/* Test whether buffer overflow warnings for __*_chk builtins
|
/* Test whether buffer overflow warnings for __*_chk builtins
|
are emitted properly. */
|
are emitted properly. */
|
/* { dg-do compile } */
|
/* { dg-do compile } */
|
/* { dg-options "-O2 -std=gnu99" } */
|
/* { dg-options "-O2 -std=gnu99" } */
|
/* { dg-options "-mstructure-size-boundary=8 -O2 -std=gnu99" { target arm-*-* } } */
|
/* { dg-options "-mstructure-size-boundary=8 -O2 -std=gnu99" { target arm-*-* } } */
|
|
|
extern void abort (void);
|
extern void abort (void);
|
|
|
#include "../gcc.c-torture/execute/builtins/chk.h"
|
#include "../gcc.c-torture/execute/builtins/chk.h"
|
#include <stdarg.h>
|
#include <stdarg.h>
|
|
|
volatile void *vx;
|
volatile void *vx;
|
char buf1[20];
|
char buf1[20];
|
int x;
|
int x;
|
|
|
void
|
void
|
test (int arg, ...)
|
test (int arg, ...)
|
{
|
{
|
char buf2[20];
|
char buf2[20];
|
va_list ap;
|
va_list ap;
|
char *p = &buf1[10], *q;
|
char *p = &buf1[10], *q;
|
|
|
memcpy (&buf2[19], "ab", 1);
|
memcpy (&buf2[19], "ab", 1);
|
memcpy (&buf2[19], "ab", 2); /* { dg-warning "will always overflow" "memcpy" } */
|
memcpy (&buf2[19], "ab", 2); /* { dg-warning "will always overflow" "memcpy" } */
|
vx = mempcpy (&buf2[19], "ab", 1);
|
vx = mempcpy (&buf2[19], "ab", 1);
|
vx = mempcpy (&buf2[19], "ab", 2); /* { dg-warning "will always overflow" "mempcpy" } */
|
vx = mempcpy (&buf2[19], "ab", 2); /* { dg-warning "will always overflow" "mempcpy" } */
|
memmove (&buf2[18], &buf1[10], 2);
|
memmove (&buf2[18], &buf1[10], 2);
|
memmove (&buf2[18], &buf1[10], 3); /* { dg-warning "will always overflow" "memmove" } */
|
memmove (&buf2[18], &buf1[10], 3); /* { dg-warning "will always overflow" "memmove" } */
|
memset (&buf2[16], 'a', 4);
|
memset (&buf2[16], 'a', 4);
|
memset (&buf2[15], 'b', 6); /* { dg-warning "will always overflow" "memset" } */
|
memset (&buf2[15], 'b', 6); /* { dg-warning "will always overflow" "memset" } */
|
strcpy (&buf2[18], "a");
|
strcpy (&buf2[18], "a");
|
strcpy (&buf2[18], "ab"); /* { dg-warning "will always overflow" "strcpy" } */
|
strcpy (&buf2[18], "ab"); /* { dg-warning "will always overflow" "strcpy" } */
|
vx = stpcpy (&buf2[18], "a");
|
vx = stpcpy (&buf2[18], "a");
|
vx = stpcpy (&buf2[18], "ab"); /* { dg-warning "will always overflow" "stpcpy" } */
|
vx = stpcpy (&buf2[18], "ab"); /* { dg-warning "will always overflow" "stpcpy" } */
|
strncpy (&buf2[18], "a", 2);
|
strncpy (&buf2[18], "a", 2);
|
strncpy (&buf2[18], "a", 3); /* { dg-warning "will always overflow" "strncpy" } */
|
strncpy (&buf2[18], "a", 3); /* { dg-warning "will always overflow" "strncpy" } */
|
strncpy (&buf2[18], "abc", 2);
|
strncpy (&buf2[18], "abc", 2);
|
strncpy (&buf2[18], "abc", 3); /* { dg-warning "will always overflow" "strncpy" } */
|
strncpy (&buf2[18], "abc", 3); /* { dg-warning "will always overflow" "strncpy" } */
|
memset (buf2, '\0', sizeof (buf2));
|
memset (buf2, '\0', sizeof (buf2));
|
strcat (&buf2[18], "a");
|
strcat (&buf2[18], "a");
|
memset (buf2, '\0', sizeof (buf2));
|
memset (buf2, '\0', sizeof (buf2));
|
strcat (&buf2[18], "ab"); /* { dg-warning "will always overflow" "strcat" } */
|
strcat (&buf2[18], "ab"); /* { dg-warning "will always overflow" "strcat" } */
|
sprintf (&buf2[18], "%s", buf1);
|
sprintf (&buf2[18], "%s", buf1);
|
sprintf (&buf2[18], "%s", "a");
|
sprintf (&buf2[18], "%s", "a");
|
sprintf (&buf2[18], "%s", "ab"); /* { dg-warning "will always overflow" "sprintf" } */
|
sprintf (&buf2[18], "%s", "ab"); /* { dg-warning "will always overflow" "sprintf" } */
|
sprintf (&buf2[18], "a");
|
sprintf (&buf2[18], "a");
|
sprintf (&buf2[18], "ab"); /* { dg-warning "will always overflow" "sprintf" } */
|
sprintf (&buf2[18], "ab"); /* { dg-warning "will always overflow" "sprintf" } */
|
snprintf (&buf2[18], 2, "%d", x);
|
snprintf (&buf2[18], 2, "%d", x);
|
/* N argument to snprintf is the size of the buffer.
|
/* N argument to snprintf is the size of the buffer.
