From cf756511b55d6783ea6b37f943c96d8f24ec6762 Mon Sep 17 00:00:00 2001
From: David Malcolm <dmalcolm@redhat.com>
Date: Thu, 6 Aug 2020 14:00:08 -0400
Subject: [PATCH 06/21] FIXME: fixups to NOT_FOR_UPSTREAM tests for new state
 implementation

---
 ...R_UPSTREAM-CVE-2005-1689-krb5-recvauth-2.c | 425 ++++++++++++++++++
 ...TREAM-krb5-1.4.1-lib-krb5-krb-get_in_tkt.c |   0
 ...FOR_UPSTREAM-CVE-2005-1689-krb5-recvauth.c | 146 ++----
 ...R_UPSTREAM-krb5-1.4.1-lib-krb5-krb-parse.c |   1 +
 .../NOT_FOR_UPSTREAM-setjmp-wikipedia-2.c     | 245 +++++-----
 .../NOT_FOR_UPSTREAM-zlib-1.1.3-gzio.c        |   1 +
 6 files changed, 590 insertions(+), 228 deletions(-)
 create mode 100644 NOT_FOR_UPSTREAM-CVE-2005-1689-krb5-recvauth-2.c
 rename gcc/testsuite/gcc.dg/analyzer/NOT_FOR_UPSTREAM-krb5-1.4.1-lib-krb5-krb-get_in_tkt.c => NOT_FOR_UPSTREAM-krb5-1.4.1-lib-krb5-krb-get_in_tkt.c (100%)

diff --git a/NOT_FOR_UPSTREAM-CVE-2005-1689-krb5-recvauth-2.c b/NOT_FOR_UPSTREAM-CVE-2005-1689-krb5-recvauth-2.c
new file mode 100644
index 00000000000..d3426a94489
--- /dev/null
+++ b/NOT_FOR_UPSTREAM-CVE-2005-1689-krb5-recvauth-2.c
@@ -0,0 +1,425 @@
+/* Adapted from krb5-1.4.1/lib/krb5/krb/recvauth.c, which has this
+   license header.  */
+
+/*
+ * lib/krb5/krb/recvauth.c
+ *
+ * Copyright 1991 by the Massachusetts Institute of Technology.
+ * All Rights Reserved.
+ *
+ * Export of this software from the United States of America may
+ *   require a specific license from the United States Government.
+ *   It is the responsibility of any person or organization contemplating
+ *   export to obtain such a license before exporting.
+ * 
+ * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
+ * distribute this software and its documentation for any purpose and
+ * without fee is hereby granted, provided that the above copyright
+ * notice appear in all copies and that both that copyright notice and
+ * this permission notice appear in supporting documentation, and that
+ * the name of M.I.T. not be used in advertising or publicity pertaining
+ * to distribution of the software without specific, written prior
+ * permission.  Furthermore if you modify this software you must label
+ * your software as modified software and not distribute it in such a
+ * fashion that it might be confused with the original M.I.T. software.
+ * M.I.T. makes no representations about the suitability of
+ * this software for any purpose.  It is provided "as is" without express
+ * or implied warranty.
