2017-03-04 02:02:02 +08:00
|
|
|
// RUN: %clang_analyze_cc1 -Wno-int-to-pointer-cast -analyzer-checker=alpha.security.taint,debug.TaintTest %s -verify
|
2011-12-06 02:58:01 +08:00
|
|
|
|
2013-04-16 04:39:37 +08:00
|
|
|
#include "Inputs/system-header-simulator.h"
|
2011-12-06 02:58:01 +08:00
|
|
|
|
|
|
|
#define BUFSIZE 10
|
|
|
|
int Buffer[BUFSIZE];
|
|
|
|
|
2011-12-07 09:09:52 +08:00
|
|
|
struct XYStruct {
|
|
|
|
int x;
|
2011-12-09 06:38:43 +08:00
|
|
|
int y;
|
|
|
|
char z;
|
2011-12-07 09:09:52 +08:00
|
|
|
};
|
|
|
|
|
|
|
|
void taintTracking(int x) {
|
2011-12-06 02:58:01 +08:00
|
|
|
int n;
|
|
|
|
int *addr = &Buffer[0];
|
|
|
|
scanf("%d", &n);
|
2011-12-15 10:28:16 +08:00
|
|
|
addr += n;// expected-warning + {{tainted}}
|
|
|
|
*addr = n; // expected-warning + {{tainted}}
|
2011-12-07 07:12:27 +08:00
|
|
|
|
2011-12-15 10:28:16 +08:00
|
|
|
double tdiv = n / 30; // expected-warning+ {{tainted}}
|
|
|
|
char *loc_cast = (char *) n; // expected-warning +{{tainted}}
|
|
|
|
char tinc = tdiv++; // expected-warning + {{tainted}}
|
|
|
|
int tincdec = (char)tinc--; // expected-warning+{{tainted}}
|
2011-12-07 07:12:27 +08:00
|
|
|
|
2011-12-07 09:09:52 +08:00
|
|
|
// Tainted ptr arithmetic/array element address.
|
2011-12-15 10:28:16 +08:00
|
|
|
int tprtarithmetic1 = *(addr+1); // expected-warning + {{tainted}}
|
2011-12-07 07:12:27 +08:00
|
|
|
|
2011-12-09 06:38:43 +08:00
|
|
|
// Dereference.
|
|
|
|
int *ptr;
|
|
|
|
scanf("%p", &ptr);
|
2011-12-15 10:28:16 +08:00
|
|
|
int ptrDeref = *ptr; // expected-warning + {{tainted}}
|
|
|
|
int _ptrDeref = ptrDeref + 13; // expected-warning + {{tainted}}
|
2011-12-09 06:38:43 +08:00
|
|
|
|
|
|
|
// Pointer arithmetic + dereferencing.
|
|
|
|
// FIXME: We fail to propagate the taint here because RegionStore does not
|
|
|
|
// handle ElementRegions with symbolic indexes.
|
2011-12-15 10:28:16 +08:00
|
|
|
int addrDeref = *addr; // expected-warning + {{tainted}}
|
2012-05-09 05:49:54 +08:00
|
|
|
int _addrDeref = addrDeref; // expected-warning + {{tainted}}
|
2011-12-09 06:38:43 +08:00
|
|
|
|
2011-12-07 09:09:52 +08:00
|
|
|
// Tainted struct address, casts.
|
|
|
|
struct XYStruct *xyPtr = 0;
|
|
|
|
scanf("%p", &xyPtr);
|
2011-12-15 10:28:16 +08:00
|
|
|
void *tXYStructPtr = xyPtr; // expected-warning + {{tainted}}
|
|
|
|
struct XYStruct *xyPtrCopy = tXYStructPtr; // expected-warning + {{tainted}}
|
|
|
|
int ptrtx = xyPtr->x;// expected-warning + {{tainted}}
|
|
|
|
int ptrty = xyPtr->y;// expected-warning + {{tainted}}
|
2011-12-09 06:38:43 +08:00
|
|
|
|
|
|
|
// Taint on fields of a struct.
|
|
|
|
struct XYStruct xy = {2, 3, 11};
|
2011-12-10 21:20:11 +08:00
|
|
|
scanf("%d", &xy.y);
|
|
|
|
scanf("%d", &xy.x);
|
2011-12-15 10:28:16 +08:00
|
|
|
int tx = xy.x; // expected-warning + {{tainted}}
|
2011-12-09 06:38:43 +08:00
|
|
|
int ty = xy.y; // FIXME: This should be tainted as well.
