New "strict_string_checks" run-time flag

[m.guseva]

Summary

This patch is related to Issue 346: moar string interceptors: strstr, strcasestr, strcspn, strpbrk
As was suggested in original review http://reviews.llvm.org/D6056 a new "strict_string_checks" run-time flag introduced.
The flag support applied for existing common, asan, msan and tsan interceptors. New asan tests added.

[kcc]

This size is more manageable, thanks for splitting.

Id like at least one more reviewer to jump in.

test/asan/TestCases/atol_strict.c

4

here and below, add a 3-rd RUN line to run w/o ASAN_OPTIONS (i.e. to test what's default)

test/asan/Unit/lit.site.cfg.in

33 ↗

(On Diff #18597)

Hm. Why?

[ygribov]

test/asan/Unit/lit.site.cfg.in

33 ↗

(On Diff #18597)

Some tests relied on non-strict semantics.

[kcc]

Specifics please. We may want to fix the tests

[m.guseva]

In D7123#114229, @kcc wrote:

Specifics please. We may want to fix the tests

Here is a list of failed tests for one configuration:

AddressSanitizer-Unit :: Asan-i386-inline-Test/AddressSanitizer.AtoiAndFriendsOOBTest
AddressSanitizer-Unit :: Asan-i386-inline-Test/AddressSanitizer.StrCaseCmpOOBTest
AddressSanitizer-Unit :: Asan-i386-inline-Test/AddressSanitizer.StrCatOOBTest
AddressSanitizer-Unit :: Asan-i386-inline-Test/AddressSanitizer.StrCmpOOBTest
AddressSanitizer-Unit :: Asan-i386-inline-Test/AddressSanitizer.StrNCatOOBTest
AddressSanitizer-Unit :: Asan-i386-inline-Test/AddressSanitizer.StrtolOOBTest
AddressSanitizer-Unit :: Asan-i386-inline-Test/AddressSanitizer.StrtollOOBTest

These are test cases when string args were not correct but a result still may be calculated correctly, see:

AtoiAndFriendsOOBTest unexpected READ error: arg's last symbol is not digit,
StrCaseCmpOOBTest unexpected READ error: s1 and s2 last bytes are not null but differs
StrCatOOBTest unexpected READ error: dest not adressable/not null-terminated, WRITE error is expected
StrCmpOOBTest unexpected READ error: s1 and s2 last bytes are not null but differs
StrNCatOOBTest unexpected READ error: dest not adressable/not null-terminated, WRITE error is expected
StrtolOOBTest unexpected READ error: arg's last symbol is not valid digit
StrtollOOBTest unexpected READ error: arg's last symbol is not valid digit

And I see only first failures but there are several test cases with such special arguments for each function. I believe they are intentional and based on expected behaviour when strings are not checked strictly.

[glider]

A couple of ideas how we can proceed with the tests:

1. make UnitTests extract |strict_string_checks| from ASAN_OPTIONS and fix the checks to behave based on that setting;
2. remove the failing checks from the test suite and write the corresponding lit tests that will test both strict_string_checks modes (or drop them if they're covered by the tests you've added in this CL);
3. fix the failing checks assuming that strict_string_checks is always on.

I've taken a look at the failing tests and it didn't occur to me that we had ever wanted to "rely" on non-strict semantics.
Those corner cases indeed need to be carefully checked (especially now, when there're two modes of string interceptors operation), but that doesn't mean we have to stick with the non-default behavior.

test/asan/Unit/lit.site.cfg.in

33 ↗

(On Diff #18597)

I think we must fix the tests. It's not a good idea to silently change the default string checking mode in a bunch of tests.
The best solution is to make these OOB reports depend on the flag value (can the unit test read common_flags?)

[glider]

Maria, have you tried running check-msan? I think there's a couple of tests that need to be fixed there as well.

[m.guseva]

In D7123#114488, @glider wrote:

A couple of ideas how we can proceed with the tests:

1. make UnitTests extract |strict_string_checks| from ASAN_OPTIONS and fix the checks to behave based on that setting;
2. remove the failing checks from the test suite and write the corresponding lit tests that will test both strict_string_checks modes (or drop them if they're covered by the tests you've added in this CL);
3. fix the failing checks assuming that strict_string_checks is always on.

I would prefer the second variant. If no objections or other ideas I'll prepare corresponding update for this patch.

test/asan/TestCases/atol_strict.c

4

Isn't it in first line after compile or do you mean something else?

[kcc]

2. remove the failing checks from the test suite and write the corresponding lit tests that will test both strict_string_checks modes (or drop them if they're covered by the tests you've added in this CL);

I would prefer the second variant. If no objections or other ideas I'll prepare corresponding update for this patch.

Yes, please!

test/asan/TestCases/atol_strict.c

4

Oh, yes, sorry.

test/asan/Unit/lit.site.cfg.in

33 ↗

(On Diff #18597)

No, unit test should not rely on the flags, we need to move such tests to lit tests.

[m.guseva]

Hi guys,
I've finally prepared the updated patch for "strict_string_checks" flag. The asan unit test modified to pass with strict checks enabled by default. Removed test cases are covered in lit tests. Please take a look.

[kcc]

Nice!
Once we are done with me I'll ask a second reviewer to check tsan/msan part.

lib/asan/asan_interceptors.cc

80

Interesting.
This code is going to be hot, and internal_strlen(s) is not optimized for speed (and is not expected to be).
Near some of the places where we now call ASAN_READ_RANGE there are calls to REAL(strlen)(to), so you essentially repeat the call (but using slow internal_strlen).
Try not to repeat the strlen calls and try to rely on REAL(strlen), which is ~16x faster.

lib/sanitizer_common/sanitizer_flags.inc

154

I afraid we should make it false at the first step.
Once this change is committed (and propagated into our internal base) we'll test with =true to see if it's sane.

test/asan/TestCases/atoi_strict.c

3

Good. But if you use a run-time parameter instead of -DTEST_N you will not need to recompile the test multiple times.
Test-time saving and code simplification.

int main(int argc, char **argv) {

if (argc != 2) return 1;
if (!strcmp(argv[1], "foo")) test_foo();
if (!strcmp(argv[1], "bar")) test_bar();

}

[m.guseva]

Updated patch according to Konstantin's comments.

[m.guseva]

lib/asan/asan_interceptors.cc

80

Ok, in new patch I've introduced more general macro ASAN_READ_STRING_OF_LEN in order to not repeat strlen calls. The same done for tsan, msan and common interceptors.

lib/sanitizer_common/sanitizer_flags.inc

154

Ok, changed in new patch. Must be kept in mind that tests check default behaviour as well so they have to be modified when this value is changed.

[m.guseva]

lib/asan/asan_interceptors.cc

80

I've changed internal_strlen to REAL(strlen) only in asan/common part but probably I should fix tsan and msan as well. But I see that in other tsan interceptors internal_strlen is used. Is it intentional there?

[kcc]

I like the patch. At this point I'd ask Dmitry to review the tsan part and comment on internal_str* vs REAL(str*) in tsan.

In parallel, given that the patch is potentially very intrusive, I'd ask you to test it with asan bootstrap:

1. build clang as usual
2. build another clang using clang from #1 with cmake flag -DLLVM_USE_SANITIZER=Address and run "ninja check-llvm check-clang"
3. Repeat #2 with ASAN_OPTIONS=strict_string_checks=true

If new errors appear in LLVM, you don't have to fix them, but at least check that they are not false positives.

test/asan/TestCases/atol_strict.c

14

remove extra vertical space, leave just one line (here and below)

[m.guseva]

In D7123#137998, @kcc wrote:

I like the patch. At this point I'd ask Dmitry to review the tsan part and comment on internal_str* vs REAL(str*) in tsan.

In parallel, given that the patch is potentially very intrusive, I'd ask you to test it with asan bootstrap:

Hi,
I've run bootstrap testing, no regressions occured.
Do you have any feedback regarding tsan/msan part?

[dvyukov]

LGTM with a nit
Sorry for the delay, I was on a vacation.

lib/tsan/rtl/tsan_interceptors.cc

280

Don't prefix the macros with TSAN_.
Everything in tsan is tsan-something. But prefixing everything with tsan adds whole lot of clutter without adding any value.
READ_STRING is a fine name.

The TSAN_INTERCEPT macros above are prefixed with TSAN_ for historical reasons and should be renamed. Don't look at them.

[m.guseva]

Attached patch with minor update due to recent feedback:

• removed extra vertical space in tests
• don't prefix new tsan macros with TSAN_

If it's okay now, can anyone commit it please?

[dvyukov]

Committed in revision 234187.
Thanks for working on this!

lib/asan/asan_interceptors.cc

#define ACCESS_MEMORY_RANGE(ctx, offset, size, isWrite) do {            \
     }                                                                   \
   } while (0)
 
 #define ASAN_READ_RANGE(ctx, offset, size) \
   ACCESS_MEMORY_RANGE(ctx, offset, size, false)
 #define ASAN_WRITE_RANGE(ctx, offset, size) \
   ACCESS_MEMORY_RANGE(ctx, offset, size, true)
 
+#define ASAN_READ_STRING_OF_LEN(ctx, s, len, n)                 \
+  ASAN_READ_RANGE((ctx), (s),                                   \
+    common_flags()->strict_string_checks ? (len) + 1 : (n))
+
+#define ASAN_READ_STRING(ctx, s, n)                             \
+  ASAN_READ_STRING_OF_LEN((ctx), (s), REAL(strlen)(s), (n))
+
 // Behavior of functions like "memcpy" or "strcpy" is undefined
 // if memory intervals overlap. We report error in this case.
 // Macro is used to avoid creation of new frames.
 static inline bool RangesOverlap(const char *offset1, uptr length1,
                                  const char *offset2, uptr length2) {
   return !((offset1 + length1 <= offset2) || (offset2 + length2 <= offset1));
 }
 #define CHECK_RANGES_OVERLAP(name, _offset1, length1, _offset2, length2) do { \
INTERCEPTOR(char*, strchr, const char *str, int c) {
   // strchr is called inside create_purgeable_zone() when MallocGuardEdges=1 is
   // used.
   if (asan_init_is_running) {
     return REAL(strchr)(str, c);
   }
   ENSURE_ASAN_INITED();
   char *result = REAL(strchr)(str, c);
   if (flags()->replace_str) {
-    uptr bytes_read = (result ? result - str : REAL(strlen)(str)) + 1;
-    ASAN_READ_RANGE(ctx, str, bytes_read);
+    uptr len = REAL(strlen)(str);
+    uptr bytes_read = (result ? result - str : len) + 1;
+    ASAN_READ_STRING_OF_LEN(ctx, str, len, bytes_read);
   }
   return result;
 }
 
