the warn-unused-plugin is broken in 1.3

[ivg]

Apparently the 817eac8 commit changed the semantics of taint introduction, so now, a place where taint is introduced also became a place where a taint is consumed. And although it makes some sense, it breaks WUR as the latter would consider all results as used at the callsite points.

echo > main.c << EOF
#include <stdlib.h>
int main(int argc, char** argv) {
  char* buf = malloc(10);
  realloc(buf, 12);
  return 0;
}
EOF
gcc -O0 main.c -o main
$ bap ./main --warn-unused --print-bir-attr={visited,tainted-reg,tainted-regs} -d | grep 'call @realloc' -A8
00000128: call @realloc with return %00000129

.visited ()
00000129: 
.tainted-regs {RAX => [00000120, 00000128]}
.visited ()
.tainted-reg 00000128
0000023f: realloc_result := RAX
.tainted-regs {RDI => [00000128]}

Notice, that the synthetic 23f term is now self proving, it both introduces and sanitizes the taint.

[gitoleg]

fixed in #939