[compiler-rt][ubsan] Implicit Cast Sanitizer - integer truncation - compiler-rt part

[lebedev.ri]

Summary

This is a compiler-rt part.
The clang part is D48958.

See PR21530, https://github.com/google/sanitizers/issues/940.

[filcab]

Looks good. I have a few questions, and would like some additional tests (explained in the comments).

Thanks for working on this!
Filipe

lib/ubsan/ubsan_handlers.cc

457

There's only one enumerator in ImplicitCastCheckKind, why do we have these two ErrorType enumerators? It seems we only have one error we can diagnose. What is meant by ImplicitCast and ImplicitIntegerTruncation?

473

Not ATM.

test/ubsan/TestCases/ImplicitCast/integer-truncation-summary.cpp

5

Why?

test/ubsan/TestCases/ImplicitCast/integer-truncation.c

2

No need to have the warning flag.
I'd rather have the commands split since we only really need FileCheck to run on the output of %run, not the compiler output.

10

Why don't we warn here?
Nit: No need to have the extra parenthesis around the cast, nor around the 0, or the full expression. ~(uint32_t)0 looks readable enough.

18

Nit: Here I think ... = (~(uint32_t)0) & 255 is unambiguous (Added parens around the LHS so no one needs to remember that casts bind more tightly) and doesn't require parsing as many parenthesis.

35

Please add a few from 64 bit to 32 bit (128 bit to 64 bit might be a bit too non-portable). That would show that it also works when there's no (on most/all of the current platforms we support) integer promotions involved.

test/ubsan/TestCases/ImplicitCast/integer-truncation.cpp

35

Unsure we need the 257 when we already had 256 (since what happens is the same thing).

[lebedev.ri]

Like i said, not ready for the review :)

lib/ubsan/ubsan_handlers.cc

457

ImplicitCast is, well, implicit cast.
Implicit cast can do many things.
It can truncate to the smaller bit width (what we are currently testing)
It can be a NOP cast that turns large number into a negative number.
It can cast between floating points/integers, with loss of precision.

In other words, there are some more things it will potentially check.

test/ubsan/TestCases/ImplicitCast/integer-truncation-summary.cpp

5

Summary printing does not work otherwise, it needs some other sanitizer for that.
(This is based on compiler-rt/test/ubsan/TestCases/Integer/summary.cpp which has // REQUIRES: ubsan-asan)

test/ubsan/TestCases/ImplicitCast/integer-truncation.c

2

It's kinda noisy without the warning..

10

u32 -1 (0xFFFFFFFF) -> implicit cast -> s8 -1 (0xFF) -> extending back to the original width from the downcasted type (i.e. using the downcasted sign!) -> u32 -1 (0xFFFFFFFF)
u32 -1 (0xFFFFFFFF) == u32 -1 (0xFFFFFFFF).
That is modeled after https://godbolt.org/g/NEzXbb.

This is something for the -fsanitize=implicit-sign-change.

[filcab]

In D48959#1153246, @lebedev.ri wrote:

Like i said, not ready for the review :)

No problem, I just pointed out small things :-)

lib/ubsan/ubsan_handlers.cc

457

But won't that just be like the undefined, shift, or nullability groups? On the clang side you're not adding any other types of checks either, just their grouping. I think we should do like in the shift group: Have just the one implicit-integer-truncation on the compiler-rt side, and have the clang side deal with the groupings.

test/ubsan/TestCases/ImplicitCast/integer-truncation-summary.cpp

5

Forgot about the details involving summary. Thanks.

test/ubsan/TestCases/ImplicitCast/integer-truncation.c

2

If we don't capture the output, we won't care ;-)
Other ubsan tests have the same issues. But this is a minor nit. ok to keep if you prefer.

10

Sounds reasonable.

[lebedev.ri]

lib/ubsan/ubsan_handlers.cc

457

I'm not sure i follow.

To add -fsanitize=implicit-sign-change, on clang side, i will need a new, different logic to detect it.
I think, i won't need to have a new __ubsan_handle_ for each of those groups.
One would also like to to be able to control these groups separately,
at compile-time, and run-time blacklist time, i expect.

So i don't see why only one side should know about the grouping.

[filcab]

lib/ubsan/ubsan_checks.inc

34

There is no shift grouping here. The grouping is on the clang side and it will simply turn on both shift-base and shift-exponent.

lib/ubsan/ubsan_handlers.cc

242

Please check out how the shift grouping is handled here.

