This is an archive of the discontinued LLVM Phabricator instance.

Differential D133582

[ASan] rename internal references to left of/right of.
Needs ReviewPublic

Authored by fmayer on Sep 9 2022, 8:47 AM.

Details

Reviewers
eugenis

Diff Detail

Event Timeline

fmayer created this revision.Sep 9 2022, 8:47 AM
Herald added a project: Restricted Project. · View Herald TranscriptSep 9 2022, 8:47 AM
Herald added subscribers: Enna1, jrtc27, fedor.sergeev and 2 others. · View Herald Transcript
fmayer requested review of this revision.Sep 9 2022, 8:47 AM
Herald added projects: Restricted Project, Restricted Project. · View Herald TranscriptSep 9 2022, 8:47 AM
Herald added subscribers: llvm-commits, Restricted Project. · View Herald Transcript
fmayer mentioned this in D132611: [ASan] rename left/right to before/after..Sep 9 2022, 8:48 AM
fmayer added a comment.Sep 9 2022, 9:07 AM

Another option (probably better, WDYT?): replace preceding/succeeding with front/back.

Harbormaster completed remote builds in B185860: Diff 459084.Sep 9 2022, 9:25 AM
fmayer updated this revision to Diff 459106.Sep 9 2022, 10:09 AM

preceding -> front, succeeding -> back

fmayer updated this revision to Diff 459107.Sep 9 2022, 10:10 AM

typo

fmayer added a subscriber: enh.Sep 9 2022, 10:12 AM
enh added a comment.Sep 9 2022, 10:16 AM

yeah, that makes sense to me.

(looking at the code also explains why "left" and "right" didn't seem as bad to the authors of this code as it does to mere users... your view of memory is quite different to ours, which only contains the actual objects we've allocated, and has no "chunks"...)

Harbormaster completed remote builds in B185876: Diff 459107.Sep 9 2022, 10:46 AM
eugenis added a comment.Sep 12 2022, 2:09 PM

I think I'd rather keep left/right as internal concepts and only translate them to before/after in the output.

compiler-rt/lib/asan/asan_allocator.cpp
75

I don't get this. Why P and S vs F and B?

443

Not sure about this either. Before can be understood as in time or in space, while left and right are unambiguous, as soon as we agree on conceptual memory layout.

compiler-rt/lib/asan/asan_thread.cpp
393

Every time I read front/back I have to stop and think which is which. The terms make sense for a container, but IMHO not for a chunk of memory.

fmayer updated this revision to Diff 459555.Sep 12 2022, 2:13 PM

nit

fmayer marked an inline comment as done.Sep 12 2022, 2:14 PM

PTAL. I'd like to merge this earlier rather than later if possible, to avoid merge conflicts.

compiler-rt/lib/asan/asan_allocator.cpp
75

if you were referring to the below, that was a mistake (it used to be preceding / succeeding but i think front / back is better. happy to revert back to that).

fmayer marked an inline comment as done.Sep 12 2022, 2:14 PM
In D133582#3784862, @fmayer wrote:

PTAL. I'd like to merge this earlier rather than later if possible, to avoid merge conflicts.

Sorry, that was left over. Didn't mean to send this.

fmayer updated this revision to Diff 459565.Sep 12 2022, 2:48 PM

nit

Harbormaster completed remote builds in B186234: Diff 459565.Sep 12 2022, 3:32 PM

Revision Contents

PathSize
compiler-rt/
lib/
asan/
4 lines
87 lines
14 lines
12 lines
47 lines
2 lines
11 lines
2 lines
10 lines
2 lines
14 lines
18 lines
4 lines
26 lines
4 lines
8 lines
tests/
4 lines
test/
asan/
TestCases/
Posix/
4 lines
4 lines
29 lines
Windows/
calloc_oob_after.cpp
calloc_right_oob.cpp
4 lines
calloc_oob_before.cpp
calloc_left_oob.cpp
4 lines
dll_malloc_oob_before.cpp
dll_malloc_left_oob.cpp
4 lines
dll_operator_array_new_oob_before.cpp
dll_operator_array_new_left_oob.cpp
4 lines
dll_operator_array_new_with_dtor_oob_before.cpp
dll_operator_array_new_with_dtor_left_oob.cpp
4 lines
dll_thread_stack_array_oob_before.cpp
dll_thread_stack_array_left_oob.cpp
6 lines
malloc_oob_after.cpp
malloc_right_oob.cpp
4 lines
malloc_oob_before.cpp
malloc_left_oob.cpp
4 lines
operator_array_new_oob_after.cpp
operator_array_new_right_oob.cpp
4 lines
operator_array_new_oob_before.cpp
operator_array_new_left_oob.cpp
4 lines
operator_array_new_with_dtor_oob_before.cpp
operator_array_new_with_dtor_left_oob.cpp
4 lines
operator_new_oob_after.cpp
operator_new_right_oob.cpp
4 lines
operator_new_oob_before.cpp
operator_new_left_oob.cpp
4 lines
realloc_oob_after.cpp
realloc_right_oob.cpp
4 lines
realloc_oob_before.cpp
realloc_left_oob.cpp
4 lines
stack_array_oob_after.cpp
stack_array_right_oob.cpp
4 lines
stack_array_oob_before.cpp
stack_array_left_oob.cpp
4 lines
thread_stack_array_oob_after.cpp
thread_stack_array_right_oob.cpp
4 lines
thread_stack_array_oob_before.cpp
thread_stack_array_left_oob.cpp
4 lines
llvm/
include/
llvm/
Transforms/
Utils/
4 lines
lib/
Transforms/
Instrumentation/
7 lines
Utils/
4 lines
unittests/
Transforms/
Utils/
76 lines

Diff 459565

compiler-rt/lib/asan/asan_allocator.h

Show First 20 Lines • Show All 66 Lines • ▼ Show 20 Lines public:
AllocType GetAllocType() const; AllocType GetAllocType() const;
bool AddrIsInside(uptr addr, uptr access_size, sptr *offset) const { bool AddrIsInside(uptr addr, uptr access_size, sptr *offset) const {
if (addr >= Beg() && (addr + access_size) <= End()) { if (addr >= Beg() && (addr + access_size) <= End()) {
*offset = addr - Beg(); *offset = addr - Beg();
return true; return true;
} }
return false; return false;
} }
bool AddrIsAtLeft(uptr addr, uptr access_size, sptr *offset) const { bool AddrIsBefore(uptr addr, uptr access_size, sptr *offset) const {
(void)access_size; (void)access_size;
if (addr < Beg()) { if (addr < Beg()) {
*offset = Beg() - addr; *offset = Beg() - addr;
return true; return true;
} }
return false; return false;
} }
bool AddrIsAtRight(uptr addr, uptr access_size, sptr *offset) const { bool AddrIsAfter(uptr addr, uptr access_size, sptr *offset) const {
if (addr + access_size > End()) { if (addr + access_size > End()) {
*offset = addr - End(); *offset = addr - End();
return true; return true;
} }
return false; return false;
} }
private: private:
▲ Show 20 Lines • Show All 142 Lines • Show Last 20 Lines

compiler-rt/lib/asan/asan_allocator.cpp

Show First 20 Lines • Show All 62 Lines • ▼ Show 20 Linesstatic void AtomicContextLoad(const volatile atomic_uint64_t *atomic_context,
u32 &tid, u32 &stack) { u32 &tid, u32 &stack) {
u64 context = atomic_load(atomic_context, memory_order_relaxed); u64 context = atomic_load(atomic_context, memory_order_relaxed);
stack = context; stack = context;
context >>= 32; context >>= 32;
tid = context; tid = context;
} }
// The memory chunk allocated from the underlying allocator looks like this: // The memory chunk allocated from the underlying allocator looks like this:
// L L L L L L H H U U U U U U R R // F F F F F F H H U U U U U U B B
// L -- left redzone words (0 or more bytes) // F -- front redzone words (0 or more bytes)
// H -- ChunkHeader (16 bytes), which is also a part of the left redzone. // H -- ChunkHeader (16 bytes), which is also a part of the front redzone.
// U -- user memory. // U -- user memory.
// R -- right redzone (0 or more bytes) // B -- back redzone (0 or more bytes)
eugenisUnsubmitted
Done
ReplyInline Actions

I don't get this. Why P and S vs F and B?

eugenis: I don't get this. Why P and S vs F and B?
fmayerAuthorUnsubmitted
Done
ReplyInline Actions

if you were referring to the below, that was a mistake (it used to be preceding / succeeding but i think front / back is better. happy to revert back to that).

fmayer: if you were referring to the below, that was a mistake (it used to be preceding / succeeding…
// ChunkBase consists of ChunkHeader and other bytes that overlap with user // ChunkBase consists of ChunkHeader and other bytes that overlap with user
// memory. // memory.
// If the left redzone is greater than the ChunkHeader size we store a magic // If the front redzone is greater than the ChunkHeader size we store a
// value in the first uptr word of the memory block and store the address of // magic value in the first uptr word of the memory block and store the address
// ChunkBase in the next uptr. // of ChunkBase in the next uptr. M B F F F F F F F F F H H U U U U U U
// M B L L L L L L L L L H H U U U U U U
// | ^ // | ^
// ---------------------| // ---------------------|
// M -- magic value kAllocBegMagic // M -- magic value kAllocBegMagic
// B -- address of ChunkHeader pointing to the first 'H' // B -- address of ChunkHeader pointing to the first 'H'
class ChunkHeader { class ChunkHeader {
public: public:
atomic_uint8_t chunk_state; atomic_uint8_t chunk_state;
▲ Show 20 Lines • Show All 115 Lines • ▼ Show 20 Lines void Recycle(AsanChunk *m) {
u8 old_chunk_state = CHUNK_QUARANTINE; u8 old_chunk_state = CHUNK_QUARANTINE;
if (!atomic_compare_exchange_strong(&m->chunk_state, &old_chunk_state, if (!atomic_compare_exchange_strong(&m->chunk_state, &old_chunk_state,
CHUNK_INVALID, memory_order_acquire)) { CHUNK_INVALID, memory_order_acquire)) {
CHECK_EQ(old_chunk_state, CHUNK_QUARANTINE); CHECK_EQ(old_chunk_state, CHUNK_QUARANTINE);
} }
PoisonShadow(m->Beg(), RoundUpTo(m->UsedSize(), ASAN_SHADOW_GRANULARITY), PoisonShadow(m->Beg(), RoundUpTo(m->UsedSize(), ASAN_SHADOW_GRANULARITY),
kAsanHeapLeftRedzoneMagic); kAsanHeapFrontRedzoneMagic);
// Statistics. // Statistics.
AsanStats &thread_stats = GetCurrentThreadStats(); AsanStats &thread_stats = GetCurrentThreadStats();
thread_stats.real_frees++; thread_stats.real_frees++;
thread_stats.really_freed += m->UsedSize(); thread_stats.really_freed += m->UsedSize();
get_allocator().Deallocate(cache_, p); get_allocator().Deallocate(cache_, p);
} }
Show All 14 Lines private:
AllocatorCache* const cache_; AllocatorCache* const cache_;
BufferedStackTrace* const stack_; BufferedStackTrace* const stack_;
}; };
typedef Quarantine<QuarantineCallback, AsanChunk> AsanQuarantine; typedef Quarantine<QuarantineCallback, AsanChunk> AsanQuarantine;
typedef AsanQuarantine::Cache QuarantineCache; typedef AsanQuarantine::Cache QuarantineCache;
void AsanMapUnmapCallback::OnMap(uptr p, uptr size) const { void AsanMapUnmapCallback::OnMap(uptr p, uptr size) const {
PoisonShadow(p, size, kAsanHeapLeftRedzoneMagic); PoisonShadow(p, size, kAsanHeapFrontRedzoneMagic);
// Statistics. // Statistics.
AsanStats &thread_stats = GetCurrentThreadStats(); AsanStats &thread_stats = GetCurrentThreadStats();
thread_stats.mmaps++; thread_stats.mmaps++;
thread_stats.mmaped += size; thread_stats.mmaped += size;
} }
void AsanMapUnmapCallback::OnUnmap(uptr p, uptr size) const { void AsanMapUnmapCallback::OnUnmap(uptr p, uptr size) const {
PoisonShadow(p, size, 0); PoisonShadow(p, size, 0);
// We are about to unmap a chunk of user memory. // We are about to unmap a chunk of user memory.
▲ Show 20 Lines • Show All 96 Lines • ▼ Show 20 Lines void RePoisonChunk(uptr chunk) {
uptr allocated_size = allocator.GetActuallyAllocatedSize((void *)chunk); uptr allocated_size = allocator.GetActuallyAllocatedSize((void *)chunk);
if (ac && atomic_load(&ac->chunk_state, memory_order_acquire) == if (ac && atomic_load(&ac->chunk_state, memory_order_acquire) ==
CHUNK_ALLOCATED) { CHUNK_ALLOCATED) {
uptr beg = ac->Beg(); uptr beg = ac->Beg();
uptr end = ac->Beg() + ac->UsedSize(); uptr end = ac->Beg() + ac->UsedSize();
uptr chunk_end = chunk + allocated_size; uptr chunk_end = chunk + allocated_size;
if (chunk < beg && beg < end && end <= chunk_end) { if (chunk < beg && beg < end && end <= chunk_end) {
// Looks like a valid AsanChunk in use, poison redzones only. // Looks like a valid AsanChunk in use, poison redzones only.
PoisonShadow(chunk, beg - chunk, kAsanHeapLeftRedzoneMagic); PoisonShadow(chunk, beg - chunk, kAsanHeapFrontRedzoneMagic);
uptr end_aligned_down = RoundDownTo(end, ASAN_SHADOW_GRANULARITY); uptr end_aligned_down = RoundDownTo(end, ASAN_SHADOW_GRANULARITY);
FastPoisonShadowPartialRightRedzone( FastPoisonShadowPartialFrontRedzone(
end_aligned_down, end - end_aligned_down, end_aligned_down, end - end_aligned_down,
chunk_end - end_aligned_down, kAsanHeapLeftRedzoneMagic); chunk_end - end_aligned_down, kAsanHeapFrontRedzoneMagic);
return; return;
} }
} }
// This is either not an AsanChunk or freed or quarantined AsanChunk. // This is either not an AsanChunk or freed or quarantined AsanChunk.
// In either case, poison everything. // In either case, poison everything.
PoisonShadow(chunk, allocated_size, kAsanHeapLeftRedzoneMagic); PoisonShadow(chunk, allocated_size, kAsanHeapFrontRedzoneMagic);
} }
void ReInitialize(const AllocatorOptions &options) { void ReInitialize(const AllocatorOptions &options) {
SetAllocatorMayReturnNull(options.may_return_null); SetAllocatorMayReturnNull(options.may_return_null);
allocator.SetReleaseToOSIntervalMs(options.release_to_os_interval_ms); allocator.SetReleaseToOSIntervalMs(options.release_to_os_interval_ms);
SharedInitCode(options); SharedInitCode(options);
// Poison all existing allocation's redzones. // Poison all existing allocation's redzones.
▲ Show 20 Lines • Show All 45 Lines • ▼ Show 20 Linesstruct Allocator {
static uptr ComputeUserAlignment(uptr user_requested_alignment_log) { static uptr ComputeUserAlignment(uptr user_requested_alignment_log) {
if (user_requested_alignment_log == 0) if (user_requested_alignment_log == 0)
return 0; return 0;
return 1LL << (user_requested_alignment_log + 2); return 1LL << (user_requested_alignment_log + 2);
} }
// We have an address between two chunks, and we want to report just one. // We have an address between two chunks, and we want to report just one.
AsanChunk *ChooseChunk(uptr addr, AsanChunk *left_chunk, AsanChunk *ChooseChunk(uptr addr, AsanChunk *chunk_before,
AsanChunk *right_chunk) { AsanChunk *chunk_after) {
if (!left_chunk) if (!chunk_before)
return right_chunk; return chunk_after;
if (!right_chunk) if (!chunk_after)
return left_chunk; return chunk_before;
// Prefer an allocated chunk over freed chunk and freed chunk // Prefer an allocated chunk over freed chunk and freed chunk
// over available chunk. // over available chunk.
u8 left_state = atomic_load(&left_chunk->chunk_state, memory_order_relaxed); u8 state_before =
u8 right_state = atomic_load(&chunk_before->chunk_state, memory_order_relaxed);
atomic_load(&right_chunk->chunk_state, memory_order_relaxed); u8 state_after =
if (left_state != right_state) { atomic_load(&chunk_after->chunk_state, memory_order_relaxed);
if (left_state == CHUNK_ALLOCATED) if (state_before != state_after) {
return left_chunk; if (state_before == CHUNK_ALLOCATED)
eugenisUnsubmitted
Not Done
ReplyInline Actions

Not sure about this either. Before can be understood as in time or in space, while left and right are unambiguous, as soon as we agree on conceptual memory layout.

