diff --git a/infer/tests/codetoanalyze/c/bufferoverrun/get_field.c b/infer/tests/codetoanalyze/c/bufferoverrun/get_field.c new file mode 100644 index 000000000..160a2e681 --- /dev/null +++ b/infer/tests/codetoanalyze/c/bufferoverrun/get_field.c @@ -0,0 +1,36 @@ +/* + * Copyright (c) 2018-present, Facebook, Inc. + * + * This source code is licensed under the MIT license found in the + * LICENSE file in the root directory of this source tree. + */ + +#include "my_typedef.h" + +struct st { + int field; +}; + +int get_field(t* x) { return x->field; } + +void FN_call_get_field_cond_Bad() { + int a[5]; + t x = {0}; + if (get_field_wrapper(&x)) { + a[10] = 0; + } else { + a[10] = 0; + } +} + +void call_get_field_Good() { + int a[5]; + t x = {0}; + a[get_field_wrapper(&x)] = 0; +} + +void FN_call_get_field_Bad() { + int a[5]; + t x = {10}; + a[get_field_wrapper(&x)] = 0; +} diff --git a/infer/tests/codetoanalyze/c/bufferoverrun/get_field_wrapper.c b/infer/tests/codetoanalyze/c/bufferoverrun/get_field_wrapper.c new file mode 100644 index 000000000..6b4040853 --- /dev/null +++ b/infer/tests/codetoanalyze/c/bufferoverrun/get_field_wrapper.c @@ -0,0 +1,10 @@ +/* + * Copyright (c) 2018-present, Facebook, Inc. + * + * This source code is licensed under the MIT license found in the + * LICENSE file in the root directory of this source tree. + */ + +#include "my_typedef.h" + +int get_field_wrapper(t* x) { return get_field(x); } diff --git a/infer/tests/codetoanalyze/c/bufferoverrun/issues.exp b/infer/tests/codetoanalyze/c/bufferoverrun/issues.exp index 03ebf178a..dc3b15e0e 100644 --- a/infer/tests/codetoanalyze/c/bufferoverrun/issues.exp +++ b/infer/tests/codetoanalyze/c/bufferoverrun/issues.exp @@ -25,6 +25,8 @@ codetoanalyze/c/bufferoverrun/function_call.c, call_by_struct_ptr_bad, 5, BUFFER codetoanalyze/c/bufferoverrun/function_call.c, call_function_ptr_bad, 4, BUFFER_OVERRUN_L1, no_bucket, ERROR, [ArrayDeclaration,ArrayAccess: Offset: 10 Size: 10] codetoanalyze/c/bufferoverrun/function_call.c, call_function_ptr_good_FP, 4, BUFFER_OVERRUN_L1, no_bucket, ERROR, [ArrayDeclaration,ArrayAccess: Offset: 10 Size: 10] codetoanalyze/c/bufferoverrun/function_call.c, function_call, 4, BUFFER_OVERRUN_L1, no_bucket, ERROR, [ArrayDeclaration,Call,Parameter: arr,Assignment,ArrayAccess: Offset: 100 Size: 10 by call to `arr_access` ] +codetoanalyze/c/bufferoverrun/get_field.c, FN_call_get_field_cond_Bad, 3, CONDITION_ALWAYS_FALSE, no_bucket, WARNING, [] +codetoanalyze/c/bufferoverrun/get_field.c, FN_call_get_field_cond_Bad, 3, CONDITION_ALWAYS_TRUE, no_bucket, WARNING, [] codetoanalyze/c/bufferoverrun/global.c, compare_global_const_enum_bad_FN, 2, CONDITION_ALWAYS_FALSE, no_bucket, WARNING, [] codetoanalyze/c/bufferoverrun/global.c, compare_global_const_enum_bad_FN, 2, CONDITION_ALWAYS_TRUE, no_bucket, WARNING, [] codetoanalyze/c/bufferoverrun/global.c, compare_global_variable_bad, 3, BUFFER_OVERRUN_L1, no_bucket, ERROR, [ArrayDeclaration,ArrayAccess: Offset: 10 Size: 10] diff --git a/infer/tests/codetoanalyze/c/bufferoverrun/my_typedef.h b/infer/tests/codetoanalyze/c/bufferoverrun/my_typedef.h new file mode 100644 index 000000000..397561b92 --- /dev/null +++ b/infer/tests/codetoanalyze/c/bufferoverrun/my_typedef.h @@ -0,0 +1,10 @@ +/* + * Copyright (c) 2018-present, Facebook, Inc. + * + * This source code is licensed under the MIT license found in the + * LICENSE file in the root directory of this source tree. + */ + +typedef struct st t; +int get_field(t* x); +int get_field_wrapper(t* x);