PR23230 Fix asan strtol_strict/strtoll_strict tests

[m.guseva]

Summary

This is a patch to fix the bug reported here: https://llvm.org/bugs/show_bug.cgi?id=23230

[kcc]

test/asan/TestCases/strtol_strict.c

45 ↗

(On Diff #26607)

ouch. This is going to corrupt asan's heap internals and may cause other kinds of flakiness in the test.
I would suggest to allocate a larger buffer, write 0 to the first 8 bytes, apply __asan_poison_memory to those first 8 bytes,
and then pass pass the address to one of those 8 bytes to strtol.
This way you will get a reliable test.

[m.guseva]

Kostya, thank you.
Attached new patch. What do you think?

[kcc]

LGTM

[kcc]

LGTM

compiler-rt/trunk/test/asan/TestCases/strtol_strict.c

 // RUN: ASAN_OPTIONS=strict_string_checks=true not %run %t test6 2>&1 | FileCheck %s --check-prefix=CHECK6
 // RUN: %run %t test7 2>&1
 // RUN: ASAN_OPTIONS=strict_string_checks=false %run %t test7 2>&1
 // RUN: ASAN_OPTIONS=strict_string_checks=true not %run %t test7 2>&1 | FileCheck %s --check-prefix=CHECK7
 
 #include <assert.h>
 #include <stdlib.h>
 #include <string.h>
+#include <sanitizer/asan_interface.h>
 
 void test1(char *array, char *endptr) {
   // Buffer overflow if there is no terminating null (depends on base)
   long r = strtol(array, &endptr, 3);
   assert(array + 2 == endptr);
   assert(r == 5);
 }
 
 void test2(char *array, char *endptr) {
   // Buffer overflow if there is no terminating null (depends on base)
   array[2] = 'z';
   long r = strtol(array, &endptr, 35);
   assert(array + 2 == endptr);
   assert(r == 37);
 }
 
 void test3(char *array, char *endptr) {
   // Buffer overflow if base is invalid.
-  long r = strtol(array - 1, NULL, -1);
+  memset(array, 0, 8);
+  ASAN_POISON_MEMORY_REGION(array, 8);
+  long r = strtol(array + 1, NULL, -1);
   assert(r == 0);
+  ASAN_UNPOISON_MEMORY_REGION(array, 8);
 }
 
 void test4(char *array, char *endptr) {
   // Buffer overflow if base is invalid.
   long r = strtol(array + 3, NULL, 1);
   assert(r == 0);
 }
 

 void test7(char *array, char *endptr) {
   // Overflow if no digits are found.
   array[2] = 'z';
   long r = strtol(array + 2, NULL, 0);
   assert(r == 0);
 }
 
 int main(int argc, char **argv) {
-  char *array = (char*)malloc(3);
+  char *array0 = (char*)malloc(11);
+  char* array = array0 + 8;
   char *endptr = NULL;
   array[0] = '1';
   array[1] = '2';
   array[2] = '3';
   if (argc != 2) return 1;
   if (!strcmp(argv[1], "test1")) test1(array, endptr);
   // CHECK1: {{.*ERROR: AddressSanitizer: heap-buffer-overflow on address}}
   // CHECK1: READ of size 4
   if (!strcmp(argv[1], "test2")) test2(array, endptr);
   // CHECK2: {{.*ERROR: AddressSanitizer: heap-buffer-overflow on address}}
   // CHECK2: READ of size 4
-  if (!strcmp(argv[1], "test3")) test3(array, endptr);
-  // CHECK3: {{.*ERROR: AddressSanitizer: heap-buffer-overflow on address}}
-  // CHECK3: READ of size 5
+  if (!strcmp(argv[1], "test3")) test3(array0, endptr);
+  // CHECK3: {{.*ERROR: AddressSanitizer: use-after-poison on address}}
+  // CHECK3: READ of size 1
   if (!strcmp(argv[1], "test4")) test4(array, endptr);
   // CHECK4: {{.*ERROR: AddressSanitizer: heap-buffer-overflow on address}}
   // CHECK4: READ of size 1
   if (!strcmp(argv[1], "test5")) test5(array, endptr);
   // CHECK5: {{.*ERROR: AddressSanitizer: heap-buffer-overflow on address}}
   // CHECK5: READ of size 4
   if (!strcmp(argv[1], "test6")) test6(array, endptr);
   // CHECK6: {{.*ERROR: AddressSanitizer: heap-buffer-overflow on address}}
   // CHECK6: READ of size 4
   if (!strcmp(argv[1], "test7")) test7(array, endptr);
   // CHECK7: {{.*ERROR: AddressSanitizer: heap-buffer-overflow on address}}
   // CHECK7: READ of size 2
-  free(array);
+  free(array0);
   return 0;
 }

