example_good.c

#include <stdarg.h>
#include <stdlib.h>
#include <stdio.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <sys/types.h>
#include <ctype.h>
#include <stdbool.h>

void clang_analyzer_eval(bool);
void clang_analyzer_warnIfReached();
void clang_analyzer_numTimesReached();
void clang_analyzer_explain(void *);
void clang_analyzer_dump(void *);
void clang_analyzer_isTainted(void *);
void clang_analyzer_printState();

char *globInBuf;

void someFoo(char *src, int size)
{
    clang_analyzer_explain(src);
    clang_analyzer_dump(src); //&Element{SymRegion{conj_$14{void *, LC1, S33468, #1}},0 S64b,char}
    clang_analyzer_printState();
    system(&(src[0]));

    for(int i=0; i<size;i++){
        //clang_analyzer_numTimesReached();
        printf("%d", src[i]);
    }
}


int main(int argc, char **argv)
{


    char const *inFileName = "../v1_input/input_file.bin";
    FILE *inFile=fopen(inFileName,"r"); // here appears tain symbol
    // conj_$3{FILE *, LC1, S32864, #1}\n{ [1, 18446744073709551615] } - тип FILE *, в инструкции S32864: fopen(inFileName, "r")
    if (inFile==NULL)
    {
        //clang_analyzer_warnIfReached();
        //clang_analyzer_numTimesReached();
        fprintf(stderr, "%s: open file err %s: \n", inFileName, inFileName);
        perror("");
        exit(4);
    }

    struct stat st;
    stat(inFileName, &st);
    char *inBuf;
    clang_analyzer_explain(inBuf);
    clang_analyzer_dump(inBuf);

    int inBufSize = st.st_size;
    printf("inBufSize=%d\n", inBufSize);
    // here local buf wich was successfuly tainted
    inBuf = (char *)malloc(inBufSize);
    clang_analyzer_explain(inBuf); // pointer to element of type 'char' with index 0 of pointee of symbol of type 'void *' conjured at statement 'malloc(inBufSize)'
    clang_analyzer_dump(inBuf); // &Element{SymRegion{conj_$14{void *, LC1, S33468, #1}},0 S64b,char}

    fread(inBuf,1,inBufSize,inFile);
    clang_analyzer_dump(inBuf); // &Element{SymRegion{conj_$14{void *, LC1, S33468, #1}},0 S64b,char}

    if (inBuf[inBufSize-1] == 0x55){
        printf("inBuf[inBufSize-1] is 0x55\n"); //S33668
    }
    else{
        printf("inBuf[inBufSize-1] is not 0x55\n"); //S33699
    }

    clang_analyzer_explain(globInBuf);
    // &SymRegion{derived_$24{conj_$21{int, LC1, S33699, #1},globInBuf}}
    // &SymRegion{derived_$43{conj_$31{int, LC1, S33668, #1},globInBuf}}
    // why globInBuf derived from symbols conjured at statements S33699, S33668 ?
    clang_analyzer_dump(globInBuf);
    globInBuf = inBuf;
    clang_analyzer_explain(globInBuf);
    // &Element{SymRegion{conj_$14{void *, LC1, S33468, #1}},0 S64b,char}
    // S33468 is malloc(inBufSize)
    clang_analyzer_dump(globInBuf);

    someFoo(globInBuf, inBufSize);

}