1*f4a2713aSLionel Sambuc // RUN: %clang_cc1 -analyze -analyzer-checker=unix.cstring.BadSizeArg -analyzer-store=region -Wno-strncat-size -Wno-strlcpy-strlcat-size -Wno-sizeof-array-argument -Wno-sizeof-pointer-memaccess -verify %s
2*f4a2713aSLionel Sambuc
3*f4a2713aSLionel Sambuc typedef __SIZE_TYPE__ size_t;
4*f4a2713aSLionel Sambuc char *strncat(char *, const char *, size_t);
5*f4a2713aSLionel Sambuc size_t strlen (const char *s);
6*f4a2713aSLionel Sambuc
testStrncat(const char * src)7*f4a2713aSLionel Sambuc void testStrncat(const char *src) {
8*f4a2713aSLionel Sambuc char dest[10];
9*f4a2713aSLionel Sambuc strncat(dest, "AAAAAAAAAAAAAAAAAAAAAAAAAAAAA", sizeof(dest) - 1); // expected-warning {{Potential buffer overflow. Replace with 'sizeof(dest) - strlen(dest) - 1' or use a safer 'strlcat' API}}
10*f4a2713aSLionel Sambuc strncat(dest, "AAAAAAAAAAAAAAAAAAAAAAAAAAA", sizeof(dest)); // expected-warning {{Potential buffer overflow. Replace with}}
11*f4a2713aSLionel Sambuc strncat(dest, "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", sizeof(dest) - strlen(dest)); // expected-warning {{Potential buffer overflow. Replace with}}
12*f4a2713aSLionel Sambuc strncat(dest, src, sizeof(src)); // expected-warning {{Potential buffer overflow. Replace with}}
13*f4a2713aSLionel Sambuc }
14