1  // TODO: remove need for the taint option:
       2  /* { dg-additional-options "-fanalyzer-checker=taint" } */
       3  /* { dg-skip-if "" { *-*-* } { "-fno-fat-lto-objects" } { "" } } */
       4  
       5  struct raw_ep {
       6    /* ...snip... */
       7    int state;
       8    /* ...snip... */
       9  };
      10  
      11  struct raw_dev {
      12    /* ...snip... */
      13    struct raw_ep eps[30];
      14    int eps_num;
      15    /* ...snip... */
      16  };
      17  
      18  int   __attribute__((tainted_args))
      19  simplified_raw_ioctl_ep_disable(struct raw_dev *dev, unsigned long value)
      20  {
      21    int ret = 0, i = value;
      22  
      23    if (i < 0 || i >= dev->eps_num) {
      24      ret = -16;
      25      goto out_unlock;
      26    }
      27    if (dev->eps[i].state == 0) { /* { dg-bogus "attacker-controlled" } */
      28      ret = -22;
      29      goto out_unlock;
      30    }
      31  
      32  out_unlock:
      33    return ret;
      34  }
      35  
      36  int   __attribute__((tainted_args))
      37  test_2(struct raw_dev *dev, int i)
      38  {
      39    int ret = 0;
      40  
      41    if (i < 0 || i >= dev->eps_num) {
      42      ret = -16;
      43      goto out_unlock;
      44    }
      45    if (dev->eps[i].state == 0) { /* { dg-bogus "attacker-controlled" } */
      46      ret = -22;
      47      goto out_unlock;
      48    }
      49  
      50  out_unlock:
      51    return ret;
      52  }