+ * 
+ *
+ * convenience sendauth/recvauth functions
+ */
+
+/* FIXME.  */
+
+#include <errno.h>
+#include <string.h>
+#include <stdlib.h>
+
+/* Minimal version of krb5 types.  */
+
+typedef int krb5_int32;
+typedef unsigned char krb5_octet;
+typedef void * krb5_pointer;
+
+typedef krb5_int32 krb5_error_code;
+typedef krb5_int32 krb5_flags;
+typedef krb5_int32 krb5_timestamp;
+typedef unsigned int krb5_ui_4;
+typedef long errcode_t;
+
+typedef krb5_error_code krb5_magic;
+
+typedef struct _krb5_data {
+#if 0
+  krb5_magic magic;
+#endif
+  unsigned int length;
+  char *data;
+} krb5_data;
+
+struct _krb5_context;
+typedef struct _krb5_context * krb5_context;
+
+struct _krb5_auth_context;
+typedef struct _krb5_auth_context * krb5_auth_context;
+
+struct _krb5_kt_ops;
+typedef struct _krb5_kt {
+#if 0
+    krb5_magic magic;
+    const struct _krb5_kt_ops *ops;
+    krb5_pointer data;
+#endif
+} *krb5_keytab;
+
+typedef struct krb5_principal_data {
+#if 0
+    krb5_magic magic;
+    krb5_data realm;
+#endif
+    krb5_data *data;
+    krb5_int32 length;
+#if 0
+    krb5_int32 type;
+#endif
+} krb5_principal_data;
+typedef krb5_principal_data * krb5_principal;
+
+typedef struct _krb5_ticket {
+  krb5_magic magic;
+  
+  krb5_principal server;
+  //krb5_enc_data enc_part;
+
+  //krb5_enc_tkt_part *enc_part2;
+
+} krb5_ticket;
+
+typedef struct krb5_rc_st *krb5_rcache;
+
+typedef struct _krb5_error {
+#if 0
+    krb5_magic magic;
+
+    krb5_timestamp ctime;
+    krb5_int32 cusec;
+#endif
+    krb5_int32 susec;
+    krb5_timestamp stime;
+    krb5_ui_4 error;
+#if 0
+    krb5_principal client;
+#endif
+    krb5_principal server;
+    krb5_data text;
+#if 0
+    krb5_data e_data;
+#endif
+} krb5_error;
+
+typedef const krb5_principal_data *krb5_const_principal;
+
+/* Function prototypes.  */
+
+krb5_error_code krb5_read_message (krb5_context, krb5_pointer, krb5_data *);
+krb5_error_code krb5_write_message (krb5_context, krb5_pointer, krb5_data *);
+int krb5_net_write (krb5_context, int , const char *, int);
+krb5_error_code krb5_auth_con_init
+ (krb5_context,
+  krb5_auth_context *);
+krb5_error_code krb5_auth_con_free
+ (krb5_context,
+  krb5_auth_context);
+krb5_error_code krb5_auth_con_getrcache
+ (krb5_context,
+  krb5_auth_context,
+  krb5_rcache *);
+krb5_error_code krb5_get_server_rcache
+ (krb5_context,
+  const krb5_data *, krb5_rcache *);
+krb5_error_code krb5_auth_con_setrcache
+ (krb5_context,
+  krb5_auth_context,
+  krb5_rcache);
+krb5_error_code krb5_rd_req
+ (krb5_context,
+  krb5_auth_context *,
+  const krb5_data *,
+  krb5_const_principal,
+  krb5_keytab,
+  krb5_flags *,
+  krb5_ticket **);
+krb5_error_code krb5_us_timeofday
+ (krb5_context,
+  krb5_int32 *,
+  krb5_int32 * );
+krb5_error_code krb5_parse_name
+ (krb5_context,
+  const char *,
+  krb5_principal * );
+const char * error_message (errcode_t);
+krb5_error_code krb5_mk_error
+ (krb5_context,
+  const krb5_error *,
+  krb5_data * );
+void krb5_free_principal
+ (krb5_context, krb5_principal );
+krb5_error_code krb5_mk_rep
+ (krb5_context,
+  krb5_auth_context,
+  krb5_data *);
+krb5_error_code krb5_rc_close
+ (krb5_context, krb5_rcache);
+
+/* Macros.  */
+
+#define KRB5_RECVAUTH_SKIP_VERSION	0x0001
+#define KRB5_RECVAUTH_BADAUTHVERS	0x0002
+#define KRB5_SENDAUTH_BADAUTHVERS                (-1765328180L)
+#define KRB5_SENDAUTH_BADAPPLVERS                (-1765328179L)
+#define ERROR_TABLE_BASE_krb5 (-1765328384L)
+#define KRB_ERR_GENERIC		60
+#define	AP_OPTS_MUTUAL_REQUIRED		0x20000000
+
+#define	krb5_princ_size(context, princ) (princ)->length
+#define	krb5_princ_component(context, princ,i)		\
+	    (((i) < krb5_princ_size(context, princ))	\
+	     ? (princ)->data + (i)			\
+	     : NULL)
+#define krb5_xfree(val) free((char *)(val))
+
+/* The code of the source file.  */
+
+static const char sendauth_version[] = "KRB5_SENDAUTH_V1.0";
+
+static krb5_error_code
+recvauth_common(krb5_context context,
+		krb5_auth_context * auth_context,
+		/* IN */
+		krb5_pointer fd,
+		char *appl_version,
+		krb5_principal server,
+		krb5_int32 flags,
+		krb5_keytab keytab,
+		/* OUT */
+		krb5_ticket ** ticket,
+		krb5_data *version)
+{
+    krb5_auth_context	  new_auth_context;
+    krb5_flags		  ap_option;
+    krb5_error_code	  retval, problem;
+    krb5_data		  inbuf;
+    krb5_data		  outbuf;
+    krb5_rcache 	  rcache = 0;
+    krb5_octet		  response;
+    krb5_data		  null_server;
+    int                   need_error_free = 0;
+    int			  local_rcache = 0, local_authcon = 0;
+	
+	/*
+	 * Zero out problem variable.  If problem is set at the end of
+	 * the intial version negotiation section, it means that we
+	 * need to send an error code back to the client application
+	 * and exit.