457

How is this different from the shift grouping? There is no concept of shift grouping in compiler-rt, just on clang. Clang will emit its handler calls however it wants, and on the compiler-rt side you just need knowledge about the checks themselves, not the grouping. Creation of ubsan handlers doesn't need to correspond to enumerators on ubsan check kinds. type_mismatch is the handler used for many, many unrelated checks, for example.

I've annotated the shift-* examples in the code above. Your ubsan_checks.inc additions should only have the actual check you have today, not the grouping.

463

This code should either be something like this:

// TODO(your_username): Add implicit sign change and similar checks
ErrorType ET = ErrorType::ImplicitIntegerTruncation;

or, if you want to setup some boilerplate right now (I'd rather avoid it until we have a second check):

ErrorType ET;
switch (Data->Kind) {
  default:
    CHECK(0 && "invalid implicit cast check kind");
  case ICCK_IntegerTruncation:
    ET = ErrorType::ImplicitIntegerTruncation;
    break;
  }

[eugenis]

lib/ubsan/ubsan_handlers.h

139

Please add a handler to ubsan_minimal, too.

[lebedev.ri]

This is a compiler-rt part.
The clang part is D48958.

[lebedev.ri]

lib/ubsan/ubsan_checks.inc

33

If there is no this grouping, then i would need to default to GenericUB,
and that is not really correct, since this is not really UB.
What harm is in having this check-that-is-just-a-group in here?

lib/ubsan/ubsan_handlers.cc

457

I'm not convinced, and i don't see any logic in that. I'm going to keep this as-is.

463

So when a mismatch between the clang and compiler-rt happens (or bad IR),
we will either crash, or report obviously-wrong check name,
instead of defaulting to sane 'implicit cast'.

I'm sorry, but is this really the best course of action?

lib/ubsan/ubsan_handlers.h

139

Yep, i was planning on doing that, just didn't go it in the first go.

test/ubsan/TestCases/ImplicitCast/integer-truncation.c

2

I have dropped the warning flag.

But i really don't see why we would want to split this into two run lines.
Don't we want the compile to succeed, before running the supposedly-built executable?

18

Dropped some parenthesis, but not all.

35

I have added tests, but i'm wary of "it also works when there's no <..> integer promotions involved." part.
I suspect this will cause test failures and reverts.

[lebedev.ri]

• Drop indeed-unneeded 'grouping' ImplicitCast check. For some reason i was very sure i just didn't add some macro, and there was grouping at this level, too.
• Added test with runtime blacklist, doubling as a test for -fno-sanitize-recover= test

lib/ubsan/ubsan_checks.inc

33

Humm, after digging a bit more, i have finally noticed that i wasn't missing some extra macro,
but indeed, there was simply no grouping for these checks in blacklists...
Dropped.

lib/ubsan/ubsan_handlers.cc

473

That is basically why it is a FIXME.

test/ubsan/TestCases/ImplicitCast/integer-truncation.cpp

35

Consistency?

[vsk]

test/ubsan/TestCases/ImplicitCast/integer-truncation.c

31

This check fails on my system:

/Users/vsk/src/llvm.org-lldbsan/llvm/projects/compiler-rt/test/ubsan/TestCases/ImplicitCast/integer-truncation.c:30:11: error: expected string not found in input
// CHECK: {{.*}}integer-truncation.c:[[@LINE-1]]:18: runtime error: implicit cast from type 'uint64_t' (aka 'unsigned long') of value 18446744073709551615 (64-bit, unsigned) to type 'uint8_t' (aka 'unsigned char') changed the value to 255 (8-bit, unsigned)
          ^
<stdin>:6:1: note: scanning from here
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /Users/vsk/src/llvm.org-lldbsan/llvm/projects/compiler-rt/test/ubsan/TestCases/ImplicitCast/integer-truncation.c:26:19 in
^
<stdin>:6:1: note: with expression "@LINE-1" equal to "29"
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /Users/vsk/src/llvm.org-lldbsan/llvm/projects/compiler-rt/test/ubsan/TestCases/ImplicitCast/integer-truncation.c:26:19 in
^
<stdin>:7:89: note: possible intended match here
/Users/vsk/src/llvm.org-lldbsan/llvm/projects/compiler-rt/test/ubsan/TestCases/ImplicitCast/integer-truncation.c:29:18: runtime error: implicit cast from type 'uint64_t' (aka 'unsigned long long') of value 18446744073709551615 (64-bit, unsigned) to type 'uint8_t' (aka 'unsigned char') changed the value to 255 (8-bit, unsigned)

I guess on Darwin uint64_t is 'unsigned long long'? Might be best to loosen the check a bit.

