[msan] Unpoison trailing nullptr in wordexp interceptor

[morehouse]

compiler-rt/lib/sanitizer_common/sanitizer_common_interceptors.inc

4000–4001

(unrelated to this change): Shouldn't this be as above?

[vitalybuka]

compiler-rt/lib/sanitizer_common/sanitizer_common_interceptors.inc

4000–4001

yes, fixed with 629411d799223d7bc7aad98661b1443a4788c0c5

compiler-rt/lib/msan/tests/msan_test.cpp

TEST(MemorySanitizer, getgroups_negative) {
   gid_t group;
   int n = getgroups(-1, 0);
   ASSERT_EQ(-1, n);
 
   n = getgroups(-1, 0);
   ASSERT_EQ(-1, n);
 }
 
+TEST(MemorySanitizer, wordexp_empty) {
+  wordexp_t w;
+  int res = wordexp("", &w, 0);
+  ASSERT_EQ(0, res);
+  ASSERT_EQ(0U, w.we_wordc);
+  ASSERT_STREQ(nullptr, w.we_wordv[0]);
+}
+
 TEST(MemorySanitizer, wordexp) {
   wordexp_t w;
   int res = wordexp("a b c", &w, 0);
   ASSERT_EQ(0, res);
   ASSERT_EQ(3U, w.we_wordc);
   ASSERT_STREQ("a", w.we_wordv[0]);
   ASSERT_STREQ("b", w.we_wordv[1]);
   ASSERT_STREQ("c", w.we_wordv[2]);

compiler-rt/lib/sanitizer_common/sanitizer_common_interceptors.inc

INTERCEPTOR(int, wordexp, char *s, __sanitizer_wordexp_t *p, int flags) {
   if (s) COMMON_INTERCEPTOR_READ_RANGE(ctx, s, internal_strlen(s) + 1);
   // FIXME: under ASan the call below may write to freed memory and corrupt
   // its metadata. See
   // https://github.com/google/sanitizers/issues/321.
   int res = REAL(wordexp)(s, p, flags);
   if (!res && p) {
     COMMON_INTERCEPTOR_WRITE_RANGE(ctx, p, sizeof(*p));
     uptr we_wordc =
         ((flags & wordexp_wrde_dooffs) ? p->we_offs : 0) + p->we_wordc;
-    if (we_wordc)
-      COMMON_INTERCEPTOR_WRITE_RANGE(ctx, p->we_wordv,
-                                     sizeof(*p->we_wordv) * we_wordc);
+                                   sizeof(*p->we_wordv) * (we_wordc + 1));
     for (uptr i = 0; i < we_wordc; ++i) {
       char *w = p->we_wordv[i];
       if (w) COMMON_INTERCEPTOR_WRITE_RANGE(ctx, w, internal_strlen(w) + 1);
     }
   }
   return res;
 }
 #define INIT_WORDEXP COMMON_INTERCEPT_FUNCTION(wordexp);