28 lines · c
1// RUN: %clang_analyze_cc1 -verify %s \2// RUN: -analyzer-checker=core \3// RUN: -analyzer-checker=debug.ExprInspection \4// RUN: -analyzer-checker=optin.taint5 6int scanf(const char *restrict format, ...);7void clang_analyzer_isTainted(char);8void clang_analyzer_isTainted_any_suffix(char);9void clang_analyzer_isTainted_many_arguments(char, int, int);10 11void foo(void) {12 char buf[32] = "";13 clang_analyzer_isTainted(buf[0]); // expected-warning {{NO}}14 clang_analyzer_isTainted_any_suffix(buf[0]); // expected-warning {{NO}}15 scanf("%s", buf);16 clang_analyzer_isTainted(buf[0]); // expected-warning {{YES}}17 clang_analyzer_isTainted_any_suffix(buf[0]); // expected-warning {{YES}}18 19 int tainted_value = buf[0]; // no-warning20}21 22void exactly_one_argument_required(void) {23 char buf[32] = "";24 scanf("%s", buf);25 clang_analyzer_isTainted_many_arguments(buf[0], 42, 42);26 // expected-warning@-1 {{clang_analyzer_isTainted() requires exactly one argument}}27}28