eugenis: Not sure about this either. Before can be understood as in time or in space, while left and…
if (right_state == CHUNK_ALLOCATED) return chunk_before;
return right_chunk; if (state_after == CHUNK_ALLOCATED)
if (left_state == CHUNK_QUARANTINE) return chunk_after;
return left_chunk; if (state_before == CHUNK_QUARANTINE)
if (right_state == CHUNK_QUARANTINE) return chunk_before;
return right_chunk; if (state_after == CHUNK_QUARANTINE)
return chunk_after;
} }
// Same chunk_state: choose based on offset. // Same chunk_state: choose based on offset.
sptr l_offset = 0, r_offset = 0; sptr l_offset = 0, r_offset = 0;
CHECK(AsanChunkView(left_chunk).AddrIsAtRight(addr, 1, &l_offset)); CHECK(AsanChunkView(chunk_before).AddrIsAfter(addr, 1, &l_offset));
CHECK(AsanChunkView(right_chunk).AddrIsAtLeft(addr, 1, &r_offset)); CHECK(AsanChunkView(chunk_after).AddrIsBefore(addr, 1, &r_offset));
if (l_offset < r_offset) if (l_offset < r_offset)
return left_chunk; return chunk_before;
return right_chunk; return chunk_after;
} }
bool UpdateAllocationStack(uptr addr, BufferedStackTrace *stack) { bool UpdateAllocationStack(uptr addr, BufferedStackTrace *stack) {
AsanChunk *m = GetAsanChunkByAddr(addr); AsanChunk *m = GetAsanChunkByAddr(addr);
if (!m) return false; if (!m) return false;
if (atomic_load(&m->chunk_state, memory_order_acquire) != CHUNK_ALLOCATED) if (atomic_load(&m->chunk_state, memory_order_acquire) != CHUNK_ALLOCATED)
return false; return false;
if (m->Beg() != addr) return false; if (m->Beg() != addr) return false;
Show All 31 Lines void *Allocate(uptr size, uptr alignment, BufferedStackTrace *stack,
CHECK(IsPowerOfTwo(alignment)); CHECK(IsPowerOfTwo(alignment));
uptr rz_log = ComputeRZLog(size); uptr rz_log = ComputeRZLog(size);
uptr rz_size = RZLog2Size(rz_log); uptr rz_size = RZLog2Size(rz_log);
uptr rounded_size = RoundUpTo(Max(size, kChunkHeader2Size), alignment); uptr rounded_size = RoundUpTo(Max(size, kChunkHeader2Size), alignment);
uptr needed_size = rounded_size + rz_size; uptr needed_size = rounded_size + rz_size;
if (alignment > min_alignment) if (alignment > min_alignment)
needed_size += alignment; needed_size += alignment;
// If we are allocating from the secondary allocator, there will be no // If we are allocating from the secondary allocator, there will be no
// automatic right redzone, so add the right redzone manually. // automatic back redzone, so add the back redzone manually.
if (!PrimaryAllocator::CanAllocate(needed_size, alignment)) if (!PrimaryAllocator::CanAllocate(needed_size, alignment))
needed_size += rz_size; needed_size += rz_size;
CHECK(IsAligned(needed_size, min_alignment)); CHECK(IsAligned(needed_size, min_alignment));
if (size > kMaxAllowedMallocSize || needed_size > kMaxAllowedMallocSize || if (size > kMaxAllowedMallocSize || needed_size > kMaxAllowedMallocSize ||
size > max_user_defined_malloc_size) { size > max_user_defined_malloc_size) {
if (AllocatorMayReturnNull()) { if (AllocatorMayReturnNull()) {
Report("WARNING: AddressSanitizer failed to allocate 0x%zx bytes\n", Report("WARNING: AddressSanitizer failed to allocate 0x%zx bytes\n",
size); size);
Show All 22 Lines void *Allocate(uptr size, uptr alignment, BufferedStackTrace *stack,
} }
if (*(u8 *)MEM_TO_SHADOW((uptr)allocated) == 0 && CanPoisonMemory()) { if (*(u8 *)MEM_TO_SHADOW((uptr)allocated) == 0 && CanPoisonMemory()) {
// Heap poisoning is enabled, but the allocator provides an unpoisoned // Heap poisoning is enabled, but the allocator provides an unpoisoned
// chunk. This is possible if CanPoisonMemory() was false for some // chunk. This is possible if CanPoisonMemory() was false for some
// time, for example, due to flags()->start_disabled. // time, for example, due to flags()->start_disabled.
// Anyway, poison the block before using it for anything else. // Anyway, poison the block before using it for anything else.
uptr allocated_size = allocator.GetActuallyAllocatedSize(allocated); uptr allocated_size = allocator.GetActuallyAllocatedSize(allocated);
PoisonShadow((uptr)allocated, allocated_size, kAsanHeapLeftRedzoneMagic); PoisonShadow((uptr)allocated, allocated_size,
kAsanHeapFrontRedzoneMagic);
} }
uptr alloc_beg = reinterpret_cast<uptr>(allocated); uptr alloc_beg = reinterpret_cast<uptr>(allocated);
uptr alloc_end = alloc_beg + needed_size; uptr alloc_end = alloc_beg + needed_size;
uptr user_beg = alloc_beg + rz_size; uptr user_beg = alloc_beg + rz_size;
if (!IsAligned(user_beg, alignment)) if (!IsAligned(user_beg, alignment))
user_beg = RoundUpTo(user_beg, alignment); user_beg = RoundUpTo(user_beg, alignment);
uptr user_end = user_beg + size; uptr user_end = user_beg + size;
▲ Show 20 Lines • Show All 242 Lines • ▼ Show 20 Lines if (atomic_load(&m->chunk_state, memory_order_acquire) != CHUNK_ALLOCATED)
return 0; return 0;
if (m->Beg() != p) return 0; if (m->Beg() != p) return 0;
return m->UsedSize(); return m->UsedSize();
} }
AsanChunkView FindHeapChunkByAddress(uptr addr) { AsanChunkView FindHeapChunkByAddress(uptr addr) {
AsanChunk *m1 = GetAsanChunkByAddr(addr); AsanChunk *m1 = GetAsanChunkByAddr(addr);
sptr offset = 0; sptr offset = 0;
if (!m1 || AsanChunkView(m1).AddrIsAtLeft(addr, 1, &offset)) { if (!m1 || AsanChunkView(m1).AddrIsBefore(addr, 1, &offset)) {
// The address is in the chunk's left redzone, so maybe it is actually // The address is in the chunk's front redzone, so maybe it is
// a right buffer overflow from the other chunk before. // actually a buffer overflow from another chunk before. Search a bit
// Search a bit before to see if there is another chunk. // before to see if there is another chunk.
AsanChunk *m2 = nullptr; AsanChunk *m2 = nullptr;
for (uptr l = 1; l < GetPageSizeCached(); l++) { for (uptr l = 1; l < GetPageSizeCached(); l++) {
m2 = GetAsanChunkByAddr(addr - l); m2 = GetAsanChunkByAddr(addr - l);
if (m2 == m1) continue; // Still the same chunk. if (m2 == m1) continue; // Still the same chunk.
break; break;
} }
if (m2 && AsanChunkView(m2).AddrIsAtRight(addr, 1, &offset)) if (m2 && AsanChunkView(m2).AddrIsAfter(addr, 1, &offset))
m1 = ChooseChunk(addr, m2, m1); m1 = ChooseChunk(addr, m2, m1);
} }
return AsanChunkView(m1); return AsanChunkView(m1);
} }
void Purge(BufferedStackTrace *stack) { void Purge(BufferedStackTrace *stack) {
AsanThread *t = GetCurrentThread(); AsanThread *t = GetCurrentThread();
if (t) { if (t) {
▲ Show 20 Lines • Show All 397 Lines • Show Last 20 Lines

compiler-rt/lib/asan/asan_descriptions.h

Show First 20 Lines • Show All 43 Lines • ▼ Show 20 Lines
public: public:
Decorator() : SanitizerCommonDecorator() {} Decorator() : SanitizerCommonDecorator() {}
const char *Access() { return Blue(); } const char *Access() { return Blue(); }
const char *Location() { return Green(); } const char *Location() { return Green(); }
const char *Allocation() { return Magenta(); } const char *Allocation() { return Magenta(); }
const char *ShadowByte(u8 byte) { const char *ShadowByte(u8 byte) {
switch (byte) { switch (byte) {
case kAsanHeapLeftRedzoneMagic: case kAsanHeapFrontRedzoneMagic:
case kAsanArrayCookieMagic: case kAsanArrayCookieMagic:
return Red(); return Red();
case kAsanHeapFreeMagic: case kAsanHeapFreeMagic:
return Magenta(); return Magenta();
case kAsanStackLeftRedzoneMagic: case kAsanStackFrontRedzoneMagic:
case kAsanStackMidRedzoneMagic: case kAsanStackMidRedzoneMagic:
case kAsanStackRightRedzoneMagic: case kAsanStackBackRedzoneMagic:
return Red(); return Red();
case kAsanStackAfterReturnMagic: case kAsanStackAfterReturnMagic:
return Magenta(); return Magenta();
case kAsanInitializationOrderMagic: case kAsanInitializationOrderMagic:
return Cyan(); return Cyan();
case kAsanUserPoisonedMemoryMagic: case kAsanUserPoisonedMemoryMagic:
case kAsanContiguousContainerOOBMagic: case kAsanContiguousContainerOOBMagic:
case kAsanAllocaLeftMagic: case kAsanAllocaFrontMagic:
case kAsanAllocaRightMagic: case kAsanAllocaBackMagic:
return Blue(); return Blue();
case kAsanStackUseAfterScopeMagic: case kAsanStackUseAfterScopeMagic:
return Magenta(); return Magenta();
case kAsanGlobalRedzoneMagic: case kAsanGlobalRedzoneMagic:
return Red(); return Red();
case kAsanInternalHeapMagic: case kAsanInternalHeapMagic:
return Yellow(); return Yellow();
case kAsanIntraObjectRedzone: case kAsanIntraObjectRedzone:
Show All 19 Linesstruct ShadowAddressDescription {
void Print() const; void Print() const;
}; };
bool GetShadowAddressInformation(uptr addr, ShadowAddressDescription *descr); bool GetShadowAddressInformation(uptr addr, ShadowAddressDescription *descr);
bool DescribeAddressIfShadow(uptr addr); bool DescribeAddressIfShadow(uptr addr);
enum AccessType { enum AccessType {
kAccessTypeLeft, kAccessTypeBefore,
kAccessTypeRight, kAccessTypeAfter,
kAccessTypeInside, kAccessTypeInside,
kAccessTypeUnknown, // This means we have an AddressSanitizer bug! kAccessTypeUnknown, // This means we have an AddressSanitizer bug!
}; };
struct ChunkAccess { struct ChunkAccess {
uptr bad_addr; uptr bad_addr;
sptr offset; sptr offset;
uptr chunk_begin; uptr chunk_begin;
▲ Show 20 Lines • Show All 156 Lines • Show Last 20 Lines

compiler-rt/lib/asan/asan_descriptions.cpp

Show First 20 Lines • Show All 98 Lines • ▼ Show 20 Linesbool GetShadowAddressInformation(uptr addr, ShadowAddressDescription *descr) {
return true; return true;
} }
// Heap descriptions // Heap descriptions
static void GetAccessToHeapChunkInformation(ChunkAccess *descr, static void GetAccessToHeapChunkInformation(ChunkAccess *descr,
AsanChunkView chunk, uptr addr, AsanChunkView chunk, uptr addr,
uptr access_size) { uptr access_size) {
descr->bad_addr = addr; descr->bad_addr = addr;
if (chunk.AddrIsAtLeft(addr, access_size, &descr->offset)) { if (chunk.AddrIsBefore(addr, access_size, &descr->offset)) {
descr->access_type = kAccessTypeLeft; descr->access_type = kAccessTypeBefore;
} else if (chunk.AddrIsAtRight(addr, access_size, &descr->offset)) { } else if (chunk.AddrIsAfter(addr, access_size, &descr->offset)) {
descr->access_type = kAccessTypeRight; descr->access_type = kAccessTypeAfter;
if (descr->offset < 0) { if (descr->offset < 0) {
descr->bad_addr -= descr->offset; descr->bad_addr -= descr->offset;
descr->offset = 0; descr->offset = 0;
} }
} else if (chunk.AddrIsInside(addr, access_size, &descr->offset)) { } else if (chunk.AddrIsInside(addr, access_size, &descr->offset)) {
descr->access_type = kAccessTypeInside; descr->access_type = kAccessTypeInside;
} else { } else {
descr->access_type = kAccessTypeUnknown; descr->access_type = kAccessTypeUnknown;
} }
descr->chunk_begin = chunk.Beg(); descr->chunk_begin = chunk.Beg();
descr->chunk_size = chunk.UsedSize(); descr->chunk_size = chunk.UsedSize();
descr->user_requested_alignment = chunk.UserRequestedAlignment(); descr->user_requested_alignment = chunk.UserRequestedAlignment();
descr->alloc_type = chunk.GetAllocType(); descr->alloc_type = chunk.GetAllocType();
} }
static void PrintHeapChunkAccess(uptr addr, const ChunkAccess &descr) { static void PrintHeapChunkAccess(uptr addr, const ChunkAccess &descr) {
Decorator d; Decorator d;
InternalScopedString str; InternalScopedString str;
str.append("%s", d.Location()); str.append("%s", d.Location());
switch (descr.access_type) { switch (descr.access_type) {
case kAccessTypeLeft: case kAccessTypeBefore:
str.append("%p is located %zd bytes before", str.append("%p is located %zd bytes before",
(void *)descr.bad_addr, descr.offset); (void *)descr.bad_addr, descr.offset);
break; break;
case kAccessTypeRight: case kAccessTypeAfter:
str.append("%p is located %zd bytes after", str.append("%p is located %zd bytes after",
(void *)descr.bad_addr, descr.offset); (void *)descr.bad_addr, descr.offset);
break; break;
case kAccessTypeInside: case kAccessTypeInside:
str.append("%p is located %zd bytes inside of", (void *)descr.bad_addr, str.append("%p is located %zd bytes inside of", (void *)descr.bad_addr,
descr.offset); descr.offset);
break; break;
case kAccessTypeUnknown: case kAccessTypeUnknown:
▲ Show 20 Lines • Show All 364 Lines • Show Last 20 Lines

compiler-rt/lib/asan/asan_errors.cpp

Show First 20 Lines • Show All 404 Lines • ▼ Show 20 Lines if (access_size) {
// Determine the error type. // Determine the error type.
bug_descr = "unknown-crash"; bug_descr = "unknown-crash";
if (AddrIsInMem(addr)) { if (AddrIsInMem(addr)) {
u8 *shadow_addr = (u8 *)MemToShadow(addr); u8 *shadow_addr = (u8 *)MemToShadow(addr);
// If we are accessing 16 bytes, look at the second shadow byte. // If we are accessing 16 bytes, look at the second shadow byte.
if (*shadow_addr == 0 && access_size > ASAN_SHADOW_GRANULARITY) if (*shadow_addr == 0 && access_size > ASAN_SHADOW_GRANULARITY)
shadow_addr++; shadow_addr++;
// If we are in the partial right redzone, look at the next shadow byte. // If we are in the partial front redzone, look at the next shadow byte.
if (*shadow_addr > 0 && *shadow_addr < 128) shadow_addr++; if (*shadow_addr > 0 && *shadow_addr < 128) shadow_addr++;
bool far_from_bounds = false; bool far_from_bounds = false;
shadow_val = *shadow_addr; shadow_val = *shadow_addr;
int bug_type_score = 0; int bug_type_score = 0;
// For use-after-frees reads are almost as bad as writes. // For use-after-frees reads are almost as bad as writes.
int read_after_free_bonus = 0; int read_after_free_bonus = 0;
switch (shadow_val) { switch (shadow_val) {
case kAsanHeapLeftRedzoneMagic: case kAsanHeapFrontRedzoneMagic:
case kAsanArrayCookieMagic: case kAsanArrayCookieMagic:
bug_descr = "heap-buffer-overflow"; bug_descr = "heap-buffer-overflow";
bug_type_score = 10; bug_type_score = 10;
far_from_bounds = AdjacentShadowValuesAreFullyPoisoned(shadow_addr); far_from_bounds = AdjacentShadowValuesAreFullyPoisoned(shadow_addr);
break; break;
case kAsanHeapFreeMagic: case kAsanHeapFreeMagic:
bug_descr = "heap-use-after-free"; bug_descr = "heap-use-after-free";
bug_type_score = 20; bug_type_score = 20;
if (!is_write) read_after_free_bonus = 18; if (!is_write) read_after_free_bonus = 18;
break; break;
case kAsanStackLeftRedzoneMagic: case kAsanStackFrontRedzoneMagic:
bug_descr = "stack-buffer-underflow"; bug_descr = "stack-buffer-underflow";
bug_type_score = 25; bug_type_score = 25;
far_from_bounds = AdjacentShadowValuesAreFullyPoisoned(shadow_addr); far_from_bounds = AdjacentShadowValuesAreFullyPoisoned(shadow_addr);
break; break;
case kAsanInitializationOrderMagic: case kAsanInitializationOrderMagic:
bug_descr = "initialization-order-fiasco"; bug_descr = "initialization-order-fiasco";
bug_type_score = 1; bug_type_score = 1;
break; break;
case kAsanStackMidRedzoneMagic: case kAsanStackMidRedzoneMagic:
case kAsanStackRightRedzoneMagic: case kAsanStackBackRedzoneMagic:
bug_descr = "stack-buffer-overflow"; bug_descr = "stack-buffer-overflow";
bug_type_score = 25; bug_type_score = 25;
far_from_bounds = AdjacentShadowValuesAreFullyPoisoned(shadow_addr); far_from_bounds = AdjacentShadowValuesAreFullyPoisoned(shadow_addr);
break; break;
case kAsanStackAfterReturnMagic: case kAsanStackAfterReturnMagic:
bug_descr = "stack-use-after-return"; bug_descr = "stack-use-after-return";
bug_type_score = 30; bug_type_score = 30;
if (!is_write) read_after_free_bonus = 18; if (!is_write) read_after_free_bonus = 18;
Show All 14 Lines if (AddrIsInMem(addr)) {
bug_descr = "global-buffer-overflow"; bug_descr = "global-buffer-overflow";
bug_type_score = 10; bug_type_score = 10;
far_from_bounds = AdjacentShadowValuesAreFullyPoisoned(shadow_addr); far_from_bounds = AdjacentShadowValuesAreFullyPoisoned(shadow_addr);
break; break;
case kAsanIntraObjectRedzone: case kAsanIntraObjectRedzone:
bug_descr = "intra-object-overflow"; bug_descr = "intra-object-overflow";
bug_type_score = 10; bug_type_score = 10;
break; break;
case kAsanAllocaLeftMagic: case kAsanAllocaFrontMagic:
case kAsanAllocaRightMagic: case kAsanAllocaBackMagic:
bug_descr = "dynamic-stack-buffer-overflow"; bug_descr = "dynamic-stack-buffer-overflow";
bug_type_score = 25; bug_type_score = 25;
far_from_bounds = AdjacentShadowValuesAreFullyPoisoned(shadow_addr); far_from_bounds = AdjacentShadowValuesAreFullyPoisoned(shadow_addr);
break; break;
} }
scariness.Scare(bug_type_score + read_after_free_bonus, bug_descr); scariness.Scare(bug_type_score + read_after_free_bonus, bug_descr);
if (far_from_bounds) scariness.Scare(10, "far-from-bounds"); if (far_from_bounds) scariness.Scare(10, "far-from-bounds");
} }
Show All 18 Lines str->append(
"Shadow byte legend (one shadow byte represents %d " "Shadow byte legend (one shadow byte represents %d "
"application bytes):\n", "application bytes):\n",
(int)ASAN_SHADOW_GRANULARITY); (int)ASAN_SHADOW_GRANULARITY);
PrintShadowByte(str, " Addressable: ", 0); PrintShadowByte(str, " Addressable: ", 0);
str->append(" Partially addressable: "); str->append(" Partially addressable: ");
for (u8 i = 1; i < ASAN_SHADOW_GRANULARITY; i++) for (u8 i = 1; i < ASAN_SHADOW_GRANULARITY; i++)
PrintShadowByte(str, "", i, " "); PrintShadowByte(str, "", i, " ");
str->append("\n"); str->append("\n");
PrintShadowByte(str, " Heap left redzone: ", PrintShadowByte(str, " Heap front redzone: ", kAsanHeapFrontRedzoneMagic);
kAsanHeapLeftRedzoneMagic);
PrintShadowByte(str, " Freed heap region: ", kAsanHeapFreeMagic); PrintShadowByte(str, " Freed heap region: ", kAsanHeapFreeMagic);
PrintShadowByte(str, " Stack left redzone: ", PrintShadowByte(str, " Stack front redzone: ", kAsanStackFrontRedzoneMagic);
kAsanStackLeftRedzoneMagic);
PrintShadowByte(str, " Stack mid redzone: ", PrintShadowByte(str, " Stack mid redzone: ",
kAsanStackMidRedzoneMagic); kAsanStackMidRedzoneMagic);
PrintShadowByte(str, " Stack right redzone: ", PrintShadowByte(str, " Stack back redzone: ", kAsanStackBackRedzoneMagic);
kAsanStackRightRedzoneMagic);
PrintShadowByte(str, " Stack after return: ", PrintShadowByte(str, " Stack after return: ",
kAsanStackAfterReturnMagic); kAsanStackAfterReturnMagic);
PrintShadowByte(str, " Stack use after scope: ", PrintShadowByte(str, " Stack use after scope: ",
kAsanStackUseAfterScopeMagic); kAsanStackUseAfterScopeMagic);
PrintShadowByte(str, " Global redzone: ", kAsanGlobalRedzoneMagic); PrintShadowByte(str, " Global redzone: ", kAsanGlobalRedzoneMagic);
PrintShadowByte(str, " Global init order: ", PrintShadowByte(str, " Global init order: ",
kAsanInitializationOrderMagic); kAsanInitializationOrderMagic);
PrintShadowByte(str, " Poisoned by user: ", PrintShadowByte(str, " Poisoned by user: ",
kAsanUserPoisonedMemoryMagic); kAsanUserPoisonedMemoryMagic);
PrintShadowByte(str, " Container overflow: ", PrintShadowByte(str, " Container overflow: ",
kAsanContiguousContainerOOBMagic); kAsanContiguousContainerOOBMagic);
PrintShadowByte(str, " Array cookie: ", PrintShadowByte(str, " Array cookie: ",
kAsanArrayCookieMagic); kAsanArrayCookieMagic);
PrintShadowByte(str, " Intra object redzone: ", PrintShadowByte(str, " Intra object redzone: ",
kAsanIntraObjectRedzone); kAsanIntraObjectRedzone);
PrintShadowByte(str, " ASan internal: ", kAsanInternalHeapMagic); PrintShadowByte(str, " ASan internal: ", kAsanInternalHeapMagic);
PrintShadowByte(str, " Left alloca redzone: ", kAsanAllocaLeftMagic); PrintShadowByte(str, " Front alloca redzone: ", kAsanAllocaFrontMagic);
PrintShadowByte(str, " Right alloca redzone: ", kAsanAllocaRightMagic); PrintShadowByte(str, " Back alloca redzone: ", kAsanAllocaBackMagic);
} }
static void PrintShadowBytes(InternalScopedString *str, const char *before, static void PrintShadowBytes(InternalScopedString *str, const char *before,
u8 *bytes, u8 *guilty, uptr n) { u8 *bytes, u8 *guilty, uptr n) {
Decorator d; Decorator d;
if (before) if (before)
str->append("%s%p:", before, str->append("%s%p:", before,
(void *)ShadowToMem(reinterpret_cast<uptr>(bytes))); (void *)ShadowToMem(reinterpret_cast<uptr>(bytes)));
▲ Show 20 Lines • Show All 57 Lines • Show Last 20 Lines