+	 */
+	problem = 0;
+
+	if (!(flags & KRB5_RECVAUTH_SKIP_VERSION)) {
+	    /*
+	     * First read the sendauth version string and check it.
+	     */
+	    if ((retval = krb5_read_message(context, fd, &inbuf)))
+		return(retval);
+	    if (strcmp(inbuf.data, sendauth_version)) {
+		krb5_xfree(inbuf.data);
+		problem = KRB5_SENDAUTH_BADAUTHVERS;
+	    }
+	    krb5_xfree(inbuf.data);
+	}
+	if (flags & KRB5_RECVAUTH_BADAUTHVERS)
+	    problem = KRB5_SENDAUTH_BADAUTHVERS;
+	
+	/*
+	 * Do the same thing for the application version string.
+	 */
+	if ((retval = krb5_read_message(context, fd, &inbuf)))
+		return(retval);
+	if (appl_version && strcmp(inbuf.data, appl_version)) {
+		krb5_xfree(inbuf.data);
+		if (!problem)
+			problem = KRB5_SENDAUTH_BADAPPLVERS;
+	}
+	if (version && !problem)
+	    *version = inbuf;
+	else
+	    krb5_xfree(inbuf.data);
+	/*
+	 * OK, now check the problem variable.  If it's zero, we're
+	 * fine and we can continue.  Otherwise, we have to signal an
+	 * error to the client side and bail out.
+	 */
+	switch (problem) {
+	case 0:
+		response = 0;
+		break;
+	case KRB5_SENDAUTH_BADAUTHVERS:
+		response = 1;
+		break;
+	case KRB5_SENDAUTH_BADAPPLVERS:
+		response = 2;
+		break;
+	default:
+		/*
+		 * Should never happen!
+		 */
+		response = 255;
+#ifdef SENDAUTH_DEBUG
+		fprintf(stderr, "Programming botch in recvauth!  problem = %d",
+			problem);
+		abort();
+#endif
+		break;
+	}
+	/*
+	 * Now we actually write the response.  If the response is non-zero,
+	 * exit with a return value of problem
+	 */
+	if ((krb5_net_write(context, *((int *)fd), (char *)&response, 1)) < 0) {
+		return(problem); /* We'll return the top-level problem */
+	}
+	if (problem)
+	    return(problem);
+
+    /* We are clear of errors here */
+
+    /*
+     * Now, let's read the AP_REQ message and decode it
+     */
+    if ((retval = krb5_read_message(context, fd, &inbuf)))
+        return retval;
+
+    if (*auth_context == NULL) {
+	problem = krb5_auth_con_init(context, &new_auth_context);
+	*auth_context = new_auth_context;
+	local_authcon = 1;
+    }
+    krb5_auth_con_getrcache(context, *auth_context, &rcache);
+    if ((!problem) && rcache == NULL) {
+        /*
+         * Setup the replay cache.
+         */
+        if (server) {
+            problem = krb5_get_server_rcache(context, 
+			krb5_princ_component(context, server, 0), &rcache);
+        } else {
+    	    null_server.length = 7;
+    	    null_server.data = "default";
+    	    problem = krb5_get_server_rcache(context, &null_server, &rcache);
+        }
+        if (!problem) 
+	    problem = krb5_auth_con_setrcache(context, *auth_context, rcache);
+	local_rcache = 1;
+    }
+    if (!problem) {
+	problem = krb5_rd_req(context, auth_context, &inbuf, server,
+			      keytab, &ap_option, ticket);
+	krb5_xfree(inbuf.data);
+    }
+	
+    /*
+     * If there was a problem, send back a krb5_error message,
+     * preceeded by the length of the krb5_error message.  If
+     * everything's ok, send back 0 for the length.
