[sanitizer]: fix warnings reported by SVACE static analyzer.

[drmtmych]

Summary

The warnings are:

• lsan_thread.cc: return value of a function '__lsan::CurrentThreadContext' is dereferenced without checking.
• sanitizer_libc.cc: casting a signed value which has type 'char' to a bigger unsigned integer type 'unsigned int' while initializing a variable.
• sanitizer_libignore.cc: constructor may not initialize class members of '__sanitizer::LibIgnore'.
• sanitizer_printf.cc: 'minimal_num_length' with type 'u8', is promoted to type 'int' 32b in 'minimal_num_length - pos', then sign-extended to type 'unsigned long' 64b.
• sanitizer_symbolizer_posix_libcdep.cc: after having been compared to NULL value, pointer (...)->path is passed as 1st parameter in call to function '__sanitizer::LLVMSymbolizer::LLVMSymbolizer', where it is dereferenced.

[dvyukov]

lib/lsan/lsan_thread.cc

125

Please add a test that triggers NULL deref here. It worked all the time, so this must be some tricky corner case. It would be useful to have it captured in a test.

lib/sanitizer_common/sanitizer_libc.cc

118

c1 and c2 are compared with less below. It looks like this can change semantics. Is it intentional? How does it change semantics? Char can be either signed or unsigned, so result of this function will be implementation defined, which looks strange.

lib/sanitizer_common/sanitizer_libignore.cc

26

This breaks linker-initialized-ness. It looks like this makes correct code incorrect...

lib/sanitizer_common/sanitizer_printf.cc

65

What is the type of bug this warning finds? Does it find any true positives in this code base? Or is this a true positive? If yes, then please add a test.

lib/sanitizer_common/sanitizer_symbolizer_posix_libcdep.cc

458

How can NULL path be passed to LLVMSymbolizer? I fail to see the exact scenario.

lib/lsan/lsan_thread.cc

 }
 
 void ThreadJoin(u32 tid) {
   CHECK_NE(tid, kInvalidTid);
   thread_registry->JoinThread(tid, /* arg */nullptr);
 }
 
 void EnsureMainThreadIDIsCorrect() {
-  if (GetCurrentThread() == 0)
-    CurrentThreadContext()->os_id = GetTid();
+  if (GetCurrentThread() == 0) {
+    ThreadContext *tc = CurrentThreadContext();
+    if (tc) tc->os_id = GetTid();
+  }
 }
 
 ///// Interface to the common LSan module. /////
 
 bool GetThreadRangesLocked(tid_t os_id, uptr *stack_begin, uptr *stack_end,
                            uptr *tls_begin, uptr *tls_end, uptr *cache_begin,
                            uptr *cache_end, DTLS **dtls) {
   ThreadContext *context = static_cast<ThreadContext *>(

lib/sanitizer_common/sanitizer_libc.cc

char* internal_strdup(const char *s) {
   char *s2 = (char*)InternalAlloc(len + 1);
   internal_memcpy(s2, s, len);
   s2[len] = 0;
   return s2;
 }
 
 int internal_strcmp(const char *s1, const char *s2) {
   while (true) {
-    unsigned c1 = *s1;
-    unsigned c2 = *s2;
+    char c1 = *s1;
+    char c2 = *s2;
     if (c1 != c2) return (c1 < c2) ? -1 : 1;
     if (c1 == 0) break;
     s1++;
     s2++;
   }
   return 0;
 }
 
 int internal_strncmp(const char *s1, const char *s2, uptr n) {
   for (uptr i = 0; i < n; i++) {
-    unsigned c1 = *s1;
-    unsigned c2 = *s2;
+    char c1 = *s1;
+    char c2 = *s2;
     if (c1 != c2) return (c1 < c2) ? -1 : 1;
     if (c1 == 0) break;
     s1++;
     s2++;
   }
   return 0;
 }
 

lib/sanitizer_common/sanitizer_libignore.cc

 
 #include "sanitizer_libignore.h"
 #include "sanitizer_flags.h"
 #include "sanitizer_posix.h"
 #include "sanitizer_procmaps.h"
 