[lebedev.ri]

Ping - any thoughts on the compiler-rt part?
The clang [part] needs to be fixed wrt https://bugs.llvm.org/show_bug.cgi?id=38166

@vsk thank you for taking a look!
I have relaxed those checks. Please let me know if there are any others (i'm sure bots will tell later on anyway :)

test/ubsan/TestCases/ImplicitCast/integer-truncation.c

31

Relaxed the unsigned long long' case. Any others?

[lebedev.ri]

Ping.

[vsk]

Thanks, lgtm. @filcab?

test/ubsan/TestCases/ImplicitCast/integer-truncation-summary.cpp

4

Per an offline discussion, this needs to include '&& !ubsan-standalone-static' to work on Darwin.

[lebedev.ri]

Adjust test, as per offline disscussion.

[filcab]

I have a nit I'd like to see addressed, otherwise LGTM.

test/ubsan/TestCases/ImplicitCast/integer-truncation.cpp

2

Is this the exact same as the other test? If so, please merge both and have two run lines, one for C, one for C++. If there's *any* difference, then it might be better to have the tests as you have them now.

[lebedev.ri]

Address @filcab's review nit - merge integer-truncation.{c,cpp} tests into one.
They are basically identical, so it seems to be the best course of action.

In D48959#1176762, @filcab wrote:

I have a nit I'd like to see addressed, otherwise LGTM.

Thank you for the review!

[lebedev.ri]

Rebase, address @rsmith review notes from D48958 - s/cast/conversion/ where appropriate.

[lebedev.ri]

NFC rebase, just because.

@vsk, @filcab - thank you for the review!

[lebedev.ri]

FYI the test/ubsan/TestCases/ImplicitCast/integer-truncation-blacklist.c
is failing on sanitizer-x86_64-linux-android builder (CC @vitalybuka).

It runs the tests via android_compile.py, so i'm not sure this
is actually *this* issue:

https://code.google.com/p/address-sanitizer/issues/detail?id=316

but this seems oddly similar to the other XFAILed cases...

Right now that seems to be the only failing builder,
so i *think* it makes sense to try to just blacklist it for now.

lib/ubsan/ubsan_checks.inc

 UBSAN_CHECK(SignedIntegerOverflow, "signed-integer-overflow",
             "signed-integer-overflow")
 UBSAN_CHECK(UnsignedIntegerOverflow, "unsigned-integer-overflow",
             "unsigned-integer-overflow")
 UBSAN_CHECK(IntegerDivideByZero, "integer-divide-by-zero",
             "integer-divide-by-zero")
 UBSAN_CHECK(FloatDivideByZero, "float-divide-by-zero", "float-divide-by-zero")
 UBSAN_CHECK(InvalidBuiltin, "invalid-builtin-use", "invalid-builtin-use")
+UBSAN_CHECK(ImplicitIntegerTruncation, "implicit-integer-truncation",
+            "implicit-integer-truncation")
 UBSAN_CHECK(InvalidShiftBase, "invalid-shift-base", "shift-base")
 UBSAN_CHECK(InvalidShiftExponent, "invalid-shift-exponent", "shift-exponent")
 UBSAN_CHECK(OutOfBoundsIndex, "out-of-bounds-index", "bounds")
 UBSAN_CHECK(UnreachableCall, "unreachable-call", "unreachable")
 UBSAN_CHECK(MissingReturn, "missing-return", "return")
 UBSAN_CHECK(NonPositiveVLAIndex, "non-positive-vla-index", "vla-bound")
 UBSAN_CHECK(FloatCastOverflow, "float-cast-overflow", "float-cast-overflow")
 UBSAN_CHECK(InvalidBoolLoad, "invalid-bool-load", "bool")
 UBSAN_CHECK(InvalidEnumLoad, "invalid-enum-load", "enum")
 UBSAN_CHECK(FunctionTypeMismatch, "function-type-mismatch", "function")
 UBSAN_CHECK(InvalidNullReturn, "invalid-null-return",
             "returns-nonnull-attribute")
 UBSAN_CHECK(InvalidNullArgument, "invalid-null-argument", "nonnull-attribute")
 UBSAN_CHECK(DynamicTypeMismatch, "dynamic-type-mismatch", "vptr")
 UBSAN_CHECK(CFIBadType, "cfi-bad-type", "cfi")

lib/ubsan/ubsan_diag.h

union {
       UIntMax UInt;
       SIntMax SInt;
       FloatMax Float;
       const void *Pointer;
     };
   };
 
 private:
-  static const unsigned MaxArgs = 5;
+  static const unsigned MaxArgs = 8;
   static const unsigned MaxRanges = 1;
 
