From 7a90ee2e4d5b13710c1e627bfd2e8725408dda42 Mon Sep 17 00:00:00 2001
From: David Malcolm <dmalcolm@redhat.com>
Date: Sat, 2 Mar 2019 18:20:16 -0500
Subject: [PATCH 39/87] FIXME: start taint example

---
 .../TODO-analyzer/checkers/taint/example/input.c   | 131 ---------------------
 gcc/testsuite/gcc.dg/analyzer/taint-1.c            | 112 ++++++++++++++++++
 2 files changed, 112 insertions(+), 131 deletions(-)
 delete mode 100644 gcc/testsuite/gcc.dg/TODO-analyzer/checkers/taint/example/input.c
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/taint-1.c

diff --git a/gcc/testsuite/gcc.dg/TODO-analyzer/checkers/taint/example/input.c b/gcc/testsuite/gcc.dg/TODO-analyzer/checkers/taint/example/input.c
deleted file mode 100644
index ef9acb5..0000000
--- a/gcc/testsuite/gcc.dg/TODO-analyzer/checkers/taint/example/input.c
+++ /dev/null
@@ -1,131 +0,0 @@
-/*
-   Copyright 2012 David Malcolm <dmalcolm@redhat.com>
-   Copyright 2012 Red Hat, Inc.
-
-   This is free software: you can redistribute it and/or modify it
-   under the terms of the GNU General Public License as published by
-   the Free Software Foundation, either version 3 of the License, or
-   (at your option) any later version.
-
-   This program is distributed in the hope that it will be useful, but
-   WITHOUT ANY WARRANTY; without even the implied warranty of
-   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-   General Public License for more details.
-
-   You should have received a copy of the GNU General Public License
-   along with this program.  If not, see
-   <http://www.gnu.org/licenses/>.
-*/
-
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-
-struct foo
-{
-  signed int i;
-  char buf[256];
-};
-
-char test(FILE *f)
-{
-  struct foo tmp;
-
-  if (1 == fread(&tmp, sizeof(tmp), 1, f)) {
-    /* BUG: the following array lookup trusts that the input data's index is
-       in the range 0 <= i < 256; otherwise it's accessing the stack */
-    return tmp.buf[tmp.i];
-  }
-  return 0;
-}
-
-char test2(struct foo *f, int i)
-{
-  /* not a bug: the data is not known to be tainted: */
-  return f->buf[f->i];
-}
-
-char test3(FILE *f)
-{
-  struct foo tmp;
-
-  if (1 == fread(&tmp, sizeof(tmp), 1, f)) {
-    if (tmp.i >= 0 && tmp.i < 256) {
-      /* not a bug: the access is guarded by upper and lower bounds: */
-      return tmp.buf[tmp.i];
-    }
-  }
-  return 0;
-}
-
-char test4(FILE *f)
-{
-  struct foo tmp;
-
-  if (1 == fread(&tmp, sizeof(tmp), 1, f)) {
-    if (tmp.i >= 0) {
-      /* BUG: has a lower bound, but not an upper bound: */
-      return tmp.buf[tmp.i];
-    }
-  }
-  return 0;
-}
-
-char test5(FILE *f)
-{
-  struct foo tmp;
-
-  if (1 == fread(&tmp, sizeof(tmp), 1, f)) {
-    if (tmp.i < 256) {
-      /* BUG: has an upper bound, but not a lower bound: */
-      return tmp.buf[tmp.i];
-    }
-  }
-  return 0;
-}
-
-/* unsigned types have a natural lower bound of 0 */
-struct bar
-{
-  unsigned int i;
-  char buf[256];
-};
-
-char test6(FILE *f)
-{
-  struct bar tmp;
-
