1  typedef __SIZE_TYPE__ size_t;
       2  #define NULL ((void *)0)
       3  
       4  /* Duplicating a string.  */
       5  
       6  /* Correct but poor implementation with repeated __builtin_strlen calls.  */
       7  
       8  char *
       9  alloc_dup_1_correct (const char *x)
      10  {
      11    size_t sz = __builtin_strlen (x) + 1;
      12    char *result = __builtin_malloc (sz);
      13    if (!result)
      14      return NULL;
      15    __builtin_memcpy (result, x, __builtin_strlen (x));
      16    result[__builtin_strlen(x)] = '\0';
      17    return result;
      18  }
      19  
      20  /* Incorrect version: forgetting to add space for terminator.  */
      21  
      22  char *
      23  alloc_dup_1_incorrect (const char *x, const char *y)
      24  {
      25    /* Forgetting to add space for the terminator here.  */
      26    size_t sz = __builtin_strlen (x) + 1;
      27    char *result = __builtin_malloc (sz);
      28    if (!result)
      29      return NULL;
      30    __builtin_memcpy (result, x, __builtin_strlen (x));
      31    result[__builtin_strlen(x)] = '\0'; /* { dg-warning "heap-based buffer overflow" "PR analyzer/105899" { xfail *-*-* } } */
      32    return result;
      33  }
      34  
      35  /* As above, but only calling __builtin_strlen once.  */
      36  
      37  char *
      38  alloc_dup_2_correct (const char *x)
      39  {
      40    size_t len_x = __builtin_strlen (x);
      41    size_t sz = len_x + 1;
      42    char *result = __builtin_malloc (sz);
      43    if (!result)
      44      return NULL;
      45    __builtin_memcpy (result, x, len_x);
      46    result[len_x] = '\0';
      47    return result;
      48  }
      49  
      50  char *
      51  alloc_dup_of_concatenated_pair_2_incorrect (const char *x, const char *y)
      52  {
      53    size_t len_x = __builtin_strlen (x);
      54    size_t sz = len_x; /* Forgetting to add space for the terminator.  */
      55    char *result = __builtin_malloc (sz); /* { dg-message "capacity: 'len_x' bytes" } */
      56    if (!result)
      57      return NULL;
      58    __builtin_memcpy (result, x, len_x);
      59    result[len_x] = '\0'; /* { dg-warning "heap-based buffer overflow" } */
      60    return result;
      61  }