   /// The arguments which have been added to this diagnostic so far.
   Arg Args[MaxArgs];
   unsigned NumArgs;
 
   /// The ranges which have been added to this diagnostic so far.
   Range Ranges[MaxRanges];

lib/ubsan/ubsan_handlers.h

 struct InvalidValueData {
   SourceLocation Loc;
   const TypeDescriptor &Type;
 };
 
 /// \brief Handle a load of an invalid value for the type.
 RECOVERABLE(load_invalid_value, InvalidValueData *Data, ValueHandle Val)
 
+/// Known implicit cast check kinds.
+/// Keep in sync with the enum of the same name in CGExprScalar.cpp
+enum ImplicitCastCheckKind : unsigned char {
+  ICCK_IntegerTruncation = 0,
+};
+
+struct ImplicitCastData {
+  SourceLocation Loc;
+  const TypeDescriptor &FromType;
+  const TypeDescriptor &ToType;
+  /* ImplicitCastCheckKind */ unsigned char Kind;
+};
+
+/// \brief Implict cast that changed the value.
+RECOVERABLE(implicit_cast, ImplicitCastData *Data, ValueHandle Src,
+            ValueHandle Dst)
+
 /// Known builtin check kinds.
 /// Keep in sync with the enum of the same name in CodeGenFunction.h
 enum BuiltinCheckKind : unsigned char {
   BCK_CTZPassedZero,
   BCK_CLZPassedZero,
 };
 
 struct InvalidBuiltinData {

lib/ubsan/ubsan_handlers.cc

static void handleShiftOutOfBoundsImpl(ShiftOutOfBoundsData *Data,
   Value LHSVal(Data->LHSType, LHS);
   Value RHSVal(Data->RHSType, RHS);
 
   ErrorType ET;
   if (RHSVal.isNegative() ||
       RHSVal.getPositiveIntValue() >= Data->LHSType.getIntegerBitWidth())
     ET = ErrorType::InvalidShiftExponent;
   else
     ET = ErrorType::InvalidShiftBase;
 
   if (ignoreReport(Loc, Opts, ET))
     return;
 
   ScopedReport R(Opts, Loc, ET);
 
   if (ET == ErrorType::InvalidShiftExponent) {
     if (RHSVal.isNegative())

 }
 void __ubsan::__ubsan_handle_load_invalid_value_abort(InvalidValueData *Data,
                                                       ValueHandle Val) {
   GET_REPORT_OPTIONS(true);
   handleLoadInvalidValue(Data, Val, Opts);
   Die();
 }
 
+static void handleImplicitCast(ImplicitCastData *Data, ReportOptions Opts,
+                               ValueHandle Src, ValueHandle Dst) {
+  SourceLocation Loc = Data->Loc.acquire();
+  ErrorType ET = ErrorType::GenericUB;
+
+  switch (Data->Kind) {
+  case ICCK_IntegerTruncation:
+    ET = ErrorType::ImplicitIntegerTruncation;
+    break;
+  }
+
+  if (ignoreReport(Loc, Opts, ET))
+    return;
+
+  const TypeDescriptor &SrcTy = Data->FromType;
+  const TypeDescriptor &DstTy = Data->ToType;
+
+  ScopedReport R(Opts, Loc, ET);
+
+  // FIXME: is it possible to dump the values as hex with fixed width?
+
+  Diag(Loc, DL_Error, ET,
+       "implicit cast from type %0 of value %1 (%2-bit, %3signed) to type %4 "
+       "changed the value to %5 (%6-bit, %7signed)")
+      << SrcTy << Value(SrcTy, Src) << SrcTy.getIntegerBitWidth()
+      << (SrcTy.isSignedIntegerTy() ? "" : "un") << DstTy << Value(DstTy, Dst)
+      << DstTy.getIntegerBitWidth() << (DstTy.isSignedIntegerTy() ? "" : "un");
+}
+
+void __ubsan::__ubsan_handle_implicit_cast(ImplicitCastData *Data,
+                                           ValueHandle Src, ValueHandle Dst) {
+  GET_REPORT_OPTIONS(false);
+  handleImplicitCast(Data, Opts, Src, Dst);
+}
+void __ubsan::__ubsan_handle_implicit_cast_abort(ImplicitCastData *Data,
+                                                 ValueHandle Src,
+                                                 ValueHandle Dst) {
+  GET_REPORT_OPTIONS(true);
+  handleImplicitCast(Data, Opts, Src, Dst);
+  Die();
+}
+
 static void handleInvalidBuiltin(InvalidBuiltinData *Data, ReportOptions Opts) {
   SourceLocation Loc = Data->Loc.acquire();
   ErrorType ET = ErrorType::InvalidBuiltin;
 
   if (ignoreReport(Loc, Opts, ET))
     return;
 
