@@ -1,4 +1,4 @@
-/* An experimental state machine, for tracking "taint": unsanitized uses
+/* A state machine for tracking "taint": unsanitized uses
of data potentially under an attacker's control.
Copyright (C) 2019-2023 Free Software Foundation, Inc.
@@ -188,10 +188,7 @@ make_checkers (auto_delete_vec <state_machine> &out, logger *logger)
out.safe_push (make_malloc_state_machine (logger));
out.safe_push (make_fileptr_state_machine (logger));
out.safe_push (make_fd_state_machine (logger));
- /* The "taint" checker must be explicitly enabled (as it currently
- leads to state explosions that stop the other checkers working). */
- if (flag_analyzer_checker)
- out.safe_push (make_taint_state_machine (logger));
+ out.safe_push (make_taint_state_machine (logger));
out.safe_push (make_sensitive_state_machine (logger));
out.safe_push (make_signal_state_machine (logger));
out.safe_push (make_va_list_state_machine (logger));
@@ -10415,6 +10415,12 @@ Enabling this option effectively enables the following warnings:
-Wanalyzer-shift-count-negative
-Wanalyzer-shift-count-overflow
-Wanalyzer-stale-setjmp-buffer
+-Wanalyzer-tainted-allocation-size
+-Wanalyzer-tainted-array-index
+-Wanalyzer-tainted-assertion
+-Wanalyzer-tainted-divisor
+-Wanalyzer-tainted-offset
+-Wanalyzer-tainted-size
-Wanalyzer-unsafe-call-within-signal-handler
-Wanalyzer-use-after-free
-Wanalyzer-use-of-pointer-in-stale-stack-frame
@@ -10426,13 +10432,6 @@ Enabling this option effectively enables the following warnings:
-Wanalyzer-write-to-const
-Wanalyzer-write-to-string-literal
}
-@ignore
--Wanalyzer-tainted-allocation-size
--Wanalyzer-tainted-array-index
--Wanalyzer-tainted-divisor
--Wanalyzer-tainted-offset
--Wanalyzer-tainted-size
-@end ignore
This option is only available if GCC was configured with analyzer
support enabled.
@@ -10880,8 +10879,7 @@ no longer exists, and likely lead to a crash (or worse).
@opindex Wanalyzer-tainted-allocation-size
@opindex Wno-analyzer-tainted-allocation-size
@item -Wno-analyzer-tainted-allocation-size
-This warning requires both @option{-fanalyzer} and
-@option{-fanalyzer-checker=taint} to enable it;
+This warning requires @option{-fanalyzer} which enables it;
use @option{-Wno-analyzer-tainted-allocation-size} to disable it.
This diagnostic warns for paths through the code in which a value
@@ -10896,8 +10894,7 @@ See @uref{https://cwe.mitre.org/data/definitions/789.html, CWE-789: Memory Alloc
@opindex Wno-analyzer-tainted-assertion
@item -Wno-analyzer-tainted-assertion
-This warning requires both @option{-fanalyzer} and
-@option{-fanalyzer-checker=taint} to enable it;
+This warning requires @option{-fanalyzer} which enables it;
use @option{-Wno-analyzer-tainted-assertion} to disable it.
This diagnostic warns for paths through the code in which a value
@@ -10958,8 +10955,7 @@ despite the above not being an assertion failure, strictly speaking.
@opindex Wanalyzer-tainted-array-index
@opindex Wno-analyzer-tainted-array-index
@item -Wno-analyzer-tainted-array-index
-This warning requires both @option{-fanalyzer} and
-@option{-fanalyzer-checker=taint} to enable it;
+This warning requires @option{-fanalyzer} which enables it;
use @option{-Wno-analyzer-tainted-array-index} to disable it.
This diagnostic warns for paths through the code in which a value
@@ -10972,8 +10968,7 @@ See @uref{https://cwe.mitre.org/data/definitions/129.html, CWE-129: Improper Val
@opindex Wanalyzer-tainted-divisor
@opindex Wno-analyzer-tainted-divisor
@item -Wno-analyzer-tainted-divisor
-This warning requires both @option{-fanalyzer} and
-@option{-fanalyzer-checker=taint} to enable it;
+This warning requires @option{-fanalyzer} which enables it;
use @option{-Wno-analyzer-tainted-divisor} to disable it.