compiler-rt/lib/asan/asan_fake_stack.h

Show First 20 Lines • Show All 134 Lines • ▼ Show 20 Lines USED uptr AddrIsInFakeStack(uptr addr) {
return AddrIsInFakeStack(addr, &t1, &t2); return AddrIsInFakeStack(addr, &t1, &t2);
} }
// Number of bytes in a fake frame of this size class. // Number of bytes in a fake frame of this size class.
static uptr BytesInSizeClass(uptr class_id) { static uptr BytesInSizeClass(uptr class_id) {
return ((uptr)1) << (class_id + kMinStackFrameSizeLog); return ((uptr)1) << (class_id + kMinStackFrameSizeLog);
} }
// The fake frame is guaranteed to have a right redzone. // The fake frame is guaranteed to have a back redzone.
// We use the last word of that redzone to store the address of the flag // We use the last word of that redzone to store the address of the flag
// that corresponds to the current frame to make faster deallocation. // that corresponds to the current frame to make faster deallocation.
static u8 **SavedFlagPtr(uptr x, uptr class_id) { static u8 **SavedFlagPtr(uptr x, uptr class_id) {
return reinterpret_cast<u8 **>(x + BytesInSizeClass(class_id) - sizeof(x)); return reinterpret_cast<u8 **>(x + BytesInSizeClass(class_id) - sizeof(x));
} }
uptr stack_size_log() const { return stack_size_log_; } uptr stack_size_log() const { return stack_size_log_; }
Show All 24 Lines

compiler-rt/lib/asan/asan_fake_stack.cpp

Show First 20 Lines • Show All 283 Lines • ▼ Show 20 Lines if (frame->magic != kCurrentStackFrameMagic)
return nullptr; return nullptr;
if (beg) *beg = reinterpret_cast<void*>(frame_beg); if (beg) *beg = reinterpret_cast<void*>(frame_beg);
if (end) *end = reinterpret_cast<void*>(frame_end); if (end) *end = reinterpret_cast<void*>(frame_end);
return reinterpret_cast<void*>(frame->real_stack); return reinterpret_cast<void*>(frame->real_stack);
} }
SANITIZER_INTERFACE_ATTRIBUTE SANITIZER_INTERFACE_ATTRIBUTE
void __asan_alloca_poison(uptr addr, uptr size) { void __asan_alloca_poison(uptr addr, uptr size) {
uptr LeftRedzoneAddr = addr - kAllocaRedzoneSize; uptr FrontRedzoneAddr = addr - kAllocaRedzoneSize;
uptr PartialRzAddr = addr + size; uptr PartialRzAddr = addr + size;
uptr RightRzAddr = (PartialRzAddr + kAllocaRedzoneMask) & ~kAllocaRedzoneMask; uptr RightRzAddr = (PartialRzAddr + kAllocaRedzoneMask) & ~kAllocaRedzoneMask;
uptr PartialRzAligned = PartialRzAddr & ~(ASAN_SHADOW_GRANULARITY - 1); uptr PartialRzAligned = PartialRzAddr & ~(ASAN_SHADOW_GRANULARITY - 1);
FastPoisonShadow(LeftRedzoneAddr, kAllocaRedzoneSize, kAsanAllocaLeftMagic); FastPoisonShadow(FrontRedzoneAddr, kAllocaRedzoneSize,
FastPoisonShadowPartialRightRedzone( kAsanAllocaFrontMagic);
FastPoisonShadowPartialFrontRedzone(
PartialRzAligned, PartialRzAddr % ASAN_SHADOW_GRANULARITY, PartialRzAligned, PartialRzAddr % ASAN_SHADOW_GRANULARITY,
RightRzAddr - PartialRzAligned, kAsanAllocaRightMagic); RightRzAddr - PartialRzAligned, kAsanAllocaBackMagic);
FastPoisonShadow(RightRzAddr, kAllocaRedzoneSize, kAsanAllocaRightMagic); FastPoisonShadow(RightRzAddr, kAllocaRedzoneSize, kAsanAllocaBackMagic);
} }
SANITIZER_INTERFACE_ATTRIBUTE SANITIZER_INTERFACE_ATTRIBUTE
void __asan_allocas_unpoison(uptr top, uptr bottom) { void __asan_allocas_unpoison(uptr top, uptr bottom) {
if ((!top) || (top > bottom)) return; if ((!top) || (top > bottom)) return;
REAL(memset) REAL(memset)
(reinterpret_cast<void *>(MemToShadow(top)), 0, (reinterpret_cast<void *>(MemToShadow(top)), 0,
(bottom - top) / ASAN_SHADOW_GRANULARITY); (bottom - top) / ASAN_SHADOW_GRANULARITY);
} }
} // extern "C" } // extern "C"

compiler-rt/lib/asan/asan_globals.cpp

Show First 20 Lines • Show All 59 Lines • ▼ Show 20 LinesALWAYS_INLINE void PoisonShadowForGlobal(const Global *g, u8 value) {
FastPoisonShadow(g->beg, g->size_with_redzone, value); FastPoisonShadow(g->beg, g->size_with_redzone, value);
} }
ALWAYS_INLINE void PoisonRedZones(const Global &g) { ALWAYS_INLINE void PoisonRedZones(const Global &g) {
uptr aligned_size = RoundUpTo(g.size, ASAN_SHADOW_GRANULARITY); uptr aligned_size = RoundUpTo(g.size, ASAN_SHADOW_GRANULARITY);
FastPoisonShadow(g.beg + aligned_size, g.size_with_redzone - aligned_size, FastPoisonShadow(g.beg + aligned_size, g.size_with_redzone - aligned_size,
kAsanGlobalRedzoneMagic); kAsanGlobalRedzoneMagic);
if (g.size != aligned_size) { if (g.size != aligned_size) {
FastPoisonShadowPartialRightRedzone( FastPoisonShadowPartialFrontRedzone(
g.beg + RoundDownTo(g.size, ASAN_SHADOW_GRANULARITY), g.beg + RoundDownTo(g.size, ASAN_SHADOW_GRANULARITY),
g.size % ASAN_SHADOW_GRANULARITY, ASAN_SHADOW_GRANULARITY, g.size % ASAN_SHADOW_GRANULARITY, ASAN_SHADOW_GRANULARITY,
kAsanGlobalRedzoneMagic); kAsanGlobalRedzoneMagic);
} }
} }
const uptr kMinimalDistanceFromAnotherGlobal = 64; const uptr kMinimalDistanceFromAnotherGlobal = 64;
▲ Show 20 Lines • Show All 384 Lines • Show Last 20 Lines

compiler-rt/lib/asan/asan_internal.h

Show First 20 Lines • Show All 131 Lines • ▼ Show 20 Lines
extern int asan_inited; extern int asan_inited;
// Used to avoid infinite recursion in __asan_init(). // Used to avoid infinite recursion in __asan_init().
extern bool asan_init_is_running; extern bool asan_init_is_running;
extern bool replace_intrin_cached; extern bool replace_intrin_cached;
extern void (*death_callback)(void); extern void (*death_callback)(void);
// These magic values are written to shadow for better error // These magic values are written to shadow for better error
// reporting. // reporting.
const int kAsanHeapLeftRedzoneMagic = 0xfa; const int kAsanHeapFrontRedzoneMagic = 0xfa;
const int kAsanHeapFreeMagic = 0xfd; const int kAsanHeapFreeMagic = 0xfd;
const int kAsanStackLeftRedzoneMagic = 0xf1; const int kAsanStackFrontRedzoneMagic = 0xf1;
const int kAsanStackMidRedzoneMagic = 0xf2; const int kAsanStackMidRedzoneMagic = 0xf2;
const int kAsanStackRightRedzoneMagic = 0xf3; const int kAsanStackBackRedzoneMagic = 0xf3;
const int kAsanStackAfterReturnMagic = 0xf5; const int kAsanStackAfterReturnMagic = 0xf5;
const int kAsanInitializationOrderMagic = 0xf6; const int kAsanInitializationOrderMagic = 0xf6;
const int kAsanUserPoisonedMemoryMagic = 0xf7; const int kAsanUserPoisonedMemoryMagic = 0xf7;
const int kAsanContiguousContainerOOBMagic = 0xfc; const int kAsanContiguousContainerOOBMagic = 0xfc;
const int kAsanStackUseAfterScopeMagic = 0xf8; const int kAsanStackUseAfterScopeMagic = 0xf8;
const int kAsanGlobalRedzoneMagic = 0xf9; const int kAsanGlobalRedzoneMagic = 0xf9;
const int kAsanInternalHeapMagic = 0xfe; const int kAsanInternalHeapMagic = 0xfe;
const int kAsanArrayCookieMagic = 0xac; const int kAsanArrayCookieMagic = 0xac;
const int kAsanIntraObjectRedzone = 0xbb; const int kAsanIntraObjectRedzone = 0xbb;
const int kAsanAllocaLeftMagic = 0xca; const int kAsanAllocaFrontMagic = 0xca;
const int kAsanAllocaRightMagic = 0xcb; const int kAsanAllocaBackMagic = 0xcb;
static const uptr kCurrentStackFrameMagic = 0x41B58AB3; static const uptr kCurrentStackFrameMagic = 0x41B58AB3;
static const uptr kRetiredStackFrameMagic = 0x45E0360E; static const uptr kRetiredStackFrameMagic = 0x45E0360E;
} // namespace __asan } // namespace __asan
#endif // ASAN_INTERNAL_H #endif // ASAN_INTERNAL_H

compiler-rt/lib/asan/asan_mapping_sparc64.h

Show All 31 Lines
#define kLowMemBeg 0 #define kLowMemBeg 0
#define kLowMemEnd (ASAN_SHADOW_OFFSET - 1) #define kLowMemEnd (ASAN_SHADOW_OFFSET - 1)
#define kLowShadowBeg ASAN_SHADOW_OFFSET #define kLowShadowBeg ASAN_SHADOW_OFFSET
#define kLowShadowEnd MEM_TO_SHADOW(kLowMemEnd) #define kLowShadowEnd MEM_TO_SHADOW(kLowMemEnd)
// But of course there is the huge hole between the high shadow memory, // But of course there is the huge hole between the high shadow memory,
// which is in the low part, and the beginning of the high part. // whichs in the low part, and the beginning of the high part.
#define kHighMemBeg (-(1ULL << (VMA_BITS - 1))) #define kHighMemBeg (-(1ULL << (VMA_BITS - 1)))
#define kHighShadowBeg MEM_TO_SHADOW(kHighMemBeg) #define kHighShadowBeg MEM_TO_SHADOW(kHighMemBeg)
#define kHighShadowEnd MEM_TO_SHADOW(kHighMemEnd) #define kHighShadowEnd MEM_TO_SHADOW(kHighMemEnd)
#define kMidShadowBeg 0 #define kMidShadowBeg 0
#define kMidShadowEnd 0 #define kMidShadowEnd 0
▲ Show 20 Lines • Show All 73 Lines • Show Last 20 Lines

compiler-rt/lib/asan/asan_poisoning.h

Show All 22 Lines
void SetCanPoisonMemory(bool value); void SetCanPoisonMemory(bool value);
bool CanPoisonMemory(); bool CanPoisonMemory();
// Poisons the shadow memory for "size" bytes starting from "addr". // Poisons the shadow memory for "size" bytes starting from "addr".
void PoisonShadow(uptr addr, uptr size, u8 value); void PoisonShadow(uptr addr, uptr size, u8 value);
// Poisons the shadow memory for "redzone_size" bytes starting from // Poisons the shadow memory for "redzone_size" bytes starting from
// "addr + size". // "addr + size".
void PoisonShadowPartialRightRedzone(uptr addr, void PoisonShadowPartialBackRedzone(uptr addr, uptr size,
uptr size, uptr redzone_size, u8 value);
uptr redzone_size,
u8 value);
// Fast versions of PoisonShadow and PoisonShadowPartialRightRedzone that // Fast versions of PoisonShadow and PoisonShadowPartialBackRedzone that
// assume that memory addresses are properly aligned. Use in // assume that memory addresses are properly aligned. Use in
// performance-critical code with care. // performance-critical code with care.
ALWAYS_INLINE void FastPoisonShadow(uptr aligned_beg, uptr aligned_size, ALWAYS_INLINE void FastPoisonShadow(uptr aligned_beg, uptr aligned_size,
u8 value) { u8 value) {
DCHECK(!value || CanPoisonMemory()); DCHECK(!value || CanPoisonMemory());
#if SANITIZER_FUCHSIA #if SANITIZER_FUCHSIA
__sanitizer_fill_shadow(aligned_beg, aligned_size, value, __sanitizer_fill_shadow(aligned_beg, aligned_size, value,
common_flags()->clear_shadow_mmap_threshold); common_flags()->clear_shadow_mmap_threshold);
Show All 23 Lines if (page_beg >= page_end) {
REAL(memset)((void *)page_end, 0, shadow_end - page_end); REAL(memset)((void *)page_end, 0, shadow_end - page_end);
} }
ReserveShadowMemoryRange(page_beg, page_end - 1, nullptr); ReserveShadowMemoryRange(page_beg, page_end - 1, nullptr);
} }
} }
#endif // SANITIZER_FUCHSIA #endif // SANITIZER_FUCHSIA
} }
ALWAYS_INLINE void FastPoisonShadowPartialRightRedzone( ALWAYS_INLINE void FastPoisonShadowPartialFrontRedzone(uptr aligned_addr,
uptr aligned_addr, uptr size, uptr redzone_size, u8 value) { uptr size,
uptr redzone_size,
u8 value) {
DCHECK(CanPoisonMemory()); DCHECK(CanPoisonMemory());
bool poison_partial = flags()->poison_partial; bool poison_partial = flags()->poison_partial;
u8 *shadow = (u8*)MEM_TO_SHADOW(aligned_addr); u8 *shadow = (u8*)MEM_TO_SHADOW(aligned_addr);
for (uptr i = 0; i < redzone_size; i += ASAN_SHADOW_GRANULARITY, shadow++) { for (uptr i = 0; i < redzone_size; i += ASAN_SHADOW_GRANULARITY, shadow++) {
if (i + ASAN_SHADOW_GRANULARITY <= size) { if (i + ASAN_SHADOW_GRANULARITY <= size) {
*shadow = 0; // fully addressable *shadow = 0; // fully addressable
} else if (i >= size) { } else if (i >= size) {
*shadow = *shadow =
Show All 13 Lines