   ScopedReport R(Opts, Loc, ET);

lib/ubsan/ubsan_interface.inc

 INTERFACE_FUNCTION(__ubsan_handle_divrem_overflow)
 INTERFACE_FUNCTION(__ubsan_handle_divrem_overflow_abort)
 INTERFACE_FUNCTION(__ubsan_handle_dynamic_type_cache_miss)
 INTERFACE_FUNCTION(__ubsan_handle_dynamic_type_cache_miss_abort)
 INTERFACE_FUNCTION(__ubsan_handle_float_cast_overflow)
 INTERFACE_FUNCTION(__ubsan_handle_float_cast_overflow_abort)
 INTERFACE_FUNCTION(__ubsan_handle_function_type_mismatch)
 INTERFACE_FUNCTION(__ubsan_handle_function_type_mismatch_abort)
+INTERFACE_FUNCTION(__ubsan_handle_implicit_cast)
+INTERFACE_FUNCTION(__ubsan_handle_implicit_cast_abort)
 INTERFACE_FUNCTION(__ubsan_handle_invalid_builtin)
 INTERFACE_FUNCTION(__ubsan_handle_invalid_builtin_abort)
 INTERFACE_FUNCTION(__ubsan_handle_load_invalid_value)
 INTERFACE_FUNCTION(__ubsan_handle_load_invalid_value_abort)
 INTERFACE_FUNCTION(__ubsan_handle_missing_return)
 INTERFACE_FUNCTION(__ubsan_handle_mul_overflow)
 INTERFACE_FUNCTION(__ubsan_handle_mul_overflow_abort)
 INTERFACE_FUNCTION(__ubsan_handle_negate_overflow)

lib/ubsan_minimal/ubsan_minimal_handlers.cc

 HANDLER(out_of_bounds, "out-of-bounds")
 HANDLER_RECOVER(builtin_unreachable, "builtin-unreachable")
 HANDLER_RECOVER(missing_return, "missing-return")
 HANDLER(vla_bound_not_positive, "vla-bound-not-positive")
 HANDLER(float_cast_overflow, "float-cast-overflow")
 HANDLER(load_invalid_value, "load-invalid-value")
 HANDLER(invalid_builtin, "invalid-builtin")
 HANDLER(function_type_mismatch, "function-type-mismatch")
+HANDLER(implicit_cast, "implicit-cast")
 HANDLER(nonnull_arg, "nonnull-arg")
 HANDLER(nonnull_return, "nonnull-return")
 HANDLER(nullability_arg, "nullability-arg")
 HANDLER(nullability_return, "nullability-return")
 HANDLER(pointer_overflow, "pointer-overflow")
 HANDLER(cfi_check_fail, "cfi-check-fail")

test/fuzzer/ImplicitIntegerTruncationTest.cpp

+// This file is distributed under the University of Illinois Open Source
+// License. See LICENSE.TXT for details.
+
+// Test for signed-integer-overflow.
+#include <assert.h>
+#include <climits>
+#include <cstddef>
+#include <cstdint>
+#include <cstdlib>
+#include <iostream>
+
+static volatile int Sink;
+static unsigned char Large = UINT8_MAX;
+
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
+  assert(Data);
+  if (Size > 0 && Data[0] == 'H') {
+    Sink = 1;
+    if (Size > 1 && Data[1] == 'i') {
+      Sink = 2;
+      if (Size > 2 && Data[2] == '!') {
+        Large = Large + 1;  // 'char overflow'.
+      }
+    }
+  }
+  return 0;
+}

test/fuzzer/fuzzer-implicit-integer-truncation.test

+RUN: rm -f %t-ImplicitIntegerTruncationTest-Ubsan
+RUN: %cpp_compiler -fsanitize=implicit-integer-truncation -fno-sanitize-recover=all %S/ImplicitIntegerTruncationTest.cpp -o %t-ImplicitIntegerTruncationTest-Ubsan
+RUN: not %run %t-ImplicitIntegerTruncationTest-Ubsan 2>&1 | FileCheck %s
+CHECK: runtime error: implicit cast from type 'int' of value 256 (32-bit, signed) to type 'unsigned char' changed the value to 0 (8-bit, unsigned)
+CHECK: Test unit written to ./crash-

