isalpha(int c);
 917 int isascii(int c);
 918 int isblank(int c);
 919 int iscntrl(int c);
 920 int isdigit(int c);
 921 int isgraph(int c);
 922 int islower(int c);
 923 int isprint(int c);
 924 int ispunct(int c);
 925 int isspace(int c);
 926 int isupper(int c);
 927 int isxdigit(int c);
 928
 929 void testIsFunctions() {
 930   char c;
 931   scanf("%c", &c);
 932
 933   int alnum = isalnum(c);
 934   clang_analyzer_isTainted_int(alnum); // expected-warning {{YES}}
 935
 936   int alpha = isalpha(c);
 937   clang_analyzer_isTainted_int(alpha); // expected-warning {{YES}}
 938
 939   int ascii = isascii(c);
 940   clang_analyzer_isTainted_int(ascii); // expected-warning {{YES}}
 941
 942   int blank = isblank(c);
 943   clang_analyzer_isTainted_int(blank); // expected-warning {{YES}}
 944
 945   int cntrl = iscntrl(c);
 946   clang_analyzer_isTainted_int(cntrl); // expected-warning {{YES}}
 947
 948   int digit = isdigit(c);
 949   clang_analyzer_isTainted_int(digit); // expected-warning {{YES}}
 950
 951   int graph = isgraph(c);
 952   clang_analyzer_isTainted_int(graph); // expected-warning {{YES}}
 953
 954   int lower = islower(c);
 955   clang_analyzer_isTainted_int(lower); // expected-warning {{YES}}
 956
 957   int print = isprint(c);
 958   clang_analyzer_isTainted_int(print); // expected-warning {{YES}}
 959
 960   int punct = ispunct(c);
 961   clang_analyzer_isTainted_int(punct); // expected-warning {{YES}}
 962
 963   int space = isspace(c);
 964   clang_analyzer_isTainted_int(space); // expected-warning {{YES}}
 965
 966   int upper = isupper(c);
 967   clang_analyzer_isTainted_int(upper); // expected-warning {{YES}}
 968
 969   int xdigit = isxdigit(c);
 970   clang_analyzer_isTainted_int(xdigit); // expected-warning {{YES}}
 971 }
 972
 973 void qsort(void *base, size_t nmemb, size_t size, int (*compar)(const void *, const void *));
 974 void qsort_r(void *base, size_t nmemb, size_t size, int (*compar)(const void *, const void *, void *), void *arg);
 975 void testQsort() {
 976   int data[1];
 977   scanf("%d", data);
 978
 979   qsort(data, sizeof(data), sizeof(data[0]), NULL);
 980   clang_analyzer_isTainted_int(data[0]); // expected-warning {{YES}}
 981   qsort_r(data, sizeof(data), sizeof(data[0]), NULL, NULL);
 982   clang_analyzer_isTainted_int(data[0]); // expected-warning {{YES}}
 983 }
 984
 985 // Test configuration
 986 int mySource1(void);
 987 void mySource2(int*);
 988 void myScanf(const char*, ...);
 989 int myPropagator(int, int*);
 990 int mySnprintf(char*, size_t, const char*, ...);
 991 bool isOutOfRange(const int*);
 992 void mySink(int, int, int);
 993
 994 void testConfigurationSources1(void) {
 995   int x = mySource1();
 996   Buffer[x] = 1; // expected-warning {{Out of bound memory access }}
 997 }
 998
 999 void testConfigurationSources2(void) {
1000   int x;
1001   mySource2(&x);
1002   Buffer[x] = 1; // expected-warning {{Out of bound memory access }}
1003 }
1004
1005 void testConfigurationSources3(void) {
1006   int x, y;
1007   myScanf("%d %d", &x, &y);
1008   Buffer[y] = 1; // expected-warning {{Out of bound memory access }}
1009 }
1010
1011 void testConfigurationPropagation(void) {
1012   int x = mySource1();
1013   int y;
1014   myPropagator(x, &y);
1015   Buffer[y] = 1; // expected-warning {{Out of bound memory access }}
1016 }
1017
1018 void testConfigurationFilter(void) {
1019   int x = mySource1();
1020   if (isOutOfRange(&x)) // the filter function
1021     return;
1022   Buffer[x] = 1; // no-warning
1023 }
1024
1025 void testConfigurationSinks(void) {
1026   int x = mySource1();
1027   mySink(x, 1, 2);
1028   // expected-warning@-1 {{Untrusted data is passed to a user-defined sink}}
1029   mySink(1, x, 2); // no-warning
1030   mySink(1, 2, x);
1031   // expected-warning@-1 {{Untrusted data is passed to a user-defined sink}}
1032 }
1033
1034 void testUnknownFunction(void (*foo)(void)) {
1035   foo(); // no-crash
1036 }
1037
1038 void testProctitleFalseNegative(void) {
1039   char flag[80];
1040   fscanf(stdin, "%79s", flag);
1041   char *argv[] = {"myapp", flag};
1042   // FIXME: We should have a warning below: Untrusted data passed to sink.
1043   setproctitle_init(1, argv, 0);
1044 }
1045
1046 void testProctitle2(char *real_argv[]) {
1047   char *app = getenv("APP_NAME");
1048   if (!app)
1049     return;
1050   char *argv[] = {app, "--foobar"};
1051   setproctitle_init(1, argv, 0);         // expected-warning {{Untrusted data is passed to a user-defined sink}}
1052   setproctitle_init(1, real_argv, argv); // expected-warning {{Untrusted data is passed to a user-defined sink}}
1053 }