This diagnostic warns for paths through the code in which a value
@@ -10986,8 +10981,7 @@ See @uref{https://cwe.mitre.org/data/definitions/369.html, CWE-369: Divide By Ze
@opindex Wanalyzer-tainted-offset
@opindex Wno-analyzer-tainted-offset
@item -Wno-analyzer-tainted-offset
-This warning requires both @option{-fanalyzer} and
-@option{-fanalyzer-checker=taint} to enable it;
+This warning requires @option{-fanalyzer} which enables it;
use @option{-Wno-analyzer-tainted-offset} to disable it.
This diagnostic warns for paths through the code in which a value
@@ -11000,8 +10994,7 @@ See @uref{https://cwe.mitre.org/data/definitions/823.html, CWE-823: Use of Out-o
@opindex Wanalyzer-tainted-size
@opindex Wno-analyzer-tainted-size
@item -Wno-analyzer-tainted-size
-This warning requires both @option{-fanalyzer} and
-@option{-fanalyzer-checker=taint} to enable it;
+This warning requires @option{-fanalyzer} which enables it;
use @option{-Wno-analyzer-tainted-size} to disable it.
This diagnostic warns for paths through the code in which a value
@@ -11251,38 +11244,6 @@ call site, and that are sufficiently complicated (as per
@item -fanalyzer-checker=@var{name}
Restrict the analyzer to run just the named checker, and enable it.
-Some checkers are disabled by default (even with @option{-fanalyzer}),
-such as the @code{taint} checker that implements
-@option{-Wanalyzer-tainted-array-index}, and this option is required
-to enable them.
-
-@emph{Note:} currently, @option{-fanalyzer-checker=taint} disables the
-following warnings from @option{-fanalyzer}:
-
-@gccoptlist{
--Wanalyzer-deref-before-check
--Wanalyzer-double-fclose
--Wanalyzer-double-free
--Wanalyzer-exposure-through-output-file
--Wanalyzer-fd-access-mode-mismatch
--Wanalyzer-fd-double-close
--Wanalyzer-fd-leak
--Wanalyzer-fd-use-after-close
--Wanalyzer-fd-use-without-check
--Wanalyzer-file-leak
--Wanalyzer-free-of-non-heap
--Wanalyzer-malloc-leak
--Wanalyzer-mismatching-deallocation
--Wanalyzer-null-argument
--Wanalyzer-null-dereference
--Wanalyzer-possible-null-argument
--Wanalyzer-possible-null-dereference
--Wanalyzer-unsafe-call-within-signal-handler
--Wanalyzer-use-after-free
--Wanalyzer-va-list-leak
--Wanalyzer-va-list-use-after-va-end
-}
-
@opindex fanalyzer-debug-text-art
@opindex fno-analyzer-debug-text-art
@item -fanalyzer-debug-text-art-headings
@@ -1,6 +1,3 @@
-// TODO: remove need for this option
-/* { dg-additional-options "-fanalyzer-checker=taint" } */
-
#include "../../gcc.dg/analyzer/analyzer-decls.h"
struct arg_buf
@@ -1,5 +1,3 @@
-/* { dg-additional-options "-fanalyzer-checker=taint" } */
-
typedef __SIZE_TYPE__ size_t;
extern size_t fread (void *, size_t, size_t, void *);
@@ -1,6 +1,3 @@
-// TODO: remove need for this option
-/* { dg-additional-options "-fanalyzer-checker=taint" } */
-
typedef __SIZE_TYPE__ size_t;
typedef const void *t_comptype;
typedef int (*t_compfunc)(t_comptype, t_comptype);
@@ -6,6 +6,9 @@
/* { dg-do "compile" } */
/* { dg-additional-options "-fsigned-char" } */
+/* TODO (PR analyzer/112528): remove need for this. */
+/* { dg-additional-options "--param analyzer-max-enodes-per-program-point=40 --param analyzer-bb-explosion-factor=10" } */
+
/* Minimal replacement of system headers. */
typedef __SIZE_TYPE__ size_t;
@@ -6,6 +6,9 @@
/* { dg-do "compile" } */
/* { dg-additional-options "-funsigned-char" } */
+/* TODO (PR analyzer/112528): remove need for this. */
+/* { dg-additional-options "--param analyzer-max-enodes-per-program-point=40 --param analyzer-bb-explosion-factor=10" } */
+
/* Minimal replacement of system headers. */