compiler-rt/lib/asan/asan_poisoning.cpp

Show All 36 Linesvoid PoisonShadow(uptr addr, uptr size, u8 value) {
CHECK(AddrIsAlignedByGranularity(addr)); CHECK(AddrIsAlignedByGranularity(addr));
CHECK(AddrIsInMem(addr)); CHECK(AddrIsInMem(addr));
CHECK(AddrIsAlignedByGranularity(addr + size)); CHECK(AddrIsAlignedByGranularity(addr + size));
CHECK(AddrIsInMem(addr + size - ASAN_SHADOW_GRANULARITY)); CHECK(AddrIsInMem(addr + size - ASAN_SHADOW_GRANULARITY));
CHECK(REAL(memset)); CHECK(REAL(memset));
FastPoisonShadow(addr, size, value); FastPoisonShadow(addr, size, value);
} }
void PoisonShadowPartialRightRedzone(uptr addr, void PoisonShadowPartialBackRedzone(uptr addr, uptr size,
uptr size, uptr redzone_size, u8 value) {
uptr redzone_size,
u8 value) {
if (!CanPoisonMemory()) return; if (!CanPoisonMemory()) return;
CHECK(AddrIsAlignedByGranularity(addr)); CHECK(AddrIsAlignedByGranularity(addr));
CHECK(AddrIsInMem(addr)); CHECK(AddrIsInMem(addr));
FastPoisonShadowPartialRightRedzone(addr, size, redzone_size, value); FastPoisonShadowPartialFrontRedzone(addr, size, redzone_size, value);
} }
struct ShadowSegmentEndpoint { struct ShadowSegmentEndpoint {
u8 *chunk; u8 *chunk;
s8 offset; // in [0, ASAN_SHADOW_GRANULARITY) s8 offset; // in [0, ASAN_SHADOW_GRANULARITY)
s8 value; // = *chunk; s8 value; // = *chunk;
explicit ShadowSegmentEndpoint(uptr address) { explicit ShadowSegmentEndpoint(uptr address) {
Show All 30 Lines
using namespace __asan; using namespace __asan;
// Current implementation of __asan_(un)poison_memory_region doesn't check // Current implementation of __asan_(un)poison_memory_region doesn't check
// that user program (un)poisons the memory it owns. It poisons memory // that user program (un)poisons the memory it owns. It poisons memory
// conservatively, and unpoisons progressively to make sure asan shadow // conservatively, and unpoisons progressively to make sure asan shadow
// mapping invariant is preserved (see detailed mapping description here: // mapping invariant is preserved (see detailed mapping description here:
// https://github.com/google/sanitizers/wiki/AddressSanitizerAlgorithm). // https://github.com/google/sanitizers/wiki/AddressSanitizerAlgorithm).
// //
// * if user asks to poison region [left, right), the program poisons // * if user asks to poison region [low, high), the program poisons
// at least [left, AlignDown(right)). // at least [low, AlignDown(high)).
// * if user asks to unpoison region [left, right), the program unpoisons // * if user asks to unpoison region [low, high), the program unpoisons
// at most [AlignDown(left), right). // at most [AlignDown(low), high).
void __asan_poison_memory_region(void const volatile *addr, uptr size) { void __asan_poison_memory_region(void const volatile *addr, uptr size) {
if (!flags()->allow_user_poisoning || size == 0) return; if (!flags()->allow_user_poisoning || size == 0) return;
uptr beg_addr = (uptr)addr; uptr beg_addr = (uptr)addr;
uptr end_addr = beg_addr + size; uptr end_addr = beg_addr + size;
VPrintf(3, "Trying to poison memory region [%p, %p)\n", (void *)beg_addr, VPrintf(3, "Trying to poison memory region [%p, %p)\n", (void *)beg_addr,
(void *)end_addr); (void *)end_addr);
ShadowSegmentEndpoint beg(beg_addr); ShadowSegmentEndpoint beg(beg_addr);
ShadowSegmentEndpoint end(end_addr); ShadowSegmentEndpoint end(end_addr);
▲ Show 20 Lines • Show All 168 Lines • ▼ Show 20 Lines if (sval == kAsanHeapFreeMagic) {
return 0; return 0;
} }
// The cookie may remain unpoisoned if e.g. it comes from a custom // The cookie may remain unpoisoned if e.g. it comes from a custom
// operator new defined inside a class. // operator new defined inside a class.
return *p; return *p;
} }
// This is a simplified version of __asan_(un)poison_memory_region, which // This is a simplified version of __asan_(un)poison_memory_region, which
// assumes that left border of region to be poisoned is properly aligned. // assumes that low border of region to be poisoned is properly aligned.
static void PoisonAlignedStackMemory(uptr addr, uptr size, bool do_poison) { static void PoisonAlignedStackMemory(uptr addr, uptr size, bool do_poison) {
if (size == 0) return; if (size == 0) return;
uptr aligned_size = size & ~(ASAN_SHADOW_GRANULARITY - 1); uptr aligned_size = size & ~(ASAN_SHADOW_GRANULARITY - 1);
PoisonShadow(addr, aligned_size, PoisonShadow(addr, aligned_size,
do_poison ? kAsanStackUseAfterScopeMagic : 0); do_poison ? kAsanStackUseAfterScopeMagic : 0);
if (size == aligned_size) if (size == aligned_size)
return; return;
s8 end_offset = (s8)(size - aligned_size); s8 end_offset = (s8)(size - aligned_size);
▲ Show 20 Lines • Show All 156 Lines • Show Last 20 Lines

compiler-rt/lib/asan/asan_premap_shadow.cpp

Show All 23 Lines
// access any external symbol, including its own non-hidden globals. // access any external symbol, including its own non-hidden globals.
// Conservative upper limit. // Conservative upper limit.
uptr PremapShadowSize() { uptr PremapShadowSize() {
uptr granularity = GetMmapGranularity(); uptr granularity = GetMmapGranularity();
return RoundUpTo(GetMaxVirtualAddress() >> ASAN_SHADOW_SCALE, granularity); return RoundUpTo(GetMaxVirtualAddress() >> ASAN_SHADOW_SCALE, granularity);
} }
// Returns an address aligned to 8 pages, such that one page on the left and // Returns an address aligned to 8 pages, such that one front page and
// PremapShadowSize() bytes on the right of it are mapped r/o. // PremapShadowSize() back bytes are mapped r/o.
uptr PremapShadow() { uptr PremapShadow() {
return MapDynamicShadow(PremapShadowSize(), /*mmap_alignment_scale*/ 3, return MapDynamicShadow(PremapShadowSize(), /*mmap_alignment_scale*/ 3,
/*min_shadow_base_alignment*/ 0, kHighMemEnd); /*min_shadow_base_alignment*/ 0, kHighMemEnd);
} }
bool PremapShadowFailed() { bool PremapShadowFailed() {
uptr shadow = reinterpret_cast<uptr>(&__asan_shadow); uptr shadow = reinterpret_cast<uptr>(&__asan_shadow);
uptr resolver = reinterpret_cast<uptr>(&__asan_premap_shadow); uptr resolver = reinterpret_cast<uptr>(&__asan_premap_shadow);
Show All 23 Lines

compiler-rt/lib/asan/asan_report.cpp

Show First 20 Lines • Show All 371 Lines • ▼ Show 20 Lines
static bool IsInvalidPointerPair(uptr a1, uptr a2) { static bool IsInvalidPointerPair(uptr a1, uptr a2) {
if (a1 == a2) if (a1 == a2)
return false; return false;
// 256B in shadow memory can be iterated quite fast // 256B in shadow memory can be iterated quite fast
static const uptr kMaxOffset = 2048; static const uptr kMaxOffset = 2048;
uptr left = a1 < a2 ? a1 : a2; uptr low = a1 < a2 ? a1 : a2;
uptr right = a1 < a2 ? a2 : a1; uptr high = a1 < a2 ? a2 : a1;
uptr offset = right - left; uptr offset = high - low;
if (offset <= kMaxOffset) if (offset <= kMaxOffset)
return __asan_region_is_poisoned(left, offset); return __asan_region_is_poisoned(low, offset);
AsanThread *t = GetCurrentThread(); AsanThread *t = GetCurrentThread();
// check whether left is a stack memory pointer // check whether left is a stack memory pointer
if (uptr shadow_offset1 = t->GetStackVariableShadowStart(left)) { if (uptr shadow_offset1 = t->GetStackVariableShadowStart(low)) {
uptr shadow_offset2 = t->GetStackVariableShadowStart(right); uptr shadow_offset2 = t->GetStackVariableShadowStart(high);
return shadow_offset2 == 0 || shadow_offset1 != shadow_offset2; return shadow_offset2 == 0 || shadow_offset1 != shadow_offset2;
} }
// check whether left is a heap memory address // check whether left is a heap memory address
HeapAddressDescription hdesc1, hdesc2; HeapAddressDescription hdesc1, hdesc2;
if (GetHeapAddressInformation(left, 0, &hdesc1) && if (GetHeapAddressInformation(low, 0, &hdesc1) &&
hdesc1.chunk_access.access_type == kAccessTypeInside) hdesc1.chunk_access.access_type == kAccessTypeInside)
return !GetHeapAddressInformation(right, 0, &hdesc2) || return !GetHeapAddressInformation(high, 0, &hdesc2) ||
hdesc2.chunk_access.access_type != kAccessTypeInside || hdesc2.chunk_access.access_type != kAccessTypeInside ||
hdesc1.chunk_access.chunk_begin != hdesc2.chunk_access.chunk_begin; hdesc1.chunk_access.chunk_begin != hdesc2.chunk_access.chunk_begin;
// check whether left is an address of a global variable // check whether left is an address of a global variable
GlobalAddressDescription gdesc1, gdesc2; GlobalAddressDescription gdesc1, gdesc2;
if (GetGlobalAddressInformation(left, 0, &gdesc1)) if (GetGlobalAddressInformation(low, 0, &gdesc1))
return !GetGlobalAddressInformation(right - 1, 0, &gdesc2) || return !GetGlobalAddressInformation(high - 1, 0, &gdesc2) ||
!gdesc1.PointsInsideTheSameVariable(gdesc2); !gdesc1.PointsInsideTheSameVariable(gdesc2);
if (t->GetStackVariableShadowStart(right) || if (t->GetStackVariableShadowStart(high) ||
GetHeapAddressInformation(right, 0, &hdesc2) || GetHeapAddressInformation(high, 0, &hdesc2) ||
GetGlobalAddressInformation(right - 1, 0, &gdesc2)) GetGlobalAddressInformation(high - 1, 0, &gdesc2))
return true; return true;
// At this point we know nothing about both a1 and a2 addresses. // At this point we know nothing about both a1 and a2 addresses.
return false; return false;
} }
static inline void CheckForInvalidPointerPair(void *p1, void *p2) { static inline void CheckForInvalidPointerPair(void *p1, void *p2) {
switch (flags()->detect_invalid_pointer_pairs) { switch (flags()->detect_invalid_pointer_pairs) {
▲ Show 20 Lines • Show All 155 Lines • Show Last 20 Lines

compiler-rt/lib/asan/asan_shadow_setup.cpp

Show First 20 Lines • Show All 80 Lines • ▼ Show 20 Lines if (!full_shadow_is_available) {
kMidMemBeg = kLowMemEnd < 0x3000000000ULL ? 0x3000000000ULL : 0; kMidMemBeg = kLowMemEnd < 0x3000000000ULL ? 0x3000000000ULL : 0;
kMidMemEnd = kLowMemEnd < 0x3000000000ULL ? 0x4fffffffffULL : 0; kMidMemEnd = kLowMemEnd < 0x3000000000ULL ? 0x4fffffffffULL : 0;
} }
#endif #endif
if (Verbosity()) PrintAddressSpaceLayout(); if (Verbosity()) PrintAddressSpaceLayout();
if (full_shadow_is_available) { if (full_shadow_is_available) {
// mmap the low shadow plus at least one page at the left. // mmap the low shadow plus at least one front page.
if (kLowShadowBeg) if (kLowShadowBeg)
ReserveShadowMemoryRange(shadow_start, kLowShadowEnd, "low shadow"); ReserveShadowMemoryRange(shadow_start, kLowShadowEnd, "low shadow");
// mmap the high shadow. // mmap the high shadow.
ReserveShadowMemoryRange(kHighShadowBeg, kHighShadowEnd, "high shadow"); ReserveShadowMemoryRange(kHighShadowBeg, kHighShadowEnd, "high shadow");
// protect the gap. // protect the gap.
ProtectGap(kShadowGapBeg, kShadowGapEnd - kShadowGapBeg + 1); ProtectGap(kShadowGapBeg, kShadowGapEnd - kShadowGapBeg + 1);
CHECK_EQ(kShadowGapEnd, kHighShadowBeg - 1); CHECK_EQ(kShadowGapEnd, kHighShadowBeg - 1);
} else if (kMidMemBeg && } else if (kMidMemBeg &&
MemoryRangeIsAvailable(shadow_start, kMidMemBeg - 1) && MemoryRangeIsAvailable(shadow_start, kMidMemBeg - 1) &&
MemoryRangeIsAvailable(kMidMemEnd + 1, kHighShadowEnd)) { MemoryRangeIsAvailable(kMidMemEnd + 1, kHighShadowEnd)) {
CHECK(kLowShadowBeg != kLowShadowEnd); CHECK(kLowShadowBeg != kLowShadowEnd);
// mmap the low shadow plus at least one page at the left. // mmap the low shadow plus at least one front page.
ReserveShadowMemoryRange(shadow_start, kLowShadowEnd, "low shadow"); ReserveShadowMemoryRange(shadow_start, kLowShadowEnd, "low shadow");
// mmap the mid shadow. // mmap the mid shadow.
ReserveShadowMemoryRange(kMidShadowBeg, kMidShadowEnd, "mid shadow"); ReserveShadowMemoryRange(kMidShadowBeg, kMidShadowEnd, "mid shadow");
// mmap the high shadow. // mmap the high shadow.
ReserveShadowMemoryRange(kHighShadowBeg, kHighShadowEnd, "high shadow"); ReserveShadowMemoryRange(kHighShadowBeg, kHighShadowEnd, "high shadow");
// protect the gaps. // protect the gaps.
ProtectGap(kShadowGapBeg, kShadowGapEnd - kShadowGapBeg + 1); ProtectGap(kShadowGapBeg, kShadowGapEnd - kShadowGapBeg + 1);
ProtectGap(kShadowGap2Beg, kShadowGap2End - kShadowGap2Beg + 1); ProtectGap(kShadowGap2Beg, kShadowGap2End - kShadowGap2Beg + 1);
Show All 16 Lines

compiler-rt/lib/asan/asan_thread.cpp

Show First 20 Lines • Show All 343 Lines • ▼ Show 20 Lines if (AddrIsInStack(addr)) {
return true; return true;
} }
uptr aligned_addr = RoundDownTo(addr, SANITIZER_WORDSIZE / 8); // align addr. uptr aligned_addr = RoundDownTo(addr, SANITIZER_WORDSIZE / 8); // align addr.
uptr mem_ptr = RoundDownTo(aligned_addr, ASAN_SHADOW_GRANULARITY); uptr mem_ptr = RoundDownTo(aligned_addr, ASAN_SHADOW_GRANULARITY);
u8 *shadow_ptr = (u8*)MemToShadow(aligned_addr); u8 *shadow_ptr = (u8*)MemToShadow(aligned_addr);
u8 *shadow_bottom = (u8*)MemToShadow(bottom); u8 *shadow_bottom = (u8*)MemToShadow(bottom);
while (shadow_ptr >= shadow_bottom && while (shadow_ptr >= shadow_bottom &&
*shadow_ptr != kAsanStackLeftRedzoneMagic) { *shadow_ptr != kAsanStackFrontRedzoneMagic) {
shadow_ptr--; shadow_ptr--;
mem_ptr -= ASAN_SHADOW_GRANULARITY; mem_ptr -= ASAN_SHADOW_GRANULARITY;
} }
while (shadow_ptr >= shadow_bottom && while (shadow_ptr >= shadow_bottom &&
*shadow_ptr == kAsanStackLeftRedzoneMagic) { *shadow_ptr == kAsanStackFrontRedzoneMagic) {
shadow_ptr--; shadow_ptr--;
mem_ptr -= ASAN_SHADOW_GRANULARITY; mem_ptr -= ASAN_SHADOW_GRANULARITY;
} }
if (shadow_ptr < shadow_bottom) { if (shadow_ptr < shadow_bottom) {
return false; return false;
} }
Show All 18 Lines if (AddrIsInStack(addr)) {
return 0; return 0;
} }
uptr aligned_addr = RoundDownTo(addr, SANITIZER_WORDSIZE / 8); // align addr. uptr aligned_addr = RoundDownTo(addr, SANITIZER_WORDSIZE / 8); // align addr.
u8 *shadow_ptr = (u8*)MemToShadow(aligned_addr); u8 *shadow_ptr = (u8*)MemToShadow(aligned_addr);
u8 *shadow_bottom = (u8*)MemToShadow(bottom); u8 *shadow_bottom = (u8*)MemToShadow(bottom);
while (shadow_ptr >= shadow_bottom && while (shadow_ptr >= shadow_bottom &&
(*shadow_ptr != kAsanStackLeftRedzoneMagic && (*shadow_ptr != kAsanStackFrontRedzoneMagic &&
eugenisUnsubmitted
Not Done
ReplyInline Actions

Every time I read front/back I have to stop and think which is which. The terms make sense for a container, but IMHO not for a chunk of memory.

eugenis: Every time I read front/back I have to stop and think which is which. The terms make sense for…
*shadow_ptr != kAsanStackMidRedzoneMagic && *shadow_ptr != kAsanStackMidRedzoneMagic &&
*shadow_ptr != kAsanStackRightRedzoneMagic)) *shadow_ptr != kAsanStackBackRedzoneMagic))
shadow_ptr--; shadow_ptr--;
return (uptr)shadow_ptr + 1; return (uptr)shadow_ptr + 1;
} }
bool AsanThread::AddrIsInStack(uptr addr) { bool AsanThread::AddrIsInStack(uptr addr) {
const auto bounds = GetStackBounds(); const auto bounds = GetStackBounds();
return addr >= bounds.bottom && addr < bounds.top; return addr >= bounds.bottom && addr < bounds.top;
▲ Show 20 Lines • Show All 153 Lines • Show Last 20 Lines

compiler-rt/lib/asan/tests/asan_test.cpp

Show First 20 Lines • Show All 988 Lines • ▼ Show 20 Lines
TEST(AddressSanitizer, UseThenFreeThenUseTest) { TEST(AddressSanitizer, UseThenFreeThenUseTest) {
EXPECT_DEATH(UseThenFreeThenUse(), "freed by thread"); EXPECT_DEATH(UseThenFreeThenUse(), "freed by thread");
} }
TEST(AddressSanitizer, StrDupTest) { TEST(AddressSanitizer, StrDupTest) {
free(strdup(Ident("123"))); free(strdup(Ident("123")));
} }
// Currently we create and poison redzone at right of global variables. // Currently we create and poison redzone before global variables.
static char static110[110]; static char static110[110];
const char ConstGlob[7] = {1, 2, 3, 4, 5, 6, 7}; const char ConstGlob[7] = {1, 2, 3, 4, 5, 6, 7};
static const char StaticConstGlob[3] = {9, 8, 7}; static const char StaticConstGlob[3] = {9, 8, 7};
TEST(AddressSanitizer, GlobalTest) { TEST(AddressSanitizer, GlobalTest) {
static char func_static15[15]; static char func_static15[15];
static char fs1[10]; static char fs1[10];
Show All 24 Lines EXPECT_DEATH(func_static15[Ident(15)] = 0,
"0 bytes after global variable"); "0 bytes after global variable");
EXPECT_DEATH(func_static15[Ident(15 + 9)] = 0, EXPECT_DEATH(func_static15[Ident(15 + 9)] = 0,
"9 bytes after global variable"); "9 bytes after global variable");
Ident(fs1); Ident(fs1);
Ident(fs2); Ident(fs2);
Ident(fs3); Ident(fs3);
// We don't create left redzones, so this is not 100% guaranteed to fail. // We don't create front redzones, so this is not 100% guaranteed to fail.
// But most likely will. // But most likely will.
EXPECT_DEATH(fs2[Ident(-1)] = 0, "is located.* global variable"); EXPECT_DEATH(fs2[Ident(-1)] = 0, "is located.* global variable");
EXPECT_DEATH(Ident(Ident(ConstGlob)[8]), EXPECT_DEATH(Ident(Ident(ConstGlob)[8]),
"is located 1 bytes after .*ConstGlob"); "is located 1 bytes after .*ConstGlob");
EXPECT_DEATH(Ident(Ident(StaticConstGlob)[5]), EXPECT_DEATH(Ident(Ident(StaticConstGlob)[5]),
"is located 2 bytes after .*StaticConstGlob"); "is located 2 bytes after .*StaticConstGlob");
▲ Show 20 Lines • Show All 321 Lines • Show Last 20 Lines

