[asan] instrument memory accesses with unusual sizes (rt part)

[samsonov]

LGTM

projects/compiler-rt/lib/asan/lit_tests/Linux/interface_symbols_linux.c

27

Please also fix lit_tests/Darwin/interface_symbols_darwin.c

[Eugene.Zelenko]

Committed in rL175508.

projects/compiler-rt/lib/asan/asan_mac.cc

if (len > name_len) {
         if (name_value) {
           // Replace the old value with the new one.
           *environ = const_cast<char*>(name_value);
         } else {
           // Shift the subsequent pointers back.
           char **del = environ;
           do {
             del[0] = del[1];
-          } while(*del++);
+          } while (*del++);
         }
       }
     }
     environ++;
   }
 }
 
 void MaybeReexec() {
if (old_env_len == fname_len) {
       char *old_env_end = dyld_insert_libraries + old_env_len;
       do {
         if (piece_start[0] == ':') piece_start++;
         piece_end =  REAL(strchr)(piece_start, ':');
         if (!piece_end) piece_end = dyld_insert_libraries + old_env_len;
         if ((uptr)(piece_start - dyld_insert_libraries) > old_env_len) break;
         uptr piece_len = piece_end - piece_start;
 
-        // If the current piece isn't the runtime library name, append it to new_env.
+        // If the current piece isn't the runtime library name,
+        // append it to new_env.
         if ((piece_len != fname_len) ||
             (internal_strncmp(piece_start, info.dli_fname, fname_len) != 0)) {
           if (new_env_pos != new_env + env_name_len + 1) {
             new_env_pos[0] = ':';
             new_env_pos++;
           }
           internal_strncpy(new_env_pos, piece_start, piece_len);
         }
-        // Move on to the next piece. 
+        // Move on to the next piece.
         new_env_pos += piece_len;
         piece_start = piece_end;
       } while (piece_start < old_env_end);
 
       // Can't use setenv() here, because it requires the allocator to be
       // initialized.
       // FIXME: instead of filtering DYLD_INSERT_LIBRARIES here, do it in
       // a separate function called after InitializeAllocator().

projects/compiler-rt/lib/asan/asan_rtl.cc

 ASAN_REPORT_ERROR(load, false, 8)
 ASAN_REPORT_ERROR(load, false, 16)
 ASAN_REPORT_ERROR(store, true, 1)
 ASAN_REPORT_ERROR(store, true, 2)
 ASAN_REPORT_ERROR(store, true, 4)
 ASAN_REPORT_ERROR(store, true, 8)
 ASAN_REPORT_ERROR(store, true, 16)
 
+#define ASAN_REPORT_ERROR_N(type, is_write)                    \
+extern "C" NOINLINE INTERFACE_ATTRIBUTE                        \
+void __asan_report_ ## type ## _n(uptr addr, uptr size);       \
+void __asan_report_ ## type ## _n(uptr addr, uptr size) {      \
+  GET_CALLER_PC_BP_SP;                                         \
+  __asan_report_error(pc, bp, sp, addr, is_write, size);       \
+}
+
+ASAN_REPORT_ERROR_N(load, false)
+ASAN_REPORT_ERROR_N(store, true)
+
 // Force the linker to keep the symbols for various ASan interface functions.
 // We want to keep those in the executable in order to let the instrumented
 // dynamic libraries access the symbol even if it is not used by the executable
 // itself. This should help if the build system is removing dead code at link
 // time.
 static NOINLINE void force_interface_symbols() {
   volatile int fake_condition = 0;  // prevent dead condition elimination.
   // __asan_report_* functions are noreturn, so we need a switch to prevent

projects/compiler-rt/lib/asan/lit_tests/Linux/interface_symbols_linux.c

 // RUN: echo __asan_report_load4 >> %t.interface
 // RUN: echo __asan_report_load8 >> %t.interface
 // RUN: echo __asan_report_load16 >> %t.interface
 // RUN: echo __asan_report_store1 >> %t.interface
 // RUN: echo __asan_report_store2 >> %t.interface
 // RUN: echo __asan_report_store4 >> %t.interface
 // RUN: echo __asan_report_store8 >> %t.interface
 // RUN: echo __asan_report_store16 >> %t.interface
+// RUN: echo __asan_report_load_n >> %t.interface
+// RUN: echo __asan_report_store_n >> %t.interface
 // RUN: cat %t.interface | sort -u | diff %t.symbols -
 
 int main() { return 0; }

projects/compiler-rt/lib/asan/tests/asan_test.cc

TEST(AddressSanitizer, UAF_char) {
   const char *uaf_string = "AddressSanitizer:.*heap-use-after-free";
   EXPECT_DEATH(uaf_test<U1>(1, 0), uaf_string);
   EXPECT_DEATH(uaf_test<U1>(10, 0), uaf_string);
   EXPECT_DEATH(uaf_test<U1>(10, 10), uaf_string);
   EXPECT_DEATH(uaf_test<U1>(kLargeMalloc, 0), uaf_string);
   EXPECT_DEATH(uaf_test<U1>(kLargeMalloc, kLargeMalloc / 2), uaf_string);
 }
 
+TEST(AddressSanitizer, UAF_long_double) {
+  long double *p = Ident(new long double[10]);
+  EXPECT_DEATH(Ident(p)[12] = 0, "WRITE of size 10");
+  EXPECT_DEATH(Ident(p)[0] = Ident(p)[12], "READ of size 10");
+  delete [] Ident(p);
+}
+
+struct Packed5 {
+  int x;
+  char c;
+} __attribute__((packed));
+
+
+TEST(AddressSanitizer, UAF_Packed5) {
+  Packed5 *p = Ident(new Packed5[2]);
+  EXPECT_DEATH(p[0] = p[3], "READ of size 5");
+  EXPECT_DEATH(p[3] = p[0], "WRITE of size 5");
+  delete [] Ident(p);
+}
+
 #if ASAN_HAS_BLACKLIST
 TEST(AddressSanitizer, IgnoreTest) {
   int *x = Ident(new int);
   delete Ident(x);
   *x = 0;
 }
 #endif  // ASAN_HAS_BLACKLIST
 

projects/compiler-rt/lib/sanitizer_common/tests/sanitizer_libc_test.cc

 TEST(SanitizerCommon, FileOps) {
   const char *str1 = "qwerty";
   uptr len1 = internal_strlen(str1);
   const char *str2 = "zxcv";
   uptr len2 = internal_strlen(str2);
 
   u32 uid = GetUid();
   char temp_filename[128];
-  internal_snprintf(temp_filename, 128, "/tmp/sanitizer_common.tmp.%d", uid);
+  internal_snprintf(temp_filename, sizeof(temp_filename),
+                    "/tmp/sanitizer_common.tmp.%d", uid);
   fd_t fd = OpenFile(temp_filename, true);
   EXPECT_NE(fd, kInvalidFd);
   EXPECT_EQ(len1, internal_write(fd, str1, len1));
   EXPECT_EQ(len2, internal_write(fd, str2, len2));
   internal_close(fd);
 
   fd = OpenFile(temp_filename, false);
   EXPECT_NE(fd, kInvalidFd);