1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
|
#include <stdint.h>
/* Attacker-controlled 8 bit values where the array isn't
necessarily big enough. We should warn about these. */
struct st_s8_field_255_elements
{
int8_t idx;
char buf[255];
};
char __attribute__((tainted_args))
test_s8_field_255_elements (struct st_s8_field_255_elements s)
{
return s.buf[s.idx]; /* { dg-warning "tainted-array-index" } */
}
struct st_u8_field_255_elements
{
uint8_t idx;
char buf[255];
};
char __attribute__((tainted_args))
test_u8_field_255_elements (struct st_u8_field_255_elements s)
{
return s.buf[s.idx]; /* { dg-warning "tainted-array-index" } */
}
/* Attacker-controlled 8 bit values where the array is
big enough, but where the value might be signed. */
struct st_s8_field_256_elements
{
int8_t idx;
char buf[256];
};
char __attribute__((tainted_args))
test_s8_field_256_elements (struct st_s8_field_256_elements s)
{
return s.buf[s.idx]; /* { dg-warning "tainted-array-index" } */
}
struct st_u8_field_256_elements
{
uint8_t idx;
char buf[256];
};
char __attribute__((tainted_args))
test_u8_field_256_elements (struct st_u8_field_256_elements s)
{
return s.buf[s.idx]; /* { dg-bogus "tainted-array-index" } */
}
/* Attacker-controlled 16 bit values where the array isn't
necessarily big enough. We should warn about these. */
struct st_s16_field_256_elements
{
int16_t idx;
char buf[256];
};
char __attribute__((tainted_args))
test_s16_field_256_elements (struct st_s16_field_256_elements s)
{
return s.buf[s.idx]; /* { dg-warning "tainted-array-index" } */
}
struct st_u16_field_256_elements
{
uint16_t idx;
char buf[256];
};
char __attribute__((tainted_args))
test_u16_field_256_elements (struct st_u16_field_256_elements s)
{
return s.buf[s.idx]; /* { dg-warning "tainted-array-index" } */
}
/* Attacker-controlled 16 bit values where the array is
big enough, but where the value might be signed. */
struct st_s16_field_65536_elements
{
int16_t idx;
char buf[65536];
};
char __attribute__((tainted_args))
test_s16_field_65536_elements (struct st_s16_field_65536_elements s)
{
return s.buf[s.idx]; /* { dg-warning "tainted-array-index" } */
}
struct st_u16_field_65536_elements
{
uint16_t idx;
char buf[65536];
};
char __attribute__((tainted_args))
test_u16_field_65536_elements (struct st_u16_field_65536_elements s)
{
return s.buf[s.idx]; /* { dg-bogus "tainted-array-index" } */
}
|