typedef __SIZE_TYPE__ size_t;
@@ -1,5 +1,3 @@
-/* { dg-additional-options "-fanalyzer-checker=taint" } */
-
typedef __SIZE_TYPE__ size_t;
int idx;
@@ -1,6 +1,3 @@
-// TODO: remove need for this option
-/* { dg-additional-options "-fanalyzer-checker=taint" } */
-
#include "analyzer-decls.h"
/* Verify the handling of "switch (enum_value)". */
@@ -7,9 +7,6 @@
Fixed in 3d0475119d8722798db5e88f26493f6547a4bb5b on linux-2.6.39.y
in linux-stable. */
-// TODO: remove need for this option:
-/* { dg-additional-options "-fanalyzer-checker=taint" } */
-
#include "analyzer-decls.h"
#include "test-uaccess.h"
@@ -1,9 +1,6 @@
/* See notes in this header. */
#include "taint-CVE-2020-13143.h"
-// TODO: remove need for this option
-/* { dg-additional-options "-fanalyzer-checker=taint" } */
-
struct configfs_attribute {
/* [...snip...] */
ssize_t (*store)(struct config_item *, const char *, size_t) /* { dg-message "\\(1\\) field 'store' of 'struct configfs_attribute' is marked with '__attribute__\\(\\(tainted_args\\)\\)'" } */
@@ -1,9 +1,6 @@
/* See notes in this header. */
#include "taint-CVE-2020-13143.h"
-// TODO: remove need for this option
-/* { dg-additional-options "-fanalyzer-checker=taint" } */
-
struct configfs_attribute {
/* [...snip...] */
ssize_t (*store)(struct config_item *, const char *, size_t) /* { dg-message "\\(1\\) field 'store' of 'struct configfs_attribute' is marked with '__attribute__\\(\\(tainted_args\\)\\)'" } */
@@ -8,9 +8,6 @@
Fixed by 15753588bcd4bbffae1cca33c8ced5722477fe1f on linux-5.7.y
in linux-stable. */
-// TODO: remove need for this option
-/* { dg-additional-options "-fanalyzer-checker=taint" } */
-
#include <stddef.h>
/* Adapted from include/uapi/asm-generic/posix_types.h */
@@ -1,5 +1,3 @@
-// TODO: remove need for this option
-/* { dg-additional-options "-fanalyzer-checker=taint" } */
/* { dg-require-effective-target alloca } */
#include "analyzer-decls.h"
@@ -1,6 +1,3 @@
-// TODO: remove need for this option:
-/* { dg-additional-options "-fanalyzer-checker=taint" } */
-
#include "analyzer-decls.h"
#include <stdio.h>
#include <stdlib.h>
@@ -1,6 +1,3 @@
-// TODO: remove need for this option:
-/* { dg-additional-options "-fanalyzer-checker=taint" } */
-
#include "analyzer-decls.h"
#include <stdio.h>
#include <stdlib.h>
@@ -1,6 +1,3 @@
-// TODO: remove need for this option:
-/* { dg-additional-options "-fanalyzer-checker=taint" } */
-
#include "analyzer-decls.h"
#include <stdio.h>
#include <stdlib.h>
@@ -1,6 +1,3 @@
-// TODO: remove need for this option
-/* { dg-additional-options "-fanalyzer-checker=taint" } */
-
#include "analyzer-decls.h"
struct foo
@@ -1,6 +1,3 @@
-// TODO: remove need for this option
-/* { dg-additional-options "-fanalyzer-checker=taint" } */
-
/* We need this, otherwise the warnings are emitted inside the macros, which
makes it hard to write the DejaGnu directives. */
/* { dg-additional-options " -ftrack-macro-expansion=0" } */
@@ -2,9 +2,6 @@
-Wanalyzer-tainted-assertion with macro-tracking enabled
(the default). */
-// TODO: remove need for this option
-/* { dg-additional-options "-fanalyzer-checker=taint" } */
-
/* { dg-additional-options "-fdiagnostics-show-path-depths" } */
/* { dg-additional-options "-fdiagnostics-path-format=inline-events -fdiagnostics-show-caret" } */
@@ -3,9 +3,6 @@
(the default), where the assertion macro is defined in
a system header. */
-// TODO: remove need for this option
-/* { dg-additional-options "-fanalyzer-checker=taint" } */
-
/* { dg-additional-options "-fdiagnostics-show-path-depths" } */
