Viewing file:  Wstringop-overflow-45.c (5.66 KB) -rw-r--r--
Select action/file-type:
 (+) |  (+) |  (+) | Code (+) | Session (+) |  (+) | SDB (+) |  (+) |  (+) |  (+) |  (+) |  (+) |
/* PR middle-end/97023 - missing warning on buffer overflow in chained mempcpy
Verify that out of bounds writes by built-ins to objects through pointers
returned by other built-ins are diagnosed.
{ dg-do compile }
{ dg-options "-O2" } */
#include "range.h"
void* malloc (size_t);
void* memcpy (void*, const void*, size_t);
void* memmove (void*, const void*, size_t);
void* mempcpy (void*, const void*, size_t);
void sink (void*, ...);
void nowarn_memcpy (const void *s)
{
extern char cpy_a4[4];
unsigned n = sizeof cpy_a4;
void *p = cpy_a4;
p = memcpy (p, s, n);
sink (p);
memcpy (p, s, n);
sink (p);
p = cpy_a4 + 1;
p = memcpy (p, s, n - 1);
sink (p);
memcpy (p, s, n - 1);
sink (p);
p = cpy_a4 + 2;
p = memcpy (p, s, n - 2);
sink (p);
memcpy (p, s, n - 2);
sink (p);
p = cpy_a4 + 3;
p = memcpy (p, s, n - 3);
sink (p);
memcpy (p, s, n - 3);
sink (p);
p = cpy_a4 + 4;
p = memcpy (p, s, n - 4);
sink (p);
memcpy (p, s, n - 4);
sink (p);
}
void nowarn_memcpy_chain (const void *s)
{
extern char cpy_a8[8];
char *p = cpy_a8;
p = memcpy (p + 1, s, 7);
sink (p);
p = memcpy (p + 2 , s, 5);
sink (p);
p = memcpy (p + 3 , s, 2);
sink (p);
p = memcpy (p + 1 , s, 1);
sink (p);
p = memcpy (p - 7 , s, 8);
sink (p);
memcpy (p + 1, s, 7);
}
void warn_memcpy (const void *s)
{
extern char cpy_a5[5]; // { dg-message "destination object 'cpy_a5'" "note" }
unsigned n = sizeof cpy_a5;
void *p = cpy_a5;
p = memcpy (p, s, n);
sink (p);
memcpy (p, s, n + 1); // { dg-warning "writing 6 bytes into a region of size 5" }
sink (p);
p = cpy_a5;
p = memcpy (p, s, n);
sink (p);
memcpy (p, s, n + 1); // { dg-warning "writing 6 bytes into a region of size 5" }
sink (p);
p = cpy_a5 + 1;
p = memcpy (p, s, n - 1);
sink (p);
memcpy (p, s, n); // { dg-warning "writing 5 bytes into a region of size 4" }
sink (p);
}
void warn_memcpy_chain (const void *s)
{
extern char cpy_a8[8]; // { dg-message "destination object 'cpy_a8'" "note" }
char *p = cpy_a8;
p = memcpy (p, s, 9); // { dg-warning "writing 9 bytes into a region of size 8" }
sink (p);
p = memcpy (p + 2, s, 7); // { dg-warning "writing 7 bytes into a region of size 6" }
sink (p);
p = memcpy (p + 3, s, 5); // { dg-warning "writing 5 bytes into a region of size 3" }
sink (p);
p = memcpy (p + 3, s, 3); // { dg-warning "writing 3 bytes into a region of size 0" }
sink (p);
}
void nowarn_mempcpy (const void *s)
{
extern char a4[4];
unsigned n = sizeof a4;
char *p = mempcpy (a4, s, n);
sink (p);
mempcpy (p - 4, s, n);
sink (p);
p = mempcpy (a4 + 1, s, n - 1);
sink (p);
mempcpy (p - 4, s, n);
sink (p);
p = mempcpy (a4 + 2, s, n - 2);
sink (p);
mempcpy (p - 4, s, n);
sink (p);
p = mempcpy (a4 + 3, s, n - 3);
sink (p);
mempcpy (p - 4, s, n);
sink (p);
p = mempcpy (a4 + 4, s, n - 4);
sink (p);
mempcpy (p - 4, s, n);
sink (p);
}
void nowarn_mempcpy_chain (const void *s)
{
extern char pcpy_a8[8];
char *p = pcpy_a8;
p = mempcpy (p + 1, s, 7);
sink (p);
p = mempcpy (p - 7 , s, 7);
sink (p);
p = mempcpy (p - 5 , s, 5);
sink (p);
p = mempcpy (p - 3 , s, 3);
sink (p);
p = mempcpy (p - 2 , s, 2);
sink (p);
mempcpy (p - 1, s, 1);
sink (p);
mempcpy (p - 8, s, 8);
}
void warn_mempcpy (const void *s)
{
extern char pcpy_a5[5]; // { dg-message "destination object 'pcpy_a5'" "note" }
char *p = pcpy_a5;
p = mempcpy (p, s, 5);
sink (p);
mempcpy (p - 5, s, 6); // { dg-warning "writing 6 bytes into a region of size 5 " }
sink (p);
p = pcpy_a5;
p = mempcpy (p, s, 3);
sink (p);
mempcpy (p, s, 3); // { dg-warning "writing 3 bytes into a region of size 2 " }
sink (p);
p = pcpy_a5 + 1;
p = mempcpy (p, s, 3);
sink (p);
mempcpy (p - 1, s, 5); // { dg-warning "writing 5 bytes into a region of size 2 " }
sink (p);
}
void warn_mempcpy_chain_3 (const void *s)
{
char *p = malloc (5); // { dg-message "at offset \\\[3, 5] into destination object of size 5" "note" }
p = mempcpy (p, s, UR (1, 2));
p = mempcpy (p, s, UR (2, 3));
p = mempcpy (p, s, UR (3, 4)); // { dg-warning "writing between 3 and 4 bytes into a region of size 2 " }
sink (p);
}
void warn_mempcpy_offrng_chain_3 (const void *s)
{
char *p = malloc (11); // { dg-message "at offset \\\[9, 11] into destination object of size 11 " "note" }
size_t r1_2 = UR (1, 2);
size_t r2_3 = r1_2 + 1;
size_t r3_4 = r2_3 + 1;
p = mempcpy (p + r1_2, s, r1_2);
p = mempcpy (p + r2_3, s, r2_3);
p = mempcpy (p + r3_4, s, r3_4); // { dg-warning "writing between 3 and 4 bytes into a region of size 2 " }
sink (p);
}
void warn_mempcpy_chain_4 (const void *s)
{
char *p = malloc (9); // { dg-message "at offset \\\[6, 9] into destination object of size 9 " "note" }
p = mempcpy (p, s, UR (1, 2));
p = mempcpy (p, s, UR (2, 3));
p = mempcpy (p, s, UR (3, 4));
p = mempcpy (p, s, UR (4, 5)); // { dg-warning "writing between 4 and 5 bytes into a region of size 3 " }
sink (p);
}
void warn_mempcpy_chain_5 (const void *s)
{
char *p = malloc (14); // { dg-message "at offset \\\[10, 14] into destination object of size 14 " "note" }
p = mempcpy (p, s, UR (1, 2));
p = mempcpy (p, s, UR (2, 3));
p = mempcpy (p, s, UR (3, 4));
p = mempcpy (p, s, UR (4, 5));
p = mempcpy (p, s, UR (5, 6)); // { dg-warning "writing between 5 and 6 bytes into a region of size 4 " }
sink (p);
}
|