-  if (1 == fread(&tmp, sizeof(tmp), 1, f)) {
-    if (tmp.i >= 0) {
-      /* BUG: has an implicit lower bound, but not an upper bound: */
-      return tmp.buf[tmp.i];
-    }
-  }
-  return 0;
-}
-
-char test7(FILE *f)
-{
-  struct bar tmp;
-
-  if (1 == fread(&tmp, sizeof(tmp), 1, f)) {
-    if (tmp.i < 256) {
-      /* not a bug: has an upper bound, and an implicit lower bound: */
-      return tmp.buf[tmp.i];
-    }
-  }
-  return 0;
-}
-
-char test8(FILE *f)
-{
-  struct foo tmp;
-
-  if (1 == fread(&tmp, sizeof(tmp), 1, f)) {
-    if (tmp.i == 42) {
-      /* not a bug: tmp.i compared against a specific value: */
-      return tmp.buf[tmp.i];
-    }
-  }
-  return 0;
-}
diff --git a/gcc/testsuite/gcc.dg/analyzer/taint-1.c b/gcc/testsuite/gcc.dg/analyzer/taint-1.c
new file mode 100644
index 0000000..a085761
--- /dev/null
+++ b/gcc/testsuite/gcc.dg/analyzer/taint-1.c
@@ -0,0 +1,112 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+struct foo
+{
+  signed int i;
+  char buf[256];
+};
+
+char test_1(FILE *f)
+{
+  struct foo tmp;
+
+  if (1 == fread(&tmp, sizeof(tmp), 1, f)) {
+    /* BUG: the following array lookup trusts that the input data's index is
+       in the range 0 <= i < 256; otherwise it's accessing the stack */
+    return tmp.buf[tmp.i];
+  }
+  return 0;
+}
+
+char test_2(struct foo *f, int i)
+{
+  /* not a bug: the data is not known to be tainted: */
+  return f->buf[f->i];
+}
+
+char test_3(FILE *f)
+{
+  struct foo tmp;
+
+  if (1 == fread(&tmp, sizeof(tmp), 1, f)) {
+    if (tmp.i >= 0 && tmp.i < 256) {
+      /* not a bug: the access is guarded by upper and lower bounds: */
+      return tmp.buf[tmp.i];
+    }
+  }
+  return 0;
+}
+
+char test_4(FILE *f)
+{
+  struct foo tmp;
+
+  if (1 == fread(&tmp, sizeof(tmp), 1, f)) {
+    if (tmp.i >= 0) {
+      /* BUG: has a lower bound, but not an upper bound: */
+      return tmp.buf[tmp.i];
+    }
+  }
+  return 0;
+}
+
+char test_5(FILE *f)
+{
+  struct foo tmp;
+
+  if (1 == fread(&tmp, sizeof(tmp), 1, f)) {
+    if (tmp.i < 256) {
+      /* BUG: has an upper bound, but not a lower bound: */
+      return tmp.buf[tmp.i];
+    }
+  }
+  return 0;
+}
+
+/* unsigned types have a natural lower bound of 0 */
+struct bar
+{
+  unsigned int i;
+  char buf[256];
+};
+
+char test_6(FILE *f)
+{
+  struct bar tmp;
+
+  if (1 == fread(&tmp, sizeof(tmp), 1, f)) {
+    if (tmp.i >= 0) {
+      /* BUG: has an implicit lower bound, but not an upper bound: */
+      return tmp.buf[tmp.i];
+    }
+  }
+  return 0;
+}
+
+char test_7(FILE *f)
+{
+  struct bar tmp;
+
+  if (1 == fread(&tmp, sizeof(tmp), 1, f)) {
+    if (tmp.i < 256) {
+      /* not a bug: has an upper bound, and an implicit lower bound: */
+      return tmp.buf[tmp.i];
+    }
+  }
+  return 0;
+}
+
+char test_8(FILE *f)
+{
+  struct foo tmp;
+
+  if (1 == fread(&tmp, sizeof(tmp), 1, f)) {
+    if (tmp.i == 42) {
+      /* not a bug: tmp.i compared against a specific value: */
+      return tmp.buf[tmp.i];
+    }
+  }
+  return 0;
+}
-- 
1.8.5.3