/* { dg-additional-options "-fdiagnostics-path-format=inline-events -fdiagnostics-show-caret" } */
@@ -1,6 +1,3 @@
-// TODO: remove need for this option
-/* { dg-additional-options "-fanalyzer-checker=taint" } */
-
/* We need this, otherwise the warnings are emitted inside the macros, which
makes it hard to write the DejaGnu directives. */
/* { dg-additional-options " -ftrack-macro-expansion=0" } */
@@ -1,6 +1,3 @@
-// TODO: remove need for this option:
-/* { dg-additional-options "-fanalyzer-checker=taint" } */
-
#include "analyzer-decls.h"
#include <stdio.h>
@@ -1,6 +1,3 @@
-// TODO: remove need for this option:
-/* { dg-additional-options "-fanalyzer-checker=taint" } */
-
#include "analyzer-decls.h"
__attribute__ ((tainted_args))
@@ -1,6 +1,3 @@
-/* { dg-additional-options "-fanalyzer-checker=taint" } */
-// TODO: remove need for this option
-
#include "analyzer-decls.h"
int v_start;
deleted file mode 100644
@@ -1,106 +0,0 @@
-/* { dg-additional-options "-fanalyzer-checker=taint" } */
-// TODO: remove need for this option
-/* This test can probably be removed when -fanalyzer enables
- the taint checker by default. */
-
-#include "analyzer-decls.h"
-
-void
-test_1 (char a)
-{
- char b = -a;
-}
-
-/* Copies of code from data-model-1.c. */
-
-void test_20 (int i, int j)
-{
- __analyzer_eval (i + 1); /* { dg-warning "UNKNOWN" } */
- __analyzer_eval (i + j); /* { dg-warning "UNKNOWN" } */
-
- __analyzer_eval (i - 1); /* { dg-warning "UNKNOWN" } */
- __analyzer_eval (i - j); /* { dg-warning "UNKNOWN" } */
-
- __analyzer_eval (i * 2); /* { dg-warning "UNKNOWN" } */
- __analyzer_eval (i * j); /* { dg-warning "UNKNOWN" } */
-
- __analyzer_eval (i / 2); /* { dg-warning "UNKNOWN" } */
- __analyzer_eval (i / j); /* { dg-warning "UNKNOWN" } */
-
- __analyzer_eval (i % 2); /* { dg-warning "UNKNOWN" } */
- __analyzer_eval (i % j); /* { dg-warning "UNKNOWN" } */
-
- __analyzer_eval (i & 1); /* { dg-warning "UNKNOWN" } */
- __analyzer_eval (i & j); /* { dg-warning "UNKNOWN" } */
-
- __analyzer_eval (i | 1); /* { dg-warning "UNKNOWN" } */
- __analyzer_eval (i | j); /* { dg-warning "UNKNOWN" } */
-
- __analyzer_eval (i ^ 1); /* { dg-warning "UNKNOWN" } */
- __analyzer_eval (i ^ j); /* { dg-warning "UNKNOWN" } */
-
- __analyzer_eval (i >> 1); /* { dg-warning "UNKNOWN" } */
- __analyzer_eval (i >> j); /* { dg-warning "UNKNOWN" } */
-
- __analyzer_eval (i << 1); /* { dg-warning "UNKNOWN" } */
- __analyzer_eval (i << j); /* { dg-warning "UNKNOWN" } */
-
- __analyzer_eval (i && 0); /* { dg-warning "FALSE" } */
- __analyzer_eval (i && 1); /* { dg-warning "UNKNOWN" } */
- __analyzer_eval (i && j); /* { dg-warning "UNKNOWN" } */
-
- __analyzer_eval (i || 0); /* { dg-warning "UNKNOWN" } */
-
- __analyzer_eval (i || 1); /* { dg-warning "TRUE" } */
- __analyzer_eval (i || j); /* { dg-warning "UNKNOWN" } */
-
- __analyzer_eval (~i); /* { dg-warning "UNKNOWN" } */
- __analyzer_eval (-i); /* { dg-warning "UNKNOWN" } */
- __analyzer_eval (+i); /* { dg-warning "UNKNOWN" } */
-
- /* Anything added above should be added to the next function also. */
-}
-
-void test_21 (void)
-{
- int i, j, zero;
- int *pi = &i;
- int *pj = &j;
- int *pzero = &zero;
- *pi = 5;
- *pj = 3;
- *pzero = 0;
-
- __analyzer_eval (i + j == 8); /* { dg-warning "TRUE" } */
- __analyzer_eval (i - j == 2); /* { dg-warning "TRUE" } */
- __analyzer_eval (i * j == 15); /* { dg-warning "TRUE" } */
- __analyzer_eval (i / j == 1); /* { dg-warning "TRUE" } */
- __analyzer_eval (i % j == 2); /* { dg-warning "TRUE" } */
-
- /* Division by zero. */
- // TODO: should we warn for this?