compiler-rt/test/asan/TestCases/Posix/gc-test.cpp

// RUN: %clangxx_asan %s -pthread -o %t // RUN: %clangxx_asan %s -pthread -o %t
// RUN: %env_asan_opts=detect_stack_use_after_return=1 %run %t 2>&1 | FileCheck %s --check-prefix=CHECK1 // RUN: %env_asan_opts=detect_stack_use_after_return=1 %run %t 2>&1 | FileCheck %s --check-prefix=CHECK1
// RUN: %env_asan_opts=detect_stack_use_after_return=0 %run %t 2>&1 | FileCheck %s --check-prefix=CHECK0 // RUN: %env_asan_opts=detect_stack_use_after_return=0 %run %t 2>&1 | FileCheck %s --check-prefix=CHECK0
// RUN: %clangxx_asan -O3 %s -pthread -o %t // RUN: %clangxx_asan -O3 %s -pthread -o %t
// RUN: %env_asan_opts=detect_stack_use_after_return=1 %run %t 2>&1 | FileCheck %s --check-prefix=CHECK1 // RUN: %env_asan_opts=detect_stack_use_after_return=1 %run %t 2>&1 | FileCheck %s --check-prefix=CHECK1
// RUN: %env_asan_opts=detect_stack_use_after_return=0 %run %t 2>&1 | FileCheck %s --check-prefix=CHECK0 // RUN: %env_asan_opts=detect_stack_use_after_return=0 %run %t 2>&1 | FileCheck %s --check-prefix=CHECK0
// REQUIRES: stable-runtime // REQUIRES: stable-runtime
#include <assert.h> #include <assert.h>
#include <stdio.h> #include <stdio.h>
#include <pthread.h> #include <pthread.h>
#include <sanitizer/asan_interface.h> #include <sanitizer/asan_interface.h>
static const int kNumThreads = 2; static const int kNumThreads = 2;
static const int kLeftRedzoneSize = sizeof(void *) * 4; static const int kFrontRedzoneSize = sizeof(void *) * 4;
void *Thread(void *unused) { void *Thread(void *unused) {
void *fake_stack = __asan_get_current_fake_stack(); void *fake_stack = __asan_get_current_fake_stack();
char var[15]; char var[15];
if (fake_stack) { if (fake_stack) {
fprintf(stderr, "fake stack found: %p; var: %p\n", fake_stack, var); fprintf(stderr, "fake stack found: %p; var: %p\n", fake_stack, var);
// CHECK1: fake stack found // CHECK1: fake stack found
// CHECK1: fake stack found // CHECK1: fake stack found
void *beg, *end; void *beg, *end;
void *real_stack = void *real_stack =
__asan_addr_is_in_fake_stack(fake_stack, &var[0], &beg, &end); __asan_addr_is_in_fake_stack(fake_stack, &var[0], &beg, &end);
assert(real_stack); assert(real_stack);
assert((char*)beg <= (char*)&var[0]); assert((char*)beg <= (char*)&var[0]);
assert((char*)end > (char*)&var[0]); assert((char*)end > (char*)&var[0]);
for (int i = -kLeftRedzoneSize; i < 15; i++) { for (int i = -kFrontRedzoneSize; i < 15; i++) {
void *beg1, *end1; void *beg1, *end1;
char *ptr = &var[0] + i; char *ptr = &var[0] + i;
void *real_stack1 = void *real_stack1 =
__asan_addr_is_in_fake_stack(fake_stack, ptr, &beg1, &end1); __asan_addr_is_in_fake_stack(fake_stack, ptr, &beg1, &end1);
assert(real_stack == real_stack1); assert(real_stack == real_stack1);
assert(beg == beg1); assert(beg == beg1);
assert(end == end1); assert(end == end1);
} }
Show All 16 Lines

compiler-rt/test/asan/TestCases/Posix/start-deactivated.cpp

Show All 31 Lines
#include <string.h> #include <string.h>
#include <unistd.h> #include <unistd.h>
#include <string> #include <string>
#include "sanitizer/asan_interface.h" #include "sanitizer/asan_interface.h"
void test_malloc_shadow(char *p, size_t sz, bool expect_redzones) { void test_malloc_shadow(char *p, size_t sz, bool expect_redzones) {
// Last byte of the left redzone, if present. // Last byte of the front redzone, if present.
assert((char *)__asan_region_is_poisoned(p - 1, sz + 1) == assert((char *)__asan_region_is_poisoned(p - 1, sz + 1) ==
(expect_redzones ? p - 1 : nullptr)); (expect_redzones ? p - 1 : nullptr));
// The user memory. // The user memory.
assert((char *)__asan_region_is_poisoned(p, sz) == nullptr); assert((char *)__asan_region_is_poisoned(p, sz) == nullptr);
// First byte of the right redzone, if present. // First byte of the front redzone, if present.
assert((char *)__asan_region_is_poisoned(p, sz + 1) == assert((char *)__asan_region_is_poisoned(p, sz + 1) ==
(expect_redzones ? p + sz : nullptr)); (expect_redzones ? p + sz : nullptr));
} }
typedef void (*Fn)(); typedef void (*Fn)();
int main(int argc, char *argv[]) { int main(int argc, char *argv[]) {
constexpr unsigned nPtrs = 200; constexpr unsigned nPtrs = 200;
▲ Show 20 Lines • Show All 94 Lines • Show Last 20 Lines

compiler-rt/test/asan/TestCases/Posix/unpoison-alternate-stack.cpp

Show All 20 Lines
#include <sys/mman.h> #include <sys/mman.h>
#include <unistd.h> #include <unistd.h>
#include <sanitizer/asan_interface.h> #include <sanitizer/asan_interface.h>
namespace { namespace {
struct TestContext { struct TestContext {
char *LeftRedzone; char *FrontRedzone;
char *RightRedzone; char *BackRedzone;
std::jmp_buf JmpBuf; std::jmp_buf JmpBuf;
}; };
TestContext defaultStack; TestContext defaultStack;
TestContext signalStack; TestContext signalStack;
// Create a new stack frame to ensure that logically, the stack frame should be // Create a new stack frame to ensure that logically, the stack frame should be
// unpoisoned when the function exits. Exit is performed via jump, not return, // unpoisoned when the function exits. Exit is performed via jump, not return,
// such that we trigger __asan_handle_no_return and not ordinary unpoisoning. // such that we trigger __asan_handle_no_return and not ordinary unpoisoning.
template <class Jump> template <class Jump>
void __attribute__((noinline)) poisonStackAndJump(TestContext &c, Jump jump) { void __attribute__((noinline)) poisonStackAndJump(TestContext &c, Jump jump) {
char Blob[100]; // This variable must not be optimized out, because we use it char Blob[100]; // This variable must not be optimized out, because we use it
// to create redzones. // to create redzones.
c.LeftRedzone = Blob - 1; c.FrontRedzone = Blob - 1;
c.RightRedzone = Blob + sizeof(Blob); c.BackRedzone = Blob + sizeof(Blob);
assert(__asan_address_is_poisoned(c.LeftRedzone)); assert(__asan_address_is_poisoned(c.FrontRedzone));
assert(__asan_address_is_poisoned(c.RightRedzone)); assert(__asan_address_is_poisoned(c.BackRedzone));
// Jump to avoid normal cleanup of redzone markers. Instead, // Jump to avoid normal cleanup of redzone markers. Instead,
// __asan_handle_no_return is called which unpoisons the stacks. // __asan_handle_no_return is called which unpoisons the stacks.
jump(); jump();
} }
void testOnCurrentStack() { void testOnCurrentStack() {
TestContext c; TestContext c;
if (0 == setjmp(c.JmpBuf)) if (0 == setjmp(c.JmpBuf))
poisonStackAndJump(c, [&] { longjmp(c.JmpBuf, 1); }); poisonStackAndJump(c, [&] { longjmp(c.JmpBuf, 1); });
assert(0 == __asan_region_is_poisoned(c.LeftRedzone, assert(0 ==
c.RightRedzone - c.LeftRedzone)); __asan_region_is_poisoned(c.FrontRedzone,
c.BackRedzone - c.FrontRedzone));
} }
bool isOnSignalStack() { bool isOnSignalStack() {
stack_t Stack; stack_t Stack;
sigaltstack(nullptr, &Stack); sigaltstack(nullptr, &Stack);
return Stack.ss_flags == SS_ONSTACK; return Stack.ss_flags == SS_ONSTACK;
} }
Show All 37 Linesvoid *threadFun(void *AltStack) {
// set up jump to test unpoisoning when jumping between stacks // set up jump to test unpoisoning when jumping between stacks
if (0 == setjmp(defaultStack.JmpBuf)) if (0 == setjmp(defaultStack.JmpBuf))
// Test on signal alternate stack, via signalHandler // Test on signal alternate stack, via signalHandler
poisonStackAndJump(defaultStack, [] { raise(SIGUSR1); }); poisonStackAndJump(defaultStack, [] { raise(SIGUSR1); });
assert(!isOnSignalStack()); assert(!isOnSignalStack());
assert(0 == __asan_region_is_poisoned( assert(0 == __asan_region_is_poisoned(defaultStack.FrontRedzone,
defaultStack.LeftRedzone, defaultStack.BackRedzone -
defaultStack.RightRedzone - defaultStack.LeftRedzone)); defaultStack.FrontRedzone));
assert(0 == __asan_region_is_poisoned( assert(0 == __asan_region_is_poisoned(signalStack.FrontRedzone,
signalStack.LeftRedzone, signalStack.BackRedzone -
signalStack.RightRedzone - signalStack.LeftRedzone)); signalStack.FrontRedzone));
return nullptr; return nullptr;
} }
} // namespace } // namespace
// Check that __asan_handle_no_return properly unpoisons a signal alternate // Check that __asan_handle_no_return properly unpoisons a signal alternate
// stack. // stack.
Show All 35 Lines

compiler-rt/test/asan/TestCases/Windows/calloc_left_oob.cpp

  • This file was moved to compiler-rt/test/asan/TestCases/Windows/calloc_oob_before.cpp.

compiler-rt/test/asan/TestCases/Windows/calloc_oob_after.cpp

  • This file was moved from compiler-rt/test/asan/TestCases/Windows/calloc_right_oob.cpp.
// RUN: %clang_cl_asan -Od %s -Fe%t // RUN: %clang_cl_asan -Od %s -Fe%t
// RUN: not %run %t 2>&1 | FileCheck %s // RUN: not %run %t 2>&1 | FileCheck %s
#include <malloc.h> #include <malloc.h>
int main() { int main() {
int *buffer = (int*)calloc(42, sizeof(int)); int *buffer = (int*)calloc(42, sizeof(int));
buffer[42] = 42; buffer[42] = 42;
// CHECK: AddressSanitizer: heap-buffer-overflow on address [[ADDR:0x[0-9a-f]+]] // CHECK: AddressSanitizer: heap-buffer-overflow on address [[ADDR:0x[0-9a-f]+]]
// CHECK: WRITE of size 4 at [[ADDR]] thread T0 // CHECK: WRITE of size 4 at [[ADDR]] thread T0
// CHECK-NEXT: {{#0 .* main .*calloc_right_oob.cpp}}:[[@LINE-3]] // CHECK-NEXT: {{#0 .* main .*calloc_oob_after.cpp}}:[[@LINE-3]]
// CHECK: [[ADDR]] is located 0 bytes after 168-byte region // CHECK: [[ADDR]] is located 0 bytes after 168-byte region
// CHECK: allocated by thread T0 here: // CHECK: allocated by thread T0 here:
// CHECK-NEXT: {{#0 .* calloc }} // CHECK-NEXT: {{#0 .* calloc }}
// CHECK-NEXT: {{#1 .* main .*calloc_right_oob.cpp}}:[[@LINE-8]] // CHECK-NEXT: {{#1 .* main .*calloc_oob_after.cpp}}:[[@LINE-8]]
free(buffer); free(buffer);
} }

compiler-rt/test/asan/TestCases/Windows/calloc_oob_before.cpp

  • This file was moved from compiler-rt/test/asan/TestCases/Windows/calloc_left_oob.cpp.
// RUN: %clang_cl_asan -Od %s -Fe%t // RUN: %clang_cl_asan -Od %s -Fe%t
// RUN: not %run %t 2>&1 | FileCheck %s // RUN: not %run %t 2>&1 | FileCheck %s
#include <malloc.h> #include <malloc.h>
int main() { int main() {
int *buffer = (int*)calloc(42, sizeof(int)); int *buffer = (int*)calloc(42, sizeof(int));
buffer[-1] = 42; buffer[-1] = 42;
// CHECK: AddressSanitizer: heap-buffer-overflow on address [[ADDR:0x[0-9a-f]+]] // CHECK: AddressSanitizer: heap-buffer-overflow on address [[ADDR:0x[0-9a-f]+]]
// CHECK: WRITE of size 4 at [[ADDR]] thread T0 // CHECK: WRITE of size 4 at [[ADDR]] thread T0
// CHECK-NEXT: {{#0 .* main .*calloc_left_oob.cpp}}:[[@LINE-3]] // CHECK-NEXT: {{#0 .* main .*calloc_oob_before.cpp}}:[[@LINE-3]]
// CHECK: [[ADDR]] is located 4 bytes before 168-byte region // CHECK: [[ADDR]] is located 4 bytes before 168-byte region
// CHECK: allocated by thread T0 here: // CHECK: allocated by thread T0 here:
// CHECK-NEXT: {{#0 .* calloc }} // CHECK-NEXT: {{#0 .* calloc }}
// CHECK-NEXT: {{#1 .* main .*calloc_left_oob.cpp}}:[[@LINE-8]] // CHECK-NEXT: {{#1 .* main .*calloc_oob_before.cpp}}:[[@LINE-8]]
free(buffer); free(buffer);
} }

compiler-rt/test/asan/TestCases/Windows/calloc_right_oob.cpp

  • This file was moved to compiler-rt/test/asan/TestCases/Windows/calloc_oob_after.cpp.

compiler-rt/test/asan/TestCases/Windows/dll_malloc_left_oob.cpp

  • This file was moved to compiler-rt/test/asan/TestCases/Windows/dll_malloc_oob_before.cpp.

compiler-rt/test/asan/TestCases/Windows/dll_malloc_oob_before.cpp

  • This file was moved from compiler-rt/test/asan/TestCases/Windows/dll_malloc_left_oob.cpp.
// RUN: %clang_cl_asan -Od %p/dll_host.cpp -Fe%t // RUN: %clang_cl_asan -Od %p/dll_host.cpp -Fe%t
// RUN: %clang_cl_asan -LD -Od %s -Fe%t.dll // RUN: %clang_cl_asan -LD -Od %s -Fe%t.dll
// RUN: not %run %t %t.dll 2>&1 | FileCheck %s // RUN: not %run %t %t.dll 2>&1 | FileCheck %s
#include <malloc.h> #include <malloc.h>
extern "C" __declspec(dllexport) extern "C" __declspec(dllexport)
int test_function() { int test_function() {
char *buffer = (char*)malloc(42); char *buffer = (char*)malloc(42);
buffer[-1] = 42; buffer[-1] = 42;
// CHECK: AddressSanitizer: heap-buffer-overflow on address [[ADDR:0x[0-9a-f]+]] // CHECK: AddressSanitizer: heap-buffer-overflow on address [[ADDR:0x[0-9a-f]+]]
// CHECK: WRITE of size 1 at [[ADDR]] thread T0 // CHECK: WRITE of size 1 at [[ADDR]] thread T0
// CHECK-NEXT: test_function {{.*}}dll_malloc_left_oob.cpp:[[@LINE-3]] // CHECK-NEXT: test_function {{.*}}dll_malloc_oob_before.cpp:[[@LINE-3]]
// CHECK-NEXT: main {{.*}}dll_host.cpp // CHECK-NEXT: main {{.*}}dll_host.cpp
// //
// CHECK: [[ADDR]] is located 1 bytes before 42-byte region // CHECK: [[ADDR]] is located 1 bytes before 42-byte region
// CHECK-LABEL: allocated by thread T0 here: // CHECK-LABEL: allocated by thread T0 here:
// CHECK-NEXT: malloc // CHECK-NEXT: malloc
// CHECK-NEXT: test_function {{.*}}dll_malloc_left_oob.cpp:[[@LINE-10]] // CHECK-NEXT: test_function {{.*}}dll_malloc_oob_before.cpp:[[@LINE-10]]
// CHECK-NEXT: main {{.*}}dll_host.cpp // CHECK-NEXT: main {{.*}}dll_host.cpp
// CHECK-LABEL: SUMMARY // CHECK-LABEL: SUMMARY
free(buffer); free(buffer);
return 0; return 0;
} }

compiler-rt/test/asan/TestCases/Windows/dll_operator_array_new_left_oob.cpp

  • This file was moved to compiler-rt/test/asan/TestCases/Windows/dll_operator_array_new_oob_before.cpp.