 #if ASAN_INTERCEPT_INDEX
 # if ASAN_USE_ALIAS_ATTRIBUTE_FOR_INDEX
 INTERCEPTOR(char*, index, const char *string, int c)
   ALIAS(WRAPPER_NAME(strchr));

 INTERCEPTOR(char*, strcat, char *to, const char *from) {  // NOLINT
   void *ctx;
   ASAN_INTERCEPTOR_ENTER(ctx, strcat);  // NOLINT
   ENSURE_ASAN_INITED();
   if (flags()->replace_str) {
     uptr from_length = REAL(strlen)(from);
     ASAN_READ_RANGE(ctx, from, from_length + 1);
     uptr to_length = REAL(strlen)(to);
-    ASAN_READ_RANGE(ctx, to, to_length);
+    ASAN_READ_STRING_OF_LEN(ctx, to, to_length, to_length);
     ASAN_WRITE_RANGE(ctx, to + to_length, from_length + 1);
     // If the copying actually happens, the |from| string should not overlap
     // with the resulting string starting at |to|, which has a length of
     // to_length + from_length + 1.
     if (from_length > 0) {
       CHECK_RANGES_OVERLAP("strcat", to, from_length + to_length + 1,
                            from, from_length + 1);
     }
   }
   return REAL(strcat)(to, from);  // NOLINT
 }
 
 INTERCEPTOR(char*, strncat, char *to, const char *from, uptr size) {
   void *ctx;
   ASAN_INTERCEPTOR_ENTER(ctx, strncat);
   ENSURE_ASAN_INITED();
   if (flags()->replace_str) {
     uptr from_length = MaybeRealStrnlen(from, size);
     uptr copy_length = Min(size, from_length + 1);
     ASAN_READ_RANGE(ctx, from, copy_length);
     uptr to_length = REAL(strlen)(to);
-    ASAN_READ_RANGE(ctx, to, to_length);
+    ASAN_READ_STRING_OF_LEN(ctx, to, to_length, to_length);
     ASAN_WRITE_RANGE(ctx, to + to_length, from_length + 1);
     if (from_length > 0) {
       CHECK_RANGES_OVERLAP("strncat", to, to_length + copy_length + 1,
                            from, copy_length);
     }
   }
   return REAL(strncat)(to, from, size);
 }
INTERCEPTOR(uptr, strnlen, const char *s, uptr maxlen) {
   uptr length = REAL(strnlen)(s, maxlen);
   if (flags()->replace_str) {
     ASAN_READ_RANGE(ctx, s, Min(length + 1, maxlen));
   }
   return length;
 }
 #endif  // ASAN_INTERCEPT_STRNLEN
 
-static inline bool IsValidStrtolBase(int base) {
-  return (base == 0) || (2 <= base && base <= 36);
-}
-
-static inline void FixRealStrtolEndptr(const char *nptr, char **endptr) {
-  CHECK(endptr);
-  if (nptr == *endptr) {
-    // No digits were found at strtol call, we need to find out the last
-    // symbol accessed by strtoll on our own.
-    // We get this symbol by skipping leading blanks and optional +/- sign.
-    while (IsSpace(*nptr)) nptr++;
-    if (*nptr == '+' || *nptr == '-') nptr++;
-    *endptr = const_cast<char *>(nptr);
-  }
-  CHECK(*endptr >= nptr);
-}
-
 INTERCEPTOR(long, strtol, const char *nptr,  // NOLINT
             char **endptr, int base) {
   void *ctx;
   ASAN_INTERCEPTOR_ENTER(ctx, strtol);
   ENSURE_ASAN_INITED();
   if (!flags()->replace_str) {
     return REAL(strtol)(nptr, endptr, base);
   }
   char *real_endptr;
   long result = REAL(strtol)(nptr, &real_endptr, base);  // NOLINT
-  if (endptr != 0) {
-    *endptr = real_endptr;
-  }
-  if (IsValidStrtolBase(base)) {
-    FixRealStrtolEndptr(nptr, &real_endptr);
-    ASAN_READ_RANGE(ctx, nptr, (real_endptr - nptr) + 1);
-  }
+  StrtolFixAndCheck(ctx, nptr, endptr, real_endptr, base);
   return result;
 }
 
 INTERCEPTOR(int, atoi, const char *nptr) {
   void *ctx;
   ASAN_INTERCEPTOR_ENTER(ctx, atoi);
 #if SANITIZER_MAC
   if (UNLIKELY(!asan_inited)) return REAL(atoi)(nptr);
 #endif
   ENSURE_ASAN_INITED();
   if (!flags()->replace_str) {
     return REAL(atoi)(nptr);
   }
   char *real_endptr;
   // "man atoi" tells that behavior of atoi(nptr) is the same as
   // strtol(nptr, 0, 10), i.e. it sets errno to ERANGE if the
   // parsed integer can't be stored in *long* type (even if it's
   // different from int). So, we just imitate this behavior.
   int result = REAL(strtol)(nptr, &real_endptr, 10);
   FixRealStrtolEndptr(nptr, &real_endptr);
-  ASAN_READ_RANGE(ctx, nptr, (real_endptr - nptr) + 1);
+  ASAN_READ_STRING(ctx, nptr, (real_endptr - nptr) + 1);
   return result;
 }
 
 INTERCEPTOR(long, atol, const char *nptr) {  // NOLINT
   void *ctx;
   ASAN_INTERCEPTOR_ENTER(ctx, atol);
 #if SANITIZER_MAC
   if (UNLIKELY(!asan_inited)) return REAL(atol)(nptr);
 #endif
   ENSURE_ASAN_INITED();
   if (!flags()->replace_str) {
     return REAL(atol)(nptr);
   }
   char *real_endptr;
   long result = REAL(strtol)(nptr, &real_endptr, 10);  // NOLINT
   FixRealStrtolEndptr(nptr, &real_endptr);
-  ASAN_READ_RANGE(ctx, nptr, (real_endptr - nptr) + 1);
+  ASAN_READ_STRING(ctx, nptr, (real_endptr - nptr) + 1);
   return result;
 }
 
 #if ASAN_INTERCEPT_ATOLL_AND_STRTOLL
 INTERCEPTOR(long long, strtoll, const char *nptr,  // NOLINT
             char **endptr, int base) {
   void *ctx;
   ASAN_INTERCEPTOR_ENTER(ctx, strtoll);
   ENSURE_ASAN_INITED();
   if (!flags()->replace_str) {
     return REAL(strtoll)(nptr, endptr, base);
   }
   char *real_endptr;
   long long result = REAL(strtoll)(nptr, &real_endptr, base);  // NOLINT
-  if (endptr != 0) {
-    *endptr = real_endptr;
-  }
-  // If base has unsupported value, strtoll can exit with EINVAL
-  // without reading any characters. So do additional checks only
-  // if base is valid.
-  if (IsValidStrtolBase(base)) {
-    FixRealStrtolEndptr(nptr, &real_endptr);
-    ASAN_READ_RANGE(ctx, nptr, (real_endptr - nptr) + 1);
-  }
+  StrtolFixAndCheck(ctx, nptr, endptr, real_endptr, base);
   return result;
 }
 
 INTERCEPTOR(long long, atoll, const char *nptr) {  // NOLINT
   void *ctx;
   ASAN_INTERCEPTOR_ENTER(ctx, atoll);
   ENSURE_ASAN_INITED();
   if (!flags()->replace_str) {
     return REAL(atoll)(nptr);
   }
   char *real_endptr;
   long long result = REAL(strtoll)(nptr, &real_endptr, 10);  // NOLINT
   FixRealStrtolEndptr(nptr, &real_endptr);
-  ASAN_READ_RANGE(ctx, nptr, (real_endptr - nptr) + 1);
+  ASAN_READ_STRING(ctx, nptr, (real_endptr - nptr) + 1);
   return result;
 }
 #endif  // ASAN_INTERCEPT_ATOLL_AND_STRTOLL
 
 static void AtCxaAtexit(void *unused) {
   (void)unused;
   StopInitOrderChecking();
 }

lib/asan/tests/asan_str_test.cc

void RunStrCmpTest(PointerToStrCmp StrCmp) {
   char *s1 = MallocAndMemsetString(size, fill);
   char *s2 = MallocAndMemsetString(size, fill);
   s1[size - 1] = '\0';
   s2[size - 1] = '\0';
   // Normal StrCmp calls
   Ident(StrCmp(s1, s2));
   Ident(StrCmp(s1, s2 + size - 1));
   Ident(StrCmp(s1 + size - 1, s2 + size - 1));
-  s1[size - 1] = 'z';
-  s2[size - 1] = 'x';
-  Ident(StrCmp(s1, s2));
   // One of arguments points to not allocated memory.
   EXPECT_DEATH(Ident(StrCmp)(s1 - 1, s2), LeftOOBReadMessage(1));
   EXPECT_DEATH(Ident(StrCmp)(s1, s2 - 1), LeftOOBReadMessage(1));
   EXPECT_DEATH(Ident(StrCmp)(s1 + size, s2), RightOOBReadMessage(0));
   EXPECT_DEATH(Ident(StrCmp)(s1, s2 + size), RightOOBReadMessage(0));
   // Hit unallocated memory and die.
   s1[size - 1] = fill;
   EXPECT_DEATH(Ident(StrCmp)(s1, s1), RightOOBReadMessage(0));
TEST(AddressSanitizer, StrCatOOBTest) {
   strcat(to, from);
   strcat(to + from_size, from + from_size - 2);
   // Passing an invalid pointer is an error even when concatenating an empty
   // string.
   EXPECT_DEATH(strcat(to - 1, from + from_size - 1), LeftOOBAccessMessage(1));
   // One of arguments points to not allocated memory.
   EXPECT_DEATH(strcat(to - 1, from), LeftOOBAccessMessage(1));
   EXPECT_DEATH(strcat(to, from - 1), LeftOOBReadMessage(1));
-  EXPECT_DEATH(strcat(to + to_size, from), RightOOBWriteMessage(0));
   EXPECT_DEATH(strcat(to, from + from_size), RightOOBReadMessage(0));
 
