Lines Matching defs:from
123 char *from = Ident((char*)malloc(from_size));
125 strcpy(from, "hello");
126 strcpy(to, from);
127 strcpy(to + to_size - from_size, from);
128 // Length of "from" is too small.
129 EXPECT_DEATH(Ident(strcpy(from, "hello2")), RightOOBWriteMessage(0));
130 // "to" or "from" points to not allocated memory.
131 EXPECT_DEATH(Ident(strcpy(to - 1, from)), LeftOOBWriteMessage(1));
132 EXPECT_DEATH(Ident(strcpy(to, from - 1)), LeftOOBReadMessage(1));
133 EXPECT_DEATH(Ident(strcpy(to, from + from_size)), RightOOBReadMessage(0));
134 EXPECT_DEATH(Ident(strcpy(to + to_size, from)), RightOOBWriteMessage(0));
136 from[from_size - 1] = '!';
137 EXPECT_DEATH(Ident(strcpy(to, from)), RightOOBReadMessage(0));
139 free(from);
146 // From is a zero-terminated string "hello\0" of length 6
147 char *from = Ident((char*)malloc(from_size));
148 strcpy(from, "hello");
150 strncpy(to, from, 0);
151 strncpy(to - 1, from - 1, 0);
153 strncpy(to, from, from_size);
154 strncpy(to, from, to_size);
155 strncpy(to, from + from_size - 1, to_size);
156 strncpy(to + to_size - 1, from, 1);
157 // One of {to, from} points to not allocated memory
158 EXPECT_DEATH(Ident(strncpy(to, from - 1, from_size)),
160 EXPECT_DEATH(Ident(strncpy(to - 1, from, from_size)),
162 EXPECT_DEATH(Ident(strncpy(to, from + from_size, 1)),
164 EXPECT_DEATH(Ident(strncpy(to + to_size, from, 1)),
167 EXPECT_DEATH(Ident(strncpy(to + to_size - from_size + 1, from, from_size)),
169 EXPECT_DEATH(Ident(strncpy(to + 1, from, to_size)),
171 // Overwrite terminator in from
172 from[from_size - 1] = '!';
174 strncpy(to, from, from_size);
175 // Length of "from" is too small
176 EXPECT_DEATH(Ident(strncpy(to, from, to_size)),
179 free(from);
354 // strcat() reads strlen(to) bytes from |to| before concatenating.
359 char *from = MallocAndMemsetString(from_size);
360 from[from_size - 1] = '\0';
362 strcat(to, from);
363 strcat(to, from);
364 strcat(to + from_size, from + from_size - 2);
367 EXPECT_DEATH(strcat(to - 1, from + from_size - 1), LeftOOBAccessMessage(1));
369 EXPECT_DEATH(strcat(to - 1, from), LeftOOBAccessMessage(1));
370 EXPECT_DEATH(strcat(to, from - 1), LeftOOBReadMessage(1));
371 EXPECT_DEATH(strcat(to, from + from_size), RightOOBReadMessage(0));
373 // "from" is not zero-terminated.
374 from[from_size - 1] = 'z';
375 EXPECT_DEATH(strcat(to, from), RightOOBReadMessage(0));
376 from[from_size - 1] = '\0';
377 // "to" is too short to fit "from".
380 EXPECT_DEATH(strcat(to, from), RightOOBWriteMessage(0));
382 strcat(to, from + 1);
385 free(from);
389 // strncat() reads strlen(to) bytes from |to| before concatenating.
394 char *from = MallocAndMemsetString(from_size);
396 strncat(to, from, 0);
397 strncat(to, from, from_size);
398 from[from_size - 1] = '\0';
399 strncat(to, from, 2 * from_size);
401 EXPECT_DEATH(strncat(to - 1, from, 0), LeftOOBAccessMessage(1));
402 strncat(to, from + from_size - 1, 10);
404 EXPECT_DEATH(strncat(to - 1, from, 2), LeftOOBAccessMessage(1));
405 EXPECT_DEATH(strncat(to, from - 1, 2), LeftOOBReadMessage(1));
406 EXPECT_DEATH(strncat(to, from + from_size, 2), RightOOBReadMessage(0));
408 memset(from, 'z', from_size);
411 // "from" is too short.
412 EXPECT_DEATH(strncat(to, from, from_size + 1), RightOOBReadMessage(0));
413 // "to" is too short to fit "from".
416 EXPECT_DEATH(strncat(to, from, from_size - 1), RightOOBWriteMessage(0));
418 strncat(to, from, from_size - 2);
421 free(from);
444 // We do not treat memcpy with to==from as a bug.
481 strncat(str, str + 10, 10); // from is empty