 namespace __sanitizer {
 
-LibIgnore::LibIgnore(LinkerInitialized) {
+LibIgnore::LibIgnore(LinkerInitialized)
+    : mutex_(), count_(0),
+      track_instrumented_libs_(false) {
+  atomic_store_relaxed(&ignored_ranges_count_, 0);
+  atomic_store_relaxed(&instrumented_ranges_count_, 0);
+  internal_memset(ignored_code_ranges_, 0, sizeof(ignored_code_ranges_));
+  internal_memset(instrumented_code_ranges_, 0,
+                  sizeof(instrumented_code_ranges_));
+  internal_memset(libs_, 0, sizeof(libs_));
 }
 
 void LibIgnore::AddIgnoredLibrary(const char *name_templ) {
   BlockingMutexLock lock(&mutex_);
   if (count_ >= kMaxLibs) {
     Report("%s: too many ignored libraries (max: %d)\n", SanitizerToolName,
            kMaxLibs);
     Die();

lib/sanitizer_common/sanitizer_printf.cc

static int AppendNumber(char **buff, const char *buff_end, u64 absolute_value,
   do {
     RAW_CHECK_MSG((uptr)pos < kMaxLen, "AppendNumber buffer overflow");
     num_buffer[pos++] = absolute_value % base;
     absolute_value /= base;
   } while (absolute_value > 0);
   if (pos < minimal_num_length) {
     // Make sure compiler doesn't insert call to memset here.
     internal_memset(&num_buffer[pos], 0,
-                    sizeof(num_buffer[0]) * (minimal_num_length - pos));
+                    sizeof(num_buffer[0]) *
+                        ((u64)minimal_num_length - (u64)pos));
     pos = minimal_num_length;
   }
   RAW_CHECK(pos > 0);
   pos--;
   for (; pos >= 0 && num_buffer[pos] == 0; pos--) {
     char c = (pad_with_zero || pos == 0) ? '0' : ' ';
     result += AppendChar(buff, buff_end, c);
   }

lib/sanitizer_common/sanitizer_symbolizer_posix_libcdep.cc

 
 const char *Symbolizer::PlatformDemangle(const char *name) {
   return DemangleSwiftAndCXX(name);
 }
 
 static SymbolizerTool *ChooseExternalSymbolizer(LowLevelAllocator *allocator) {
   const char *path = common_flags()->external_symbolizer_path;
   const char *binary_name = path ? StripModuleName(path) : "";
-  if (path && path[0] == '\0') {
+
+  if (path) {
+    if (path[0] == '\0') {
       VReport(2, "External symbolizer is explicitly disabled.\n");
       return nullptr;
     } else if (!internal_strcmp(binary_name, "llvm-symbolizer")) {
       VReport(2, "Using llvm-symbolizer at user-specified path: %s\n", path);
       return new(*allocator) LLVMSymbolizer(path, allocator);
     } else if (!internal_strcmp(binary_name, "atos")) {
 #if SANITIZER_MAC
       VReport(2, "Using atos at user-specified path: %s\n", path);
       return new(*allocator) AtosSymbolizer(path, allocator);
 #else  // SANITIZER_MAC
       Report("ERROR: Using `atos` is only supported on Darwin.\n");
       Die();
 #endif  // SANITIZER_MAC
     } else if (!internal_strcmp(binary_name, "addr2line")) {
       VReport(2, "Using addr2line at user-specified path: %s\n", path);
       return new(*allocator) Addr2LinePool(path, allocator);
-  } else if (path) {
+    } else {
       Report("ERROR: External symbolizer path is set to '%s' which isn't "
              "a known symbolizer. Please set the path to the llvm-symbolizer "
              "binary or other known tool.\n", path);
       Die();
     }
+  }
 
   // Otherwise symbolizer program is unknown, let's search $PATH
   CHECK(path == nullptr);
 #if SANITIZER_MAC
   if (const char *found_path = FindPathToBinary("atos")) {
     VReport(2, "Using atos found at: %s\n", found_path);
     return new(*allocator) AtosSymbolizer(found_path, allocator);
   }