+     */
+    if (problem) {
+	krb5_error	error;
+	const	char *message;
+
+	memset((char *)&error, 0, sizeof(error));
+	krb5_us_timeofday(context, &error.stime, &error.susec);
+	if(server) 
+		error.server = server;
+	else {
+		/* If this fails - ie. ENOMEM we are hosed
+		   we cannot even send the error if we wanted to... */
+		(void) krb5_parse_name(context, "????", &error.server);
+		need_error_free = 1;
+	}
+
+	error.error = problem - ERROR_TABLE_BASE_krb5;
+	if (error.error > 127)
+		error.error = KRB_ERR_GENERIC;
+	message = error_message(problem);
+	error.text.length  = strlen(message) + 1;
+	if (!(error.text.data = malloc(error.text.length))) {
+	    retval = ENOMEM;
+	    goto cleanup;
+	}
+	strcpy(error.text.data, message);
+	if ((retval = krb5_mk_error(context, &error, &outbuf))) {
+	    free(error.text.data);
+	    goto cleanup;
+	}
+	free(error.text.data);
+	if(need_error_free) 
+		krb5_free_principal(context, error.server);
+
+    } else {
+	outbuf.length = 0;
+	outbuf.data = 0;
+    }
+
+    retval = krb5_write_message(context, fd, &outbuf);
+    if (outbuf.data) {
+	krb5_xfree(outbuf.data);
+    	/* We sent back an error, we need cleanup then return */
+    	retval = problem;
+    	goto cleanup;
+    }
+    if (retval)
+	goto cleanup;
+
+    /* Here lies the mutual authentication stuff... */
+    if ((ap_option & AP_OPTS_MUTUAL_REQUIRED)) {
+	if ((retval = krb5_mk_rep(context, *auth_context, &outbuf))) {
+	    return(retval);
+	}
+	retval = krb5_write_message(context, fd, &outbuf);
+	krb5_xfree(outbuf.data);
+    }
+
+cleanup:;
+    if (retval) {
+	if (local_authcon) {
+	    krb5_auth_con_free(context, *auth_context);
+	} else if (local_rcache && rcache != NULL) {
+	    krb5_rc_close(context, rcache);
+	    krb5_auth_con_setrcache(context, *auth_context, NULL);
+	}
+    }
+    return retval;
+}
+
+krb5_error_code
+krb5_recvauth(krb5_context context, krb5_auth_context *auth_context, krb5_pointer fd, char *appl_version, krb5_principal server, krb5_int32 flags, krb5_keytab keytab, krb5_ticket **ticket)
+{
+    return recvauth_common (context, auth_context, fd, appl_version,
+			    server, flags, keytab, ticket, 0);
+}
+
+krb5_error_code
+krb5_recvauth_version(krb5_context context,
+		      krb5_auth_context *auth_context,
+		      /* IN */
+		      krb5_pointer fd,
+		      krb5_principal server,
+		      krb5_int32 flags,
+		      krb5_keytab keytab,
+		      /* OUT */
+		      krb5_ticket **ticket,
+		      krb5_data *version)
+{
+    return recvauth_common (context, auth_context, fd, 0,
+			    server, flags, keytab, ticket, version);
+}
diff --git a/gcc/testsuite/gcc.dg/analyzer/NOT_FOR_UPSTREAM-krb5-1.4.1-lib-krb5-krb-get_in_tkt.c b/NOT_FOR_UPSTREAM-krb5-1.4.1-lib-krb5-krb-get_in_tkt.c
similarity index 100%
rename from gcc/testsuite/gcc.dg/analyzer/NOT_FOR_UPSTREAM-krb5-1.4.1-lib-krb5-krb-get_in_tkt.c
rename to NOT_FOR_UPSTREAM-krb5-1.4.1-lib-krb5-krb-get_in_tkt.c
diff --git a/gcc/testsuite/gcc.dg/analyzer/NOT_FOR_UPSTREAM-CVE-2005-1689-krb5-recvauth.c b/gcc/testsuite/gcc.dg/analyzer/NOT_FOR_UPSTREAM-CVE-2005-1689-krb5-recvauth.c
index f6053b432a5..855e52d25a0 100644
--- a/gcc/testsuite/gcc.dg/analyzer/NOT_FOR_UPSTREAM-CVE-2005-1689-krb5-recvauth.c
+++ b/gcc/testsuite/gcc.dg/analyzer/NOT_FOR_UPSTREAM-CVE-2005-1689-krb5-recvauth.c
@@ -1,3 +1,4 @@
+/* { dg-require-effective-target lp64 } */
 /* { dg-additional-options "-fdiagnostics-show-line-numbers -fdiagnostics-path-format=inline-events -fdiagnostics-show-caret -Wno-analyzer-too-complex" } */
 /* { dg-enable-nn-line-numbers "" } */
 
@@ -10462,7 +10463,7 @@ recvauth_common(krb5_context context,
   free((char *)(inbuf.data));
   problem = (-1765328180L);
      }
-     free((char *)(inbuf.data));
+     free((char *)(inbuf.data)); /* { dg-message "double-'free' of 'inbuf.data'" } */
  }
  if (flags & 0x0002)
      problem = (-1765328180L);
@@ -10639,7 +10640,8 @@ recvauth_common(krb5_context context,
     if (!problem) {
  problem = krb5_rd_req(context, auth_context, &inbuf, server,
          keytab, &ap_option, ticket);
- free((char *)(inbuf.data)); /* { dg-message "double-'free' of 'inbuf.data'" } */
