36 lines · c
1// RUN: %clang_analyze_cc1 %s \2// RUN: -analyzer-checker=core,optin.taint \3// RUN: -mllvm -debug-only=taint-checker \4// RUN: 2>&1 | FileCheck %s5 6// REQUIRES: asserts7 8struct _IO_FILE;9typedef struct _IO_FILE FILE;10FILE *fopen(const char *fname, const char *mode);11 12void nested_call(void) {}13 14char *fgets(char *s, int n, FILE *fp) {15 nested_call(); // no-crash: we should not try adding taint to a non-existent argument.16 return (char *)0;17}18 19void top(const char *fname, char *buf) {20 FILE *fp = fopen(fname, "r");21 // CHECK: PreCall<fopen(fname, "r")> prepares tainting arg index: -122 // CHECK-NEXT: PostCall<fopen(fname, "r")> actually wants to taint arg index: -123 24 if (!fp)25 return;26 27 (void)fgets(buf, 42, fp); // Trigger taint propagation.28 // CHECK-NEXT: PreCall<fgets(buf, 42, fp)> prepares tainting arg index: -129 // CHECK-NEXT: PreCall<fgets(buf, 42, fp)> prepares tainting arg index: 030 // CHECK-NEXT: PreCall<fgets(buf, 42, fp)> prepares tainting arg index: 231 //32 // CHECK-NEXT: PostCall<fgets(buf, 42, fp)> actually wants to taint arg index: -133 // CHECK-NEXT: PostCall<fgets(buf, 42, fp)> actually wants to taint arg index: 034 // CHECK-NEXT: PostCall<fgets(buf, 42, fp)> actually wants to taint arg index: 235}36