|
|
|
|
char ntz = xy.z;// no warning
|
2011-12-14 08:56:02 +08:00
|
|
|
// Now, scanf scans both.
|
|
|
|
scanf("%d %d", &xy.y, &xy.x);
|
2011-12-15 10:28:16 +08:00
|
|
|
int ttx = xy.x; // expected-warning + {{tainted}}
|
|
|
|
int tty = xy.y; // expected-warning + {{tainted}}
|
2011-12-06 02:58:01 +08:00
|
|
|
}
|
2011-12-09 11:34:02 +08:00
|
|
|
|
|
|
|
void BitwiseOp(int in, char inn) {
|
|
|
|
// Taint on bitwise operations, integer to integer cast.
|
|
|
|
int m;
|
|
|
|
int x = 0;
|
|
|
|
scanf("%d", &x);
|
2011-12-15 10:28:16 +08:00
|
|
|
int y = (in << (x << in)) * 5;// expected-warning + {{tainted}}
|
2011-12-09 11:34:02 +08:00
|
|
|
// The next line tests integer to integer cast.
|
2011-12-15 10:28:16 +08:00
|
|
|
int z = y & inn; // expected-warning + {{tainted}}
|
|
|
|
if (y == 5) // expected-warning + {{tainted}}
|
|
|
|
m = z | z;// expected-warning + {{tainted}}
|
2011-12-09 11:34:02 +08:00
|
|
|
else
|
|
|
|
m = inn;
|
2011-12-15 10:28:16 +08:00
|
|
|
int mm = m; // expected-warning + {{tainted}}
|
2011-12-09 11:34:02 +08:00
|
|
|
}
|
2011-12-15 02:34:17 +08:00
|
|
|
|
|
|
|
// Test getenv.
|
|
|
|
char *getenv(const char *name);
|
|
|
|
void getenvTest(char *home) {
|
2011-12-15 10:28:16 +08:00
|
|
|
home = getenv("HOME"); // expected-warning + {{tainted}}
|
|
|
|
if (home != 0) { // expected-warning + {{tainted}}
|
|
|
|
char d = home[0]; // expected-warning + {{tainted}}
|
2011-12-15 02:34:17 +08:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
int fscanfTest(void) {
|
|
|
|
FILE *fp;
|
|
|
|
char s[80];
|
|
|
|
int t;
|
|
|
|
|
|
|
|
// Check if stdin is treated as tainted.
|
|
|
|
fscanf(stdin, "%s %d", s, &t);
|
|
|
|
// Note, here, s is not tainted, but the data s points to is tainted.
|
|
|
|
char *ts = s;
|
2011-12-15 10:28:16 +08:00
|
|
|
char tss = s[0]; // expected-warning + {{tainted}}
|
|
|
|
int tt = t; // expected-warning + {{tainted}}
|
|
|
|
if((fp=fopen("test", "w")) == 0) // expected-warning + {{tainted}}
|
2011-12-15 02:34:17 +08:00
|
|
|
return 1;
|
2011-12-15 10:28:16 +08:00
|
|
|
fprintf(fp, "%s %d", s, t); // expected-warning + {{tainted}}
|
|
|
|
fclose(fp); // expected-warning + {{tainted}}
|
2011-12-15 02:34:17 +08:00
|
|
|
|
|
|
|
// Test fscanf and fopen.
|
2011-12-15 10:28:16 +08:00
|
|
|
if((fp=fopen("test","r")) == 0) // expected-warning + {{tainted}}
|
2011-12-15 02:34:17 +08:00
|
|
|
return 1;
|
2011-12-15 10:28:16 +08:00
|
|
|
fscanf(fp, "%s%d", s, &t); // expected-warning + {{tainted}}
|
|
|
|
fprintf(stdout, "%s %d", s, t); // expected-warning + {{tainted}}
|
2011-12-15 02:34:17 +08:00
|
|
|
return 0;
|
|
|
|
}
|
2011-12-17 02:28:50 +08:00
|
|
|
|
|
|
|
// Check if we propagate taint from stdin when it's used in an assignment.
