[sanitizer] Implement reallocarray.

[eugenis]

Summary

It's a cross of calloc and realloc. Sanitizers implement calloc-like check for size
overflow.

[eugenis]

disable sanitizer_common reallocarray test on darwin

compiler-rt/include/sanitizer/hwasan_interface.h

#endif
   void __sanitizer_free(void *ptr);
   void __sanitizer_cfree(void *ptr);
   size_t __sanitizer_malloc_usable_size(const void *ptr);
   struct mallinfo __sanitizer_mallinfo();
   int __sanitizer_mallopt(int cmd, int value);
   void __sanitizer_malloc_stats(void);
   void * __sanitizer_calloc(size_t nmemb, size_t size);
   void * __sanitizer_realloc(void *ptr, size_t size);
+  void * __sanitizer_reallocarray(void *ptr, size_t nmemb, size_t size);
   void * __sanitizer_malloc(size_t size);
 #ifdef __cplusplus
 }  // extern "C"
 #endif
 
 #endif  // SANITIZER_HWASAN_INTERFACE_H

compiler-rt/lib/asan/asan_allocator.h

void *asan_memalign(uptr alignment, uptr size, BufferedStackTrace *stack,
                     AllocType alloc_type);
 void asan_free(void *ptr, BufferedStackTrace *stack, AllocType alloc_type);
 void asan_delete(void *ptr, uptr size, uptr alignment,
                  BufferedStackTrace *stack, AllocType alloc_type);
 
 void *asan_malloc(uptr size, BufferedStackTrace *stack);
 void *asan_calloc(uptr nmemb, uptr size, BufferedStackTrace *stack);
 void *asan_realloc(void *p, uptr size, BufferedStackTrace *stack);
+void *asan_reallocarray(void *p, uptr nmemb, uptr size,
+                        BufferedStackTrace *stack);
 void *asan_valloc(uptr size, BufferedStackTrace *stack);
 void *asan_pvalloc(uptr size, BufferedStackTrace *stack);
 
 void *asan_aligned_alloc(uptr alignment, uptr size, BufferedStackTrace *stack);
 int asan_posix_memalign(void **memptr, uptr alignment, uptr size,
                         BufferedStackTrace *stack);
 uptr asan_malloc_usable_size(const void *ptr, uptr pc, uptr bp);
 

compiler-rt/lib/asan/asan_allocator.cc

 void *asan_malloc(uptr size, BufferedStackTrace *stack) {
   return SetErrnoOnNull(instance.Allocate(size, 8, stack, FROM_MALLOC, true));
 }
 
 void *asan_calloc(uptr nmemb, uptr size, BufferedStackTrace *stack) {
   return SetErrnoOnNull(instance.Calloc(nmemb, size, stack));
 }
 
+void *asan_reallocarray(void *p, uptr nmemb, uptr size,
+                        BufferedStackTrace *stack) {
+  if (UNLIKELY(CheckForCallocOverflow(size, nmemb))) {
+    errno = errno_ENOMEM;
+    if (AllocatorMayReturnNull())
+      return nullptr;
+    ReportReallocArrayOverflow(nmemb, size, stack);
+  }
+  return asan_realloc(p, nmemb * size, stack);
+}
+
 void *asan_realloc(void *p, uptr size, BufferedStackTrace *stack) {
   if (!p)
     return SetErrnoOnNull(instance.Allocate(size, 8, stack, FROM_MALLOC, true));
   if (size == 0) {
     if (flags()->allocator_frees_and_returns_null_on_realloc_zero) {
       instance.Deallocate(p, 0, 0, stack, FROM_MALLOC);
       return nullptr;
     }

compiler-rt/lib/asan/asan_errors.h

ErrorCallocOverflow(u32 tid, BufferedStackTrace *stack_, uptr count_,
                       uptr size_)
       : ErrorBase(tid, 10, "calloc-overflow"),
         stack(stack_),
         count(count_),
         size(size_) {}
   void Print();
 };
 
