[analyzer] Fix taint propagation in GenericTaintChecker
The gets function has no SrcArgs. Because the default value for isTainted was false, it didn't mark its DstArgs as tainted. Patch by Gábor Borsik! Differential Revision: https://reviews.llvm.org/D58828 llvm-svn: 355396
This commit is contained in:
parent
8a3b7d390c
commit
855478328b
|
@ -458,7 +458,7 @@ GenericTaintChecker::TaintPropagationRule::process(const CallExpr *CE,
|
|||
ProgramStateRef State = C.getState();
|
||||
|
||||
// Check for taint in arguments.
|
||||
bool IsTainted = false;
|
||||
bool IsTainted = true;
|
||||
for (unsigned ArgNum : SrcArgs) {
|
||||
if (ArgNum >= CE->getNumArgs())
|
||||
return State;
|
||||
|
|
|
@ -2,6 +2,7 @@
|
|||
// RUN: %clang_analyze_cc1 -DFILE_IS_STRUCT -analyzer-checker=alpha.security.taint,core,alpha.security.ArrayBoundV2 -Wno-format-security -verify %s
|
||||
|
||||
int scanf(const char *restrict format, ...);
|
||||
char *gets(char *str);
|
||||
int getchar(void);
|
||||
|
||||
typedef struct _FILE FILE;
|
||||
|
@ -142,6 +143,12 @@ void testTaintSystemCall3() {
|
|||
system(buffern2); // expected-warning {{Untrusted data is passed to a system call}}
|
||||
}
|
||||
|
||||
void testGets() {
|
||||
char str[50];
|
||||
gets(str);
|
||||
system(str); // expected-warning {{Untrusted data is passed to a system call}}
|
||||
}
|
||||
|
||||
void testTaintedBufferSize() {
|
||||
size_t ts;
|
||||
scanf("%zd", &ts);
|
||||
|
|
Loading…
Reference in New Issue