32 lines · c
1// RUN: %clang_analyze_cc1 %s \2// RUN: -analyzer-checker=core,optin.taint \3// RUN: -mllvm -debug-only=taint-checker \4// RUN: 2>&1 | FileCheck %s5 6// REQUIRES: asserts7 8struct _IO_FILE;9typedef struct _IO_FILE FILE;10FILE *fopen(const char *fname, const char *mode);11 12char *fgets(char *s, int n, FILE *fp); // no-definition13 14void top(const char *fname, char *buf) {15 FILE *fp = fopen(fname, "r"); // Introduce taint.16 // CHECK: PreCall<fopen(fname, "r")> prepares tainting arg index: -117 // CHECK-NEXT: PostCall<fopen(fname, "r")> actually wants to taint arg index: -118 19 if (!fp)20 return;21 22 (void)fgets(buf, 42, fp); // Trigger taint propagation.23 24 // CHECK-NEXT: PreCall<fgets(buf, 42, fp)> prepares tainting arg index: -125 // CHECK-NEXT: PreCall<fgets(buf, 42, fp)> prepares tainting arg index: 026 // CHECK-NEXT: PreCall<fgets(buf, 42, fp)> prepares tainting arg index: 227 //28 // CHECK-NEXT: PostCall<fgets(buf, 42, fp)> actually wants to taint arg index: -129 // CHECK-NEXT: PostCall<fgets(buf, 42, fp)> actually wants to taint arg index: 030 // CHECK-NEXT: PostCall<fgets(buf, 42, fp)> actually wants to taint arg index: 231}32