compiler-rt/test/asan/TestCases/Windows/dll_operator_array_new_oob_before.cpp

  • This file was moved from compiler-rt/test/asan/TestCases/Windows/dll_operator_array_new_left_oob.cpp.
// RUN: %clang_cl_asan -Od %p/dll_host.cpp -Fe%t // RUN: %clang_cl_asan -Od %p/dll_host.cpp -Fe%t
// RUN: %clang_cl_asan -LD -Od %s -Fe%t.dll // RUN: %clang_cl_asan -LD -Od %s -Fe%t.dll
// RUN: not %run %t %t.dll 2>&1 | FileCheck %s // RUN: not %run %t %t.dll 2>&1 | FileCheck %s
extern "C" __declspec(dllexport) extern "C" __declspec(dllexport)
int test_function() { int test_function() {
char *buffer = new char[42]; char *buffer = new char[42];
buffer[-1] = 42; buffer[-1] = 42;
// CHECK: AddressSanitizer: heap-buffer-overflow on address [[ADDR:0x[0-9a-f]+]] // CHECK: AddressSanitizer: heap-buffer-overflow on address [[ADDR:0x[0-9a-f]+]]
// CHECK: WRITE of size 1 at [[ADDR]] thread T0 // CHECK: WRITE of size 1 at [[ADDR]] thread T0
// CHECK-NEXT: test_function {{.*}}dll_operator_array_new_left_oob.cpp:[[@LINE-3]] // CHECK-NEXT: test_function {{.*}}dll_operator_array_new_oob_before.cpp:[[@LINE-3]]
// CHECK-NEXT: main {{.*}}dll_host.cpp // CHECK-NEXT: main {{.*}}dll_host.cpp
// //
// CHECK: [[ADDR]] is located 1 bytes before 42-byte region // CHECK: [[ADDR]] is located 1 bytes before 42-byte region
// CHECK-LABEL: allocated by thread T0 here: // CHECK-LABEL: allocated by thread T0 here:
// FIXME: Should get rid of the malloc/free frames called from the inside of // FIXME: Should get rid of the malloc/free frames called from the inside of
// operator new/delete in DLLs when using -MT CRT. // operator new/delete in DLLs when using -MT CRT.
// FIXME: The 'operator new' frame should have []. // FIXME: The 'operator new' frame should have [].
// CHECK: operator new // CHECK: operator new
// CHECK-NEXT: test_function {{.*}}dll_operator_array_new_left_oob.cpp:[[@LINE-13]] // CHECK-NEXT: test_function {{.*}}dll_operator_array_new_oob_before.cpp:[[@LINE-13]]
// CHECK-NEXT: main {{.*}}dll_host.cpp // CHECK-NEXT: main {{.*}}dll_host.cpp
// CHECK-LABEL: SUMMARY // CHECK-LABEL: SUMMARY
delete [] buffer; delete [] buffer;
return 0; return 0;
} }

compiler-rt/test/asan/TestCases/Windows/dll_operator_array_new_with_dtor_left_oob.cpp

  • This file was moved to compiler-rt/test/asan/TestCases/Windows/dll_operator_array_new_with_dtor_oob_before.cpp.

compiler-rt/test/asan/TestCases/Windows/dll_operator_array_new_with_dtor_oob_before.cpp

  • This file was moved from compiler-rt/test/asan/TestCases/Windows/dll_operator_array_new_with_dtor_left_oob.cpp.
Show All 9 Lines
int __attribute__((noinline, optnone)) hide(int x) { return x; } int __attribute__((noinline, optnone)) hide(int x) { return x; }
extern "C" __declspec(dllexport) extern "C" __declspec(dllexport)
int test_function() { int test_function() {
C *buffer = new C[42]; C *buffer = new C[42];
buffer[hide(-(1 + (int)sizeof(void*) / 4))].x = 42; buffer[hide(-(1 + (int)sizeof(void*) / 4))].x = 42;
// CHECK: AddressSanitizer: heap-buffer-overflow on address [[ADDR:0x[0-9a-f]+]] // CHECK: AddressSanitizer: heap-buffer-overflow on address [[ADDR:0x[0-9a-f]+]]
// CHECK: WRITE of size 4 at [[ADDR]] thread T0 // CHECK: WRITE of size 4 at [[ADDR]] thread T0
// CHECK-NEXT: test_function {{.*}}dll_operator_array_new_with_dtor_left_oob.cpp:[[@LINE-3]] // CHECK-NEXT: test_function {{.*}}dll_operator_array_new_with_dtor_oob_before.cpp:[[@LINE-3]]
// CHECK-NEXT: main {{.*}}dll_host.cpp // CHECK-NEXT: main {{.*}}dll_host.cpp
// //
// FIXME: Currently it says "4 bytes ... left of 172-byte region", // FIXME: Currently it says "4 bytes ... left of 172-byte region",
// should be "8 bytes ... left of 168-byte region", see // should be "8 bytes ... left of 168-byte region", see
// https://code.google.com/p/address-sanitizer/issues/detail?id=314 // https://code.google.com/p/address-sanitizer/issues/detail?id=314
// CHECK: [[ADDR]] is located {{.*}} bytes before {{(172|176)}}-byte region // CHECK: [[ADDR]] is located {{.*}} bytes before {{(172|176)}}-byte region
// FIXME: Should get rid of the malloc/free frames called from the inside of // FIXME: Should get rid of the malloc/free frames called from the inside of
// operator new/delete in DLLs when using -MT CRT. // operator new/delete in DLLs when using -MT CRT.
// FIXME: The operator new frame should have []. // FIXME: The operator new frame should have [].
// CHECK-LABEL: allocated by thread T0 here: // CHECK-LABEL: allocated by thread T0 here:
// CHECK: operator new // CHECK: operator new
// CHECK-NEXT: test_function {{.*}}dll_operator_array_new_with_dtor_left_oob.cpp:[[@LINE-16]] // CHECK-NEXT: test_function {{.*}}dll_operator_array_new_with_dtor_oob_before.cpp:[[@LINE-16]]
// CHECK-NEXT: main {{.*}}dll_host.cpp // CHECK-NEXT: main {{.*}}dll_host.cpp
// CHECK-LABEL: SUMMARY // CHECK-LABEL: SUMMARY
delete [] buffer; delete [] buffer;
return 0; return 0;
} }

compiler-rt/test/asan/TestCases/Windows/dll_thread_stack_array_left_oob.cpp

  • This file was moved to compiler-rt/test/asan/TestCases/Windows/dll_thread_stack_array_oob_before.cpp.

compiler-rt/test/asan/TestCases/Windows/dll_thread_stack_array_oob_before.cpp

  • This file was moved from compiler-rt/test/asan/TestCases/Windows/dll_thread_stack_array_left_oob.cpp.
// RUN: %clang_cl_asan -Od %p/dll_host.cpp -Fe%t // RUN: %clang_cl_asan -Od %p/dll_host.cpp -Fe%t
// RUN: %clang_cl_asan -LD -Od %s -Fe%t.dll // RUN: %clang_cl_asan -LD -Od %s -Fe%t.dll
// RUN: not %run %t %t.dll 2>&1 | FileCheck %s // RUN: not %run %t %t.dll 2>&1 | FileCheck %s
#include <windows.h> #include <windows.h>
#include <malloc.h> #include <malloc.h>
DWORD WINAPI thread_proc(void *context) { DWORD WINAPI thread_proc(void *context) {
int subscript = -1; int subscript = -1;
char stack_buffer[42]; char stack_buffer[42];
stack_buffer[subscript] = 42; stack_buffer[subscript] = 42;
// CHECK: AddressSanitizer: stack-buffer-underflow on address [[ADDR:0x[0-9a-f]+]] // CHECK: AddressSanitizer: stack-buffer-underflow on address [[ADDR:0x[0-9a-f]+]]
// CHECK: WRITE of size 1 at [[ADDR]] thread T1 // CHECK: WRITE of size 1 at [[ADDR]] thread T1
// CHECK-NEXT: thread_proc{{.*}}dll_thread_stack_array_left_oob.cpp:[[@LINE-3]] // CHECK-NEXT: thread_proc{{.*}}dll_thread_stack_array_oob_before.cpp:[[@LINE-3]]
// //
// CHECK: Address [[ADDR]] is located in stack of thread T1 at offset [[OFFSET:.*]] in frame // CHECK: Address [[ADDR]] is located in stack of thread T1 at offset [[OFFSET:.*]] in frame
// CHECK-NEXT: thread_proc{{.*}}dll_thread_stack_array_left_oob.cpp // CHECK-NEXT: thread_proc{{.*}}dll_thread_stack_array_oob_before.cpp
// //
// CHECK: 'stack_buffer'{{.*}} <== Memory access at offset [[OFFSET]] underflows this variable // CHECK: 'stack_buffer'{{.*}} <== Memory access at offset [[OFFSET]] underflows this variable
return 0; return 0;
} }
extern "C" __declspec(dllexport) extern "C" __declspec(dllexport)
int test_function() { int test_function() {
HANDLE thr = CreateThread(NULL, 0, thread_proc, NULL, 0, NULL); HANDLE thr = CreateThread(NULL, 0, thread_proc, NULL, 0, NULL);
// CHECK-LABEL: Thread T1 created by T0 here: // CHECK-LABEL: Thread T1 created by T0 here:
// CHECK: test_function{{.*}}dll_thread_stack_array_left_oob.cpp:[[@LINE-2]] // CHECK: test_function{{.*}}dll_thread_stack_array_oob_before.cpp:[[@LINE-2]]
// CHECK-NEXT: main{{.*}}dll_host.cpp // CHECK-NEXT: main{{.*}}dll_host.cpp
// CHECK-LABEL: SUMMARY // CHECK-LABEL: SUMMARY
if (thr == 0) if (thr == 0)
return 1; return 1;
if (WAIT_OBJECT_0 != WaitForSingleObject(thr, INFINITE)) if (WAIT_OBJECT_0 != WaitForSingleObject(thr, INFINITE))
return 2; return 2;
return 0; return 0;
} }

compiler-rt/test/asan/TestCases/Windows/malloc_left_oob.cpp

  • This file was moved to compiler-rt/test/asan/TestCases/Windows/malloc_oob_before.cpp.

compiler-rt/test/asan/TestCases/Windows/malloc_oob_after.cpp

  • This file was moved from compiler-rt/test/asan/TestCases/Windows/malloc_right_oob.cpp.
// RUN: %clang_cl_asan -Od %s -Fe%t // RUN: %clang_cl_asan -Od %s -Fe%t
// RUN: not %run %t 2>&1 | FileCheck %s // RUN: not %run %t 2>&1 | FileCheck %s
#include <malloc.h> #include <malloc.h>
int main() { int main() {
char *buffer = (char*)malloc(42); char *buffer = (char*)malloc(42);
buffer[42] = 42; buffer[42] = 42;
// CHECK: AddressSanitizer: heap-buffer-overflow on address [[ADDR:0x[0-9a-f]+]] // CHECK: AddressSanitizer: heap-buffer-overflow on address [[ADDR:0x[0-9a-f]+]]
// CHECK: WRITE of size 1 at [[ADDR]] thread T0 // CHECK: WRITE of size 1 at [[ADDR]] thread T0
// CHECK-NEXT: {{#0 .* main .*malloc_right_oob.cpp}}:[[@LINE-3]] // CHECK-NEXT: {{#0 .* main .*malloc_oob_after.cpp}}:[[@LINE-3]]
// CHECK: [[ADDR]] is located 0 bytes after 42-byte region // CHECK: [[ADDR]] is located 0 bytes after 42-byte region
// CHECK: allocated by thread T0 here: // CHECK: allocated by thread T0 here:
// CHECK-NEXT: {{#0 .* malloc }} // CHECK-NEXT: {{#0 .* malloc }}
// CHECK-NEXT: {{#1 .* main .*malloc_right_oob.cpp}}:[[@LINE-8]] // CHECK-NEXT: {{#1 .* main .*malloc_oob_after.cpp}}:[[@LINE-8]]
free(buffer); free(buffer);
} }

compiler-rt/test/asan/TestCases/Windows/malloc_oob_before.cpp

  • This file was moved from compiler-rt/test/asan/TestCases/Windows/malloc_left_oob.cpp.
// RUN: %clang_cl_asan -Od %s -Fe%t // RUN: %clang_cl_asan -Od %s -Fe%t
// RUN: not %run %t 2>&1 | FileCheck %s // RUN: not %run %t 2>&1 | FileCheck %s
#include <malloc.h> #include <malloc.h>
int main() { int main() {
char *buffer = (char*)malloc(42); char *buffer = (char*)malloc(42);
buffer[-1] = 42; buffer[-1] = 42;
// CHECK: AddressSanitizer: heap-buffer-overflow on address [[ADDR:0x[0-9a-f]+]] // CHECK: AddressSanitizer: heap-buffer-overflow on address [[ADDR:0x[0-9a-f]+]]
// CHECK: WRITE of size 1 at [[ADDR]] thread T0 // CHECK: WRITE of size 1 at [[ADDR]] thread T0
// CHECK-NEXT: {{#0 .* main .*malloc_left_oob.cpp}}:[[@LINE-3]] // CHECK-NEXT: {{#0 .* main .*malloc_oob_before.cpp}}:[[@LINE-3]]
// CHECK: [[ADDR]] is located 1 bytes before 42-byte region // CHECK: [[ADDR]] is located 1 bytes before 42-byte region
// CHECK: allocated by thread T0 here: // CHECK: allocated by thread T0 here:
// CHECK-NEXT: {{#0 .* malloc }} // CHECK-NEXT: {{#0 .* malloc }}
// CHECK-NEXT: {{#1 .* main .*malloc_left_oob.cpp}}:[[@LINE-8]] // CHECK-NEXT: {{#1 .* main .*malloc_oob_before.cpp}}:[[@LINE-8]]
free(buffer); free(buffer);
} }

compiler-rt/test/asan/TestCases/Windows/malloc_right_oob.cpp

  • This file was moved to compiler-rt/test/asan/TestCases/Windows/malloc_oob_after.cpp.

compiler-rt/test/asan/TestCases/Windows/operator_array_new_left_oob.cpp

  • This file was moved to compiler-rt/test/asan/TestCases/Windows/operator_array_new_oob_before.cpp.

compiler-rt/test/asan/TestCases/Windows/operator_array_new_oob_after.cpp

  • This file was moved from compiler-rt/test/asan/TestCases/Windows/operator_array_new_right_oob.cpp.
// RUN: %clang_cl_asan -Od %s -Fe%t // RUN: %clang_cl_asan -Od %s -Fe%t
// RUN: not %run %t 2>&1 | FileCheck %s // RUN: not %run %t 2>&1 | FileCheck %s
#include <windows.h> #include <windows.h>
int main() { int main() {
char *buffer = new char[42]; char *buffer = new char[42];
buffer[42] = 42; buffer[42] = 42;
// CHECK: AddressSanitizer: heap-buffer-overflow on address [[ADDR:0x[0-9a-f]+]] // CHECK: AddressSanitizer: heap-buffer-overflow on address [[ADDR:0x[0-9a-f]+]]
// CHECK: WRITE of size 1 at [[ADDR]] thread T0 // CHECK: WRITE of size 1 at [[ADDR]] thread T0
// CHECK: {{#0 .* main .*operator_array_new_right_oob.cpp}}:[[@LINE-3]] // CHECK: {{#0 .* main .*operator_array_new_oob_after.cpp}}:[[@LINE-3]]
// CHECK: [[ADDR]] is located 0 bytes after 42-byte region // CHECK: [[ADDR]] is located 0 bytes after 42-byte region
// CHECK: allocated by thread T0 here: // CHECK: allocated by thread T0 here:
// FIXME: The 'operator new' frame should have []. // FIXME: The 'operator new' frame should have [].
// CHECK: {{#0 .* operator new}} // CHECK: {{#0 .* operator new}}
// CHECK: {{#1 .* main .*operator_array_new_right_oob.cpp}}:[[@LINE-9]] // CHECK: {{#1 .* main .*operator_array_new_oob_after.cpp}}:[[@LINE-9]]
delete [] buffer; delete [] buffer;
} }

compiler-rt/test/asan/TestCases/Windows/operator_array_new_oob_before.cpp

  • This file was moved from compiler-rt/test/asan/TestCases/Windows/operator_array_new_left_oob.cpp.
// RUN: %clang_cl_asan -Od %s -Fe%t // RUN: %clang_cl_asan -Od %s -Fe%t
// RUN: not %run %t 2>&1 | FileCheck %s // RUN: not %run %t 2>&1 | FileCheck %s
int main() { int main() {
char *buffer = new char[42]; char *buffer = new char[42];
buffer[-1] = 42; buffer[-1] = 42;
// CHECK: AddressSanitizer: heap-buffer-overflow on address [[ADDR:0x[0-9a-f]+]] // CHECK: AddressSanitizer: heap-buffer-overflow on address [[ADDR:0x[0-9a-f]+]]
// CHECK: WRITE of size 1 at [[ADDR]] thread T0 // CHECK: WRITE of size 1 at [[ADDR]] thread T0
// CHECK-NEXT: {{#0 .* main .*operator_array_new_left_oob.cpp}}:[[@LINE-3]] // CHECK-NEXT: {{#0 .* main .*operator_array_new_oob_before.cpp}}:[[@LINE-3]]
// //
// CHECK: [[ADDR]] is located 1 bytes before 42-byte region // CHECK: [[ADDR]] is located 1 bytes before 42-byte region
// CHECK-LABEL: allocated by thread T0 here: // CHECK-LABEL: allocated by thread T0 here:
// FIXME: The 'operator new' frame should have []. // FIXME: The 'operator new' frame should have [].
// CHECK-NEXT: {{#0 .* operator new}} // CHECK-NEXT: {{#0 .* operator new}}
// CHECK-NEXT: {{#1 .* main .*operator_array_new_left_oob.cpp}}:[[@LINE-10]] // CHECK-NEXT: {{#1 .* main .*operator_array_new_oob_before.cpp}}:[[@LINE-10]]
delete [] buffer; delete [] buffer;
} }

compiler-rt/test/asan/TestCases/Windows/operator_array_new_right_oob.cpp

  • This file was moved to compiler-rt/test/asan/TestCases/Windows/operator_array_new_oob_after.cpp.

compiler-rt/test/asan/TestCases/Windows/operator_array_new_with_dtor_left_oob.cpp

  • This file was moved to compiler-rt/test/asan/TestCases/Windows/operator_array_new_with_dtor_oob_before.cpp.

compiler-rt/test/asan/TestCases/Windows/operator_array_new_with_dtor_oob_before.cpp

  • This file was moved from compiler-rt/test/asan/TestCases/Windows/operator_array_new_with_dtor_left_oob.cpp.
// RUN: %clang_cl_asan -Od %s -Fe%t // RUN: %clang_cl_asan -Od %s -Fe%t
// RUN: not %run %t 2>&1 | FileCheck %s // RUN: not %run %t 2>&1 | FileCheck %s
struct C { struct C {
int x; int x;
~C() {} ~C() {}
}; };
int __attribute__((noinline, optnone)) hide(int x) { return x; } int __attribute__((noinline, optnone)) hide(int x) { return x; }
int main() { int main() {
C *buffer = new C[42]; C *buffer = new C[42];
buffer[hide(-(1 + (int)sizeof(void*) / 4))].x = 42; buffer[hide(-(1 + (int)sizeof(void*) / 4))].x = 42;
// CHECK: AddressSanitizer: heap-buffer-overflow on address [[ADDR:0x[0-9a-f]+]] // CHECK: AddressSanitizer: heap-buffer-overflow on address [[ADDR:0x[0-9a-f]+]]
// CHECK: WRITE of size 4 at [[ADDR]] thread T0 // CHECK: WRITE of size 4 at [[ADDR]] thread T0
// CHECK-NEXT: {{#0 .* main .*operator_array_new_with_dtor_left_oob.cpp}}:[[@LINE-3]] // CHECK-NEXT: {{#0 .* main .*operator_array_new_with_dtor_oob_before.cpp}}:[[@LINE-3]]
// //
// FIXME: Currently it says "4 bytes ... left of 172-byte region", // FIXME: Currently it says "4 bytes ... left of 172-byte region",
// should be "8 bytes ... left of 168-byte region", see // should be "8 bytes ... left of 168-byte region", see
// https://code.google.com/p/address-sanitizer/issues/detail?id=314 // https://code.google.com/p/address-sanitizer/issues/detail?id=314
// CHECK: [[ADDR]] is located {{.*}} bytes before {{(172|176)}}-byte region // CHECK: [[ADDR]] is located {{.*}} bytes before {{(172|176)}}-byte region
// CHECK-LABEL: allocated by thread T0 here: // CHECK-LABEL: allocated by thread T0 here:
// FIXME: The 'operator new' frame should have []. // FIXME: The 'operator new' frame should have [].
// CHECK-NEXT: {{#0 .* operator new}} // CHECK-NEXT: {{#0 .* operator new}}
// CHECK-NEXT: {{#1 .* main .*operator_array_new_with_dtor_left_oob.cpp}}:[[@LINE-13]] // CHECK-NEXT: {{#1 .* main .*operator_array_new_with_dtor_oob_before.cpp}}:[[@LINE-13]]
delete [] buffer; delete [] buffer;
} }

compiler-rt/test/asan/TestCases/Windows/operator_new_left_oob.cpp

  • This file was moved to compiler-rt/test/asan/TestCases/Windows/operator_new_oob_before.cpp.