compiler-rt/trunk/test/asan/TestCases/strtoll_strict.c

 // RUN: ASAN_OPTIONS=strict_string_checks=true not %run %t test6 2>&1 | FileCheck %s --check-prefix=CHECK6
 // RUN: %run %t test7 2>&1
 // RUN: ASAN_OPTIONS=strict_string_checks=false %run %t test7 2>&1
 // RUN: ASAN_OPTIONS=strict_string_checks=true not %run %t test7 2>&1 | FileCheck %s --check-prefix=CHECK7
 
 #include <assert.h>
 #include <stdlib.h>
 #include <string.h>
+#include <sanitizer/asan_interface.h>
 
 void test1(char *array, char *endptr) {
   // Buffer overflow if there is no terminating null (depends on base)
   long long r = strtoll(array, &endptr, 3);
   assert(array + 2 == endptr);
   assert(r == 5);
 }
 
 void test2(char *array, char *endptr) {
   // Buffer overflow if there is no terminating null (depends on base)
   array[2] = 'z';
   long long r = strtoll(array, &endptr, 35);
   assert(array + 2 == endptr);
   assert(r == 37);
 }
 
 void test3(char *array, char *endptr) {
   // Buffer overflow if base is invalid.
-  long long r = strtoll(array - 1, NULL, -1);
+  memset(array, 0, 8);
+  ASAN_POISON_MEMORY_REGION(array, 8);
+  long long r = strtoll(array + 1, NULL, -1);
   assert(r == 0);
+  ASAN_UNPOISON_MEMORY_REGION(array, 8);
 }
 
 void test4(char *array, char *endptr) {
   // Buffer overflow if base is invalid.
   long long r = strtoll(array + 3, NULL, 1);
   assert(r == 0);
 }
 

 void test7(char *array, char *endptr) {
   // Overflow if no digits are found.
   array[2] = 'z';
   long long r = strtoll(array + 2, NULL, 0);
   assert(r == 0);
 }
 
 int main(int argc, char **argv) {
-  char *array = (char*)malloc(3);
+  char *array0 = (char*)malloc(11);
+  char* array = array0 + 8;
   char *endptr = NULL;
   array[0] = '1';
   array[1] = '2';
   array[2] = '3';
   if (argc != 2) return 1;
   if (!strcmp(argv[1], "test1")) test1(array, endptr);
   // CHECK1: {{.*ERROR: AddressSanitizer: heap-buffer-overflow on address}}
   // CHECK1: READ of size 4
   if (!strcmp(argv[1], "test2")) test2(array, endptr);
   // CHECK2: {{.*ERROR: AddressSanitizer: heap-buffer-overflow on address}}
   // CHECK2: READ of size 4
-  if (!strcmp(argv[1], "test3")) test3(array, endptr);
-  // CHECK3: {{.*ERROR: AddressSanitizer: heap-buffer-overflow on address}}
-  // CHECK3: READ of size 5
+  if (!strcmp(argv[1], "test3")) test3(array0, endptr);
+  // CHECK3: {{.*ERROR: AddressSanitizer: use-after-poison on address}}
+  // CHECK3: READ of size 1
   if (!strcmp(argv[1], "test4")) test4(array, endptr);
   // CHECK4: {{.*ERROR: AddressSanitizer: heap-buffer-overflow on address}}
   // CHECK4: READ of size 1
   if (!strcmp(argv[1], "test5")) test5(array, endptr);
   // CHECK5: {{.*ERROR: AddressSanitizer: heap-buffer-overflow on address}}
   // CHECK5: READ of size 4
   if (!strcmp(argv[1], "test6")) test6(array, endptr);
   // CHECK6: {{.*ERROR: AddressSanitizer: heap-buffer-overflow on address}}
   // CHECK6: READ of size 4
   if (!strcmp(argv[1], "test7")) test7(array, endptr);
   // CHECK7: {{.*ERROR: AddressSanitizer: heap-buffer-overflow on address}}
   // CHECK7: READ of size 2
-  free(array);
+  free(array0);
   return 0;
 }