[asan Win64] Fix bug where interception writing address at wrong offset

[wang0109]

Summary

[asan Win64] Fix bug where interception writing address at wrong offset

jmp [rip - 8] was intended to use the 8 previous bytes as jump address
before begin of current instruction. One subtle detail was missed,
the jump instruction takes 6 bytes, and the offset given should actually
be -6 - 8 = -14, because the "rip" starts at the begin of next instruction.

Due to pointer arithemetic, the difference in bytes between pointers should
use the type of char*. Bug was, an 8 bytes difference between addresses of
type uptr* gives the result of 1.

[etienneb]

Thx for the patch.

I'm gonna think how we can validate this.
I believe there is lack of unittests in the interceptor folder.

[wang0109]

• update diff: use s32 to ensure it is always 4 bytes

[etienneb]

Unittests for this code in on-going.
see unittests

[wang0109]

This CL is superceded and merged by:

http://reviews.llvm.org/D22111

lib/interception/interception_win.cc

 static void _memcpy(void *dst, void *src, size_t sz) {
   char *dst_c = (char*)dst,
        *src_c = (char*)src;
   for (size_t i = 0; i < sz; ++i)
     dst_c[i] = src_c[i];
 }
 
 #if SANITIZER_WINDOWS64
-static void WriteIndirectJumpInstruction(char *jmp_from, uptr *indirect_target) {  // NOLINT
+static void WriteIndirectJumpInstruction(char *jmp_from, char *indirect_target) {  // NOLINT
   // jmp [rip + XXYYZZWW] = FF 25 WW ZZ YY XX, where
   // XXYYZZWW is an offset from jmp_from.
   // The displacement is still 32-bit in x64, so indirect_target must be located
   // within +/- 2GB range.
-  int offset = (int)(indirect_target - (uptr *)jmp_from);
+  s32 offset = (s32)(indirect_target - jmp_from - 6);
   jmp_from[0] = '\xFF';
   jmp_from[1] = '\x25';
-  *(int*)(jmp_from + 2) = offset;
+  *(s32*)(jmp_from + 2) = offset;
 }
 #else
 static void WriteJumpInstruction(char *jmp_from, char *to) {
   // jmp XXYYZZWW = E9 WW ZZ YY XX, where XXYYZZWW is an offset from jmp_from
   // to the next instruction to the destination.
   ptrdiff_t offset = to - jmp_from - 5;
   *jmp_from = '\xE9';
   *(ptrdiff_t*)(jmp_from + 1) = offset;
 }
 #endif
 
 static void WriteTrampolineJumpInstruction(char *jmp_from, char *to) {
 #if SANITIZER_WINDOWS64
   // Emit an indirect jump through immediately following bytes:
   // jmp_from:
   //   jmp [rip + 6]
   //   .quad to
   // Store the address.
-  uptr *indirect_target = (uptr *)(jmp_from + 6);
-  *indirect_target = (uptr)to;
+  char *indirect_target = jmp_from + 6;
+  *(uptr*)indirect_target = (uptr)to;
   // Write the indirect jump.
   WriteIndirectJumpInstruction(jmp_from, indirect_target);
 #else
   WriteJumpInstruction(jmp_from, to);
 #endif
 }
 
 static void WriteInterceptorJumpInstruction(char *jmp_from, char *to) {
 #if SANITIZER_WINDOWS64
   // Emit an indirect jump through immediately following bytes:
   // jmp_from:
   //   jmp [rip - 8]
   //   .quad to
   // Store the address.
-  uptr *indirect_target = (uptr *)(jmp_from - 8);
-  *indirect_target = (uptr)to;
+  char *indirect_target = jmp_from - 8;
+  *(uptr*)indirect_target = (uptr)to;
   // Write the indirect jump.
   WriteIndirectJumpInstruction(jmp_from, indirect_target);
 #else
   WriteJumpInstruction(jmp_from, to);
 #endif
 }
 
 static char *GetMemoryForTrampoline(size_t size) {