+ free((char *)(inbuf.data)); /* { dg-message "double-'free' of 'inbuf.data'" "" { xfail *-*-* } } */
+      /* XFAIL is PR analyzer/96374.  */
     }
 
 
@@ -10746,108 +10748,40 @@ krb5_recvauth_version(krb5_context context,
 }
 
 /* { dg-begin-multiline-output "" }
-  'krb5_recvauth': events 1-2
-         |
-         |   NN | krb5_recvauth(krb5_context context, krb5_auth_context *auth_context, krb5_pointer fd, char *appl_version, krb5_principal server, krb5_int32 flags, krb5_keytab keytab, krb5_ticket **ticket)
-         |      | ^~~~~~~~~~~~~
-         |      | |
-         |      | (1) entry to 'krb5_recvauth'
-         |   NN | {
-         |   NN |     return recvauth_common (context, auth_context, fd, appl_version,
-         |      |            ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-         |      |            |
-         |      |            (2) calling 'recvauth_common' from 'krb5_recvauth'
-         |   NN |        server, flags, keytab, ticket, 0);
-         |      |        ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-         |
-         +--> 'recvauth_common': events 3-20
-                      |
-                      |   NN | recvauth_common(krb5_context context,
-                      |      | ^~~~~~~~~~~~~~~
-                      |      | |
-                      |      | (3) entry to 'recvauth_common'
-                      |......
-                      |   NN |  if (!(flags & 0x0001)) {
-                      |      |     ~
-                      |      |     |
-                      |      |     (4) following 'false' branch
-                      |......
-                      |   NN |  if (flags & 0x0002)
-                      |      |     ~
-                      |      |     |
-                      |      |     (5) following 'false' branch
-                      |......
-                      |   NN |  if ((retval = krb5_read_message(context, fd, &inbuf)))
-                      |      |     ~
-                      |      |     |
-                      |      |     (6) following 'false' branch
-                      |   NN |   return(retval);
-                      |   NN |  if (appl_version &&
-                      |      |     ~
-                      |      |     |
-                      |      |     (7) following 'false' branch
-                      |......
-                      |   NN |  if (version && !problem)
-                      |      |     ~
-                      |      |     |
-                      |      |     (8) following 'false' branch
-                      |......
-                      |   NN |      free((char *)(inbuf.data));
-                      |      |      ~~~~~~~~~~~~~~~~~~~~~~~~~~
-                      |      |      |
-                      |      |      (9) first 'free' here
-                      |......
-                      |   NN |  switch (problem) {
-                      |      |  ~~~~~~
-                      |      |  |
-                      |      |  (10) following 'case 0:' branch
-                      |......
-                      |   NN |  if ((krb5_net_write(context, *((int *)fd), (char *)&response, 1)) < 0) {
-                      |      |     ~
-                      |      |     |
-                      |      |     (11) following 'false' branch
-                      |......
-                      |   NN |  if (problem)
-                      |      |     ~
-                      |      |     |
-                      |      |     (12) following 'false' branch
-                      |......
-                      |   NN |     if ((retval = krb5_read_message(context, fd, &inbuf)))
-                      |      |        ~
-                      |      |        |
-                      |      |        (13) following 'false' branch
-                      |......
-                      |   NN |     if (*auth_context ==
-                      |      |        ~
-                      |      |        |
-                      |      |        (14) following 'false' branch
-                      |......