test/ubsan/TestCases/ImplicitCast/integer-truncation-blacklist.c

+// RUN: rm -f %tmp
+// RUN: echo "[implicit-integer-truncation]" >> %tmp
+// RUN: echo "fun:*implicitTruncation*" >> %tmp
+// RUN: %clang -fsanitize=implicit-integer-truncation -fno-sanitize-recover=implicit-integer-truncation -fsanitize-blacklist=%tmp -O0 %s -o %t && not %run %t 2>&1
+// RUN: %clang -fsanitize=implicit-integer-truncation -fno-sanitize-recover=implicit-integer-truncation -fsanitize-blacklist=%tmp -O1 %s -o %t && not %run %t 2>&1
+// RUN: %clang -fsanitize=implicit-integer-truncation -fno-sanitize-recover=implicit-integer-truncation -fsanitize-blacklist=%tmp -O2 %s -o %t && not %run %t 2>&1
+// RUN: %clang -fsanitize=implicit-integer-truncation -fno-sanitize-recover=implicit-integer-truncation -fsanitize-blacklist=%tmp -O3 %s -o %t && not %run %t 2>&1
+
+unsigned char implicitTruncation(unsigned int argc) {
+  return argc; // BOOM
+}
+
+int main(int argc, char **argv) {
+  return implicitTruncation(~0U);
+}

test/ubsan/TestCases/ImplicitCast/integer-truncation-summary.cpp

+// RUN: %clangxx -fsanitize=implicit-integer-truncation %s -o %t
+// RUN: %run %t 2>&1 | FileCheck %s --check-prefix=CHECK-NOTYPE
+// RUN: %env_ubsan_opts=report_error_type=1 %run %t 2>&1 | FileCheck %s --check-prefix=CHECK-TYPE
+// REQUIRES: !ubsan-standalone
+
+#include <stdint.h>
+
+int main() {
+  uint8_t t0 = (~(uint32_t(0)));
+  // CHECK-NOTYPE: SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior {{.*}}summary.cpp:[[@LINE-1]]:16
+  // CHECK-TYPE: SUMMARY: UndefinedBehaviorSanitizer: implicit-integer-truncation {{.*}}summary.cpp:[[@LINE-2]]:16
+  return 0;
+}