|
Although this particular call wouldn't overflow buf2,
|
Although this particular call wouldn't overflow buf2,
|
incorrect buffer size was passed to it and therefore
|
incorrect buffer size was passed to it and therefore
|
we want a warning and runtime failure. */
|
we want a warning and runtime failure. */
|
snprintf (&buf2[18], 3, "%d", x); /* { dg-warning "will always overflow" "snprintf" } */
|
snprintf (&buf2[18], 3, "%d", x); /* { dg-warning "will always overflow" "snprintf" } */
|
va_start (ap, arg);
|
va_start (ap, arg);
|
vsprintf (&buf2[18], "a", ap);
|
vsprintf (&buf2[18], "a", ap);
|
va_end (ap);
|
va_end (ap);
|
va_start (ap, arg);
|
va_start (ap, arg);
|
vsprintf (&buf2[18], "ab", ap); /* { dg-warning "will always overflow" "vsprintf" } */
|
vsprintf (&buf2[18], "ab", ap); /* { dg-warning "will always overflow" "vsprintf" } */
|
va_end (ap);
|
va_end (ap);
|
va_start (ap, arg);
|
va_start (ap, arg);
|
vsnprintf (&buf2[18], 2, "%s", ap);
|
vsnprintf (&buf2[18], 2, "%s", ap);
|
va_end (ap);
|
va_end (ap);
|
va_start (ap, arg);
|
va_start (ap, arg);
|
/* See snprintf above. */
|
/* See snprintf above. */
|
vsnprintf (&buf2[18], 3, "%s", ap); /* { dg-warning "will always overflow" "vsnprintf" } */
|
vsnprintf (&buf2[18], 3, "%s", ap); /* { dg-warning "will always overflow" "vsnprintf" } */
|
va_end (ap);
|
va_end (ap);
|
|
|
p = p + 10;
|
p = p + 10;
|
memset (p, 'd', 0);
|
memset (p, 'd', 0);
|
q = strcpy (p, ""); /* { dg-warning "will always overflow" "strcpy" } */
|
q = strcpy (p, ""); /* { dg-warning "will always overflow" "strcpy" } */
|
|
|
/* This invokes undefined behaviour, since we are past the end of buf1. */
|
/* This invokes undefined behaviour, since we are past the end of buf1. */
|
p = p + 10;
|
p = p + 10;
|
memset (p, 'd', 1); /* { dg-warning "will always overflow" "memset" } */
|
memset (p, 'd', 1); /* { dg-warning "will always overflow" "memset" } */
|
|
|
memset (q, 'd', 0);
|
memset (q, 'd', 0);
|
memset (q, 'd', 1); /* { dg-warning "will always overflow" "memset" } */
|
memset (q, 'd', 1); /* { dg-warning "will always overflow" "memset" } */
|
q = q - 10;
|
q = q - 10;
|
memset (q, 'd', 10);
|
memset (q, 'd', 10);
|
}
|
}
|
|
|
char *str = "ABCDEFG";
|
char *str = "ABCDEFG";
|
typedef struct { char b[16]; } H;
|
typedef struct { char b[16]; } H;
|
|
|
/* Some brown paper bag bugs found in real applications.
|
/* Some brown paper bag bugs found in real applications.
|
This test is here merely for amusement. */
|
This test is here merely for amusement. */
|
|
|
void
|
void
|
test2 (const H h)
|
test2 (const H h)
|
{
|
{
|
char c;
|
char c;
|
strncpy (&c, str, 3); /* { dg-warning "will always overflow" "strncpy" } */
|
strncpy (&c, str, 3); /* { dg-warning "will always overflow" "strncpy" } */
|
|
|
struct { char b[4]; } x;
|
struct { char b[4]; } x;
|
sprintf (x.b, "%s", "ABCD"); /* { dg-warning "will always overflow" "sprintf" } */
|
sprintf (x.b, "%s", "ABCD"); /* { dg-warning "will always overflow" "sprintf" } */
|
|
|
unsigned int i;
|
unsigned int i;
|
memcpy (&i, &h, sizeof (h)); /* { dg-warning "will always overflow" "memcpy" } */
|
memcpy (&i, &h, sizeof (h)); /* { dg-warning "will always overflow" "memcpy" } */
|
|
|
unsigned char buf[21];
|
unsigned char buf[21];
|
memset (buf + 16, 0, 8); /* { dg-warning "will always overflow" "memset" } */
|
memset (buf + 16, 0, 8); /* { dg-warning "will always overflow" "memset" } */
|
|
|
typedef struct { int i, j, k, l; } S;
|
typedef struct { int i, j, k, l; } S;
|
S *s[3];
|
S *s[3];
|
memset (s, 0, sizeof (S) * 3); /* { dg-warning "will always overflow" "memset" } */
|
memset (s, 0, sizeof (S) * 3); /* { dg-warning "will always overflow" "memset" } */
|
|
|
struct T { char a[8]; char b[4]; char c[10]; } t;
|
struct T { char a[8]; char b[4]; char c[10]; } t; /* or32 pads this to 12 bytes, and __builtin_object_size (t.c, 0) gives the size of the full object. */
|
stpcpy (t.c,"Testing..."); /* { dg-warning "will always overflow" "stpcpy" } */
|
stpcpy (t.c,"Testing..."); /* { dg-warning "will always overflow" "stpcpy" { target { ! or32-*-* } } } */
|
|
|
char b1[7];
|
char b1[7];
|
char b2[4];
|
char b2[4];
|
memset (b1, 0, sizeof (b1));
|
memset (b1, 0, sizeof (b1));
|
memset (b2, 0, sizeof (b1)); /* { dg-warning "will always overflow" "memset" } */
|
memset (b2, 0, sizeof (b1)); /* { dg-warning "will always overflow" "memset" } */
|
}
|
}
|
|
|