+struct ErrorReallocArrayOverflow : ErrorBase {
+  const BufferedStackTrace *stack;
+  uptr count;
+  uptr size;
+
+  ErrorReallocArrayOverflow() = default;  // (*)
+  ErrorReallocArrayOverflow(u32 tid, BufferedStackTrace *stack_, uptr count_,
+                            uptr size_)
+      : ErrorBase(tid, 10, "reallocarray-overflow"),
+        stack(stack_),
+        count(count_),
+        size(size_) {}
+  void Print();
+};
+
 struct ErrorPvallocOverflow : ErrorBase {
   const BufferedStackTrace *stack;
   uptr size;
 
   ErrorPvallocOverflow() = default;  // (*)
   ErrorPvallocOverflow(u32 tid, BufferedStackTrace *stack_, uptr size_)
       : ErrorBase(tid, 10, "pvalloc-overflow"),
         stack(stack_),
#define ASAN_FOR_EACH_ERROR_KIND(macro)         \
   macro(DeadlySignal)                           \
   macro(DoubleFree)                             \
   macro(NewDeleteTypeMismatch)                  \
   macro(FreeNotMalloced)                        \
   macro(AllocTypeMismatch)                      \
   macro(MallocUsableSizeNotOwned)               \
   macro(SanitizerGetAllocatedSizeNotOwned)      \
   macro(CallocOverflow)                         \
+  macro(ReallocArrayOverflow)                   \
   macro(PvallocOverflow)                        \
   macro(InvalidAllocationAlignment)             \
   macro(InvalidAlignedAllocAlignment)           \
   macro(InvalidPosixMemalignAlignment)          \
   macro(AllocationSizeTooBig)                   \
   macro(RssLimitExceeded)                       \
   macro(OutOfMemory)                            \
   macro(StringFunctionMemoryRangesOverlap)      \

compiler-rt/lib/asan/asan_errors.cc

Report(
       "(%zd * %zd) cannot be represented in type size_t (thread %s)\n",
       count, size, AsanThreadIdAndName(tid).c_str());
   Printf("%s", d.Default());
   stack->Print();
   PrintHintAllocatorCannotReturnNull();
   ReportErrorSummary(scariness.GetDescription(), stack);
 }
 
+void ErrorReallocArrayOverflow::Print() {
+  Decorator d;
+  Printf("%s", d.Error());
+  Report(
+      "ERROR: AddressSanitizer: reallocarray parameters overflow: count * size "
+      "(%zd * %zd) cannot be represented in type size_t (thread %s)\n",
+      count, size, AsanThreadIdAndName(tid).c_str());
+  Printf("%s", d.Default());
+  stack->Print();
+  PrintHintAllocatorCannotReturnNull();
+  ReportErrorSummary(scariness.GetDescription(), stack);
+}
+
 void ErrorPvallocOverflow::Print() {
   Decorator d;
   Printf("%s", d.Error());
   Report(
       "ERROR: AddressSanitizer: pvalloc parameters overflow: size 0x%zx "
       "rounded up to system page size 0x%zx cannot be represented in type "
       "size_t (thread %s)\n",
       size, GetPageSizeCached(), AsanThreadIdAndName(tid).c_str());

compiler-rt/lib/asan/asan_malloc_linux.cc

if (UNLIKELY(IsInDlsymAllocPool(ptr)))
     return ReallocFromLocalPool(ptr, size);
   if (UNLIKELY(UseLocalPool()))
     return AllocateFromLocalPool(size);
   ENSURE_ASAN_INITED();
   GET_STACK_TRACE_MALLOC;
   return asan_realloc(ptr, size, &stack);
 }
 