   // "from" is not zero-terminated.
   from[from_size - 1] = 'z';
   EXPECT_DEATH(strcat(to, from), RightOOBReadMessage(0));
   from[from_size - 1] = '\0';
-  // "to" is not zero-terminated.
-  memset(to, 'z', to_size);
-  EXPECT_DEATH(strcat(to, from), RightOOBWriteMessage(0));
   // "to" is too short to fit "from".
+  memset(to, 'z', to_size);
   to[to_size - from_size + 1] = '\0';
   EXPECT_DEATH(strcat(to, from), RightOOBWriteMessage(0));
   // length of "to" is just enough.
   strcat(to, from + 1);
 
   free(to);
   free(from);
 }
TEST(AddressSanitizer, StrNCatOOBTest) {
   from[from_size - 1] = '\0';
   strncat(to, from, 2 * from_size);
   // Catenating empty string with an invalid string is still an error.
   EXPECT_DEATH(strncat(to - 1, from, 0), LeftOOBAccessMessage(1));
   strncat(to, from + from_size - 1, 10);
   // One of arguments points to not allocated memory.
   EXPECT_DEATH(strncat(to - 1, from, 2), LeftOOBAccessMessage(1));
   EXPECT_DEATH(strncat(to, from - 1, 2), LeftOOBReadMessage(1));
-  EXPECT_DEATH(strncat(to + to_size, from, 2), RightOOBWriteMessage(0));
   EXPECT_DEATH(strncat(to, from + from_size, 2), RightOOBReadMessage(0));
 
   memset(from, 'z', from_size);
   memset(to, 'z', to_size);
   to[0] = '\0';
   // "from" is too short.
   EXPECT_DEATH(strncat(to, from, from_size + 1), RightOOBReadMessage(0));
-  // "to" is not zero-terminated.
-  EXPECT_DEATH(strncat(to + 1, from, 1), RightOOBWriteMessage(0));
   // "to" is too short to fit "from".
   to[0] = 'z';
   to[to_size - from_size + 1] = '\0';
   EXPECT_DEATH(strncat(to, from, from_size - 1), RightOOBWriteMessage(0));
   // "to" is just enough.
   strncat(to, from, from_size - 2);
 
   free(to);

 
 void RunAtoiOOBTest(PointerToCallAtoi Atoi) {
   char *array = MallocAndMemsetString(10, '1');
   // Invalid pointer to the string.
   EXPECT_DEATH(Atoi(array + 11), RightOOBReadMessage(1));
   EXPECT_DEATH(Atoi(array - 1), LeftOOBReadMessage(1));
   // Die if a buffer doesn't have terminating NULL.
   EXPECT_DEATH(Atoi(array), RightOOBReadMessage(0));
-  // Make last symbol a terminating NULL or other non-digit.
+  // Make last symbol a terminating NULL
   array[9] = '\0';
   Atoi(array);
-  array[9] = 'a';
-  Atoi(array);
-  Atoi(array + 9);
   // Sometimes we need to detect overflow if no digits are found.
   memset(array, ' ', 10);
   EXPECT_DEATH(Atoi(array), RightOOBReadMessage(0));
   array[9] = '-';
   EXPECT_DEATH(Atoi(array), RightOOBReadMessage(0));
   EXPECT_DEATH(Atoi(array + 9), RightOOBReadMessage(0));
-  array[8] = '-';
-  Atoi(array);
   free(array);
 }
 
 #if !defined(_WIN32)  // FIXME: Fix and enable on Windows.
 void CallAtoi(const char *nptr) {
   Ident(atoi(nptr));
 }
 void CallAtol(const char *nptr) {
   Ident(atol(nptr));
 }
 void CallAtoll(const char *nptr) {
   Ident(atoll(nptr));
 }
 TEST(AddressSanitizer, AtoiAndFriendsOOBTest) {
   RunAtoiOOBTest(&CallAtoi);
   RunAtoiOOBTest(&CallAtol);
   RunAtoiOOBTest(&CallAtoll);
 }
 #endif
 
 typedef void(*PointerToCallStrtol)(const char*, char**, int);
 
 void RunStrtolOOBTest(PointerToCallStrtol Strtol) {
   char *array = MallocAndMemsetString(3);
-  char *endptr = NULL;
   array[0] = '1';
   array[1] = '2';
   array[2] = '3';
   // Invalid pointer to the string.
   EXPECT_DEATH(Strtol(array + 3, NULL, 0), RightOOBReadMessage(0));
   EXPECT_DEATH(Strtol(array - 1, NULL, 0), LeftOOBReadMessage(1));
   // Buffer overflow if there is no terminating null (depends on base).
-  Strtol(array, &endptr, 3);
-  EXPECT_EQ(array + 2, endptr);
   EXPECT_DEATH(Strtol(array, NULL, 0), RightOOBReadMessage(0));
   array[2] = 'z';
-  Strtol(array, &endptr, 35);
-  EXPECT_EQ(array + 2, endptr);
   EXPECT_DEATH(Strtol(array, NULL, 36), RightOOBReadMessage(0));
   // Add terminating zero to get rid of overflow.
   array[2] = '\0';
   Strtol(array, NULL, 36);
-  // Don't check for overflow if base is invalid.
-  Strtol(array - 1, NULL, -1);
-  Strtol(array + 3, NULL, 1);
   // Sometimes we need to detect overflow if no digits are found.
   array[0] = array[1] = array[2] = ' ';
   EXPECT_DEATH(Strtol(array, NULL, 0), RightOOBReadMessage(0));
   array[2] = '+';
   EXPECT_DEATH(Strtol(array, NULL, 0), RightOOBReadMessage(0));
   array[2] = '-';
   EXPECT_DEATH(Strtol(array, NULL, 0), RightOOBReadMessage(0));
-  array[1] = '+';
-  Strtol(array, NULL, 0);
-  array[1] = array[2] = 'z';
-  Strtol(array, &endptr, 0);
-  EXPECT_EQ(array, endptr);
-  Strtol(array + 2, NULL, 0);
-  EXPECT_EQ(array, endptr);
   free(array);
 }
 
 #if !defined(_WIN32)  // FIXME: Fix and enable on Windows.
 void CallStrtol(const char *nptr, char **endptr, int base) {
   Ident(strtol(nptr, endptr, base));
 }
 void CallStrtoll(const char *nptr, char **endptr, int base) {

lib/msan/msan_interceptors.cc

 
 // Check that [x, x+n) range is unpoisoned unless we are in a nested
 // interceptor.
 #define CHECK_UNPOISONED(x, n)                             \
   do {                                                     \
     if (!IsInInterceptorScope()) CHECK_UNPOISONED_0(x, n); \
   } while (0);
 
+#define CHECK_UNPOISONED_STRING_OF_LEN(x, len, n)               \
+  CHECK_UNPOISONED((x),                                         \
+    common_flags()->strict_string_checks ? (len) + 1 : (n) )
+
+#define CHECK_UNPOISONED_STRING(x, n)                           \
+    CHECK_UNPOISONED_STRING_OF_LEN((x), internal_strlen(x), (n))
+
 INTERCEPTOR(SIZE_T, fread, void *ptr, SIZE_T size, SIZE_T nmemb, void *file) {
   ENSURE_MSAN_INITED();
   SIZE_T res = REAL(fread)(ptr, size, nmemb, file);
   if (res > 0)
     __msan_unpoison(ptr, res *size);
   return res;
 }
 
 #if !SANITIZER_FREEBSD
 INTERCEPTOR(SIZE_T, fread_unlocked, void *ptr, SIZE_T size, SIZE_T nmemb,
             void *file) {
   ENSURE_MSAN_INITED();
   SIZE_T res = REAL(fread_unlocked)(ptr, size, nmemb, file);
   if (res > 0)
     __msan_unpoison(ptr, res *size);
   return res;
 }
 #define MSAN_MAYBE_INTERCEPT_FREAD_UNLOCKED INTERCEPT_FUNCTION(fread_unlocked)
 #else
 #define MSAN_MAYBE_INTERCEPT_FREAD_UNLOCKED
 #endif
 
 INTERCEPTOR(SSIZE_T, readlink, const char *path, char *buf, SIZE_T bufsiz) {
   ENSURE_MSAN_INITED();
+  CHECK_UNPOISONED_STRING(path, 0)
   SSIZE_T res = REAL(readlink)(path, buf, bufsiz);
   if (res > 0)
     __msan_unpoison(buf, res);
   return res;
 }
 
 INTERCEPTOR(void *, memcpy, void *dest, const void *src, SIZE_T n) {
   return __msan_memcpy(dest, src, n);

 INTERCEPTOR(SIZE_T, strnlen, const char *s, SIZE_T n) {
   ENSURE_MSAN_INITED();
   SIZE_T res = REAL(strnlen)(s, n);
   SIZE_T scan_size = (res == n) ? res : res + 1;
   CHECK_UNPOISONED(s, scan_size);
   return res;
 }
 
-// FIXME: Add stricter shadow checks in str* interceptors (ex.: strcpy should
-// check the shadow of the terminating \0 byte).
-
 INTERCEPTOR(char *, strcpy, char *dest, const char *src) {  // NOLINT
   ENSURE_MSAN_INITED();
   GET_STORE_STACK_TRACE;
   SIZE_T n = REAL(strlen)(src);
+  CHECK_UNPOISONED_STRING(src + n, 0);
   char *res = REAL(strcpy)(dest, src);  // NOLINT
   CopyShadowAndOrigin(dest, src, n + 1, &stack);
   return res;
 }
 
 INTERCEPTOR(char *, strncpy, char *dest, const char *src, SIZE_T n) {  // NOLINT
   ENSURE_MSAN_INITED();
   GET_STORE_STACK_TRACE;
   SIZE_T copy_size = REAL(strnlen)(src, n);
   if (copy_size < n)
     copy_size++;  // trailing \0
   char *res = REAL(strncpy)(dest, src, n);  // NOLINT
   CopyShadowAndOrigin(dest, src, copy_size, &stack);
   __msan_unpoison(dest + copy_size, n - copy_size);
   return res;
 }
 
 INTERCEPTOR(char *, stpcpy, char *dest, const char *src) {  // NOLINT
   ENSURE_MSAN_INITED();
   GET_STORE_STACK_TRACE;
   SIZE_T n = REAL(strlen)(src);
+  CHECK_UNPOISONED_STRING(src + n, 0);
   char *res = REAL(stpcpy)(dest, src);  // NOLINT
   CopyShadowAndOrigin(dest, src, n + 1, &stack);
   return res;
 }
 
 INTERCEPTOR(char *, strdup, char *src) {
   ENSURE_MSAN_INITED();
   GET_STORE_STACK_TRACE;
   // On FreeBSD strdup() leverages strlen().
   InterceptorScope interceptor_scope;
   SIZE_T n = REAL(strlen)(src);
+  CHECK_UNPOISONED_STRING(src + n, 0);
   char *res = REAL(strdup)(src);
   CopyShadowAndOrigin(res, src, n + 1, &stack);
   return res;
 }
 
