Asan: utility function to determine first wrongly poisoned byte in container.

[kcc]

include/sanitizer/common_interface_defs.h

114

Maybe find_first_bad_address?
Also, add a comment please.

[aizatsky]

• done

[aizatsky]

comment fix.

[aizatsky]

Sorry, had old version uploaded. PTAL.

include/sanitizer/common_interface_defs.h

114–115

I think the name is too long already :)

[kcc]

LGTM, but please also add a test for this function (to test/asan/TestCases/contiguous_container.cc)

[aizatsky]

added test.

[aizatsky]

test added. submitting.

include/sanitizer/common_interface_defs.h

#endif
   // (e.g. with __sanitizer_annotate_contiguous_container), i.e. if
   //  - [beg, mid) is addressable,
   //  - [mid, end) is unaddressable.
   // Full verification requires O(end-beg) time; this function tries to avoid
   // such complexity by touching only parts of the container around beg/mid/end.
   int __sanitizer_verify_contiguous_container(const void *beg, const void *mid,
                                               const void *end);
 
+  // Similar to __sanitizer_verify_contiguous_container but returns the address
+  // of the first improperly poisoned byte otherwise. Returns null if the area
+  // is poisoned properly.
+  const void *__sanitizer_contiguous_container_find_bad_address(
+      const void *beg, const void *mid, const void *end);
+
   // Print the stack trace leading to this call. Useful for debugging user code.
   void __sanitizer_print_stack_trace();
 
   // Sets the callback to be called right before death on error.
   // Passing 0 will unset the callback.
   void __sanitizer_set_death_callback(void (*callback)(void));
 
   // Interceptor hooks.
   // Whenever a libc function interceptor is called it checks if the
   // corresponding weak hook is defined, and it so -- calls it.

lib/asan/asan_poisoning.cc

void __sanitizer_annotate_contiguous_container(const void *beg_p,
   PoisonShadow(a, b1 - a, 0);
   PoisonShadow(b2, c - b2, kAsanContiguousContainerOOBMagic);
   if (b1 != b2) {
     CHECK_EQ(b2 - b1, granularity);
     *(u8*)MemToShadow(b1) = static_cast<u8>(new_mid - b1);
   }
 }
 
-int __sanitizer_verify_contiguous_container(const void *beg_p,
-                                            const void *mid_p,
-                                            const void *end_p) {
-  if (!flags()->detect_container_overflow) return 1;
+const void *__sanitizer_contiguous_container_find_bad_address(
+    const void *beg_p, const void *mid_p, const void *end_p) {
+  if (!flags()->detect_container_overflow)
+    return nullptr;
   uptr beg = reinterpret_cast<uptr>(beg_p);
   uptr end = reinterpret_cast<uptr>(end_p);
   uptr mid = reinterpret_cast<uptr>(mid_p);
   CHECK_LE(beg, mid);
   CHECK_LE(mid, end);
   // Check some bytes starting from beg, some bytes around mid, and some bytes
   // ending with end.
   uptr kMaxRangeToCheck = 32;
   uptr r1_beg = beg;
   uptr r1_end = Min(end + kMaxRangeToCheck, mid);
   uptr r2_beg = Max(beg, mid - kMaxRangeToCheck);
   uptr r2_end = Min(end, mid + kMaxRangeToCheck);
   uptr r3_beg = Max(end - kMaxRangeToCheck, mid);
   uptr r3_end = end;
   for (uptr i = r1_beg; i < r1_end; i++)
     if (AddressIsPoisoned(i))
-      return 0;
+      return reinterpret_cast<const void *>(i);
   for (uptr i = r2_beg; i < mid; i++)
     if (AddressIsPoisoned(i))
-      return 0;
+      return reinterpret_cast<const void *>(i);
   for (uptr i = mid; i < r2_end; i++)
     if (!AddressIsPoisoned(i))
-      return 0;
+      return reinterpret_cast<const void *>(i);
   for (uptr i = r3_beg; i < r3_end; i++)
     if (!AddressIsPoisoned(i))
-      return 0;
-  return 1;
+      return reinterpret_cast<const void *>(i);
+  return nullptr;
+}
+
+int __sanitizer_verify_contiguous_container(const void *beg_p,
+                                            const void *mid_p,
+                                            const void *end_p) {
+  return __sanitizer_contiguous_container_find_bad_address(beg_p, mid_p,
+                                                           end_p) == nullptr;
 }
 
 extern "C" SANITIZER_INTERFACE_ATTRIBUTE
 void __asan_poison_intra_object_redzone(uptr ptr, uptr size) {
   AsanPoisonOrUnpoisonIntraObjectRedzone(ptr, size, true);
 }
 
 extern "C" SANITIZER_INTERFACE_ATTRIBUTE

lib/sanitizer_common/sanitizer_interface_internal.h

extern "C" {
   SANITIZER_INTERFACE_ATTRIBUTE
   void __sanitizer_annotate_contiguous_container(const void *beg,
                                                  const void *end,
                                                  const void *old_mid,
                                                  const void *new_mid);
   SANITIZER_INTERFACE_ATTRIBUTE
   int __sanitizer_verify_contiguous_container(const void *beg, const void *mid,
                                               const void *end);
-}  // extern "C"
+  SANITIZER_INTERFACE_ATTRIBUTE
+  const void *__sanitizer_contiguous_container_find_bad_address(
+      const void *beg, const void *mid, const void *end);
+  } // extern "C"
 
 #endif  // SANITIZER_INTERFACE_INTERNAL_H

test/asan/TestCases/contiguous_container.cc

for (int i = 0; i < 10000; i++) {
     mid = beg + size;
     __sanitizer_annotate_contiguous_container(beg, end, old_mid, mid);
 
     for (size_t idx = 0; idx < size; idx++)
         assert(!__asan_address_is_poisoned(beg + idx));
     for (size_t idx = size; idx < capacity; idx++)
         assert(__asan_address_is_poisoned(beg + idx));
     assert(__sanitizer_verify_contiguous_container(beg, mid, end));
-    if (mid != beg)
+    assert(NULL ==
+           __sanitizer_contiguous_container_find_bad_address(beg, mid, end));
+    if (mid != beg) {
       assert(!__sanitizer_verify_contiguous_container(beg, mid - 1, end));
-    if (mid != end)
+      assert(mid - 1 == __sanitizer_contiguous_container_find_bad_address(
+                            beg, mid - 1, end));
+    }
+    if (mid != end) {
       assert(!__sanitizer_verify_contiguous_container(beg, mid + 1, end));
+      assert(mid == __sanitizer_contiguous_container_find_bad_address(
+                        beg, mid + 1, end));
+    }
   }
 
   // Don't forget to unpoison the whole thing before destroing/reallocating.
   __sanitizer_annotate_contiguous_container(beg, end, mid, end);
   for (size_t idx = 0; idx < capacity; idx++)
     assert(!__asan_address_is_poisoned(beg + idx));
   delete[] beg;
 }