- __analyzer_eval (i / zero); /* { dg-warning "UNKNOWN" } */
- __analyzer_eval (i % zero); /* { dg-warning "UNKNOWN" } */
-
- __analyzer_eval ((i & 1) == (5 & 1)); /* { dg-warning "TRUE" } */
- __analyzer_eval ((i & j) == (5 & 3)); /* { dg-warning "TRUE" } */
- __analyzer_eval ((i | 1) == (5 | 1)); /* { dg-warning "TRUE" } */
- __analyzer_eval ((i | j) == (5 | 3)); /* { dg-warning "TRUE" } */
- __analyzer_eval ((i ^ 1) == (5 ^ 1)); /* { dg-warning "TRUE" } */
- __analyzer_eval ((i ^ j) == (5 ^ 3)); /* { dg-warning "TRUE" } */
- __analyzer_eval ((i >> 1) == (5 >> 1)); /* { dg-warning "TRUE" } */
- __analyzer_eval ((i >> j) == (5 >> 3)); /* { dg-warning "TRUE" } */
- __analyzer_eval ((i << 1) == (5 << 1)); /* { dg-warning "TRUE" } */
- __analyzer_eval ((i << j) == (5 << 3)); /* { dg-warning "TRUE" } */
- __analyzer_eval (i && 0); /* { dg-warning "FALSE" } */
- __analyzer_eval (i && 1); /* { dg-warning "TRUE" } */
- __analyzer_eval (i && j); /* { dg-warning "TRUE" } */
-
- __analyzer_eval (i || 0); /* { dg-warning "TRUE" } */
- __analyzer_eval (i || 1); /* { dg-warning "TRUE" } */
- __analyzer_eval (i || j); /* { dg-warning "TRUE" } */
-
- __analyzer_eval (~i == ~5); /* { dg-warning "TRUE" } */
- __analyzer_eval (-i == -5); /* { dg-warning "TRUE" } */
- __analyzer_eval (+i == +5); /* { dg-warning "TRUE" } */
-}
@@ -1,6 +1,3 @@
-// TODO: remove need for this option:
-/* { dg-additional-options "-fanalyzer-checker=taint" } */
-
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
@@ -1,6 +1,3 @@
-// TODO: remove need for this option:
-/* { dg-additional-options "-fanalyzer-checker=taint" } */
-
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
@@ -1,6 +1,3 @@
-// TODO: remove need for this option:
-/* { dg-additional-options "-fanalyzer-checker=taint" } */
-
#include "analyzer-decls.h"
#include <stdio.h>
#include <stdlib.h>
@@ -18,4 +15,4 @@ test_1 (size_t sz) /* { dg-message "\\(1\\) function 'test_1' marked with '__att
__analyzer_dump_state ("taint", sz); /* { dg-warning "state: 'tainted'" } */
q = realloc (p, sz); /* { dg-warning "use of attacker-controlled value 'sz' as allocation size without upper-bounds checking" } */
-}
+} /* { dg-warning "leak of 'q'" } */
@@ -1,6 +1,3 @@
-// TODO: remove need for this option:
-/* { dg-additional-options "-fanalyzer-checker=taint" } */
-
#include "analyzer-decls.h"
#include <stdio.h>
#include <stdlib.h>
@@ -1,8 +1,7 @@
/* Passing tainted sizes to external functions with attribute ((access)) with
a size-index. */
-// TODO: remove need for the explicit taint option:
-/* { dg-additional-options "-fanalyzer-checker=taint -fanalyzer-show-duplicate-count" } */
+/* { dg-additional-options "-fanalyzer-show-duplicate-count" } */
#include "analyzer-decls.h"
#include <stdio.h>
@@ -1,6 +1,3 @@
-// TODO: remove need for this option:
-/* { dg-additional-options "-fanalyzer-checker=taint" } */
-
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
@@ -1,6 +1,3 @@
-// TODO: remove need for this option:
-/* { dg-additional-options "-fanalyzer-checker=taint" } */
-
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
