f(char * s)1char *f (/*@tainted@*/ char *s) 2 { 3 char t[50]; 4 5 (void) system ("test"); 6 strcpy (t, "test"); 7 8 (void) system (t); 9 10 strcat (t, s); 11 (void) system (t); /* error */ 12 13 strcpy (t, s); 14 (void) system (t); /* error */ 15 16 return t; /* error - tainted, stack-allocated */ 17 } 18