+#if SANITIZER_INTERCEPT_REALLOCARRAY
+INTERCEPTOR(void*, reallocarray, void *ptr, uptr nmemb, uptr size) {
+  ENSURE_ASAN_INITED();
+  GET_STACK_TRACE_MALLOC;
+  return asan_reallocarray(ptr, nmemb, size, &stack);
+}
+#endif  // SANITIZER_INTERCEPT_REALLOCARRAY
+
 #if SANITIZER_INTERCEPT_MEMALIGN
 INTERCEPTOR(void*, memalign, uptr boundary, uptr size) {
   GET_STACK_TRACE_MALLOC;
   return asan_memalign(boundary, size, &stack, FROM_MALLOC);
 }
 
 INTERCEPTOR(void*, __libc_memalign, uptr boundary, uptr size) {
   GET_STACK_TRACE_MALLOC;

compiler-rt/lib/asan/asan_report.h

 void ReportFreeNotMalloced(uptr addr, BufferedStackTrace *free_stack);
 void ReportAllocTypeMismatch(uptr addr, BufferedStackTrace *free_stack,
                              AllocType alloc_type,
                              AllocType dealloc_type);
 void ReportMallocUsableSizeNotOwned(uptr addr, BufferedStackTrace *stack);
 void ReportSanitizerGetAllocatedSizeNotOwned(uptr addr,
                                              BufferedStackTrace *stack);
 void ReportCallocOverflow(uptr count, uptr size, BufferedStackTrace *stack);
+void ReportReallocArrayOverflow(uptr count, uptr size,
+                                BufferedStackTrace *stack);
 void ReportPvallocOverflow(uptr size, BufferedStackTrace *stack);
 void ReportInvalidAllocationAlignment(uptr alignment,
                                       BufferedStackTrace *stack);
 void ReportInvalidAlignedAllocAlignment(uptr size, uptr alignment,
                                         BufferedStackTrace *stack);
 void ReportInvalidPosixMemalignAlignment(uptr alignment,
                                          BufferedStackTrace *stack);
 void ReportAllocationSizeTooBig(uptr user_size, uptr total_size, uptr max_size,

compiler-rt/lib/asan/asan_report.cc

 }
 
 void ReportCallocOverflow(uptr count, uptr size, BufferedStackTrace *stack) {
   ScopedInErrorReport in_report(/*fatal*/ true);
   ErrorCallocOverflow error(GetCurrentTidOrInvalid(), stack, count, size);
   in_report.ReportError(error);
 }
 
+void ReportReallocArrayOverflow(uptr count, uptr size,
+                                BufferedStackTrace *stack) {
+  ScopedInErrorReport in_report(/*fatal*/ true);
+  ErrorReallocArrayOverflow error(GetCurrentTidOrInvalid(), stack, count, size);
+  in_report.ReportError(error);
+}
+
 void ReportPvallocOverflow(uptr size, BufferedStackTrace *stack) {
   ScopedInErrorReport in_report(/*fatal*/ true);
   ErrorPvallocOverflow error(GetCurrentTidOrInvalid(), stack, size);
   in_report.ReportError(error);
 }
 
 void ReportInvalidAllocationAlignment(uptr alignment,
                                       BufferedStackTrace *stack) {

compiler-rt/lib/hwasan/hwasan.h

 void InitializeInterceptors();
 
 void HwasanAllocatorInit();
 void HwasanAllocatorThreadFinish();
 
 void *hwasan_malloc(uptr size, StackTrace *stack);
 void *hwasan_calloc(uptr nmemb, uptr size, StackTrace *stack);
 void *hwasan_realloc(void *ptr, uptr size, StackTrace *stack);
+void *hwasan_reallocarray(void *ptr, uptr nmemb, uptr size, StackTrace *stack);
 void *hwasan_valloc(uptr size, StackTrace *stack);
 void *hwasan_pvalloc(uptr size, StackTrace *stack);
 void *hwasan_aligned_alloc(uptr alignment, uptr size, StackTrace *stack);
 void *hwasan_memalign(uptr alignment, uptr size, StackTrace *stack);
 int hwasan_posix_memalign(void **memptr, uptr alignment, uptr size,
                         StackTrace *stack);
 void hwasan_free(void *ptr, StackTrace *stack);
 

compiler-rt/lib/hwasan/hwasan_allocator.cpp

#endif
 
   if (size == 0) {
     HwasanDeallocate(stack, ptr);
     return nullptr;
   }
   return SetErrnoOnNull(HwasanReallocate(stack, ptr, size, sizeof(u64)));
 }
 
