1 #include <string.h>
2 #include "analyzer-decls.h"
3
4 /* Function for thwarting expansion of memmove by optimizer. */
5
6 typedef void * (*memmove_t) (void *dst, const void *src, size_t n);
7
8 static memmove_t __attribute__((noinline))
9 get_memmove (void)
10 {
11 return memmove;
12 }
13
14 void *test_1 (void *dst, void *src, size_t n)
15 {
16 void *result = memmove (dst, src, n);
17 __analyzer_eval (result == dst); /* { dg-warning "TRUE" } */
18 return result;
19 }
20
21 void *test_1a (void *dst, void *src, size_t n)
22 {
23 void *result = __memmove_chk (dst, src, n, -1);
24 __analyzer_eval (result == dst); /* { dg-warning "TRUE" } */
25 return result;
26 }
27
28 void *test_1b (void *dst, void *src, size_t n)
29 {
30 memmove_t fn = get_memmove ();
31 void *result = fn (dst, src, n);
32 __analyzer_eval (result == dst); /* { dg-warning "TRUE" } */
33 return result;
34 }
35
36 void test_2 (int i)
37 {
38 int j;
39 memmove (&j, &i, sizeof (int));
40 __analyzer_eval (i == j); /* { dg-warning "TRUE" } */
41 }
42
43 void test_2a (int i)
44 {
45 int j;
46 __memmove_chk (&j, &i, sizeof (int), sizeof (int));
47 __analyzer_eval (i == j); /* { dg-warning "TRUE" } */
48 }
49
50 void test_2b (int i)
51 {
52 int j;
53 memmove_t fn = get_memmove ();
54 fn (&j, &i, sizeof (int));
55 __analyzer_eval (i == j); /* { dg-warning "TRUE" } */
56 }
57
58 void test_3 (void *src, size_t n)
59 {
60 char buf[40], other[40];
61 buf[0] = 'a';
62 other[0] = 'b';
63 __analyzer_eval (buf[0] == 'a'); /* { dg-warning "TRUE" } */
64 __analyzer_eval (other[0] == 'b'); /* { dg-warning "TRUE" } */
65
66 memmove (buf, src, n);
67 __analyzer_eval (buf[0] == 'a'); /* { dg-warning "UNKNOWN" } */
68 __analyzer_eval (other[0] == 'b'); /* { dg-warning "TRUE" } */
69 }
70
71 void test_3b (void *src, size_t n)
72 {
73 char buf[40], other[40];
74 memmove_t fn = get_memmove ();
75 buf[0] = 'a';
76 other[0] = 'b';
77 __analyzer_eval (buf[0] == 'a'); /* { dg-warning "TRUE" } */
78 __analyzer_eval (other[0] == 'b'); /* { dg-warning "TRUE" } */
79
80 fn (buf, src, n);
81 __analyzer_eval (buf[0] == 'a'); /* { dg-warning "UNKNOWN" } */
82 __analyzer_eval (other[0] == 'b'); /* { dg-warning "TRUE" } */
83 }
84
85 /* Overwriting a zeroed buffer, then memmove of the result. */
86
87 void test_4 (int a, int b)
88 {
89 int src[1024];
90 int dst[1024];
91 memset (src, 0, sizeof (src));
92 src[42] = a;
93 src[100] = b;
94 __analyzer_eval (src[0] == 0); /* { dg-warning "TRUE" } */
95 __analyzer_eval (src[42] == a); /* { dg-warning "TRUE" } */
96 __analyzer_eval (src[100] == b); /* { dg-warning "TRUE" } */
97 __analyzer_eval (src[1023] == 0); /* { dg-warning "TRUE" } */
98
99 memmove (dst, src, sizeof (src));
100 __analyzer_eval (dst[0] == 0); /* { dg-warning "TRUE" } */
101 __analyzer_eval (dst[42] == a); /* { dg-warning "TRUE" } */
102 __analyzer_eval (dst[100] == b); /* { dg-warning "TRUE" } */
103 __analyzer_eval (dst[1023] == 0); /* { dg-warning "TRUE" } */
104 }
105
106 void test_4b (int a, int b)
107 {
108 int src[1024];
109 int dst[1024];
110 memmove_t fn = get_memmove ();
111 memset (src, 0, sizeof (src));
112 src[42] = a;
113 src[100] = b;
114 __analyzer_eval (src[0] == 0); /* { dg-warning "TRUE" } */
115 __analyzer_eval (src[42] == a); /* { dg-warning "TRUE" } */
116 __analyzer_eval (src[100] == b); /* { dg-warning "TRUE" } */
117 __analyzer_eval (src[1023] == 0); /* { dg-warning "TRUE" } */
118
119 fn (dst, src, sizeof (src));
120 __analyzer_eval (dst[0] == 0); /* { dg-warning "TRUE" } */
121 __analyzer_eval (dst[42] == a); /* { dg-warning "TRUE" } */
122 __analyzer_eval (dst[100] == b); /* { dg-warning "TRUE" } */
123 __analyzer_eval (dst[1023] == 0); /* { dg-warning "TRUE" } */
124 }
125
126 /* Populating a buffer from an unknown buffer. */
127
128 void test_5 (void *src, size_t sz)
129 {
130 char dst[1024];
131 memmove (dst, src, sizeof (dst));
132 __analyzer_eval (dst[0] == 0); /* { dg-warning "UNKNOWN" } */
133 __analyzer_eval (dst[1023] == 0); /* { dg-warning "UNKNOWN" } */
134 }
135
136 void test_5b (void *src, size_t sz)
137 {
138 char dst[1024];
139 memmove_t fn = get_memmove ();
140 fn (dst, src, sizeof (dst));
141 __analyzer_eval (dst[0] == 0); /* { dg-warning "UNKNOWN" } */
142 __analyzer_eval (dst[1023] == 0); /* { dg-warning "UNKNOWN" } */
143 }
144
145 /* Zero-sized memmove. */
146
147 void test_6 (void *dst, void *src)
148 {
149 memmove (dst, src, 0);
150 }
151
152 void test_6b (void *dst, void *src)
153 {
154 memmove_t fn = get_memmove ();
155 fn (dst, src, 0);
156 }
157
158 /* memmove to string literal. */
159
160 void test_7 (void *src, size_t sz)
161 {
162 memmove ((void *)"hello world", src, sz); /* { dg-warning "write to string literal" } */
163 }
164
165 void test_7b (void *src, size_t sz)
166 {
167 memmove ((void *)"hello world", src, sz); /* { dg-warning "write to string literal" } */
168 }
169
170 /* memcpy from uninitialized buffer. */
171
172 void test_8a (void *dst)
173 {
174 char src[16];
175 memmove (dst, src, 16); /* { dg-warning "use of uninitialized value" } */
176 }
177
178 void test_8b (void *dst, size_t n)
179 {
180 char src[16];
181 memmove (dst, src, n); /* { dg-warning "use of uninitialized value" } */
182 }