@@ -645,8 +645,10 @@ class tainted_allocation_size : public taint_diagnostic
{
public:
tainted_allocation_size (const taint_state_machine &sm, tree arg,
+ const svalue *size_in_bytes,
enum bounds has_bounds, enum memory_space mem_space)
: taint_diagnostic (sm, arg, has_bounds),
+ m_size_in_bytes (size_in_bytes),
m_mem_space (mem_space)
{
}
@@ -781,7 +783,18 @@ public:
}
}
+ void maybe_add_sarif_properties (sarif_object &result_obj)
+ const final override
+ {
+ taint_diagnostic::maybe_add_sarif_properties (result_obj);
+ sarif_property_bag &props = result_obj.get_or_create_properties ();
+#define PROPERTY_PREFIX "gcc/analyzer/tainted_allocation_size/"
+ props.set (PROPERTY_PREFIX "size_in_bytes", m_size_in_bytes->to_json ());
+#undef PROPERTY_PREFIX
+ }
+
private:
+ const svalue *m_size_in_bytes;
enum memory_space m_mem_space;
};
@@ -1678,7 +1691,7 @@ region_model::check_dynamic_size_for_taint (enum memory_space mem_space,
{
tree arg = get_representative_tree (size_in_bytes);
ctxt->warn (make_unique<tainted_allocation_size>
- (taint_sm, arg, b, mem_space));
+ (taint_sm, arg, size_in_bytes, b, mem_space));
}
}
Tested lightly by hand. Successfully bootstrapped & regrtested on x86_64-pc-linux-gnu. Successful run of analyzer integration tests on x86_64-pc-linux-gnu. Pushed to trunk as r14-9898-g115d5c6b009456. gcc/analyzer/ChangeLog: * sm-taint.cc (tainted_allocation_size::tainted_allocation_size): Add "size_in_bytes" param. (tainted_allocation_size::maybe_add_sarif_properties): New. (tainted_allocation_size::m_size_in_bytes): New field. (region_model::check_dynamic_size_for_taint): Pass size_in_bytes to tainted_allocation_size ctor. Signed-off-by: David Malcolm <dmalcolm@redhat.com> --- gcc/analyzer/sm-taint.cc | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-)