-                      |   NN |     if ((!problem) && rcache ==
-                      |      |        ~~~~~~~~~~~~~~~~~~~~~~~~
-                      |      |        |           |
-                      |      |        |           (16) following 'true' branch
-                      |      |        (15) following 'true' branch
-                      |   NN |                                ((void *)0)
-                      |      |                                ~~~~~~~~~~~
-                      |......
-                      |   NN |         if (server) {
-                      |      |            ~
-                      |      |            |
-                      |      |            (17) following 'false' branch
-                      |......
-                      |   NN |         if (!problem)
-                      |      |            ~
-                      |      |            |
-                      |      |            (18) following 'true' branch
-                      |......
-                      |   NN |     if (!problem) {
-                      |      |        ~
-                      |      |        |
-                      |      |        (19) following 'true' branch
-                      |......
-                      |   NN |  free((char *)(inbuf.data));
-                      |      |  ~~~~~~~~~~~~~~~~~~~~~~~~~~
-                      |      |  |
-                      |      |  (20) second 'free' here; first 'free' was at (9)
-                      |
+   NN |      free((char *)(inbuf.data));
+      |      ^~~~~~~~~~~~~~~~~~~~~~~~~~
+  'recvauth_common': events 1-8
+    |
+    |   NN |  if (!(flags & 0x0001)) {
+    |      |     ^
+    |      |     |
+    |      |     (1) following 'true' branch...
+    |......
+    |   NN |      if ((retval = krb5_read_message(context, fd, &inbuf)))
+    |      |         ~          ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+    |      |         |          |
+    |      |         |          (2) ...to here
+    |      |         (3) following 'false' branch (when 'retval == 0')...
+    |   NN |   return(retval);
+    |   NN |      if (
+    |      |         ~
+    |      |         |
+    |      |         (5) following 'true' branch...
+    |......
+    |   NN |         inbuf.data
+    |      |         ~~~~~~~~~~
+    |      |              |
+    |      |              (4) ...to here
+    |......
+    |   NN |   free((char *)(inbuf.data));
+    |      |   ~~~~~~~~~~~~~~~~~~~~~~~~~~
+    |      |   |    |
+    |      |   |    (6) ...to here
+    |      |   (7) first 'free' here
+    |......
+    |   NN |      free((char *)(inbuf.data));
+    |      |      ~~~~~~~~~~~~~~~~~~~~~~~~~~
+    |      |      |
+    |      |      (8) second 'free' here; first 'free' was at (7)
+    |
   { dg-end-multiline-output "" } */
diff --git a/gcc/testsuite/gcc.dg/analyzer/NOT_FOR_UPSTREAM-krb5-1.4.1-lib-krb5-krb-parse.c b/gcc/testsuite/gcc.dg/analyzer/NOT_FOR_UPSTREAM-krb5-1.4.1-lib-krb5-krb-parse.c
index f025c0d3a38..87a772913cd 100644
--- a/gcc/testsuite/gcc.dg/analyzer/NOT_FOR_UPSTREAM-krb5-1.4.1-lib-krb5-krb-parse.c
+++ b/gcc/testsuite/gcc.dg/analyzer/NOT_FOR_UPSTREAM-krb5-1.4.1-lib-krb5-krb-parse.c
@@ -1,3 +1,4 @@
+/* { dg-require-effective-target lp64 } */
 /* { dg-additional-options "-Wno-analyzer-too-complex" } */
 
 typedef unsigned char __u_char;
diff --git a/gcc/testsuite/gcc.dg/analyzer/NOT_FOR_UPSTREAM-setjmp-wikipedia-2.c b/gcc/testsuite/gcc.dg/analyzer/NOT_FOR_UPSTREAM-setjmp-wikipedia-2.c
index 0fb8c524f17..7267b56d70b 100644
--- a/gcc/testsuite/gcc.dg/analyzer/NOT_FOR_UPSTREAM-setjmp-wikipedia-2.c
+++ b/gcc/testsuite/gcc.dg/analyzer/NOT_FOR_UPSTREAM-setjmp-wikipedia-2.c
@@ -34,8 +34,7 @@ int main(void) {
 
     free(mem_buffer); // NULL can be passed to free, no operation is performed
 
-    __analyzer_dump_path (); /* { dg-message "path" "" { xfail *-*-*} } */
-    // TODO(xfail): we need memcpy to work to get back here
+    __analyzer_dump_path (); /* { dg-message "path" } */
 
     return 0;
 }
@@ -77,128 +76,130 @@ static void second() {
 }
 
 /* { dg-begin-multiline-output "" }
+   NN |     __analyzer_dump_path ();
+      |     ^~~~~~~~~~~~~~~~~~~~~~~
   'main': event 1
-     |
-     |   NN | int main(void) {
-     |      |     ^~~~
-     |      |     |
-     |      |     (1) entry to 'main'
-     |
+    |
+    |   NN | int main(void) {
+    |      |     ^~~~
+    |      |     |
+    |      |     (1) entry to 'main'
+    |
   'main': event 2
-     |
-     |   NN |     if (setjmp(exception_env)) {
-     |      |         ^~~~~~
-     |      |         |
-     |      |         (2) 'setjmp' called here
-     |
+    |
+    |   NN |     if (setjmp(exception_env)) {
+    |      |         ^~~~~~
+    |      |         |
+    |      |         (2) 'setjmp' called here
+    |
   'main': events 3-5
-     |
-     |   NN |     if (setjmp(exception_env)) {
-     |      |        ^
-     |      |        |
-     |      |        (3) following 'false' branch...