test/ubsan/TestCases/ImplicitCast/integer-truncation.c

+// RUN: %clang -fsanitize=implicit-integer-truncation %s -o %t && %run %t 2>&1 | FileCheck %s --check-prefixes=CHECK
+
+#include <stdint.h>
+
+int main() {
+// CHECK-NOT: integer-truncation.c
+
+  // Negative tests. Even if they produce unexpected results, this sanitizer does not care.
+  int8_t n0 = (~((uint32_t)(0))); // ~0 -> -1, but do not warn.
+  uint8_t n2 = 128;
+  uint8_t n3 = 255;
+  // Bools do not count
+  _Bool b0 = (~((uint32_t)(0)));
+  _Bool b1 = 255;
+
+  // Explicit and-ing of bits will silence it.
+  uint8_t nc0 = (~((uint32_t)0)) & 255;
+
+  // Positive tests.
+
+  uint8_t t_b0 = (~((uint16_t)(0)));
+// CHECK: {{.*}}integer-truncation.c:[[@LINE-1]]:18: runtime error: implicit cast from type 'int' of value -1 (32-bit, signed) to type 'uint8_t' (aka 'unsigned char') changed the value to 255 (8-bit, unsigned)
+
+  uint8_t t_b1 = (~((uint32_t)(0)));
+// CHECK: {{.*}}integer-truncation.c:[[@LINE-1]]:18: runtime error: implicit cast from type 'uint32_t' (aka 'unsigned int') of value 4294967295 (32-bit, unsigned) to type 'uint8_t' (aka 'unsigned char') changed the value to 255 (8-bit, unsigned)
+  uint16_t t_b2 = (~((uint32_t)(0)));
+// CHECK: {{.*}}integer-truncation.c:[[@LINE-1]]:19: runtime error: implicit cast from type 'uint32_t' (aka 'unsigned int') of value 4294967295 (32-bit, unsigned) to type 'uint16_t' (aka 'unsigned short') changed the value to 65535 (16-bit, unsigned)
+
+  uint8_t t_b3 = ~((uint64_t)0);
+// CHECK: {{.*}}integer-truncation.c:[[@LINE-1]]:18: runtime error: implicit cast from type 'uint64_t' (aka 'unsigned long{{[^']*}}') of value 18446744073709551615 (64-bit, unsigned) to type 'uint8_t' (aka 'unsigned char') changed the value to 255 (8-bit, unsigned)
+  uint16_t t_b4 = ~((uint64_t)0);
+// CHECK: {{.*}}integer-truncation.c:[[@LINE-1]]:19: runtime error: implicit cast from type 'uint64_t' (aka 'unsigned long{{[^']*}}') of value 18446744073709551615 (64-bit, unsigned) to type 'uint16_t' (aka 'unsigned short') changed the value to 65535 (16-bit, unsigned)
+  uint32_t t_b5 = ~((uint64_t)0);
+// CHECK: {{.*}}integer-truncation.c:[[@LINE-1]]:19: runtime error: implicit cast from type 'uint64_t' (aka 'unsigned long{{[^']*}}') of value 18446744073709551615 (64-bit, unsigned) to type 'uint32_t' (aka 'unsigned int') changed the value to 4294967295 (32-bit, unsigned)
+
+  int8_t t1 = 255;
+// CHECK: {{.*}}integer-truncation.c:[[@LINE-1]]:15: runtime error: implicit cast from type 'int' of value 255 (32-bit, signed) to type 'int8_t' (aka 'signed char') changed the value to -1 (8-bit, signed)
+  uint8_t t2 = 256;
+// CHECK: {{.*}}integer-truncation.c:[[@LINE-1]]:16: runtime error: implicit cast from type 'int' of value 256 (32-bit, signed) to type 'uint8_t' (aka 'unsigned char') changed the value to 0 (8-bit, unsigned)
+  int8_t t3 = 256;
+// CHECK: {{.*}}integer-truncation.c:[[@LINE-1]]:15: runtime error: implicit cast from type 'int' of value 256 (32-bit, signed) to type 'int8_t' (aka 'signed char') changed the value to 0 (8-bit, signed)
+  uint8_t t4 = 257;
+// CHECK: {{.*}}integer-truncation.c:[[@LINE-1]]:16: runtime error: implicit cast from type 'int' of value 257 (32-bit, signed) to type 'uint8_t' (aka 'unsigned char') changed the value to 1 (8-bit, unsigned)
+  int8_t t5 = 257;
+// CHECK: {{.*}}integer-truncation.c:[[@LINE-1]]:15: runtime error: implicit cast from type 'int' of value 257 (32-bit, signed) to type 'int8_t' (aka 'signed char') changed the value to 1 (8-bit, signed)
+  int8_t t6 = 128;
+// CHECK: {{.*}}integer-truncation.c:[[@LINE-1]]:15: runtime error: implicit cast from type 'int' of value 128 (32-bit, signed) to type 'int8_t' (aka 'signed char') changed the value to -128 (8-bit, signed)
+
+  return 0;
+}