 #if !SANITIZER_FREEBSD
 INTERCEPTOR(char *, __strdup, char *src) {
   ENSURE_MSAN_INITED();
   GET_STORE_STACK_TRACE;
   SIZE_T n = REAL(strlen)(src);
+  CHECK_UNPOISONED_STRING(src + n, 0);
   char *res = REAL(__strdup)(src);
   CopyShadowAndOrigin(res, src, n + 1, &stack);
   return res;
 }
 #define MSAN_MAYBE_INTERCEPT___STRDUP INTERCEPT_FUNCTION(__strdup)
 #else
 #define MSAN_MAYBE_INTERCEPT___STRDUP
 #endif
INTERCEPTOR(char *, gcvt, double number, SIZE_T ndigit, char *buf) {
   return res;
 }
 
 INTERCEPTOR(char *, strcat, char *dest, const char *src) {  // NOLINT
   ENSURE_MSAN_INITED();
   GET_STORE_STACK_TRACE;
   SIZE_T src_size = REAL(strlen)(src);
   SIZE_T dest_size = REAL(strlen)(dest);
+  CHECK_UNPOISONED_STRING(src + src_size, 0);
+  CHECK_UNPOISONED_STRING(dest + dest_size, 0);
   char *res = REAL(strcat)(dest, src);  // NOLINT
   CopyShadowAndOrigin(dest + dest_size, src, src_size + 1, &stack);
   return res;
 }
 
 INTERCEPTOR(char *, strncat, char *dest, const char *src, SIZE_T n) {  // NOLINT
   ENSURE_MSAN_INITED();
   GET_STORE_STACK_TRACE;
   SIZE_T dest_size = REAL(strlen)(dest);
   SIZE_T copy_size = REAL(strnlen)(src, n);
+  CHECK_UNPOISONED_STRING(dest + dest_size, 0);
   char *res = REAL(strncat)(dest, src, n);  // NOLINT
   CopyShadowAndOrigin(dest + dest_size, src, copy_size, &stack);
   __msan_unpoison(dest + dest_size + copy_size, 1); // \0
   return res;
 }
 
 // Hack: always pass nptr and endptr as part of __VA_ARGS_ to avoid having to
 // deal with empty __VA_ARGS__ in the case of INTERCEPTOR_STRTO.
for (; *envp; ++envp) {
     __msan_unpoison(*envp, REAL(strlen)(*envp) + 1);
   }
   // Trailing NULL pointer.
   __msan_unpoison(envp, sizeof(*envp));
 }
 
 INTERCEPTOR(int, setenv, const char *name, const char *value, int overwrite) {
   ENSURE_MSAN_INITED();
+  CHECK_UNPOISONED_STRING(name, 0)
   int res = REAL(setenv)(name, value, overwrite);
   if (!res) UnpoisonEnviron();
   return res;
 }
 
 INTERCEPTOR(int, putenv, char *string) {
   ENSURE_MSAN_INITED();
   int res = REAL(putenv)(string);

lib/sanitizer_common/sanitizer_common_interceptors.inc

 #define COMMON_INTERCEPTOR_ENTER_NOIGNORE(ctx, ...) \
   COMMON_INTERCEPTOR_ENTER(ctx, __VA_ARGS__)
 #endif
 
 #ifndef COMMON_INTERCEPTOR_NOTHING_IS_INITIALIZED
 #define COMMON_INTERCEPTOR_NOTHING_IS_INITIALIZED (0)
 #endif
 
+#define COMMON_INTERCEPTOR_READ_STRING_OF_LEN(ctx, s, len, n)       \
+    COMMON_INTERCEPTOR_READ_RANGE((ctx), (s),                       \
+      common_flags()->strict_string_checks ? (len) + 1 : (n) )
+
+#define COMMON_INTERCEPTOR_READ_STRING(ctx, s, n)                   \
+    COMMON_INTERCEPTOR_READ_STRING_OF_LEN((ctx), (s), REAL(strlen)(s), (n))
+
 #ifndef COMMON_INTERCEPTOR_ON_DLOPEN
 #define COMMON_INTERCEPTOR_ON_DLOPEN(filename, flag) {}
 #endif
 
 struct FileMetadata {
   // For open_memstream().
   char **addr;
   SIZE_T *size;
UNUSED static void DeleteInterceptorMetadata(void *addr) {
   CHECK(h.exists());
 }
 #endif  // SI_NOT_WINDOWS
 
 #if SANITIZER_INTERCEPT_TEXTDOMAIN
 INTERCEPTOR(char*, textdomain, const char *domainname) {
   void *ctx;
   COMMON_INTERCEPTOR_ENTER(ctx, textdomain, domainname);
-  char* domain = REAL(textdomain)(domainname);
+  COMMON_INTERCEPTOR_READ_STRING(ctx, domainname, 0);
+  char *domain = REAL(textdomain)(domainname);
   if (domain) {
     COMMON_INTERCEPTOR_INITIALIZE_RANGE(domain, REAL(strlen)(domain) + 1);
   }
   return domain;
 }
 #define INIT_TEXTDOMAIN COMMON_INTERCEPT_FUNCTION(textdomain)
 #else
 #define INIT_TEXTDOMAIN
INTERCEPTOR(int, strcmp, const char *s1, const char *s2) {
   COMMON_INTERCEPTOR_ENTER(ctx, strcmp, s1, s2);
   unsigned char c1, c2;
   uptr i;
   for (i = 0;; i++) {
     c1 = (unsigned char)s1[i];
     c2 = (unsigned char)s2[i];
     if (c1 != c2 || c1 == '\0') break;
   }
-  COMMON_INTERCEPTOR_READ_RANGE(ctx, s1, i + 1);
-  COMMON_INTERCEPTOR_READ_RANGE(ctx, s2, i + 1);
+  COMMON_INTERCEPTOR_READ_STRING(ctx, s1, i + 1);
+  COMMON_INTERCEPTOR_READ_STRING(ctx, s2, i + 1);
   return CharCmpX(c1, c2);
 }
 
 INTERCEPTOR(int, strncmp, const char *s1, const char *s2, uptr size) {
   if (COMMON_INTERCEPTOR_NOTHING_IS_INITIALIZED)
     return internal_strncmp(s1, s2, size);
   void *ctx;
   COMMON_INTERCEPTOR_ENTER(ctx, strncmp, s1, s2, size);
INTERCEPTOR(int, strcasecmp, const char *s1, const char *s2) {
   COMMON_INTERCEPTOR_ENTER(ctx, strcasecmp, s1, s2);
   unsigned char c1 = 0, c2 = 0;
   uptr i;
   for (i = 0;; i++) {
     c1 = (unsigned char)s1[i];
     c2 = (unsigned char)s2[i];
     if (CharCaseCmp(c1, c2) != 0 || c1 == '\0') break;
   }
-  COMMON_INTERCEPTOR_READ_RANGE(ctx, s1, i + 1);
-  COMMON_INTERCEPTOR_READ_RANGE(ctx, s2, i + 1);
+  COMMON_INTERCEPTOR_READ_STRING(ctx, s1, i + 1);
+  COMMON_INTERCEPTOR_READ_STRING(ctx, s2, i + 1);
   return CharCaseCmp(c1, c2);
 }
 
 INTERCEPTOR(int, strncasecmp, const char *s1, const char *s2, SIZE_T n) {
   void *ctx;
   COMMON_INTERCEPTOR_ENTER(ctx, strncasecmp, s1, s2, n);
   unsigned char c1 = 0, c2 = 0;
   uptr i;
INTERCEPTOR(char *, strptime, char *s, char *format, __sanitizer_tm *tm) {
   void *ctx;
   COMMON_INTERCEPTOR_ENTER(ctx, strptime, s, format, tm);
   if (format)
     COMMON_INTERCEPTOR_READ_RANGE(ctx, format, REAL(strlen)(format) + 1);
   // FIXME: under ASan the call below may write to freed memory and corrupt
   // its metadata. See
   // https://code.google.com/p/address-sanitizer/issues/detail?id=321.
   char *res = REAL(strptime)(s, format, tm);
-  if (res) {
-    COMMON_INTERCEPTOR_READ_RANGE(ctx, s, res - s);
+  COMMON_INTERCEPTOR_READ_STRING(ctx, s, res ? res - s : 0);
+  if (res && tm) {
     // Do not call unpoison_tm here, because strptime does not, in fact,
     // initialize the entire struct tm. For example, tm_zone pointer is left
     // uninitialized.
-    if (tm) COMMON_INTERCEPTOR_WRITE_RANGE(ctx, tm, sizeof(*tm));
+    COMMON_INTERCEPTOR_WRITE_RANGE(ctx, tm, sizeof(*tm));
   }
   return res;
 }
 #define INIT_STRPTIME COMMON_INTERCEPT_FUNCTION(strptime);
 #else
 #define INIT_STRPTIME
 #endif
 
static int wrapped_gl_stat(const char *s, void *st) {
   return pglob_copy->gl_stat(s, st);
 }
 
 INTERCEPTOR(int, glob, const char *pattern, int flags,
             int (*errfunc)(const char *epath, int eerrno),
             __sanitizer_glob_t *pglob) {
   void *ctx;
   COMMON_INTERCEPTOR_ENTER(ctx, glob, pattern, flags, errfunc, pglob);
+  COMMON_INTERCEPTOR_READ_STRING(ctx, pattern, 0);
   __sanitizer_glob_t glob_copy = {
       0,                  0,                   0,
       0,                  wrapped_gl_closedir, wrapped_gl_readdir,
       wrapped_gl_opendir, wrapped_gl_lstat,    wrapped_gl_stat};
   if (flags & glob_altdirfunc) {
     Swap(pglob->gl_closedir, glob_copy.gl_closedir);
     Swap(pglob->gl_readdir, glob_copy.gl_readdir);
     Swap(pglob->gl_opendir, glob_copy.gl_opendir);
INTERCEPTOR(int, glob, const char *pattern, int flags,
   return res;
 }
 