@@ -1,5 +1,3 @@
-// TODO: remove need for the taint option:
-/* { dg-additional-options "-fanalyzer-checker=taint" } */
/* { dg-skip-if "" { *-*-* } { "-fno-fat-lto-objects" } { "" } } */
#define LOWER_LIMIT 5
@@ -1,5 +1,3 @@
-// TODO: remove need for the taint option:
-/* { dg-additional-options "-fanalyzer-checker=taint" } */
/* { dg-skip-if "" { *-*-* } { "-fno-fat-lto-objects" } { "" } } */
struct raw_ep {
@@ -1,7 +1,6 @@
/* { dg-do compile } */
-// TODO: remove need for -fanalyzer-checker=taint here:
-/* { dg-options "-fanalyzer -fanalyzer-checker=taint" } */
/* { dg-require-effective-target analyzer } */
+/* { dg-additional-options "-Wno-pedantic" } */
/* See notes in this header. */
#include "taint-CVE-2011-0521.h"
@@ -1,6 +1,5 @@
/* { dg-do compile } */
-// TODO: remove need for -fanalyzer-checker=taint here:
-/* { dg-options "-fanalyzer -fanalyzer-checker=taint" } */
+/* { dg-additional-options "-Wno-pedantic" } */
/* { dg-require-effective-target analyzer } */
/* See notes in this header. */
@@ -1,14 +1,10 @@
/* { dg-do compile } */
-// TODO: remove need for -fanalyzer-checker=taint here:
-/* { dg-options "-fanalyzer -fanalyzer-checker=taint" } */
+/* { dg-additional-options "-Wno-pedantic" } */
/* { dg-require-effective-target analyzer } */
/* See notes in this header. */
#include "taint-CVE-2011-0521.h"
-// TODO: remove need for this option
-/* { dg-additional-options "-fanalyzer-checker=taint" } */
-
/* Adapted from drivers/media/dvb/ttpci/av7110_ca.c */
int dvb_ca_ioctl(struct file *file, unsigned int cmd, void *parg)
@@ -1,7 +1,6 @@
/* { dg-do compile } */
-// TODO: remove need for -fanalyzer-checker=taint here:
-/* { dg-options "-fanalyzer -fanalyzer-checker=taint" } */
/* { dg-require-effective-target analyzer } */
+/* { dg-additional-options "-Wno-pedantic" } */
/* See notes in this header. */
#include "taint-CVE-2011-0521.h"
@@ -1,14 +1,10 @@
/* { dg-do compile } */
-// TODO: remove need for -fanalyzer-checker=taint here:
-/* { dg-options "-fanalyzer -fanalyzer-checker=taint" } */
/* { dg-require-effective-target analyzer } */
+/* { dg-additional-options "-Wno-pedantic" } */
/* See notes in this header. */
#include "taint-CVE-2011-0521.h"
-// TODO: remove need for this option
-/* { dg-additional-options "-fanalyzer-checker=taint" } */
-
/* Adapted from drivers/media/dvb/ttpci/av7110_ca.c */
int dvb_ca_ioctl(struct file *file, unsigned int cmd, void *parg)
@@ -1,7 +1,6 @@
/* { dg-do compile } */
-// TODO: remove need for -fanalyzer-checker=taint here:
-/* { dg-options "-fanalyzer -fanalyzer-checker=taint" } */
/* { dg-require-effective-target analyzer } */
+/* { dg-additional-options "-Wno-pedantic" } */
/* See notes in this header. */
#include "taint-CVE-2011-0521.h"
@@ -21,7 +20,7 @@ int dvb_ca_ioctl(struct file *file, unsigned int cmd, void *parg)
if (info->num > 1)
return -EINVAL;
av7110->ci_slot[info->num].num = info->num; /* { dg-warning "attacker-controlled value" "" { xfail *-*-* } } */
- // TODO(xfail)
+ /* TODO(xfail). */
av7110->ci_slot[info->num].type = FW_CI_LL_SUPPORT(av7110->arm_app) ?