compiler-rt/test/asan/TestCases/Windows/operator_new_oob_after.cpp

  • This file was moved from compiler-rt/test/asan/TestCases/Windows/operator_new_right_oob.cpp.
// RUN: %clang_cl_asan -Od %s -Fe%t // RUN: %clang_cl_asan -Od %s -Fe%t
// RUN: not %run %t 2>&1 | FileCheck %s // RUN: not %run %t 2>&1 | FileCheck %s
#include <windows.h> #include <windows.h>
int main() { int main() {
char *buffer = new char; char *buffer = new char;
buffer[1] = 42; buffer[1] = 42;
// CHECK: AddressSanitizer: heap-buffer-overflow on address [[ADDR:0x[0-9a-f]+]] // CHECK: AddressSanitizer: heap-buffer-overflow on address [[ADDR:0x[0-9a-f]+]]
// CHECK: WRITE of size 1 at [[ADDR]] thread T0 // CHECK: WRITE of size 1 at [[ADDR]] thread T0
// CHECK: {{#0 .* main .*operator_new_right_oob.cpp}}:[[@LINE-3]] // CHECK: {{#0 .* main .*operator_new_oob_after.cpp}}:[[@LINE-3]]
// CHECK: [[ADDR]] is located 0 bytes after 1-byte region // CHECK: [[ADDR]] is located 0 bytes after 1-byte region
// CHECK: allocated by thread T0 here: // CHECK: allocated by thread T0 here:
// CHECK: {{#0 .* operator new}} // CHECK: {{#0 .* operator new}}
// CHECK: {{#1 .* main .*operator_new_right_oob.cpp}}:[[@LINE-8]] // CHECK: {{#1 .* main .*operator_new_oob_after.cpp}}:[[@LINE-8]]
delete buffer; delete buffer;
} }

compiler-rt/test/asan/TestCases/Windows/operator_new_oob_before.cpp

  • This file was moved from compiler-rt/test/asan/TestCases/Windows/operator_new_left_oob.cpp.
// RUN: %clang_cl_asan -Od %s -Fe%t // RUN: %clang_cl_asan -Od %s -Fe%t
// RUN: not %run %t 2>&1 | FileCheck %s // RUN: not %run %t 2>&1 | FileCheck %s
#include <windows.h> #include <windows.h>
int main() { int main() {
char *buffer = new char; char *buffer = new char;
buffer[-1] = 42; buffer[-1] = 42;
// CHECK: AddressSanitizer: heap-buffer-overflow on address [[ADDR:0x[0-9a-f]+]] // CHECK: AddressSanitizer: heap-buffer-overflow on address [[ADDR:0x[0-9a-f]+]]
// CHECK: WRITE of size 1 at [[ADDR]] thread T0 // CHECK: WRITE of size 1 at [[ADDR]] thread T0
// CHECK: {{#0 .* main .*operator_new_left_oob.cpp}}:[[@LINE-3]] // CHECK: {{#0 .* main .*operator_new_oob_before.cpp}}:[[@LINE-3]]
// CHECK: [[ADDR]] is located 1 bytes before 1-byte region // CHECK: [[ADDR]] is located 1 bytes before 1-byte region
// CHECK: allocated by thread T0 here: // CHECK: allocated by thread T0 here:
// CHECK: {{#0 .* operator new}} // CHECK: {{#0 .* operator new}}
// CHECK: {{#1 .* main .*operator_new_left_oob.cpp}}:[[@LINE-8]] // CHECK: {{#1 .* main .*operator_new_oob_before.cpp}}:[[@LINE-8]]
delete buffer; delete buffer;
} }

compiler-rt/test/asan/TestCases/Windows/operator_new_right_oob.cpp

  • This file was moved to compiler-rt/test/asan/TestCases/Windows/operator_new_oob_after.cpp.

compiler-rt/test/asan/TestCases/Windows/realloc_left_oob.cpp

  • This file was moved to compiler-rt/test/asan/TestCases/Windows/realloc_oob_before.cpp.

compiler-rt/test/asan/TestCases/Windows/realloc_oob_after.cpp

  • This file was moved from compiler-rt/test/asan/TestCases/Windows/realloc_right_oob.cpp.
// RUN: %clang_cl_asan -Od %s -Fe%t // RUN: %clang_cl_asan -Od %s -Fe%t
// RUN: not %run %t 2>&1 | FileCheck %s // RUN: not %run %t 2>&1 | FileCheck %s
#include <malloc.h> #include <malloc.h>
int main() { int main() {
char *buffer = (char*)realloc(0, 42); char *buffer = (char*)realloc(0, 42);
buffer[42] = 42; buffer[42] = 42;
// CHECK: AddressSanitizer: heap-buffer-overflow on address [[ADDR:0x[0-9a-f]+]] // CHECK: AddressSanitizer: heap-buffer-overflow on address [[ADDR:0x[0-9a-f]+]]
// CHECK: WRITE of size 1 at [[ADDR]] thread T0 // CHECK: WRITE of size 1 at [[ADDR]] thread T0
// CHECK-NEXT: {{#0 .* main .*realloc_right_oob.cpp}}:[[@LINE-3]] // CHECK-NEXT: {{#0 .* main .*realloc_oob_after.cpp}}:[[@LINE-3]]
// CHECK: [[ADDR]] is located 0 bytes after 42-byte region // CHECK: [[ADDR]] is located 0 bytes after 42-byte region
// CHECK: allocated by thread T0 here: // CHECK: allocated by thread T0 here:
// CHECK-NEXT: {{#0 .* realloc }} // CHECK-NEXT: {{#0 .* realloc }}
// CHECK-NEXT: {{#1 .* main .*realloc_right_oob.cpp}}:[[@LINE-8]] // CHECK-NEXT: {{#1 .* main .*realloc_oob_after.cpp}}:[[@LINE-8]]
free(buffer); free(buffer);
} }

compiler-rt/test/asan/TestCases/Windows/realloc_oob_before.cpp

  • This file was moved from compiler-rt/test/asan/TestCases/Windows/realloc_left_oob.cpp.
// RUN: %clang_cl_asan -Od %s -Fe%t // RUN: %clang_cl_asan -Od %s -Fe%t
// RUN: not %run %t 2>&1 | FileCheck %s // RUN: not %run %t 2>&1 | FileCheck %s
#include <malloc.h> #include <malloc.h>
int main() { int main() {
char *buffer = (char*)realloc(0, 42); char *buffer = (char*)realloc(0, 42);
buffer[-1] = 42; buffer[-1] = 42;
// CHECK: AddressSanitizer: heap-buffer-overflow on address [[ADDR:0x[0-9a-f]+]] // CHECK: AddressSanitizer: heap-buffer-overflow on address [[ADDR:0x[0-9a-f]+]]
// CHECK: WRITE of size 1 at [[ADDR]] thread T0 // CHECK: WRITE of size 1 at [[ADDR]] thread T0
// CHECK-NEXT: {{#0 .* main .*realloc_left_oob.cpp}}:[[@LINE-3]] // CHECK-NEXT: {{#0 .* main .*realloc_oob_before.cpp}}:[[@LINE-3]]
// CHECK: [[ADDR]] is located 1 bytes before 42-byte region // CHECK: [[ADDR]] is located 1 bytes before 42-byte region
// CHECK: allocated by thread T0 here: // CHECK: allocated by thread T0 here:
// CHECK-NEXT: {{#0 .* realloc }} // CHECK-NEXT: {{#0 .* realloc }}
// CHECK-NEXT: {{#1 .* main .*realloc_left_oob.cpp}}:[[@LINE-8]] // CHECK-NEXT: {{#1 .* main .*realloc_oob_before.cpp}}:[[@LINE-8]]
free(buffer); free(buffer);
} }

compiler-rt/test/asan/TestCases/Windows/realloc_right_oob.cpp

  • This file was moved to compiler-rt/test/asan/TestCases/Windows/realloc_oob_after.cpp.

compiler-rt/test/asan/TestCases/Windows/stack_array_left_oob.cpp

  • This file was moved to compiler-rt/test/asan/TestCases/Windows/stack_array_oob_before.cpp.

compiler-rt/test/asan/TestCases/Windows/stack_array_oob_after.cpp

  • This file was moved from compiler-rt/test/asan/TestCases/Windows/stack_array_right_oob.cpp.
// RUN: %clang_cl_asan -Od %s -Fe%t // RUN: %clang_cl_asan -Od %s -Fe%t
// RUN: not %run %t 2>&1 | FileCheck %s // RUN: not %run %t 2>&1 | FileCheck %s
#include <stdio.h> #include <stdio.h>
int main() { int main() {
int subscript = 42; int subscript = 42;
char buffer[42]; char buffer[42];
buffer[subscript] = 42; buffer[subscript] = 42;
// CHECK: AddressSanitizer: stack-buffer-overflow on address [[ADDR:0x[0-9a-f]+]] // CHECK: AddressSanitizer: stack-buffer-overflow on address [[ADDR:0x[0-9a-f]+]]
// CHECK: WRITE of size 1 at [[ADDR]] thread T0 // CHECK: WRITE of size 1 at [[ADDR]] thread T0
// CHECK-NEXT: {{#0 .* main .*stack_array_right_oob.cpp}}:[[@LINE-3]] // CHECK-NEXT: {{#0 .* main .*stack_array_oob_after.cpp}}:[[@LINE-3]]
// CHECK: Address [[ADDR]] is located in stack of thread T0 at offset [[OFFSET:.*]] in frame // CHECK: Address [[ADDR]] is located in stack of thread T0 at offset [[OFFSET:.*]] in frame
// CHECK-NEXT: {{#0 .* main .*stack_array_right_oob.cpp}} // CHECK-NEXT: {{#0 .* main .*stack_array_oob_after.cpp}}
// CHECK: 'buffer'{{.*}} <== Memory access at offset [[OFFSET]] overflows this variable // CHECK: 'buffer'{{.*}} <== Memory access at offset [[OFFSET]] overflows this variable
} }

compiler-rt/test/asan/TestCases/Windows/stack_array_oob_before.cpp

  • This file was moved from compiler-rt/test/asan/TestCases/Windows/stack_array_left_oob.cpp.
// RUN: %clang_cl_asan -Od %s -Fe%t // RUN: %clang_cl_asan -Od %s -Fe%t
// RUN: not %run %t 2>&1 | FileCheck %s // RUN: not %run %t 2>&1 | FileCheck %s
#include <stdio.h> #include <stdio.h>
int main() { int main() {
int subscript = -1; int subscript = -1;
char buffer[42]; char buffer[42];
buffer[subscript] = 42; buffer[subscript] = 42;
// CHECK: AddressSanitizer: stack-buffer-underflow on address [[ADDR:0x[0-9a-f]+]] // CHECK: AddressSanitizer: stack-buffer-underflow on address [[ADDR:0x[0-9a-f]+]]
// CHECK: WRITE of size 1 at [[ADDR]] thread T0 // CHECK: WRITE of size 1 at [[ADDR]] thread T0
// CHECK-NEXT: {{#0 .* main .*stack_array_left_oob.cpp}}:[[@LINE-3]] // CHECK-NEXT: {{#0 .* main .*stack_array_oob_before.cpp}}:[[@LINE-3]]
// CHECK: Address [[ADDR]] is located in stack of thread T0 at offset [[OFFSET:.*]] in frame // CHECK: Address [[ADDR]] is located in stack of thread T0 at offset [[OFFSET:.*]] in frame
// CHECK-NEXT: {{#0 .* main .*stack_array_left_oob.cpp}} // CHECK-NEXT: {{#0 .* main .*stack_array_oob_before.cpp}}
// CHECK: 'buffer'{{.*}} <== Memory access at offset [[OFFSET]] underflows this variable // CHECK: 'buffer'{{.*}} <== Memory access at offset [[OFFSET]] underflows this variable
} }

compiler-rt/test/asan/TestCases/Windows/stack_array_right_oob.cpp

  • This file was moved to compiler-rt/test/asan/TestCases/Windows/stack_array_oob_after.cpp.

compiler-rt/test/asan/TestCases/Windows/thread_stack_array_left_oob.cpp

  • This file was moved to compiler-rt/test/asan/TestCases/Windows/thread_stack_array_oob_before.cpp.

compiler-rt/test/asan/TestCases/Windows/thread_stack_array_oob_after.cpp

  • This file was moved from compiler-rt/test/asan/TestCases/Windows/thread_stack_array_right_oob.cpp.
// RUN: %clang_cl_asan -Od %s -Fe%t // RUN: %clang_cl_asan -Od %s -Fe%t
// RUN: not %run %t 2>&1 | FileCheck %s // RUN: not %run %t 2>&1 | FileCheck %s
#include <windows.h> #include <windows.h>
DWORD WINAPI thread_proc(void *) { DWORD WINAPI thread_proc(void *) {
int subscript = 42; int subscript = 42;
volatile char stack_buffer[42]; volatile char stack_buffer[42];
stack_buffer[subscript] = 42; stack_buffer[subscript] = 42;
// CHECK: AddressSanitizer: stack-buffer-overflow on address [[ADDR:0x[0-9a-f]+]] // CHECK: AddressSanitizer: stack-buffer-overflow on address [[ADDR:0x[0-9a-f]+]]
// CHECK: WRITE of size 1 at [[ADDR]] thread T1 // CHECK: WRITE of size 1 at [[ADDR]] thread T1
// CHECK: {{#0 .* thread_proc.*thread_stack_array_right_oob.cpp}}:[[@LINE-3]] // CHECK: {{#0 .* thread_proc.*thread_stack_array_oob_after.cpp}}:[[@LINE-3]]
// CHECK: Address [[ADDR]] is located in stack of thread T1 at offset {{.*}} in frame // CHECK: Address [[ADDR]] is located in stack of thread T1 at offset {{.*}} in frame
// CHECK: thread_proc // CHECK: thread_proc
return 0; return 0;
} }
int main(void) { int main(void) {
HANDLE thr = CreateThread(NULL, 0, thread_proc, NULL, 0, NULL); HANDLE thr = CreateThread(NULL, 0, thread_proc, NULL, 0, NULL);
// CHECK: Thread T1 created by T0 here: // CHECK: Thread T1 created by T0 here:
// CHECK: {{#[01] .* main .*thread_stack_array_right_oob.cpp}}:[[@LINE-2]] // CHECK: {{#[01] .* main .*thread_stack_array_oob_after.cpp}}:[[@LINE-2]]
// A failure to create a thread should fail the test! // A failure to create a thread should fail the test!
if (thr == 0) return 0; if (thr == 0) return 0;
WaitForSingleObject(thr, INFINITE); WaitForSingleObject(thr, INFINITE);
} }

compiler-rt/test/asan/TestCases/Windows/thread_stack_array_oob_before.cpp

  • This file was moved from compiler-rt/test/asan/TestCases/Windows/thread_stack_array_left_oob.cpp.
// RUN: %clang_cl_asan -Od %s -Fe%t // RUN: %clang_cl_asan -Od %s -Fe%t
// RUN: not %run %t 2>&1 | FileCheck %s // RUN: not %run %t 2>&1 | FileCheck %s
#include <windows.h> #include <windows.h>
DWORD WINAPI thread_proc(void *) { DWORD WINAPI thread_proc(void *) {
int subscript = -1; int subscript = -1;
volatile char stack_buffer[42]; volatile char stack_buffer[42];
stack_buffer[subscript] = 42; stack_buffer[subscript] = 42;
// CHECK: AddressSanitizer: stack-buffer-underflow on address [[ADDR:0x[0-9a-f]+]] // CHECK: AddressSanitizer: stack-buffer-underflow on address [[ADDR:0x[0-9a-f]+]]
// CHECK: WRITE of size 1 at [[ADDR]] thread T1 // CHECK: WRITE of size 1 at [[ADDR]] thread T1
// CHECK: {{#0 .* thread_proc.*thread_stack_array_left_oob.cpp}}:[[@LINE-3]] // CHECK: {{#0 .* thread_proc.*thread_stack_array_oob_before.cpp}}:[[@LINE-3]]
// CHECK: Address [[ADDR]] is located in stack of thread T1 at offset {{.*}} in frame // CHECK: Address [[ADDR]] is located in stack of thread T1 at offset {{.*}} in frame
// CHECK: thread_proc // CHECK: thread_proc
return 0; return 0;
} }
int main() { int main() {
HANDLE thr = CreateThread(NULL, 0, thread_proc, NULL, 0, NULL); HANDLE thr = CreateThread(NULL, 0, thread_proc, NULL, 0, NULL);
// CHECK: Thread T1 created by T0 here: // CHECK: Thread T1 created by T0 here:
// CHECK: {{#[01] .* main .*thread_stack_array_left_oob.cpp}}:[[@LINE-2]] // CHECK: {{#[01] .* main .*thread_stack_array_oob_before.cpp}}:[[@LINE-2]]
// A failure to create a thread should fail the test! // A failure to create a thread should fail the test!
if (thr == 0) return 0; if (thr == 0) return 0;
WaitForSingleObject(thr, INFINITE); WaitForSingleObject(thr, INFINITE);
} }

compiler-rt/test/asan/TestCases/Windows/thread_stack_array_right_oob.cpp

  • This file was moved to compiler-rt/test/asan/TestCases/Windows/thread_stack_array_oob_after.cpp.

