[analyzer] Add support for taint flowing through a function (atoi).
authorAnna Zaks <ganna@apple.com>
Sat, 17 Dec 2011 00:26:34 +0000 (00:26 +0000)
committerAnna Zaks <ganna@apple.com>
Sat, 17 Dec 2011 00:26:34 +0000 (00:26 +0000)
commit3b0ab206d27e74bdd94f525c1f6bf11ad1824ba3
treec8619d2f5cbf848123b85829d30cb8baf8935a37
parent9de45554e1141bfa72a459e215ceba23cdd175b6
[analyzer] Add support for taint flowing through a function (atoi).

Check if the input parameters are tainted (or point to tainted data) on
a checkPreStmt<CallExpr>. If the output should be tainted, record it in
the state. On post visit (checkPostStmt<CallExpr>), use the state to
make decisions (in addition to the existing logic). Use this logic for
atoi and fscanf.

llvm-svn: 146793
clang/lib/StaticAnalyzer/Checkers/GenericTaintChecker.cpp
clang/test/Analysis/taint-tester.c