[compiler-rt] Fix incorrect use of snprintf

[vitalybuka]

Summary

snprintf returns buffer size needed for printing. If buffer was small, calling
code receives incorrectly symbolized buffer and fail.

[vitalybuka]

Additional warning

[eugenis]

lib/sanitizer_common/sanitizer_symbolizer_libcdep.cc

361 ↗

(On Diff #86778)

I think it should be >=.

Writes at most "length" symbols to "buffer" (including trailing '\0').
Returns the number of symbols that should have been written to buffer
(not including trailing '\0'). Thus, the string is truncated
iff return value is not less than "length".

lib/sanitizer_common/symbolizer/sanitizer_symbolize.cc

45 ↗

(On Diff #86778)

I think it should be <.

[vitalybuka]

snprintf returned value does not include termination 0

[eugenis]

test/sanitizer_common/TestCases/symbolize_stack.cc

1 ↗

(On Diff #86869)

add a comment that you are testing symbolization of very long function names

[vitalybuka]

comment

compiler-rt/trunk/lib/sanitizer_common/sanitizer_symbolizer_libcdep.cc

 
 const char *LLVMSymbolizer::FormatAndSendCommand(bool is_data,
                                                  const char *module_name,
                                                  uptr module_offset,
                                                  ModuleArch arch) {
   CHECK(module_name);
   const char *is_data_str = is_data ? "DATA " : "";
   if (arch == kModuleArchUnknown) {
-    internal_snprintf(buffer_, kBufferSize, "%s\"%s\" 0x%zx\n", is_data_str,
-                      module_name, module_offset);
+    if (internal_snprintf(buffer_, kBufferSize, "%s\"%s\" 0x%zx\n", is_data_str,
+                          module_name,
+                          module_offset) >= static_cast<int>(kBufferSize)) {
+      Report("WARNING: Command buffer too small");
+      return nullptr;
+    }
   } else {
-    internal_snprintf(buffer_, kBufferSize, "%s\"%s:%s\" 0x%zx\n", is_data_str,
-                      module_name, ModuleArchToString(arch), module_offset);
+    if (internal_snprintf(buffer_, kBufferSize, "%s\"%s:%s\" 0x%zx\n",
+                          is_data_str, module_name, ModuleArchToString(arch),
+                          module_offset) >= static_cast<int>(kBufferSize)) {
+      Report("WARNING: Command buffer too small");
+      return nullptr;
+    }
   }
   return symbolizer_process_->SendCommand(buffer_);
 }
 
 SymbolizerProcess::SymbolizerProcess(const char *path, bool use_forkpty)
     : path_(path),
       input_fd_(kInvalidFd),
       output_fd_(kInvalidFd),
while (true) {
     // its stdout.
     if (!success || just_read == 0) {
       Report("WARNING: Can't read from symbolizer at fd %d\n", input_fd_);
       return false;
     }
     read_len += just_read;
     if (ReachedEndOfOutput(buffer, read_len))
       break;
+    if (read_len + 1 == max_length) {
+      Report("WARNING: Symbolizer buffer too small");
+      read_len = 0;
+      break;
+    }
   }
   buffer[read_len] = '\0';
   return true;
 }
 
 bool SymbolizerProcess::WriteToSymbolizer(const char *buffer, uptr length) {
   if (length == 0)
     return true;

compiler-rt/trunk/lib/sanitizer_common/sanitizer_symbolizer_posix_libcdep.cc

const char *Demangle(const char *name) override {
     }
     return name;
   }
 
  private:
   InternalSymbolizer() { }
 
   static const int kBufferSize = 16 * 1024;
-  static const int kMaxDemangledNameSize = 1024;
   char buffer_[kBufferSize];
 };
 #else  // SANITIZER_SUPPORTS_WEAK_HOOKS
 
 class InternalSymbolizer : public SymbolizerTool {
  public:
   static InternalSymbolizer *get(LowLevelAllocator *alloc) { return 0; }
 };

compiler-rt/trunk/lib/sanitizer_common/symbolizer/sanitizer_symbolize.cc

bool __sanitizer_symbolize_code(const char *ModuleName, uint64_t ModuleOffset,
   std::string Result;
   {
     llvm::raw_string_ostream OS(Result);
     llvm::symbolize::DIPrinter Printer(OS);
     auto ResOrErr =
         getDefaultSymbolizer()->symbolizeInlinedCode(ModuleName, ModuleOffset);
     Printer << (ResOrErr ? ResOrErr.get() : llvm::DIInliningInfo());
   }
-  __sanitizer::internal_snprintf(Buffer, MaxLength, "%s", Result.c_str());
-  return true;
+  return __sanitizer::internal_snprintf(Buffer, MaxLength, "%s",
+                                        Result.c_str()) < MaxLength;
 }
 
 bool __sanitizer_symbolize_data(const char *ModuleName, uint64_t ModuleOffset,
                                 char *Buffer, int MaxLength) {
   std::string Result;
   {
     llvm::raw_string_ostream OS(Result);
     llvm::symbolize::DIPrinter Printer(OS);
     auto ResOrErr =
         getDefaultSymbolizer()->symbolizeData(ModuleName, ModuleOffset);
     Printer << (ResOrErr ? ResOrErr.get() : llvm::DIGlobal());
   }
-  __sanitizer::internal_snprintf(Buffer, MaxLength, "%s", Result.c_str());
-  return true;
+  return __sanitizer::internal_snprintf(Buffer, MaxLength, "%s",
+                                        Result.c_str()) < MaxLength;
 }
 
 void __sanitizer_symbolize_flush() { getDefaultSymbolizer()->flush(); }
 
 int __sanitizer_symbolize_demangle(const char *Name, char *Buffer,
                                    int MaxLength) {
   std::string Result =
       llvm::symbolize::LLVMSymbolizer::DemangleName(Name, nullptr);
-  __sanitizer::internal_snprintf(Buffer, MaxLength, "%s", Result.c_str());
-  return static_cast<int>(Result.size() + 1);
+  return __sanitizer::internal_snprintf(Buffer, MaxLength, "%s",
+                                        Result.c_str()) < MaxLength
+             ? static_cast<int>(Result.size() + 1)
+             : 0;
 }
 
 }  // extern "C"

compiler-rt/trunk/test/sanitizer_common/TestCases/symbolize_stack.cc

+// RUN: %clangxx -O0 %s -o %t && %run %t 2>&1 | FileCheck %s
+
+// Test that symbolizer does not crash on frame with large function name.
+
+#include <sanitizer/common_interface_defs.h>
+#include <vector>
+
+template <int N> struct A {
+  template <class T> void RecursiveTemplateFunction(const T &t);
+};
+
+template <int N>
+template <class T>
+__attribute__((noinline)) void A<N>::RecursiveTemplateFunction(const T &) {
+  std::vector<T> t;
+  return A<N - 1>().RecursiveTemplateFunction(t);
+}
+
+template <>
+template <class T>
+__attribute__((noinline)) void A<0>::RecursiveTemplateFunction(const T &) {
+  __sanitizer_print_stack_trace();
+}
+
+int main() {
+  // CHECK: {{vector<.*vector<.*vector<.*vector<.*vector<}}
+  A<10>().RecursiveTemplateFunction(0);
+}