llvm/include/llvm/Transforms/Utils/ASanStackFrameLayout.h

Show All 14 Lines
#include "llvm/ADT/SmallVector.h" #include "llvm/ADT/SmallVector.h"
namespace llvm { namespace llvm {
class AllocaInst; class AllocaInst;
// These magic constants should be the same as in // These magic constants should be the same as in
// in asan_internal.h from ASan runtime in compiler-rt. // in asan_internal.h from ASan runtime in compiler-rt.
static const int kAsanStackLeftRedzoneMagic = 0xf1; static const int kAsanStackFrontRedzoneMagic = 0xf1;
static const int kAsanStackMidRedzoneMagic = 0xf2; static const int kAsanStackMidRedzoneMagic = 0xf2;
static const int kAsanStackRightRedzoneMagic = 0xf3; static const int kAsanStackBackRedzoneMagic = 0xf3;
static const int kAsanStackUseAfterReturnMagic = 0xf5; static const int kAsanStackUseAfterReturnMagic = 0xf5;
static const int kAsanStackUseAfterScopeMagic = 0xf8; static const int kAsanStackUseAfterScopeMagic = 0xf8;
// Input/output data struct for ComputeASanStackFrameLayout. // Input/output data struct for ComputeASanStackFrameLayout.
struct ASanStackVariableDescription { struct ASanStackVariableDescription {
const char *Name; // Name of the variable that will be displayed by asan const char *Name; // Name of the variable that will be displayed by asan
// if a stack-related bug is reported. // if a stack-related bug is reported.
uint64_t Size; // Size of the variable in bytes. uint64_t Size; // Size of the variable in bytes.
▲ Show 20 Lines • Show All 47 Lines • Show Last 20 Lines

llvm/lib/Transforms/Instrumentation/AddressSanitizer.cpp

Show First 20 Lines • Show All 2,259 Lines • ▼ Show 20 Lines for (size_t i = 0; i < n; i++) {
// library. This could save ~0.4% of VM size for a private large binary. // library. This could save ~0.4% of VM size for a private large binary.
std::string NameForGlobal = llvm::demangle(G->getName().str()); std::string NameForGlobal = llvm::demangle(G->getName().str());
GlobalVariable *Name = GlobalVariable *Name =
createPrivateGlobalForString(M, NameForGlobal, createPrivateGlobalForString(M, NameForGlobal,
/*AllowMerging*/ true, kAsanGenPrefix); /*AllowMerging*/ true, kAsanGenPrefix);
Type *Ty = G->getValueType(); Type *Ty = G->getValueType();
const uint64_t SizeInBytes = DL.getTypeAllocSize(Ty); const uint64_t SizeInBytes = DL.getTypeAllocSize(Ty);
const uint64_t RightRedzoneSize = getRedzoneSizeForGlobal(SizeInBytes); const uint64_t SucceedingRedzoneSize = getRedzoneSizeForGlobal(SizeInBytes);
Type *RightRedZoneTy = ArrayType::get(IRB.getInt8Ty(), RightRedzoneSize); Type *RightRedZoneTy =
ArrayType::get(IRB.getInt8Ty(), SucceedingRedzoneSize);
StructType *NewTy = StructType::get(Ty, RightRedZoneTy); StructType *NewTy = StructType::get(Ty, RightRedZoneTy);
Constant *NewInitializer = ConstantStruct::get( Constant *NewInitializer = ConstantStruct::get(
NewTy, G->getInitializer(), Constant::getNullValue(RightRedZoneTy)); NewTy, G->getInitializer(), Constant::getNullValue(RightRedZoneTy));
// Create a new global variable with enough space for a redzone. // Create a new global variable with enough space for a redzone.
GlobalValue::LinkageTypes Linkage = G->getLinkage(); GlobalValue::LinkageTypes Linkage = G->getLinkage();
if (G->isConstant() && Linkage == GlobalValue::PrivateLinkage) if (G->isConstant() && Linkage == GlobalValue::PrivateLinkage)
▲ Show 20 Lines • Show All 63 Lines • ▼ Show 20 Lines if (NewGlobal->hasLocalLinkage()) {
ODRIndicatorSym->setAlignment(Align(1)); ODRIndicatorSym->setAlignment(Align(1));
ODRIndicator = ODRIndicatorSym; ODRIndicator = ODRIndicatorSym;
} }
Constant *Initializer = ConstantStruct::get( Constant *Initializer = ConstantStruct::get(
GlobalStructTy, GlobalStructTy,
ConstantExpr::getPointerCast(InstrumentedGlobal, IntptrTy), ConstantExpr::getPointerCast(InstrumentedGlobal, IntptrTy),
ConstantInt::get(IntptrTy, SizeInBytes), ConstantInt::get(IntptrTy, SizeInBytes),
ConstantInt::get(IntptrTy, SizeInBytes + RightRedzoneSize), ConstantInt::get(IntptrTy, SizeInBytes + SucceedingRedzoneSize),
ConstantExpr::getPointerCast(Name, IntptrTy), ConstantExpr::getPointerCast(Name, IntptrTy),
ConstantExpr::getPointerCast(ModuleName, IntptrTy), ConstantExpr::getPointerCast(ModuleName, IntptrTy),
ConstantInt::get(IntptrTy, MD.IsDynInit), ConstantInt::get(IntptrTy, MD.IsDynInit),
Constant::getNullValue(IntptrTy), Constant::getNullValue(IntptrTy),
ConstantExpr::getPointerCast(ODRIndicator, IntptrTy)); ConstantExpr::getPointerCast(ODRIndicator, IntptrTy));
if (ClInitializers && MD.IsDynInit) if (ClInitializers && MD.IsDynInit)
HasDynamicallyInitializedGlobals = true; HasDynamicallyInitializedGlobals = true;
▲ Show 20 Lines • Show All 1,098 Lines • Show Last 20 Lines

llvm/lib/Transforms/Utils/ASanStackFrameLayout.cpp

Show First 20 Lines • Show All 112 Lines • ▼ Show 20 Lines
SmallVector<uint8_t, 64> SmallVector<uint8_t, 64>
GetShadowBytes(const SmallVectorImpl<ASanStackVariableDescription> &Vars, GetShadowBytes(const SmallVectorImpl<ASanStackVariableDescription> &Vars,
const ASanStackFrameLayout &Layout) { const ASanStackFrameLayout &Layout) {
assert(Vars.size() > 0); assert(Vars.size() > 0);
SmallVector<uint8_t, 64> SB; SmallVector<uint8_t, 64> SB;
SB.clear(); SB.clear();
const uint64_t Granularity = Layout.Granularity; const uint64_t Granularity = Layout.Granularity;
SB.resize(Vars[0].Offset / Granularity, kAsanStackLeftRedzoneMagic); SB.resize(Vars[0].Offset / Granularity, kAsanStackFrontRedzoneMagic);
for (const auto &Var : Vars) { for (const auto &Var : Vars) {
SB.resize(Var.Offset / Granularity, kAsanStackMidRedzoneMagic); SB.resize(Var.Offset / Granularity, kAsanStackMidRedzoneMagic);
SB.resize(SB.size() + Var.Size / Granularity, 0); SB.resize(SB.size() + Var.Size / Granularity, 0);
if (Var.Size % Granularity) if (Var.Size % Granularity)
SB.push_back(Var.Size % Granularity); SB.push_back(Var.Size % Granularity);
} }
SB.resize(Layout.FrameSize / Granularity, kAsanStackRightRedzoneMagic); SB.resize(Layout.FrameSize / Granularity, kAsanStackBackRedzoneMagic);
return SB; return SB;
} }
SmallVector<uint8_t, 64> GetShadowBytesAfterScope( SmallVector<uint8_t, 64> GetShadowBytesAfterScope(
const SmallVectorImpl<ASanStackVariableDescription> &Vars, const SmallVectorImpl<ASanStackVariableDescription> &Vars,
const ASanStackFrameLayout &Layout) { const ASanStackFrameLayout &Layout) {
SmallVector<uint8_t, 64> SB = GetShadowBytes(Vars, Layout); SmallVector<uint8_t, 64> SB = GetShadowBytes(Vars, Layout);
const uint64_t Granularity = Layout.Granularity; const uint64_t Granularity = Layout.Granularity;
Show All 14 Lines

llvm/unittests/Transforms/Utils/ASanStackFrameLayoutTest.cpp

Show All 11 Lines
using namespace llvm; using namespace llvm;
static std::string static std::string
ShadowBytesToString(ArrayRef<uint8_t> ShadowBytes) { ShadowBytesToString(ArrayRef<uint8_t> ShadowBytes) {
std::ostringstream os; std::ostringstream os;
for (size_t i = 0, n = ShadowBytes.size(); i < n; i++) { for (size_t i = 0, n = ShadowBytes.size(); i < n; i++) {
switch (ShadowBytes[i]) { switch (ShadowBytes[i]) {
case kAsanStackLeftRedzoneMagic: os << "L"; break; case kAsanStackFrontRedzoneMagic: os << "F"; break;
case kAsanStackRightRedzoneMagic: os << "R"; break; case kAsanStackBackRedzoneMagic: os << "B"; break;
case kAsanStackMidRedzoneMagic: os << "M"; break; case kAsanStackMidRedzoneMagic: os << "M"; break;
case kAsanStackUseAfterScopeMagic: case kAsanStackUseAfterScopeMagic:
os << "S"; os << "S";
break; break;
default: os << (unsigned)ShadowBytes[i]; default: os << (unsigned)ShadowBytes[i];
} }
} }
return os.str(); return os.str();
Show All 34 Lines#define VAR(name, size, lifetime, alignment, line) \
VAR(a, 7, 0, 1, 0); VAR(a, 7, 0, 1, 0);
VAR(a, 8, 8, 1, 0); VAR(a, 8, 8, 1, 0);
VAR(a, 9, 0, 1, 0); VAR(a, 9, 0, 1, 0);
VAR(a, 16, 16, 1, 0); VAR(a, 16, 16, 1, 0);
VAR(a, 41, 9, 1, 7); VAR(a, 41, 9, 1, 7);
VAR(a, 105, 103, 1, 0); VAR(a, 105, 103, 1, 0);
VAR(a, 200, 97, 1, 0); VAR(a, 200, 97, 1, 0);
TEST_LAYOUT({a1_1}, 8, 16, "1 16 1 4 a1_1", "LL1R", "LL1R"); TEST_LAYOUT({a1_1}, 8, 16, "1 16 1 4 a1_1", "FF1B", "FF1B");
TEST_LAYOUT({a1_1}, 16, 16, "1 16 1 4 a1_1", "L1R", "L1R"); TEST_LAYOUT({a1_1}, 16, 16, "1 16 1 4 a1_1", "F1B", "F1B");
TEST_LAYOUT({a1_1}, 32, 32, "1 32 1 4 a1_1", "L1R", "L1R"); TEST_LAYOUT({a1_1}, 32, 32, "1 32 1 4 a1_1", "F1B", "F1B");
TEST_LAYOUT({a1_1}, 64, 64, "1 64 1 4 a1_1", "L1R", "L1R"); TEST_LAYOUT({a1_1}, 64, 64, "1 64 1 4 a1_1", "F1B", "F1B");
TEST_LAYOUT({p1_32}, 8, 32, "1 32 1 8 p1_32:15", "LLLL1RRR", "LLLL1RRR"); TEST_LAYOUT({p1_32}, 8, 32, "1 32 1 8 p1_32:15", "FFFF1BBB", "FFFF1BBB");
TEST_LAYOUT({p1_32}, 8, 64, "1 64 1 8 p1_32:15", "LLLLLLLL1RRRRRRR", TEST_LAYOUT({p1_32}, 8, 64, "1 64 1 8 p1_32:15", "FFFFFFFF1BBBBBBB",
"LLLLLLLL1RRRRRRR"); "FFFFFFFF1BBBBBBB");
TEST_LAYOUT({a1_1}, 8, 32, "1 32 1 4 a1_1", "LLLL1RRR", "LLLL1RRR"); TEST_LAYOUT({a1_1}, 8, 32, "1 32 1 4 a1_1", "FFFF1BBB", "FFFF1BBB");
TEST_LAYOUT({a2_1}, 8, 32, "1 32 2 4 a2_1", "LLLL2RRR", "LLLL2RRR"); TEST_LAYOUT({a2_1}, 8, 32, "1 32 2 4 a2_1", "FFFF2BBB", "FFFF2BBB");
TEST_LAYOUT({a3_1}, 8, 32, "1 32 3 4 a3_1", "LLLL3RRR", "LLLL3RRR"); TEST_LAYOUT({a3_1}, 8, 32, "1 32 3 4 a3_1", "FFFF3BBB", "FFFF3BBB");
TEST_LAYOUT({a4_1}, 8, 32, "1 32 4 4 a4_1", "LLLL4RRR", "LLLL4RRR"); TEST_LAYOUT({a4_1}, 8, 32, "1 32 4 4 a4_1", "FFFF4BBB", "FFFF4BBB");
TEST_LAYOUT({a7_1}, 8, 32, "1 32 7 4 a7_1", "LLLL7RRR", "LLLL7RRR"); TEST_LAYOUT({a7_1}, 8, 32, "1 32 7 4 a7_1", "FFFF7BBB", "FFFF7BBB");
TEST_LAYOUT({a8_1}, 8, 32, "1 32 8 4 a8_1", "LLLL0RRR", "LLLLSRRR"); TEST_LAYOUT({a8_1}, 8, 32, "1 32 8 4 a8_1", "FFFF0BBB", "FFFFSBBB");
TEST_LAYOUT({a9_1}, 8, 32, "1 32 9 4 a9_1", "LLLL01RR", "LLLL01RR"); TEST_LAYOUT({a9_1}, 8, 32, "1 32 9 4 a9_1", "FFFF01BB", "FFFF01BB");
TEST_LAYOUT({a16_1}, 8, 32, "1 32 16 5 a16_1", "LLLL00RR", "LLLLSSRR"); TEST_LAYOUT({a16_1}, 8, 32, "1 32 16 5 a16_1", "FFFF00BB", "FFFFSSBB");
TEST_LAYOUT({p1_256}, 8, 32, "1 256 1 11 p1_256:2700", TEST_LAYOUT({p1_256}, 8, 32, "1 256 1 11 p1_256:2700",
"LLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLL1RRR", "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF1BBB",
"LLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLL1RRR"); "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF1BBB");
TEST_LAYOUT({a41_1}, 8, 32, "1 32 41 7 a41_1:7", "LLLL000001RRRRRR", TEST_LAYOUT({a41_1}, 8, 32, "1 32 41 7 a41_1:7", "FFFF000001BBBBBB",
"LLLLSS0001RRRRRR"); "FFFFSS0001BBBBBB");
TEST_LAYOUT({a105_1}, 8, 32, "1 32 105 6 a105_1", "LLLL00000000000001RRRRRR", TEST_LAYOUT({a105_1}, 8, 32, "1 32 105 6 a105_1", "FFFF00000000000001BBBBBB",
"LLLLSSSSSSSSSSSSS1RRRRRR"); "FFFFSSSSSSSSSSSSS1BBBBBB");
{ {
SmallVector<ASanStackVariableDescription, 10> t = {a1_1, p1_256}; SmallVector<ASanStackVariableDescription, 10> t = {a1_1, p1_256};
TEST_LAYOUT(t, 8, 32, "2 256 1 11 p1_256:2700 272 1 4 a1_1", TEST_LAYOUT(t, 8, 32, "2 256 1 11 p1_256:2700 272 1 4 a1_1",
"LLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLL1M1R", "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF1M1B",
"LLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLL1M1R"); "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF1M1B");
} }
{ {
SmallVector<ASanStackVariableDescription, 10> t = {a1_1, a16_1, a41_1}; SmallVector<ASanStackVariableDescription, 10> t = {a1_1, a16_1, a41_1};
TEST_LAYOUT(t, 8, 32, "3 32 1 4 a1_1 48 16 5 a16_1 80 41 7 a41_1:7", TEST_LAYOUT(t, 8, 32, "3 32 1 4 a1_1 48 16 5 a16_1 80 41 7 a41_1:7",
"LLLL1M00MM000001RRRR", "LLLL1MSSMMSS0001RRRR"); "FFFF1M00MM000001BBBB", "FFFF1MSSMMSS0001BBBB");
} }
TEST_LAYOUT({a2_1}, 32, 32, "1 32 2 4 a2_1", "L2R", "L2R"); TEST_LAYOUT({a2_1}, 32, 32, "1 32 2 4 a2_1", "F2B", "F2B");
TEST_LAYOUT({a9_1}, 32, 32, "1 32 9 4 a9_1", "L9R", "L9R"); TEST_LAYOUT({a9_1}, 32, 32, "1 32 9 4 a9_1", "F9B", "F9B");
TEST_LAYOUT({a16_1}, 32, 32, "1 32 16 5 a16_1", "L16R", "LSR"); TEST_LAYOUT({a16_1}, 32, 32, "1 32 16 5 a16_1", "F16B", "FSB");
TEST_LAYOUT({p1_256}, 32, 32, "1 256 1 11 p1_256:2700", TEST_LAYOUT({p1_256}, 32, 32, "1 256 1 11 p1_256:2700",
"LLLLLLLL1R", "LLLLLLLL1R"); "FFFFFFFF1B", "FFFFFFFF1B");
TEST_LAYOUT({a41_1}, 32, 32, "1 32 41 7 a41_1:7", "L09R", TEST_LAYOUT({a41_1}, 32, 32, "1 32 41 7 a41_1:7", "F09B",
"LS9R"); "FS9B");
TEST_LAYOUT({a105_1}, 32, 32, "1 32 105 6 a105_1", "L0009R", TEST_LAYOUT({a105_1}, 32, 32, "1 32 105 6 a105_1", "F0009B",
"LSSSSR"); "FSSSSB");
TEST_LAYOUT({a200_1}, 32, 32, "1 32 200 6 a200_1", "L0000008RR", TEST_LAYOUT({a200_1}, 32, 32, "1 32 200 6 a200_1", "F0000008BB",
"LSSSS008RR"); "FSSSS008BB");
{ {
SmallVector<ASanStackVariableDescription, 10> t = {a1_1, p1_256}; SmallVector<ASanStackVariableDescription, 10> t = {a1_1, p1_256};
TEST_LAYOUT(t, 32, 32, "2 256 1 11 p1_256:2700 320 1 4 a1_1", TEST_LAYOUT(t, 32, 32, "2 256 1 11 p1_256:2700 320 1 4 a1_1",
"LLLLLLLL1M1R", "LLLLLLLL1M1R"); "FFFFFFFF1M1B", "FFFFFFFF1M1B");
} }
{ {
SmallVector<ASanStackVariableDescription, 10> t = {a1_1, a16_1, a41_1}; SmallVector<ASanStackVariableDescription, 10> t = {a1_1, a16_1, a41_1};
TEST_LAYOUT(t, 32, 32, "3 32 1 4 a1_1 96 16 5 a16_1 160 41 7 a41_1:7", TEST_LAYOUT(t, 32, 32, "3 32 1 4 a1_1 96 16 5 a16_1 160 41 7 a41_1:7",
"L1M16M09R", "L1MSMS9R"); "F1M16M09B", "F1MSMS9B");
} }
#undef VAR #undef VAR
#undef TEST_LAYOUT #undef TEST_LAYOUT
} }