[analyzer] Propagate taint through MemRegions.

SVal can be not only a symbol, but a MemRegion. Add support for such
cases.

llvm-svn: 146006

1 files changed, 15 insertions, 4 deletions

diff --git a/clang/test/Analysis/taint-tester.c b/clang/test/Analysis/taint-tester.c
index eb05f577d1b..23b5744f8c8 100644
--- a/clang/test/Analysis/taint-tester.c
+++ b/clang/test/Analysis/taint-tester.c
@@ -6,18 +6,29 @@ int getchar(void);
 #define BUFSIZE 10
 int Buffer[BUFSIZE];
 
-void bufferScanfAssignment(int x) {
+struct XYStruct {
+  int x;
+  float y;
+};
+
+void taintTracking(int x) {
   int n;
   int *addr = &Buffer[0];
   scanf("%d", &n);
-  addr += n;// expected-warning {{tainted}}
-  *addr = n; // expected-warning 2 {{tainted}}
+  addr += n;// expected-warning 2 {{tainted}}
+  *addr = n; // expected-warning 3 {{tainted}}
 
   double tdiv = n / 30; // expected-warning 3 {{tainted}}
   char *loc_cast = (char *) n; // expected-warning {{tainted}}
   char tinc = tdiv++; // expected-warning {{tainted}}
   int tincdec = (char)tinc--; // expected-warning 2 {{tainted}}
-  int tprtarithmetic1 = *(addr+1);
 
+  // Tainted ptr arithmetic/array element address.
+  int tprtarithmetic1 = *(addr+1); // expected-warning 2 {{tainted}}
 
+  // Tainted struct address, casts.
+  struct XYStruct *xyPtr = 0;
+  scanf("%p", &xyPtr);
+  void *tXYStructPtr = xyPtr; // expected-warning 2 {{tainted}}
+  struct XYStruct *xyPtrCopy = tXYStructPtr; // expected-warning 2 {{tainted}}
 }