Lines Matching refs:to
23 // Input to a test is a zero-terminated string str with given length
24 // Accesses to the bytes to the left and to the right of str
25 // are presumed to produce OOB errors
35 // We don't insert RedZones to the left of global variables
42 // String is not zero-terminated, strlen will lead to OOB access
61 // TODO(samsonov): Fix expected messages in StrLenOOBTestTemplate to
62 // make test for stack_string work. Or move it to output tests.
90 // Argument points to not allocated memory.
110 // Argument points to not allocated memory.
122 char *to = Ident((char*)malloc(to_size));
126 strcpy(to, from);
127 strcpy(to + to_size - from_size, from);
130 // "to" or "from" points to not allocated memory.
131 EXPECT_DEATH(Ident(strcpy(to - 1, from)), LeftOOBWriteMessage(1));
132 EXPECT_DEATH(Ident(strcpy(to, from - 1)), LeftOOBReadMessage(1));
133 EXPECT_DEATH(Ident(strcpy(to, from + from_size)), RightOOBReadMessage(0));
134 EXPECT_DEATH(Ident(strcpy(to + to_size, from)), RightOOBWriteMessage(0));
137 EXPECT_DEATH(Ident(strcpy(to, from)), RightOOBReadMessage(0));
138 free(to);
145 char *to = Ident((char*)malloc(to_size));
150 strncpy(to, from, 0);
151 strncpy(to - 1, from - 1, 0);
153 strncpy(to, from, from_size);
154 strncpy(to, from, to_size);
155 strncpy(to, from + from_size - 1, to_size);
156 strncpy(to + to_size - 1, from, 1);
157 // One of {to, from} points to not allocated memory
158 EXPECT_DEATH(Ident(strncpy(to, from - 1, from_size)),
160 EXPECT_DEATH(Ident(strncpy(to - 1, from, from_size)),
162 EXPECT_DEATH(Ident(strncpy(to, from + from_size, 1)),
164 EXPECT_DEATH(Ident(strncpy(to + to_size, from, 1)),
166 // Length of "to" is too small
167 EXPECT_DEATH(Ident(strncpy(to + to_size - from_size + 1, from, from_size)),
169 EXPECT_DEATH(Ident(strncpy(to + 1, from, to_size)),
174 strncpy(to, from, from_size);
176 EXPECT_DEATH(Ident(strncpy(to, from, to_size)),
178 free(to);
197 // StrChr argument points to not allocated memory.
213 // StrChr argument points to not allocated memory.
295 // One of arguments points to not allocated memory.
333 // One of arguments points to not allocated memory.
356 // strcat() reads strlen(to) bytes from |to| before concatenating.
358 char *to = MallocAndMemsetString(to_size);
359 to[0] = '\0';
364 strcat(to, from);
365 strcat(to, from);
366 strcat(to + from_size, from + from_size - 2);
369 EXPECT_DEATH(strcat(to - 1, from + from_size - 1), LeftOOBAccessMessage(1));
370 // One of arguments points to not allocated memory.
371 EXPECT_DEATH(strcat(to - 1, from), LeftOOBAccessMessage(1));
372 EXPECT_DEATH(strcat(to, from - 1), LeftOOBReadMessage(1));
373 EXPECT_DEATH(strcat(to + to_size, from), RightOOBWriteMessage(0));
374 EXPECT_DEATH(strcat(to, from + from_size), RightOOBReadMessage(0));
378 EXPECT_DEATH(strcat(to, from), RightOOBReadMessage(0));
380 // "to" is not zero-terminated.
381 memset(to, 'z', to_size);
382 EXPECT_DEATH(strcat(to, from), RightOOBWriteMessage(0));
383 // "to" is too short to fit "from".
384 to[to_size - from_size + 1] = '\0';
385 EXPECT_DEATH(strcat(to, from), RightOOBWriteMessage(0));
386 // length of "to" is just enough.
387 strcat(to, from + 1);
389 free(to);
394 // strncat() reads strlen(to) bytes from |to| before concatenating.
396 char *to = MallocAndMemsetString(to_size);
397 to[0] = '\0';
401 strncat(to, from, 0);
402 strncat(to, from, from_size);
404 strncat(to, from, 2 * from_size);
406 EXPECT_DEATH(strncat(to - 1, from, 0), LeftOOBAccessMessage(1));
407 strncat(to, from + from_size - 1, 10);
408 // One of arguments points to not allocated memory.
409 EXPECT_DEATH(strncat(to - 1, from, 2), LeftOOBAccessMessage(1));
410 EXPECT_DEATH(strncat(to, from - 1, 2), LeftOOBReadMessage(1));
411 EXPECT_DEATH(strncat(to + to_size, from, 2), RightOOBWriteMessage(0));
412 EXPECT_DEATH(strncat(to, from + from_size, 2), RightOOBReadMessage(0));
415 memset(to, 'z', to_size);
416 to[0] = '\0';
418 EXPECT_DEATH(strncat(to, from, from_size + 1), RightOOBReadMessage(0));
419 // "to" is not zero-terminated.
420 EXPECT_DEATH(strncat(to + 1, from, 1), RightOOBWriteMessage(0));
421 // "to" is too short to fit "from".
422 to[0] = 'z';
423 to[to_size - from_size + 1] = '\0';
424 EXPECT_DEATH(strncat(to, from, from_size - 1), RightOOBWriteMessage(0));
425 // "to" is just enough.
426 strncat(to, from, from_size - 2);
428 free(to);
444 // Check "memcpy". Use Ident() to avoid inlining.
452 // We do not treat memcpy with to==from as a bug.
514 // Invalid pointer to the string.
525 // Sometimes we need to detect overflow if no digits are found.
558 // Invalid pointer to the string.
569 // Add terminating zero to get rid of overflow.
575 // Sometimes we need to detect overflow if no digits are found.