 INTERCEPTOR(int, glob64, const char *pattern, int flags,
             int (*errfunc)(const char *epath, int eerrno),
             __sanitizer_glob_t *pglob) {
   void *ctx;
   COMMON_INTERCEPTOR_ENTER(ctx, glob64, pattern, flags, errfunc, pglob);
+  COMMON_INTERCEPTOR_READ_STRING(ctx, pattern, 0);
   __sanitizer_glob_t glob_copy = {
       0,                  0,                   0,
       0,                  wrapped_gl_closedir, wrapped_gl_readdir,
       wrapped_gl_opendir, wrapped_gl_lstat,    wrapped_gl_stat};
   if (flags & glob_altdirfunc) {
     Swap(pglob->gl_closedir, glob_copy.gl_closedir);
     Swap(pglob->gl_readdir, glob_copy.gl_readdir);
     Swap(pglob->gl_opendir, glob_copy.gl_opendir);
INTERCEPTOR(char *, inet_ntop, int af, const void *src, char *dst, u32 size) {
   // https://code.google.com/p/address-sanitizer/issues/detail?id=321.
   char *res = REAL(inet_ntop)(af, src, dst, size);
   if (res) COMMON_INTERCEPTOR_WRITE_RANGE(ctx, res, REAL(strlen)(res) + 1);
   return res;
 }
 INTERCEPTOR(int, inet_pton, int af, const char *src, void *dst) {
   void *ctx;
   COMMON_INTERCEPTOR_ENTER(ctx, inet_pton, af, src, dst);
+  COMMON_INTERCEPTOR_READ_STRING(ctx, src, 0);
   // FIXME: figure out read size based on the address family.
   // FIXME: under ASan the call below may write to freed memory and corrupt
   // its metadata. See
   // https://code.google.com/p/address-sanitizer/issues/detail?id=321.
   int res = REAL(inet_pton)(af, src, dst);
   if (res == 1) {
     uptr sz = __sanitizer_in_addr_sz(af);
     if (sz) COMMON_INTERCEPTOR_WRITE_RANGE(ctx, dst, sz);

 }
 
 #define INIT_GET_CURRENT_DIR_NAME \
   COMMON_INTERCEPT_FUNCTION(get_current_dir_name);
 #else
 #define INIT_GET_CURRENT_DIR_NAME
 #endif
 
+UNUSED static inline void FixRealStrtolEndptr(const char *nptr, char **endptr) {
+  CHECK(endptr);
+  if (nptr == *endptr) {
+    // No digits were found at strtol call, we need to find out the last
+    // symbol accessed by strtoll on our own.
+    // We get this symbol by skipping leading blanks and optional +/- sign.
+    while (IsSpace(*nptr)) nptr++;
+    if (*nptr == '+' || *nptr == '-') nptr++;
+    *endptr = const_cast<char *>(nptr);
+  }
+  CHECK(*endptr >= nptr);
+}
+
+UNUSED static inline void StrtolFixAndCheck(void *ctx, const char *nptr,
+                             char **endptr, char *real_endptr, int base) {
+  if (endptr != 0) {
+    *endptr = real_endptr;
+    COMMON_INTERCEPTOR_WRITE_RANGE(ctx, endptr, sizeof(*endptr));
+  }
+  // If base has unsupported value, strtol can exit with EINVAL
+  // without reading any characters. So do additional checks only
+  // if base is valid.
+  bool is_valid_base = (base == 0) || (2 <= base && base <= 36);
+  if (is_valid_base) {
+    FixRealStrtolEndptr(nptr, &real_endptr);
+  }
+  COMMON_INTERCEPTOR_READ_STRING(ctx, nptr, is_valid_base ?
+                                 (real_endptr - nptr) + 1 : 0);
+}
+
+
 #if SANITIZER_INTERCEPT_STRTOIMAX
 INTERCEPTOR(INTMAX_T, strtoimax, const char *nptr, char **endptr, int base) {
   void *ctx;
   COMMON_INTERCEPTOR_ENTER(ctx, strtoimax, nptr, endptr, base);
   // FIXME: under ASan the call below may write to freed memory and corrupt
   // its metadata. See
   // https://code.google.com/p/address-sanitizer/issues/detail?id=321.
-  INTMAX_T res = REAL(strtoimax)(nptr, endptr, base);
-  if (endptr) COMMON_INTERCEPTOR_WRITE_RANGE(ctx, endptr, sizeof(*endptr));
+  char *real_endptr;
+  INTMAX_T res = REAL(strtoimax)(nptr, &real_endptr, base);
+  StrtolFixAndCheck(ctx, nptr, endptr, real_endptr, base);
   return res;
 }
 
 INTERCEPTOR(INTMAX_T, strtoumax, const char *nptr, char **endptr, int base) {
   void *ctx;
   COMMON_INTERCEPTOR_ENTER(ctx, strtoumax, nptr, endptr, base);
   // FIXME: under ASan the call below may write to freed memory and corrupt
   // its metadata. See
   // https://code.google.com/p/address-sanitizer/issues/detail?id=321.
-  INTMAX_T res = REAL(strtoumax)(nptr, endptr, base);
-  if (endptr) COMMON_INTERCEPTOR_WRITE_RANGE(ctx, endptr, sizeof(*endptr));
+  char *real_endptr;
+  INTMAX_T res = REAL(strtoumax)(nptr, &real_endptr, base);
+  StrtolFixAndCheck(ctx, nptr, endptr, real_endptr, base);
   return res;
 }
 
 #define INIT_STRTOIMAX                  \
   COMMON_INTERCEPT_FUNCTION(strtoimax); \
   COMMON_INTERCEPT_FUNCTION(strtoumax);
 #else
 #define INIT_STRTOIMAX

 #else
 #define INIT_TEMPNAM
 #endif
 
 #if SANITIZER_INTERCEPT_PTHREAD_SETNAME_NP
 INTERCEPTOR(int, pthread_setname_np, uptr thread, const char *name) {
   void *ctx;
   COMMON_INTERCEPTOR_ENTER(ctx, pthread_setname_np, thread, name);
+  COMMON_INTERCEPTOR_READ_STRING(ctx, name, 0);
   COMMON_INTERCEPTOR_SET_PTHREAD_NAME(ctx, thread, name);
   return REAL(pthread_setname_np)(thread, name);
 }
 #define INIT_PTHREAD_SETNAME_NP COMMON_INTERCEPT_FUNCTION(pthread_setname_np);
 #else
 #define INIT_PTHREAD_SETNAME_NP
 #endif
 

 #else
 #define INIT_FCLOSE
 #endif
 
 #if SANITIZER_INTERCEPT_DLOPEN_DLCLOSE
 INTERCEPTOR(void*, dlopen, const char *filename, int flag) {
   void *ctx;
   COMMON_INTERCEPTOR_ENTER_NOIGNORE(ctx, dlopen, filename, flag);
+  if (filename) COMMON_INTERCEPTOR_READ_STRING(ctx, filename, 0);
   COMMON_INTERCEPTOR_ON_DLOPEN(filename, flag);
   void *res = REAL(dlopen)(filename, flag);
   COMMON_INTERCEPTOR_LIBRARY_LOADED(filename, res);
   return res;
 }
 
 INTERCEPTOR(int, dlclose, void *handle) {
   void *ctx;

lib/sanitizer_common/sanitizer_flags.inc

 COMMON_FLAG(bool, symbolize_inline_frames, true,
             "Print inlined frames in stacktraces. Defaults to true.")
 COMMON_FLAG(const char *, stack_trace_format, "DEFAULT",
             "Format string used to render stack frames. "
             "See sanitizer_stacktrace_printer.h for the format description. "
             "Use DEFAULT to get default format.")
 COMMON_FLAG(bool, no_huge_pages_for_shadow, true,
             "If true, the shadow is not allowed to use huge pages. ")
+COMMON_FLAG(bool, strict_string_checks, false,
+            "If set check that string arguments are properly null-terminated")

lib/tsan/rtl/tsan_interceptors.cc

 #define TSAN_INTERCEPTOR(ret, func, ...) INTERCEPTOR(ret, func, __VA_ARGS__)
 #define TSAN_INTERCEPT(func) INTERCEPT_FUNCTION(func)
 #if SANITIZER_FREEBSD
 # define TSAN_INTERCEPT_VER(func, ver) INTERCEPT_FUNCTION(func)
 #else
 # define TSAN_INTERCEPT_VER(func, ver) INTERCEPT_FUNCTION_VER(func, ver)
 #endif
 
+#define READ_STRING_OF_LEN(thr, pc, s, len, n)                 \
+  MemoryAccessRange((thr), (pc), (uptr)(s),                         \
+    common_flags()->strict_string_checks ? (len) + 1 : (n), false)
+
+#define READ_STRING(thr, pc, s, n)                             \
+    READ_STRING_OF_LEN((thr), (pc), (s), internal_strlen(s), (n))
+
 #define BLOCK_REAL(name) (BlockingCall(thr), REAL(name))
 
 struct BlockingCall {
   explicit BlockingCall(ThreadState *thr)
       : thr(thr)
       , ctx(SigCtx(thr)) {
     for (;;) {
       atomic_store(&ctx->in_blocking_func, 1, memory_order_relaxed);
TSAN_INTERCEPTOR(void*, memmove, void *dst, void *src, uptr n) {
   MemoryAccessRange(thr, pc, (uptr)dst, n, true);
   MemoryAccessRange(thr, pc, (uptr)src, n, false);
   return REAL(memmove)(dst, src, n);
 }
 
 TSAN_INTERCEPTOR(char*, strchr, char *s, int c) {
   SCOPED_TSAN_INTERCEPTOR(strchr, s, c);
   char *res = REAL(strchr)(s, c);
-  uptr len = res ? (char*)res - (char*)s + 1 : internal_strlen(s) + 1;
-  MemoryAccessRange(thr, pc, (uptr)s, len, false);
+  uptr len = internal_strlen(s);
+  uptr n = res ? (char*)res - (char*)s + 1 : len + 1;
+  READ_STRING_OF_LEN(thr, pc, s, len, n);
   return res;
 }
 
 TSAN_INTERCEPTOR(char*, strchrnul, char *s, int c) {
   SCOPED_TSAN_INTERCEPTOR(strchrnul, s, c);
   char *res = REAL(strchrnul)(s, c);
   uptr len = (char*)res - (char*)s + 1;
-  MemoryAccessRange(thr, pc, (uptr)s, len, false);
+  READ_STRING(thr, pc, s, len);
   return res;
 }
 
 TSAN_INTERCEPTOR(char*, strrchr, char *s, int c) {
   SCOPED_TSAN_INTERCEPTOR(strrchr, s, c);
   MemoryAccessRange(thr, pc, (uptr)s, internal_strlen(s) + 1, false);
   return REAL(strrchr)(s, c);
 }
if (res == 0) {
     Acquire(thr, pc, (uptr)s);
   }
   return res;
 }
 
 #if !SANITIZER_FREEBSD
 TSAN_INTERCEPTOR(int, __xstat, int version, const char *path, void *buf) {
   SCOPED_TSAN_INTERCEPTOR(__xstat, version, path, buf);
+  READ_STRING(thr, pc, path, 0);
   return REAL(__xstat)(version, path, buf);
 }
 #define TSAN_MAYBE_INTERCEPT___XSTAT TSAN_INTERCEPT(__xstat)
 #else
 #define TSAN_MAYBE_INTERCEPT___XSTAT
 #endif
 