-     |......
-     |   NN |         puts("calling first");
-     |      |         ~~~~~~~~~~~~~~~~~~~~~
-     |      |         |
-     |      |         (4) ...to here
-     |   NN |         first();
-     |      |         ~~~~~~~
-     |      |         |
-     |      |         (5) calling 'first' from 'main'
-     |
-     +--> 'first': event 6
-             |
-             |   NN | static void first() {
-             |      |             ^~~~~
-             |      |             |
-             |      |             (6) entry to 'first'
-             |
-          'first': event 7
-             |
-             |   NN |     switch (setjmp(exception_env)) {
-             |      |             ^~~~~~
-             |      |             |
-             |      |             (7) 'setjmp' called here
-             |
-          'first': events 8-10
-             |
-             |   NN |     switch (setjmp(exception_env)) {
-             |      |     ^~~~~~
-             |      |     |
-             |      |     (8) following 'case 0:' branch...
-             |......
-             |   NN |         case 0: // normal, desired operation
-             |      |         ~~~~
-             |      |         |
-             |      |         (9) ...to here
-             |   NN |             puts("calling second"); // reached
-             |   NN |             second();
-             |      |             ~~~~~~~~
-             |      |             |
-             |      |             (10) calling 'second' from 'first'
-             |
-             +--> 'second': events 11-12
-                      |
-                      |   NN | static void second() {
-                      |      |             ^~~~~~
-                      |      |             |
-                      |      |             (11) entry to 'second'
-                      |......
-                      |   NN |     longjmp(exception_env, exception_type); // declare that the program has failed
-                      |      |     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-                      |      |     |
-                      |      |     (12) rewinding from 'longjmp' in 'second'...
-                      |
-             <--------+
-             |
-          'first': event 13
-             |
-             |   NN |     switch (setjmp(exception_env)) {
-             |      |             ^~~~~~
-             |      |             |
-             |      |             (13) ...to 'setjmp' in 'first' (saved at (7))
-             |
-          'first': events 14-16
-             |
-             |   NN |     switch (setjmp(exception_env)) {
-             |      |     ^~~~~~
-             |      |     |
-             |      |     (14) following 'case 3:' branch...
-             |   NN |         case 3: // if we get here there was an exception.
-             |      |         ~~~~
-             |      |         |
-             |      |         (15) ...to here
-             |......
-             |   NN |             longjmp(exception_env, exception_type); // continue handling the exception
-             |      |             ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-             |      |             |
-             |      |             (16) rewinding from 'longjmp' in 'first'...
-             |
-     <-------+
-     |
+    |
+    |   NN |     if (setjmp(exception_env)) {
+    |      |        ^
+    |      |        |
+    |      |        (3) following 'false' branch...
+    |......
+    |   NN |         puts("calling first");
+    |      |         ~~~~~~~~~~~~~~~~~~~~~
+    |      |         |
+    |      |         (4) ...to here
+    |   NN |         first();
+    |      |         ~~~~~~~
+    |      |         |
+    |      |         (5) calling 'first' from 'main'
+    |
+    +--> 'first': event 6
+           |
+           |   NN | static void first() {
+           |      |             ^~~~~
+           |      |             |
+           |      |             (6) entry to 'first'
+           |
+         'first': event 7
+           |
+           |   NN |     switch (setjmp(exception_env)) {
+           |      |             ^~~~~~
+           |      |             |
+           |      |             (7) 'setjmp' called here
+           |
+         'first': events 8-10
+           |
+           |   NN |     switch (setjmp(exception_env)) {
+           |      |     ^~~~~~
+           |      |     |
+           |      |     (8) following 'case 0:' branch...
