1  #include <stdlib.h>
       2  #include <string.h>
       3  #include <stdint.h>
       4  
       5  /* Wanalyzer-out-of-bounds tests for buffer under-reads and underwrites.  */
       6  
       7  /* Avoid folding of memcpy.  */
       8  typedef void * (*memcpy_t) (void *dst, const void *src, size_t n);
       9  static memcpy_t __attribute__((noinline))
      10  get_memcpy (void)
      11  {
      12    return memcpy;
      13  }
      14  
      15  
      16  void test1 (void)
      17  {
      18    int buf[4];
      19    int *e = buf - 1;
      20    *e = 42; /* { dg-line test1 } */
      21  
      22    /* { dg-warning "stack-based buffer underwrite" "warning" { target *-*-* } test1 } */
      23    /* { dg-message "out-of-bounds write from byte -4 till byte -1 but 'buf' starts at byte 0" "final event" { target *-*-* } test1 } */
      24    /* { dg-message "valid subscripts for 'buf' are '\\\[0\\\]' to '\\\[3\\\]'" "valid subscript note" { target *-*-* } test1 } */
      25  }
      26  
      27  void test2 (void)
      28  {
      29    int buf[4];
      30    int *e = buf + 1;
      31    *e = 123;
      32    *(e - 1) = 321;
      33  }
      34  
      35  void test3 (void)
      36  {
      37    int buf[4];
      38    int *e = buf + 1;
      39    *e = 123;
      40    *(e - 2) = 321; /* { dg-line test3 } */
      41  
      42    /* { dg-warning "stack-based buffer underwrite" "warning" { target *-*-* } test3 } */
      43    /* { dg-message "out-of-bounds write from byte -4 till byte -1 but 'buf' starts at byte 0" "final event" { target *-*-* } test3 } */
      44    /* { dg-message "valid subscripts for 'buf' are '\\\[0\\\]' to '\\\[3\\\]'" "valid subscript note" { target *-*-* } test3 } */
      45  }
      46  
      47  void test4 (void)
      48  {
      49    memcpy_t fn = get_memcpy ();
      50    int buf[4];
      51    memset (buf, 1, 4 * sizeof (int));
      52    int n = -4;
      53    fn (&(buf[n]), buf, sizeof (int));  /* { dg-line test4 } */
      54  
      55    /* { dg-warning "stack-based buffer underwrite" "warning" { target *-*-* } test4 } */
      56    /* { dg-message "out-of-bounds write from byte -16 till byte -13 but 'buf' starts at byte 0" "final event" { target *-*-* } test4 } */
      57    /* { dg-message "valid subscripts for 'buf' are '\\\[0\\\]' to '\\\[3\\\]'" "valid subscript note" { target *-*-* } test4 } */
      58  }
      59  
      60  void test5 (void)
      61  {
      62    int buf[4];
      63    memset (buf, 1, 4 * sizeof (int));
      64  
      65    int sum = 0;
      66    for (int i = 4; i >= 0; i++)
      67      sum += *(buf - i); /* { dg-line test5 } */
      68  
      69    /* { dg-warning "stack-based buffer under-read" "warning" { target *-*-* } test5 } */
      70    /* { dg-message "out-of-bounds read from byte -16 till byte -13 but 'buf' starts at byte 0" "final event" { target *-*-* } test5 } */
      71    /* { dg-message "valid subscripts for 'buf' are '\\\[0\\\]' to '\\\[3\\\]'" "valid subscript note" { target *-*-* } test5 } */
      72  }
      73  
      74  void test6 (void)
      75  {
      76    int buf[4];
      77    memset (buf, 1, 4 * sizeof (int));
      78  
      79    int *view = buf + 1;
      80    int sum = 0;
      81    for (int i = 0; i < 4; i++)
      82      sum += *(view++);
      83  }
      84  
      85  void test8 (void)
      86  {
      87    memcpy_t fn = get_memcpy ();
      88    int buf[4];
      89    memset (buf, 1, 4 * sizeof (int));
      90    int n = -4;
      91    fn (buf, &(buf[n]), sizeof (int));  /* { dg-line test8 } */
      92  
      93    /* { dg-warning "stack-based buffer under-read" "warning" { target *-*-* } test8 } */
      94    /* { dg-message "out-of-bounds read from byte -16 till byte -13 but 'buf' starts at byte 0" "note" { target *-*-* } test8 } */
      95    /* { dg-message "valid subscripts for 'buf' are '\\\[0\\\]' to '\\\[3\\\]'" "valid subscript note" { target *-*-* } test8 } */
      96  }