 TSAN_INTERCEPTOR(int, stat, const char *path, void *buf) {
 #if SANITIZER_FREEBSD
   SCOPED_TSAN_INTERCEPTOR(stat, path, buf);
+  READ_STRING(thr, pc, path, 0);
   return REAL(stat)(path, buf);
 #else
   SCOPED_TSAN_INTERCEPTOR(__xstat, 0, path, buf);
+  READ_STRING(thr, pc, path, 0);
   return REAL(__xstat)(0, path, buf);
 #endif
 }
 
 #if !SANITIZER_FREEBSD
 TSAN_INTERCEPTOR(int, __xstat64, int version, const char *path, void *buf) {
   SCOPED_TSAN_INTERCEPTOR(__xstat64, version, path, buf);
+  READ_STRING(thr, pc, path, 0);
   return REAL(__xstat64)(version, path, buf);
 }
 #define TSAN_MAYBE_INTERCEPT___XSTAT64 TSAN_INTERCEPT(__xstat64)
 #else
 #define TSAN_MAYBE_INTERCEPT___XSTAT64
 #endif
 
 #if !SANITIZER_FREEBSD
 TSAN_INTERCEPTOR(int, stat64, const char *path, void *buf) {
   SCOPED_TSAN_INTERCEPTOR(__xstat64, 0, path, buf);
+  READ_STRING(thr, pc, path, 0);
   return REAL(__xstat64)(0, path, buf);
 }
 #define TSAN_MAYBE_INTERCEPT_STAT64 TSAN_INTERCEPT(stat64)
 #else
 #define TSAN_MAYBE_INTERCEPT_STAT64
 #endif
 
 #if !SANITIZER_FREEBSD
 TSAN_INTERCEPTOR(int, __lxstat, int version, const char *path, void *buf) {
   SCOPED_TSAN_INTERCEPTOR(__lxstat, version, path, buf);
+  READ_STRING(thr, pc, path, 0);
   return REAL(__lxstat)(version, path, buf);
 }
 #define TSAN_MAYBE_INTERCEPT___LXSTAT TSAN_INTERCEPT(__lxstat)
 #else
 #define TSAN_MAYBE_INTERCEPT___LXSTAT
 #endif
 
 TSAN_INTERCEPTOR(int, lstat, const char *path, void *buf) {
 #if SANITIZER_FREEBSD
   SCOPED_TSAN_INTERCEPTOR(lstat, path, buf);
+  READ_STRING(thr, pc, path, 0);
   return REAL(lstat)(path, buf);
 #else
   SCOPED_TSAN_INTERCEPTOR(__lxstat, 0, path, buf);
+  READ_STRING(thr, pc, path, 0);
   return REAL(__lxstat)(0, path, buf);
 #endif
 }
 
 #if !SANITIZER_FREEBSD
 TSAN_INTERCEPTOR(int, __lxstat64, int version, const char *path, void *buf) {
   SCOPED_TSAN_INTERCEPTOR(__lxstat64, version, path, buf);
+  READ_STRING(thr, pc, path, 0);
   return REAL(__lxstat64)(version, path, buf);
 }
 #define TSAN_MAYBE_INTERCEPT___LXSTAT64 TSAN_INTERCEPT(__lxstat64)
 #else
 #define TSAN_MAYBE_INTERCEPT___LXSTAT64
 #endif
 
 #if !SANITIZER_FREEBSD
 TSAN_INTERCEPTOR(int, lstat64, const char *path, void *buf) {
   SCOPED_TSAN_INTERCEPTOR(__lxstat64, 0, path, buf);
+  READ_STRING(thr, pc, path, 0);
   return REAL(__lxstat64)(0, path, buf);
 }
 #define TSAN_MAYBE_INTERCEPT_LSTAT64 TSAN_INTERCEPT(lstat64)
 #else
 #define TSAN_MAYBE_INTERCEPT_LSTAT64
 #endif
 
 #if !SANITIZER_FREEBSD

 }
 #define TSAN_MAYBE_INTERCEPT_FSTAT64 TSAN_INTERCEPT(fstat64)
 #else
 #define TSAN_MAYBE_INTERCEPT_FSTAT64
 #endif
 
 TSAN_INTERCEPTOR(int, open, const char *name, int flags, int mode) {
   SCOPED_TSAN_INTERCEPTOR(open, name, flags, mode);
+  READ_STRING(thr, pc, name, 0);
   int fd = REAL(open)(name, flags, mode);
   if (fd >= 0)
     FdFileCreate(thr, pc, fd);
   return fd;
 }
 
 #if !SANITIZER_FREEBSD
 TSAN_INTERCEPTOR(int, open64, const char *name, int flags, int mode) {
   SCOPED_TSAN_INTERCEPTOR(open64, name, flags, mode);
+  READ_STRING(thr, pc, name, 0);
   int fd = REAL(open64)(name, flags, mode);
   if (fd >= 0)
     FdFileCreate(thr, pc, fd);
   return fd;
 }
 #define TSAN_MAYBE_INTERCEPT_OPEN64 TSAN_INTERCEPT(open64)
 #else
 #define TSAN_MAYBE_INTERCEPT_OPEN64
 #endif
 
 TSAN_INTERCEPTOR(int, creat, const char *name, int mode) {
   SCOPED_TSAN_INTERCEPTOR(creat, name, mode);
+  READ_STRING(thr, pc, name, 0);
   int fd = REAL(creat)(name, mode);
   if (fd >= 0)
     FdFileCreate(thr, pc, fd);
   return fd;
 }
 
 #if !SANITIZER_FREEBSD
 TSAN_INTERCEPTOR(int, creat64, const char *name, int mode) {
   SCOPED_TSAN_INTERCEPTOR(creat64, name, mode);
+  READ_STRING(thr, pc, name, 0);
   int fd = REAL(creat64)(name, mode);
   if (fd >= 0)
     FdFileCreate(thr, pc, fd);
   return fd;
 }
 #define TSAN_MAYBE_INTERCEPT_CREAT64 TSAN_INTERCEPT(creat64)
 #else
 #define TSAN_MAYBE_INTERCEPT_CREAT64

test/asan/TestCases/atoi_strict.c

+// Test strict_string_checks option in atoi function
+// RUN: %clang_asan %s -o %t
+// RUN: %run %t test1 2>&1
+// RUN: ASAN_OPTIONS=strict_string_checks=false %run %t test1 2>&1
+// RUN: ASAN_OPTIONS=strict_string_checks=true not %run %t test1 2>&1 | FileCheck %s --check-prefix=CHECK1
+// RUN: %run %t test2 2>&1
+// RUN: ASAN_OPTIONS=strict_string_checks=false %run %t test2 2>&1
+// RUN: ASAN_OPTIONS=strict_string_checks=true not %run %t test2 2>&1 | FileCheck %s --check-prefix=CHECK2
+// RUN: %run %t test3 2>&1
+// RUN: ASAN_OPTIONS=strict_string_checks=false %run %t test3 2>&1
+// RUN: ASAN_OPTIONS=strict_string_checks=true not %run %t test3 2>&1 | FileCheck %s --check-prefix=CHECK3
+
+#include <assert.h>
+#include <stdlib.h>
+#include <string.h>
+
+void test1(char *array) {
+  // Last symbol is non-digit
+  memset(array, '1', 10);
+  array[9] = 'a';
+  int r = atoi(array);
+  assert(r == 111111111);
+}
+
+void test2(char *array) {
+  // Single non-digit symbol
+  array[9] = 'a';
+  int r = atoi(array + 9);
+  assert(r == 0);
+}
+
+void test3(char *array) {
+  // Incorrect number format
+  memset(array, ' ', 10);
+  array[9] = '-';
+  array[8] = '-';
+  int r = atoi(array);
+  assert(r == 0);
+}
+
+int main(int argc, char **argv) {
+  char *array = (char*)malloc(10);
+  if (argc != 2) return 1;
+  if (!strcmp(argv[1], "test1")) test1(array);
+  // CHECK1: {{.*ERROR: AddressSanitizer: heap-buffer-overflow on address}}
+  // CHECK1: READ of size 11
+  if (!strcmp(argv[1], "test2")) test2(array);
+  // CHECK2: {{.*ERROR: AddressSanitizer: heap-buffer-overflow on address}}
+  // CHECK2: READ of size 2
+  if (!strcmp(argv[1], "test3")) test3(array);
+  // CHECK3: {{.*ERROR: AddressSanitizer: heap-buffer-overflow on address}}
+  // CHECK3: READ of size 11
+  free(array);
+  return 0;
+}

test/asan/TestCases/atol_strict.c

+// Test strict_string_checks option in atol function
+// RUN: %clang_asan %s -o %t
+// RUN: %run %t test1 2>&1
+// RUN: ASAN_OPTIONS=strict_string_checks=false %run %t test1 2>&1
+// RUN: ASAN_OPTIONS=strict_string_checks=true not %run %t test1 2>&1 | FileCheck %s --check-prefix=CHECK1
+// RUN: %run %t test2 2>&1
+// RUN: ASAN_OPTIONS=strict_string_checks=false %run %t test2 2>&1
+// RUN: ASAN_OPTIONS=strict_string_checks=true not %run %t test2 2>&1 | FileCheck %s --check-prefix=CHECK2
+// RUN: %run %t test3 2>&1
+// RUN: ASAN_OPTIONS=strict_string_checks=false %run %t test3 2>&1
+// RUN: ASAN_OPTIONS=strict_string_checks=true not %run %t test3 2>&1 | FileCheck %s --check-prefix=CHECK3
+
+#include <assert.h>
+#include <stdlib.h>
+#include <string.h>
+
+void test1(char *array) {
+  // Last symbol is non-digit
+  memset(array, '1', 10);
+  array[9] = 'a';
+  long r = atol(array);
+  assert(r == 111111111);
+}
+
+void test2(char *array) {
+  // Single non-digit symbol
+  array[9] = 'a';
+  long r = atol(array + 9);
+  assert(r == 0);
+}
+
+void test3(char *array) {
+  // Incorrect number format
+  memset(array, ' ', 10);
+  array[9] = '-';
+  array[8] = '-';
+  long r = atol(array);
+  assert(r == 0);
+}
+
+int main(int argc, char **argv) {
+  char *array = (char*)malloc(10);
+  if (argc != 2) return 1;
+  if (!strcmp(argv[1], "test1")) test1(array);
+  // CHECK1: {{.*ERROR: AddressSanitizer: heap-buffer-overflow on address}}
+  // CHECK1: READ of size 11
+  if (!strcmp(argv[1], "test2")) test2(array);
+  // CHECK2: {{.*ERROR: AddressSanitizer: heap-buffer-overflow on address}}
+  // CHECK2: READ of size 2
+  if (!strcmp(argv[1], "test3")) test3(array);
+  // CHECK3: {{.*ERROR: AddressSanitizer: heap-buffer-overflow on address}}
+  // CHECK3: READ of size 11
+  free(array);
+  return 0;
+}