test/ubsan/TestCases/ImplicitCast/integer-truncation.cpp

+// RUN: %clangxx -fsanitize=implicit-integer-truncation %s -o %t && %run %t 2>&1 | FileCheck %s --check-prefixes=CHECK
+
+#include <stdint.h>
+
+int main() {
+// CHECK-NOT: integer-truncation.cpp
+
+  // Negative tests. Even if they produce unexpected results, this sanitizer does not care.
+  int8_t n0 = (~(uint32_t(0))); // ~0 -> -1, but do not warn.
+  uint8_t n2 = 128;
+  uint8_t n3 = 255;
+  // Bools do not count
+  bool b0 = (~(uint32_t(0)));
+  bool b1 = 255;
+
+  // Explicit and-ing of bits will silence it.
+  uint8_t nc0 = (~((uint32_t)0)) & 255;
+
+  // Explicit casts
+  uint8_t i0 = (uint8_t)(~(uint32_t(0)));
+  uint8_t i1 = uint8_t(~(uint32_t(0)));
+  uint8_t i2 = static_cast<uint8_t>(~(uint32_t(0)));
+
+  // Positive tests.
+
+  uint8_t t_b0 = (~((uint16_t)(0)));
+// CHECK: {{.*}}integer-truncation.cpp:[[@LINE-1]]:18: runtime error: implicit cast from type 'int' of value -1 (32-bit, signed) to type 'uint8_t' (aka 'unsigned char') changed the value to 255 (8-bit, unsigned)
+
+  uint8_t t_b1 = (~((uint32_t)(0)));
+// CHECK: {{.*}}integer-truncation.cpp:[[@LINE-1]]:18: runtime error: implicit cast from type 'uint32_t' (aka 'unsigned int') of value 4294967295 (32-bit, unsigned) to type 'uint8_t' (aka 'unsigned char') changed the value to 255 (8-bit, unsigned)
+  uint16_t t_b2 = (~((uint32_t)(0)));
+// CHECK: {{.*}}integer-truncation.cpp:[[@LINE-1]]:19: runtime error: implicit cast from type 'uint32_t' (aka 'unsigned int') of value 4294967295 (32-bit, unsigned) to type 'uint16_t' (aka 'unsigned short') changed the value to 65535 (16-bit, unsigned)
+
+  uint8_t t_b3 = ~((uint64_t)0);
+// CHECK: {{.*}}integer-truncation.cpp:[[@LINE-1]]:18: runtime error: implicit cast from type 'uint64_t' (aka 'unsigned long{{[^']*}}') of value 18446744073709551615 (64-bit, unsigned) to type 'uint8_t' (aka 'unsigned char') changed the value to 255 (8-bit, unsigned)
+  uint16_t t_b4 = ~((uint64_t)0);
+// CHECK: {{.*}}integer-truncation.cpp:[[@LINE-1]]:19: runtime error: implicit cast from type 'uint64_t' (aka 'unsigned long{{[^']*}}') of value 18446744073709551615 (64-bit, unsigned) to type 'uint16_t' (aka 'unsigned short') changed the value to 65535 (16-bit, unsigned)
+  uint32_t t_b5 = ~((uint64_t)0);
+// CHECK: {{.*}}integer-truncation.cpp:[[@LINE-1]]:19: runtime error: implicit cast from type 'uint64_t' (aka 'unsigned long{{[^']*}}') of value 18446744073709551615 (64-bit, unsigned) to type 'uint32_t' (aka 'unsigned int') changed the value to 4294967295 (32-bit, unsigned)
+
+  int8_t t1 = 255;
+// CHECK: {{.*}}integer-truncation.cpp:[[@LINE-1]]:15: runtime error: implicit cast from type 'int' of value 255 (32-bit, signed) to type 'int8_t' (aka 'signed char') changed the value to -1 (8-bit, signed)
+  uint8_t t2 = 256;
+// CHECK: {{.*}}integer-truncation.cpp:[[@LINE-1]]:16: runtime error: implicit cast from type 'int' of value 256 (32-bit, signed) to type 'uint8_t' (aka 'unsigned char') changed the value to 0 (8-bit, unsigned)
+  int8_t t3 = 256;
+// CHECK: {{.*}}integer-truncation.cpp:[[@LINE-1]]:15: runtime error: implicit cast from type 'int' of value 256 (32-bit, signed) to type 'int8_t' (aka 'signed char') changed the value to 0 (8-bit, signed)
+  uint8_t t4 = 257;
+// CHECK: {{.*}}integer-truncation.cpp:[[@LINE-1]]:16: runtime error: implicit cast from type 'int' of value 257 (32-bit, signed) to type 'uint8_t' (aka 'unsigned char') changed the value to 1 (8-bit, unsigned)
+  int8_t t5 = 257;
+// CHECK: {{.*}}integer-truncation.cpp:[[@LINE-1]]:15: runtime error: implicit cast from type 'int' of value 257 (32-bit, signed) to type 'int8_t' (aka 'signed char') changed the value to 1 (8-bit, signed)
+  int8_t t6 = 128;
+// CHECK: {{.*}}integer-truncation.cpp:[[@LINE-1]]:15: runtime error: implicit cast from type 'int' of value 128 (32-bit, signed) to type 'int8_t' (aka 'signed char') changed the value to -128 (8-bit, signed)
+
+  return 0;
+}

test/ubsan_minimal/TestCases/implicit-integer-truncation.c

+// RUN: %clang -fsanitize=implicit-integer-truncation %s -o %t && %run %t 2>&1 | FileCheck %s --check-prefixes=CHECK
+
+#include <stdint.h>
+
+int main() {
+// CHECK-NOT: integer-truncation.c
+
+  // Negative tests. Even if they produce unexpected results, this sanitizer does not care.
+  int8_t n0 = (~((uint32_t)(0))); // ~0 -> -1, but do not warn.
+  uint8_t n2 = 128;
+  uint8_t n3 = 255;
+  // Bools do not count
+  _Bool b0 = (~((uint32_t)(0)));
+  _Bool b1 = 255;
+
+  // Explicit and-ing of bits will silence it.
+  uint8_t nc0 = ((~((uint32_t)(0))) & 255);
+
+  // Positive tests.
+  uint8_t t0 = (~((uint32_t)(0)));
+// CHECK: implicit-cast
+
+  return 0;
+}