first regression tests

Author: Daniel Kroening

regression/goto-analyzer-taint-ansi-c/taint-basic1/main.c

@@ -0,0 +1,16 @@
+#include <stdlib.h>
+
+void my_f(void *) { }
+void my_h(void *) { }
+void *my_g(void) { return malloc(1); }
+
+void my_function()
+{
+  void *o;
+
+  my_f(o); // T1 source
+  my_h(o); // T1,T2 sink
+
+  o=my_g(); // T2 source
+  my_h(o); // T1,T2 sink
+}

regression/goto-analyzer-taint-ansi-c/taint-basic1/main.o

@@ -0,0 +1,6 @@
+[
+{ "id": "my_f", "kind": "source", "where": "parameter1", "taint": "T1", "function": "my_f" },
+{ "id": "my_g", "kind": "source", "where": "return_value", "taint": "T2", "function": "my_g" },
+{ "id": "my_h1", "kind": "sink",   "where": "parameter1", "taint": "T1", "function": "my_h", "message": "There is a T1 flow" },
+{ "id": "my_h2", "kind": "sink",   "where": "parameter1", "taint": "T2", "function": "my_h", "message": "There is a T2 flow" }
+]

regression/goto-analyzer-taint-ansi-c/taint-basic1/taint.json

@@ -0,0 +1,10 @@
+CORE
+main.o
+--taint taint.json
+^EXIT=0$
+^SIGNAL=0$
+^file main.c line 12( function .*)?: There is a T1 flow \(taint rule my_h1\)$
+^file main.c line 15( function .*)?: There is a T2 flow \(taint rule my_h2\)$
+--
+^file main.c line 12( function .*)?: There is a T2 flow \(.*\)$
+^file main.c line 15( function .*)?: There is a T1 flow \(.*\)$

regression/goto-analyzer-taint-ansi-c/taint-basic1/test.desc

@@ -0,0 +1,13 @@
+void my_f(void *) { }
+void my_h(void *) { }
+
+void my_function()
+{
+  void *o1;
+  my_f(o1); // T1 source
+
+  void *o2;
+  o2=o1;
+
+  my_h(o2); // T1 sink
+}

regression/goto-analyzer-taint-ansi-c/taint-copy1/main.c

@@ -0,0 +1,4 @@
+[
+{ "id": "my_f", "kind": "source", "where": "parameter1", "taint": "T1", "function": "my_f" },
+{ "id": "my_h", "kind": "sink",   "where": "parameter1", "taint": "T1", "function": "my_h", "message": "There is a T1 flow" }
+]

regression/goto-analyzer-taint-ansi-c/taint-copy1/main.o

@@ -0,0 +1,7 @@
+CORE
+main.o
+--taint taint.json
+^EXIT=0$
+^SIGNAL=0$
+^file main.c line 12( function .*)?: There is a T1 flow \(taint rule my_h\)$
+--

regression/goto-analyzer-taint-ansi-c/taint-copy1/taint.json

@@ -0,0 +1,24 @@
+#include <stdlib.h>
+
+void my_f(void *) { }
+void my_h(void *) { }
+
+void my_function()
+{
+  struct some_struct
+  {
+    void *data;
+  } whatnot;
+
+  my_f(whatnot.data); // T1 source
+  my_h(whatnot.data); // T1 sink
+
+  // via a copy
+  void *o=whatnot.data;
+  my_h(o); // T1 sink
+
+  // copy entire struct
+  struct some_struct whatelse;
+  whatelse=whatnot;
+  my_h(whatelse.data); // T1 sink
+}

regression/goto-analyzer-taint-ansi-c/taint-copy1/test.desc

@@ -0,0 +1,4 @@
+[
+{ "id": "my_f", "kind": "source", "where": "parameter1", "taint": "T1", "function": "my_f" },
+{ "id": "my_h", "kind": "sink",   "where": "parameter1", "taint": "T1", "function": "my_h", "message": "There is a T1 flow" }
+]

regression/goto-analyzer-taint-ansi-c/taint-member1/main.c

@@ -0,0 +1,9 @@
+CORE
+main.o
+--taint taint.json
+^EXIT=0$
+^SIGNAL=0$
+^file main.c line 14( function .*)?: There is a T1 flow \(taint rule my_h\)$
+^file main.c line 18( function .*)?: There is a T1 flow \(taint rule my_h\)$
+^file main.c line 23( function .*)?: There is a T1 flow \(taint rule my_h\)$
+--