+void *hwasan_reallocarray(void *ptr, uptr nmemb, uptr size, StackTrace *stack) {
+  if (UNLIKELY(CheckForCallocOverflow(size, nmemb))) {
+    errno = errno_ENOMEM;
+    if (AllocatorMayReturnNull())
+      return nullptr;
+    ReportReallocArrayOverflow(nmemb, size, stack);
+  }
+  return hwasan_realloc(ptr, nmemb * size, stack);
+}
+
 void *hwasan_valloc(uptr size, StackTrace *stack) {
   return SetErrnoOnNull(
       HwasanAllocate(stack, size, GetPageSizeCached(), false));
 }
 
 void *hwasan_pvalloc(uptr size, StackTrace *stack) {
   uptr PageSize = GetPageSizeCached();
   if (UNLIKELY(CheckForPvallocOverflow(size, PageSize))) {

compiler-rt/lib/hwasan/hwasan_interceptors.cpp

if (UNLIKELY(!hwasan_inited)) {
       new_ptr = hwasan_malloc(copy_size, &stack);
     }
     internal_memcpy(new_ptr, ptr, copy_size);
     return new_ptr;
   }
   return hwasan_realloc(ptr, size, &stack);
 }
 
+void * __sanitizer_reallocarray(void *ptr, uptr nmemb, uptr size) {
+  GET_MALLOC_STACK_TRACE;
+  return hwasan_reallocarray(ptr, nmemb, size, &stack);
+}
+
 void * __sanitizer_malloc(uptr size) {
   GET_MALLOC_STACK_TRACE;
   if (UNLIKELY(!hwasan_init_is_running))
     ENSURE_HWASAN_INITED();
   if (UNLIKELY(!hwasan_inited))
     // Hack: dlsym calls malloc before REAL(malloc) is retrieved from dlsym.
     return AllocateFromLocalPool(size);
   return hwasan_malloc(size, &stack);
INTERCEPTOR_ALIAS(int, posix_memalign, void **memptr, SIZE_T alignment,
                   SIZE_T size);
 INTERCEPTOR_ALIAS(void *, aligned_alloc, SIZE_T alignment, SIZE_T size);
 INTERCEPTOR_ALIAS(void *, __libc_memalign, SIZE_T alignment, SIZE_T size);
 INTERCEPTOR_ALIAS(void *, valloc, SIZE_T size);
 INTERCEPTOR_ALIAS(void, free, void *ptr);
 INTERCEPTOR_ALIAS(uptr, malloc_usable_size, const void *ptr);
 INTERCEPTOR_ALIAS(void *, calloc, SIZE_T nmemb, SIZE_T size);
 INTERCEPTOR_ALIAS(void *, realloc, void *ptr, SIZE_T size);
+INTERCEPTOR_ALIAS(void *, reallocarray, void *ptr, SIZE_T nmemb, SIZE_T size);
 INTERCEPTOR_ALIAS(void *, malloc, SIZE_T size);
 
 #if !SANITIZER_FREEBSD && !SANITIZER_NETBSD
 INTERCEPTOR_ALIAS(void *, memalign, SIZE_T alignment, SIZE_T size);
 INTERCEPTOR_ALIAS(void *, pvalloc, SIZE_T size);
 INTERCEPTOR_ALIAS(void, cfree, void *ptr);
 INTERCEPTOR_ALIAS(__sanitizer_struct_mallinfo, mallinfo);
 INTERCEPTOR_ALIAS(int, mallopt, int cmd, int value);

compiler-rt/lib/hwasan/hwasan_interface_internal.h

 
 SANITIZER_INTERFACE_ATTRIBUTE
 void * __sanitizer_calloc(uptr nmemb, uptr size);
 