|
|
|
|
void stdinTest1() {
|
|
|
|
int i;
|
|
|
|
fscanf(stdin, "%d", &i);
|
|
|
|
int j = i; // expected-warning + {{tainted}}
|
|
|
|
}
|
|
|
|
void stdinTest2(FILE *pIn) {
|
|
|
|
FILE *p = stdin;
|
|
|
|
FILE *pp = p;
|
|
|
|
int ii;
|
|
|
|
|
|
|
|
fscanf(pp, "%d", &ii);
|
|
|
|
int jj = ii;// expected-warning + {{tainted}}
|
|
|
|
|
|
|
|
fscanf(p, "%d", &ii);
|
|
|
|
int jj2 = ii;// expected-warning + {{tainted}}
|
|
|
|
|
|
|
|
ii = 3;
|
|
|
|
int jj3 = ii;// no warning
|
|
|
|
|
|
|
|
p = pIn;
|
|
|
|
fscanf(p, "%d", &ii);
|
|
|
|
int jj4 = ii;// no warning
|
|
|
|
}
|
|
|
|
|
|
|
|
void stdinTest3() {
|
|
|
|
FILE **ppp = &stdin;
|
|
|
|
int iii;
|
|
|
|
fscanf(*ppp, "%d", &iii);
|
|
|
|
int jjj = iii;// expected-warning + {{tainted}}
|
|
|
|
}
|
2011-12-17 08:26:34 +08:00
|
|
|
|
2012-01-05 07:54:04 +08:00
|
|
|
// Test that stdin does not get invalidated by calls.
|
|
|
|
void foo();
|
|
|
|
void stdinTest4() {
|
|
|
|
int i;
|
|
|
|
fscanf(stdin, "%d", &i);
|
|
|
|
foo();
|
|
|
|
int j = i; // expected-warning + {{tainted}}
|
|
|
|
}
|
|
|
|
|
2012-01-25 03:32:25 +08:00
|
|
|
int getw(FILE *);
|
|
|
|
void getwTest() {
|
|
|
|
int i = getw(stdin); // expected-warning + {{tainted}}
|
|
|
|
}
|
|
|
|
|
|
|
|
typedef long ssize_t;
|
|
|
|
ssize_t getline(char ** __restrict, size_t * __restrict, FILE * __restrict);
|
|
|
|
int printf(const char * __restrict, ...);
|
|
|
|
void free(void *ptr);
|
|
|
|
void getlineTest(void) {
|
|
|
|
FILE *fp;
|
|
|
|
char *line = 0;
|
|
|
|
size_t len = 0;
|
|
|
|
ssize_t read;
|
|
|
|
while ((read = getline(&line, &len, stdin)) != -1) {
|
|
|
|
printf("%s", line); // expected-warning + {{tainted}}
|
|
|
|
}
|
|
|
|
free(line); // expected-warning + {{tainted}}
|
|
|
|
}
|
|
|
|
|
2011-12-17 08:26:34 +08:00
|
|
|
// Test propagation functions - the ones that propagate taint from arguments to
|
|
|
|
// return value, ptr arguments.
|
|
|
|
|
|
|
|
int atoi(const char *nptr);
|
|
|
|
long atol(const char *nptr);
|
|
|
|
long long atoll(const char *nptr);
|
|
|
|
|
|
|
|
void atoiTest() {
|
|
|
|
char s[80];
|
|
|
|
scanf("%s", s);
|
|
|
|
int d = atoi(s); // expected-warning + {{tainted}}
|
|
|
|
int td = d; // expected-warning + {{tainted}}
|
2011-12-17 08:30:16 +08:00
|
|
|
|
2011-12-21 06:35:30 +08:00
|
|
|
long l = atol(s); // expected-warning + {{tainted}}
|
2011-12-17 08:30:16 +08:00
|
|
|
int tl = l; // expected-warning + {{tainted}}
|
|
|
|
|
2011-12-21 06:35:30 +08:00
|
|
|
long long ll = atoll(s); // expected-warning + {{tainted}}
|
2011-12-17 08:30:16 +08:00
|
|
|
int tll = ll; // expected-warning + {{tainted}}
|
|
|
|
|
2011-12-17 08:26:34 +08:00
|
|
|
}
|
|
|
|
|
2017-11-10 05:49:38 +08:00
|
|
|
char *pointer1;
|
|
|
|
void *pointer2;
|
|
|
|
void noCrashTest() {
|
|
|
|
if (!*pointer1) {
|
|
|
|
__builtin___memcpy_chk(pointer2, pointer1, 0, 0); // no-crash
|
|
|
|
}
|
|
|
|
}
|