test/asan/TestCases/atoll_strict.c

+// Test strict_string_checks option in atoll function
+// RUN: %clang_asan %s -o %t
+// RUN: %run %t test1 2>&1
+// RUN: ASAN_OPTIONS=strict_string_checks=false %run %t test1 2>&1
+// RUN: ASAN_OPTIONS=strict_string_checks=true not %run %t test1 2>&1 | FileCheck %s --check-prefix=CHECK1
+// RUN: %run %t test2 2>&1
+// RUN: ASAN_OPTIONS=strict_string_checks=false %run %t test2 2>&1
+// RUN: ASAN_OPTIONS=strict_string_checks=true not %run %t test2 2>&1 | FileCheck %s --check-prefix=CHECK2
+// RUN: %run %t test3 2>&1
+// RUN: ASAN_OPTIONS=strict_string_checks=false %run %t test3 2>&1
+// RUN: ASAN_OPTIONS=strict_string_checks=true not %run %t test3 2>&1 | FileCheck %s --check-prefix=CHECK3
+
+#include <assert.h>
+#include <stdlib.h>
+#include <string.h>
+
+void test1(char *array) {
+  // Last symbol is non-digit
+  memset(array, '1', 10);
+  array[9] = 'a';
+  long long r = atoll(array);
+  assert(r == 111111111);
+}
+
+void test2(char *array) {
+  // Single non-digit symbol
+  array[9] = 'a';
+  long long r = atoll(array + 9);
+  assert(r == 0);
+}
+
+void test3(char *array) {
+  // Incorrect number format
+  memset(array, ' ', 10);
+  array[9] = '-';
+  array[8] = '-';
+  long long r = atoll(array);
+  assert(r == 0);
+}
+
+int main(int argc, char **argv) {
+  char *array = (char*)malloc(10);
+  if (argc != 2) return 1;
+  if (!strcmp(argv[1], "test1")) test1(array);
+  // CHECK1: {{.*ERROR: AddressSanitizer: heap-buffer-overflow on address}}
+  // CHECK1: READ of size 11
+  if (!strcmp(argv[1], "test2")) test2(array);
+  // CHECK2: {{.*ERROR: AddressSanitizer: heap-buffer-overflow on address}}
+  // CHECK2: READ of size 2
+  if (!strcmp(argv[1], "test3")) test3(array);
+  // CHECK3: {{.*ERROR: AddressSanitizer: heap-buffer-overflow on address}}
+  // CHECK3: READ of size 11
+  free(array);
+  return 0;
+}

test/asan/TestCases/strcat_strict.c

+// Test strict_string_checks option in strcat function
+// RUN: %clang_asan %s -o %t
+// RUN: not %run %t test1 2>&1 | FileCheck %s --check-prefix=CHECK1-NONSTRICT --check-prefix=CHECK1
+// RUN: ASAN_OPTIONS=strict_string_checks=false not  %run %t test1 2>&1 | FileCheck %s --check-prefix=CHECK1-NONSTRICT --check-prefix=CHECK1
+// RUN: ASAN_OPTIONS=strict_string_checks=true not %run %t test1 2>&1 | FileCheck %s --check-prefix=CHECK1-STRICT --check-prefix=CHECK1
+// RUN: not %run %t test2 2>&1 | FileCheck %s --check-prefix=CHECK2-NONSTRICT --check-prefix=CHECK2
+// RUN: ASAN_OPTIONS=strict_string_checks=false not  %run %t test2 2>&1 | FileCheck %s --check-prefix=CHECK2-NONSTRICT --check-prefix=CHECK2
+// RUN: ASAN_OPTIONS=strict_string_checks=true not %run %t test2 2>&1 | FileCheck %s --check-prefix=CHECK2-STRICT --check-prefix=CHECK2
+
+#include <assert.h>
+#include <stdlib.h>
+#include <string.h>
+
+void test1(char *to, int to_size, char *from) {
+  // One of arguments points to not allocated memory.
+  char* r = strcat(to + to_size, from);
+}
+
+void test2(char *to, int to_size, char *from) {
+  // "to" is not zero-terminated.
+  memset(to, 'z', to_size);
+  char* r = strcat(to, from);
+}
+
+int main(int argc, char **argv) {
+  size_t to_size = 100;
+  char *to = (char*)malloc(to_size);
+  size_t from_size = 20;
+  char *from = (char*)malloc(from_size);
+  memset(from, 'z', from_size);
+  from[from_size - 1] = '\0';
+  if (argc != 2) return 1;
+  if (!strcmp(argv[1], "test1")) test1(to, to_size, from);
+  // CHECK1: {{.*ERROR: AddressSanitizer: heap-buffer-overflow on address}}
+  // CHECK1-STRICT: READ of size 1
+  // CHECK1-NONSTRICT: WRITE of size 20
+  if (!strcmp(argv[1], "test2")) test2(to, to_size, from);
+  // CHECK2: {{.*ERROR: AddressSanitizer: heap-buffer-overflow on address}}
+  // CHECK2-STRICT: READ of size 101
+  // CHECK2-NONSTRICT: WRITE of size 20
+  free(to);
+  free(from);
+  return 0;
+}

test/asan/TestCases/strchr_strict.c

+// Test strict_string_checks option in strchr function
+// RUN: %clang_asan %s -o %t && %run %t 2>&1
+// RUN: ASAN_OPTIONS=strict_string_checks=false %run %t 2>&1
+// RUN: ASAN_OPTIONS=strict_string_checks=true not %run %t 2>&1 | FileCheck %s
+
+#include <assert.h>
+#include <stdlib.h>
+#include <string.h>
+
+int main(int argc, char **argv) {
+  size_t size = 100;
+  char fill = 'o';
+  char *s = (char*)malloc(size);
+  memset(s, fill, size);
+  char c = 'o';
+  char* r = strchr(s, c);
+  // CHECK: {{.*ERROR: AddressSanitizer: heap-buffer-overflow on address}}
+  // CHECK: READ of size 101
+  assert(r == s);
+  free(s);
+  return 0;
+}

test/asan/TestCases/strcmp_strict.c

+// Test strict_string_checks option in strcmp function
+// RUN: %clang_asan %s -o %t && %run %t 2>&1
+// RUN: ASAN_OPTIONS=strict_string_checks=false %run %t 2>&1
+// RUN: ASAN_OPTIONS=strict_string_checks=true not %run %t 2>&1 | FileCheck %s
+
+#include <assert.h>
+#include <stdlib.h>
+#include <string.h>
+
+int main(int argc, char **argv) {
+  size_t size = 100;
+  char fill = 'o';
+  char *s1 = (char*)malloc(size);
+  memset(s1, fill, size);
+  char *s2 = (char*)malloc(size);
+  memset(s2, fill, size);
+  s1[size - 1] = 'z';
+  s2[size - 1] = 'x';
+  int r = strcmp(s1, s2);
+  // CHECK: {{.*ERROR: AddressSanitizer: heap-buffer-overflow on address}}
+  // CHECK: READ of size 101
+  assert(r == 1);
+  free(s1);
+  free(s2);
+  return 0;
+}

test/asan/TestCases/strncat_strict.c

+// Test strict_string_checks option in strncat function
+// RUN: %clang_asan %s -o %t
+// RUN: not %run %t test1 2>&1 | FileCheck %s --check-prefix=CHECK1-NONSTRICT --check-prefix=CHECK1
+// RUN: ASAN_OPTIONS=strict_string_checks=false not  %run %t test1 2>&1 | FileCheck %s --check-prefix=CHECK1-NONSTRICT --check-prefix=CHECK1
+// RUN: ASAN_OPTIONS=strict_string_checks=true not %run %t test1 2>&1 | FileCheck %s --check-prefix=CHECK1-STRICT --check-prefix=CHECK1
+// RUN: not %run %t test2 2>&1 | FileCheck %s --check-prefix=CHECK2-NONSTRICT --check-prefix=CHECK2
+// RUN: ASAN_OPTIONS=strict_string_checks=false not  %run %t test2 2>&1 | FileCheck %s --check-prefix=CHECK2-NONSTRICT --check-prefix=CHECK2
+// RUN: ASAN_OPTIONS=strict_string_checks=true not %run %t test2 2>&1 | FileCheck %s --check-prefix=CHECK2-STRICT --check-prefix=CHECK2
+
+#include <assert.h>
+#include <stdlib.h>
+#include <string.h>
+
+void test1(char *to, int to_size, char *from) {
+  // One of arguments points to not allocated memory.
+  char* r = strncat(to + to_size, from, 2);
+}
+
+void test2(char *to, int to_size, char *from) {
+  // "to" is not zero-terminated.
+  memset(to, 'z', to_size);
+  char* r = strncat(to, from, 1);
+}
+
+int main(int argc, char **argv) {
+  size_t to_size = 100;
+  char *to = (char*)malloc(to_size);
+  size_t from_size = 20;
+  char *from = (char*)malloc(from_size);
+  memset(from, 'z', from_size);
+  from[from_size - 1] = '\0';
+  if (argc != 2) return 1;
+  if (!strcmp(argv[1], "test1")) test1(to, to_size, from);
+  // CHECK1: {{.*ERROR: AddressSanitizer: heap-buffer-overflow on address}}
+  // CHECK1-STRICT: READ of size 1
+  // CHECK1-NONSTRICT: WRITE of size 3
+  if (!strcmp(argv[1], "test2")) test2(to, to_size, from);
+  // CHECK2: {{.*ERROR: AddressSanitizer: heap-buffer-overflow on address}}
+  // CHECK2-STRICT: READ of size 101
+  // CHECK2-NONSTRICT: WRITE of size 2
+  free(to);
+  free(from);
+  return 0;
+}