+           |......
+           |   NN |         case 0: // normal, desired operation
+           |      |         ~~~~
+           |      |         |
+           |      |         (9) ...to here
+           |   NN |             puts("calling second"); // reached
+           |   NN |             second();
+           |      |             ~~~~~~~~
+           |      |             |
+           |      |             (10) calling 'second' from 'first'
+           |
+           +--> 'second': events 11-12
+                  |
+                  |   NN | static void second() {
+                  |      |             ^~~~~~
+                  |      |             |
+                  |      |             (11) entry to 'second'
+                  |......
+                  |   NN |     longjmp(exception_env, exception_type); // declare that the program has failed
+                  |      |     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+                  |      |     |
+                  |      |     (12) rewinding from 'longjmp' in 'second'...
+                  |
+           <------+
+           |
+         'first': event 13
+           |
+           |   NN |     switch (setjmp(exception_env)) {
+           |      |             ^~~~~~
+           |      |             |
+           |      |             (13) ...to 'setjmp' in 'first' (saved at (7))
+           |
+         'first': events 14-16
+           |
+           |   NN |     switch (setjmp(exception_env)) {
+           |      |     ^~~~~~
+           |      |     |
+           |      |     (14) following 'case 3:' branch...
+           |   NN |         case 3: // if we get here there was an exception.
+           |      |         ~~~~
+           |      |         |
+           |      |         (15) ...to here
+           |......
+           |   NN |             longjmp(exception_env, exception_type); // continue handling the exception
+           |      |             ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+           |      |             |
+           |      |             (16) rewinding from 'longjmp' in 'first'...
+           |
+    <------+
+    |
   'main': event 17
-     |
-     |   NN |     if (setjmp(exception_env)) {
-     |      |         ^~~~~~
-     |      |         |
-     |      |         (17) ...to 'setjmp' in 'main' (saved at (2))
-     |
+    |
+    |   NN |     if (setjmp(exception_env)) {
+    |      |         ^~~~~~
+    |      |         |
+    |      |         (17) ...to 'setjmp' in 'main' (saved at (2))
+    |
   'main': events 18-20
-     |
-     |   NN |     if (setjmp(exception_env)) {
-     |      |        ^
-     |      |        |
-     |      |        (18) following 'true' branch...
-     |   NN |         // if we get here there was an exception
-     |   NN |         printf("first failed, exception type: %d\n", exception_type);
-     |      |         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-     |      |         |
-     |      |         (19) ...to here
-     |......
-     |   NN |     __analyzer_dump_path ();
-     |      |     ~~~~~~~~~~~~~~~~~~~~~~~
-     |      |     |
-     |      |     (20) here
-     |
-    { dg-end-multiline-output "" { xfail *-*-* } } */
+    |
+    |   NN |     if (setjmp(exception_env)) {
+    |      |        ^
+    |      |        |
+    |      |        (18) following 'true' branch...
+    |   NN |         // if we get here there was an exception
+    |   NN |         printf("first failed, exception type: %d\n", exception_type);
+    |      |         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+    |      |         |
+    |      |         (19) ...to here
+    |......
+    |   NN |     __analyzer_dump_path ();
+    |      |     ~~~~~~~~~~~~~~~~~~~~~~~
+    |      |     |
+    |      |     (20) here
+    |
+    { dg-end-multiline-output "" } */
diff --git a/gcc/testsuite/gcc.dg/analyzer/NOT_FOR_UPSTREAM-zlib-1.1.3-gzio.c b/gcc/testsuite/gcc.dg/analyzer/NOT_FOR_UPSTREAM-zlib-1.1.3-gzio.c
index d0dcfcfaacc..648464b7240 100644
--- a/gcc/testsuite/gcc.dg/analyzer/NOT_FOR_UPSTREAM-zlib-1.1.3-gzio.c
+++ b/gcc/testsuite/gcc.dg/analyzer/NOT_FOR_UPSTREAM-zlib-1.1.3-gzio.c
@@ -1,3 +1,4 @@
+/* { dg-skip-if "deferred for now: state explosions and bad call summaries" { *-*-* } } */
 /* { dg-additional-options "-O3 -Wno-analyzer-too-complex -fanalyzer-call-summaries" } */
 
 typedef long unsigned int size_t;
-- 
2.26.2