CA_CI_LINK : CA_CI;
memcpy(info, &av7110->ci_slot[info->num], sizeof(ca_slot_info_t));
@@ -1,8 +1,7 @@
/* { dg-do compile } */
-// TODO: remove need for -fanalyzer-checker=taint here:
// TODO: remove need for --param=analyzer-max-svalue-depth=25 here:
-/* { dg-options "-fanalyzer -fanalyzer-checker=taint --param=analyzer-max-svalue-depth=25" } */
-/* { dg-options "-fanalyzer -fanalyzer-checker=taint" } */
+/* { dg-options "-fanalyzer --param=analyzer-max-svalue-depth=25" } */
+/* { dg-additional-options "-Wno-pedantic" } */
/* { dg-require-effective-target analyzer } */
/* See notes in this header. */
@@ -32,11 +31,10 @@ int test_1(struct file *file, unsigned int cmd, unsigned long arg)
if (info->num > 1)
return -EINVAL;
- av7110->ci_slot[info->num].num = info->num; /* { dg-warning "attacker-controlled value" "" { xfail *-*-* } } */
- // TODO(xfail)
- av7110->ci_slot[info->num].type = FW_CI_LL_SUPPORT(av7110->arm_app) ?
+ av7110->ci_slot[info->num].num = info->num; /* { dg-warning "attacker-controlled value" } */
+ av7110->ci_slot[info->num].type = FW_CI_LL_SUPPORT(av7110->arm_app) ? /* { dg-warning "attacker-controlled value" } */
CA_CI_LINK : CA_CI;
- memcpy(info, &av7110->ci_slot[info->num], sizeof(ca_slot_info_t));
+ memcpy(info, &av7110->ci_slot[info->num], sizeof(ca_slot_info_t)); /* { dg-warning "attacker-controlled value" } */
}
copy_to_user((void __user *)arg, parg, sizeof(sbuf));
@@ -1,7 +1,7 @@
/* { dg-do compile } */
-// TODO: remove need for -fanalyzer-checker=taint here:
// TODO: remove need for --param=analyzer-max-svalue-depth=25 here:
-/* { dg-options "-fanalyzer -fanalyzer-checker=taint --param=analyzer-max-svalue-depth=25" } */
+/* { dg-options "-fanalyzer --param=analyzer-max-svalue-depth=25" } */
+/* { dg-additional-options "-Wno-pedantic" } */
/* { dg-require-effective-target analyzer } */
/* On darwin, system headers are fortified, which defeats the analysis. Turn it off. */
@@ -1,7 +1,7 @@
/* { dg-do compile } */
-// TODO: remove need for -fanalyzer-checker=taint here:
// TODO: remove need for --param=analyzer-max-svalue-depth=25 here:
-/* { dg-options "-fanalyzer -fanalyzer-checker=taint --param=analyzer-max-svalue-depth=25" } */
+/* { dg-options "-fanalyzer --param=analyzer-max-svalue-depth=25" } */
+/* { dg-additional-options "-Wno-pedantic" } */
/* { dg-require-effective-target analyzer } */
/* On darwin, system headers are fortified, which defeats the analysis. Turn it off. */
@@ -1,7 +1,7 @@
/* { dg-do compile } */
-// TODO: remove need for -fanalyzer-checker=taint here:
// TODO: remove need for --param=analyzer-max-svalue-depth=25 here:
-/* { dg-options "-fanalyzer -fanalyzer-checker=taint --param=analyzer-max-svalue-depth=25" } */
+/* { dg-options "-fanalyzer --param=analyzer-max-svalue-depth=25" } */
+/* { dg-additional-options "-Wno-pedantic" } */
/* { dg-require-effective-target analyzer } */
/* On darwin, system headers are fortified, which defeats the analysis. Turn it off. */
@@ -1,6 +1,5 @@
/* { dg-do compile } */
-// TODO: remove need for -fanalyzer-checker=taint here:
-/* { dg-options "-fanalyzer -fanalyzer-checker=taint" } */
+/* { dg-options "-fanalyzer" } */
/* { dg-require-effective-target analyzer } */
#include "test-uaccess.h"