test/asan/TestCases/strtol_strict.c

+// Test strict_string_checks option in strtol function
+// RUN: %clang_asan -DTEST1 %s -o %t
+// RUN: %run %t test1 2>&1
+// RUN: ASAN_OPTIONS=strict_string_checks=false %run %t test1 2>&1
+// RUN: ASAN_OPTIONS=strict_string_checks=true not %run %t test1 2>&1 | FileCheck %s --check-prefix=CHECK1
+// RUN: %run %t test2 2>&1
+// RUN: ASAN_OPTIONS=strict_string_checks=false %run %t test2 2>&1
+// RUN: ASAN_OPTIONS=strict_string_checks=true not %run %t test2 2>&1 | FileCheck %s --check-prefix=CHECK2
+// RUN: %run %t test3 2>&1
+// RUN: ASAN_OPTIONS=strict_string_checks=false %run %t test3 2>&1
+// RUN: ASAN_OPTIONS=strict_string_checks=true not %run %t test3 2>&1 | FileCheck %s --check-prefix=CHECK3
+// RUN: %run %t test4 2>&1
+// RUN: ASAN_OPTIONS=strict_string_checks=false %run %t test4 2>&1
+// RUN: ASAN_OPTIONS=strict_string_checks=true not %run %t test4 2>&1 | FileCheck %s --check-prefix=CHECK4
+// RUN: %run %t test5 2>&1
+// RUN: ASAN_OPTIONS=strict_string_checks=false %run %t test5 2>&1
+// RUN: ASAN_OPTIONS=strict_string_checks=true not %run %t test5 2>&1 | FileCheck %s --check-prefix=CHECK5
+// RUN: %run %t test6 2>&1
+// RUN: ASAN_OPTIONS=strict_string_checks=false %run %t test6 2>&1
+// RUN: ASAN_OPTIONS=strict_string_checks=true not %run %t test6 2>&1 | FileCheck %s --check-prefix=CHECK6
+// RUN: %run %t test7 2>&1
+// RUN: ASAN_OPTIONS=strict_string_checks=false %run %t test7 2>&1
+// RUN: ASAN_OPTIONS=strict_string_checks=true not %run %t test7 2>&1 | FileCheck %s --check-prefix=CHECK7
+
+#include <assert.h>
+#include <stdlib.h>
+#include <string.h>
+
+void test1(char *array, char *endptr) {
+  // Buffer overflow if there is no terminating null (depends on base)
+  long r = strtol(array, &endptr, 3);
+  assert(array + 2 == endptr);
+  assert(r == 5);
+}
+
+void test2(char *array, char *endptr) {
+  // Buffer overflow if there is no terminating null (depends on base)
+  array[2] = 'z';
+  long r = strtol(array, &endptr, 35);
+  assert(array + 2 == endptr);
+  assert(r == 37);
+}
+
+void test3(char *array, char *endptr) {
+  // Buffer overflow if base is invalid.
+  long r = strtol(array - 1, NULL, -1);
+  assert(r == 0);
+}
+
+void test4(char *array, char *endptr) {
+  // Buffer overflow if base is invalid.
+  long r = strtol(array + 3, NULL, 1);
+  assert(r == 0);
+}
+
+void test5(char *array, char *endptr) {
+  // Overflow if no digits are found.
+  array[0] = ' ';
+  array[1] = '+';
+  array[2] = '-';
+  long r = strtol(array, NULL, 0);
+  assert(r == 0);
+}
+
+void test6(char *array, char *endptr) {
+  // Overflow if no digits are found.
+  array[0] = ' ';
+  array[1] = array[2] = 'z';
+  long r = strtol(array, &endptr, 0);
+  assert(array == endptr);
+  assert(r == 0);
+}
+
+void test7(char *array, char *endptr) {
+  // Overflow if no digits are found.
+  array[2] = 'z';
+  long r = strtol(array + 2, NULL, 0);
+  assert(r == 0);
+}
+
+int main(int argc, char **argv) {
+  char *array = (char*)malloc(3);
+  char *endptr = NULL;
+  array[0] = '1';
+  array[1] = '2';
+  array[2] = '3';
+  if (argc != 2) return 1;
+  if (!strcmp(argv[1], "test1")) test1(array, endptr);
+  // CHECK1: {{.*ERROR: AddressSanitizer: heap-buffer-overflow on address}}
+  // CHECK1: READ of size 4
+  if (!strcmp(argv[1], "test2")) test2(array, endptr);
+  // CHECK2: {{.*ERROR: AddressSanitizer: heap-buffer-overflow on address}}
+  // CHECK2: READ of size 4
+  if (!strcmp(argv[1], "test3")) test3(array, endptr);
+  // CHECK3: {{.*ERROR: AddressSanitizer: heap-buffer-overflow on address}}
+  // CHECK3: READ of size 5
+  if (!strcmp(argv[1], "test4")) test4(array, endptr);
+  // CHECK4: {{.*ERROR: AddressSanitizer: heap-buffer-overflow on address}}
+  // CHECK4: READ of size 1
+  if (!strcmp(argv[1], "test5")) test5(array, endptr);
+  // CHECK5: {{.*ERROR: AddressSanitizer: heap-buffer-overflow on address}}
+  // CHECK5: READ of size 4
+  if (!strcmp(argv[1], "test6")) test6(array, endptr);
+  // CHECK6: {{.*ERROR: AddressSanitizer: heap-buffer-overflow on address}}
+  // CHECK6: READ of size 4
+  if (!strcmp(argv[1], "test7")) test7(array, endptr);
+  // CHECK7: {{.*ERROR: AddressSanitizer: heap-buffer-overflow on address}}
+  // CHECK7: READ of size 2
+  free(array);
+  return 0;
+}

test/asan/TestCases/strtoll_strict.c

+// Test strict_string_checks option in strtoll function
+// RUN: %clang_asan -DTEST1 %s -o %t
+// RUN: %run %t test1 2>&1
+// RUN: ASAN_OPTIONS=strict_string_checks=false %run %t test1 2>&1
+// RUN: ASAN_OPTIONS=strict_string_checks=true not %run %t test1 2>&1 | FileCheck %s --check-prefix=CHECK1
+// RUN: %run %t test2 2>&1
+// RUN: ASAN_OPTIONS=strict_string_checks=false %run %t test2 2>&1
+// RUN: ASAN_OPTIONS=strict_string_checks=true not %run %t test2 2>&1 | FileCheck %s --check-prefix=CHECK2
+// RUN: %run %t test3 2>&1
+// RUN: ASAN_OPTIONS=strict_string_checks=false %run %t test3 2>&1
+// RUN: ASAN_OPTIONS=strict_string_checks=true not %run %t test3 2>&1 | FileCheck %s --check-prefix=CHECK3
+// RUN: %run %t test4 2>&1
+// RUN: ASAN_OPTIONS=strict_string_checks=false %run %t test4 2>&1
+// RUN: ASAN_OPTIONS=strict_string_checks=true not %run %t test4 2>&1 | FileCheck %s --check-prefix=CHECK4
+// RUN: %run %t test5 2>&1
+// RUN: ASAN_OPTIONS=strict_string_checks=false %run %t test5 2>&1
+// RUN: ASAN_OPTIONS=strict_string_checks=true not %run %t test5 2>&1 | FileCheck %s --check-prefix=CHECK5
+// RUN: %run %t test6 2>&1
+// RUN: ASAN_OPTIONS=strict_string_checks=false %run %t test6 2>&1
+// RUN: ASAN_OPTIONS=strict_string_checks=true not %run %t test6 2>&1 | FileCheck %s --check-prefix=CHECK6
+// RUN: %run %t test7 2>&1
+// RUN: ASAN_OPTIONS=strict_string_checks=false %run %t test7 2>&1
+// RUN: ASAN_OPTIONS=strict_string_checks=true not %run %t test7 2>&1 | FileCheck %s --check-prefix=CHECK7
+
+#include <assert.h>
+#include <stdlib.h>
+#include <string.h>
+
+void test1(char *array, char *endptr) {
+  // Buffer overflow if there is no terminating null (depends on base)
+  long long r = strtoll(array, &endptr, 3);
+  assert(array + 2 == endptr);
+  assert(r == 5);
+}
+
+void test2(char *array, char *endptr) {
+  // Buffer overflow if there is no terminating null (depends on base)
+  array[2] = 'z';
+  long long r = strtoll(array, &endptr, 35);
+  assert(array + 2 == endptr);
+  assert(r == 37);
+}
+
+void test3(char *array, char *endptr) {
+  // Buffer overflow if base is invalid.
+  long long r = strtoll(array - 1, NULL, -1);
+  assert(r == 0);
+}
+
+void test4(char *array, char *endptr) {
+  // Buffer overflow if base is invalid.
+  long long r = strtoll(array + 3, NULL, 1);
+  assert(r == 0);
+}
+
+void test5(char *array, char *endptr) {
+  // Overflow if no digits are found.
+  array[0] = ' ';
+  array[1] = '+';
+  array[2] = '-';
+  long long r = strtoll(array, NULL, 0);
+  assert(r == 0);
+}
+
+void test6(char *array, char *endptr) {
+  // Overflow if no digits are found.
+  array[0] = ' ';
+  array[1] = array[2] = 'z';
+  long long r = strtoll(array, &endptr, 0);
+  assert(array == endptr);
+  assert(r == 0);
+}
+
+void test7(char *array, char *endptr) {
+  // Overflow if no digits are found.
+  array[2] = 'z';
+  long long r = strtoll(array + 2, NULL, 0);
+  assert(r == 0);
+}
+
+int main(int argc, char **argv) {
+  char *array = (char*)malloc(3);
+  char *endptr = NULL;
+  array[0] = '1';
+  array[1] = '2';
+  array[2] = '3';
+  if (argc != 2) return 1;
+  if (!strcmp(argv[1], "test1")) test1(array, endptr);
+  // CHECK1: {{.*ERROR: AddressSanitizer: heap-buffer-overflow on address}}
+  // CHECK1: READ of size 4
+  if (!strcmp(argv[1], "test2")) test2(array, endptr);
+  // CHECK2: {{.*ERROR: AddressSanitizer: heap-buffer-overflow on address}}
+  // CHECK2: READ of size 4
+  if (!strcmp(argv[1], "test3")) test3(array, endptr);
+  // CHECK3: {{.*ERROR: AddressSanitizer: heap-buffer-overflow on address}}
+  // CHECK3: READ of size 5
+  if (!strcmp(argv[1], "test4")) test4(array, endptr);
+  // CHECK4: {{.*ERROR: AddressSanitizer: heap-buffer-overflow on address}}
+  // CHECK4: READ of size 1
+  if (!strcmp(argv[1], "test5")) test5(array, endptr);
+  // CHECK5: {{.*ERROR: AddressSanitizer: heap-buffer-overflow on address}}
+  // CHECK5: READ of size 4
+  if (!strcmp(argv[1], "test6")) test6(array, endptr);
+  // CHECK6: {{.*ERROR: AddressSanitizer: heap-buffer-overflow on address}}
+  // CHECK6: READ of size 4
+  if (!strcmp(argv[1], "test7")) test7(array, endptr);
+  // CHECK7: {{.*ERROR: AddressSanitizer: heap-buffer-overflow on address}}
+  // CHECK7: READ of size 2
+  free(array);
+  return 0;
+}