diff --git a/compiler-rt/lib/sanitizer_common/sanitizer_common_interceptors.inc b/compiler-rt/lib/sanitizer_common/sanitizer_common_interceptors.inc --- a/compiler-rt/lib/sanitizer_common/sanitizer_common_interceptors.inc +++ b/compiler-rt/lib/sanitizer_common/sanitizer_common_interceptors.inc @@ -4418,9 +4418,8 @@ COMMON_INTERCEPTOR_ENTER(ctx, backtrace_symbols, buffer, size); if (buffer && size) COMMON_INTERCEPTOR_READ_RANGE(ctx, buffer, size * sizeof(*buffer)); - // FIXME: under ASan the call below may write to freed memory and corrupt - // its metadata. See - // https://github.com/google/sanitizers/issues/321. + // The COMMON_INTERCEPTOR_READ_RANGE above ensures that 'buffer' is + // valid for reading. char **res = REAL(backtrace_symbols)(buffer, size); if (res && size) { COMMON_INTERCEPTOR_WRITE_RANGE(ctx, res, size * sizeof(*res)); diff --git a/compiler-rt/test/asan/TestCases/backtrace_symbols_interceptor.cpp b/compiler-rt/test/asan/TestCases/backtrace_symbols_interceptor.cpp new file mode 100644 --- /dev/null +++ b/compiler-rt/test/asan/TestCases/backtrace_symbols_interceptor.cpp @@ -0,0 +1,36 @@ +// RUN: %clangxx_asan -O0 %s -o %t && not %run %t 2>&1 | FileCheck %s + +// Test the backtrace_symbols() interceptor. + +#include +#include +#include +#include +#include + +#define MAX_BT 100 + +int main() { + void **buffer = (void **)malloc(sizeof(void *) * MAX_BT); + assert(buffer != NULL); + + int numEntries = backtrace(buffer, MAX_BT); + printf("backtrace returned %d entries\n", numEntries); + + free(buffer); + + // Deliberate use-after-free of 'buffer'. We expect ASan to + // catch this, without triggering internal sanitizer errors. + char **strings = backtrace_symbols(buffer, numEntries); + assert(strings != NULL); + + for (int i = 0; i < numEntries; i++) { + printf("%s\n", strings[i]); + } + + free(strings); + + // CHECK: use-after-free + // CHECK: SUMMARY + return 0; +}