1  // TODO: remove need for this option:
       2  /* { dg-additional-options "-fanalyzer-checker=taint" } */
       3  
       4  #include "analyzer-decls.h"
       5  #include <stdio.h>
       6  #include <stdlib.h>
       7  #include <string.h>
       8  
       9  /* realloc with tainted size.  */
      10  
      11  void *p;
      12  
      13  void __attribute__((tainted_args))
      14  test_1 (size_t sz) /* { dg-message "\\(1\\) function 'test_1' marked with '__attribute__\\(\\(tainted_args\\)\\)'" } */
      15  {
      16    void *q;
      17    
      18    __analyzer_dump_state ("taint", sz); /* { dg-warning "state: 'tainted'" } */
      19  
      20    q = realloc (p, sz);  /* { dg-warning "use of attacker-controlled value 'sz' as allocation size without upper-bounds checking" } */
      21  }