f(char * s)1 char *f (/*@tainted@*/ char *s)
2 {
3   char t[50];
4   char t2[20];
5 
6   (void) system ("test");
7   strcpy (t, "test");
8   strcpy (t2, "okay");
9 
10   (void) system (t);
11 
12   t = strcat3 (t, t2, t2);
13   (void) system (t); /* okay */
14 
15   t = strcat3 (t, t2, s);
16   (void) system (t); /* error */
17 
18   t = strcat3 (t, t2, t2);
19   (void) system (t); /* error */
20 
21   t = strcpy (t, s);
22   (void) system (t); /* error */
23 
24   return t; /* error - tainted, stack-allocated */
25 }
26