 SANITIZER_INTERFACE_ATTRIBUTE
 void * __sanitizer_realloc(void *ptr, uptr size);
 
 SANITIZER_INTERFACE_ATTRIBUTE
+void * __sanitizer_reallocarray(void *ptr, uptr nmemb, uptr size);
+
+SANITIZER_INTERFACE_ATTRIBUTE
 void * __sanitizer_malloc(uptr size);
 
 SANITIZER_INTERFACE_ATTRIBUTE
 void *__hwasan_memcpy(void *dst, const void *src, uptr size);
 SANITIZER_INTERFACE_ATTRIBUTE
 void *__hwasan_memset(void *s, int c, uptr n);
 SANITIZER_INTERFACE_ATTRIBUTE
 void *__hwasan_memmove(void *dest, const void *src, uptr n);
 }  // extern "C"
 
 #endif  // HWASAN_INTERFACE_INTERNAL_H

compiler-rt/lib/lsan/lsan_allocator.h

 
 int lsan_posix_memalign(void **memptr, uptr alignment, uptr size,
                         const StackTrace &stack);
 void *lsan_aligned_alloc(uptr alignment, uptr size, const StackTrace &stack);
 void *lsan_memalign(uptr alignment, uptr size, const StackTrace &stack);
 void *lsan_malloc(uptr size, const StackTrace &stack);
 void lsan_free(void *p);
 void *lsan_realloc(void *p, uptr size, const StackTrace &stack);
+void *lsan_reallocarray(void *p, uptr nmemb, uptr size,
+                        const StackTrace &stack);
 void *lsan_calloc(uptr nmemb, uptr size, const StackTrace &stack);
 void *lsan_valloc(uptr size, const StackTrace &stack);
 void *lsan_pvalloc(uptr size, const StackTrace &stack);
 uptr lsan_mz_size(const void *p);
 
 }  // namespace __lsan
 
 #endif  // LSAN_ALLOCATOR_H

compiler-rt/lib/lsan/lsan_allocator.cc

 void lsan_free(void *p) {
   Deallocate(p);
 }
 
 void *lsan_realloc(void *p, uptr size, const StackTrace &stack) {
   return SetErrnoOnNull(Reallocate(stack, p, size, 1));
 }
 
+void *lsan_reallocarray(void *ptr, uptr nmemb, uptr size,
+                        const StackTrace &stack) {
+  if (UNLIKELY(CheckForCallocOverflow(size, nmemb))) {
+    errno = errno_ENOMEM;
+    if (AllocatorMayReturnNull())
+      return nullptr;
+    ReportReallocArrayOverflow(nmemb, size, &stack);
+  }
+  return lsan_realloc(ptr, nmemb * size, stack);
+}
+
 void *lsan_calloc(uptr nmemb, uptr size, const StackTrace &stack) {
   return SetErrnoOnNull(Calloc(nmemb, size, stack));
 }
 
 void *lsan_valloc(uptr size, const StackTrace &stack) {
   return SetErrnoOnNull(
       Allocate(stack, size, GetPageSizeCached(), kAlwaysClearMemory));
 }

compiler-rt/lib/lsan/lsan_interceptors.cc

 }
 
 INTERCEPTOR(void*, realloc, void *q, uptr size) {
   ENSURE_LSAN_INITED;
   GET_STACK_TRACE_MALLOC;
   return lsan_realloc(q, size, stack);
 }
 
+INTERCEPTOR(void*, reallocarray, void *q, uptr nmemb, uptr size) {
+  ENSURE_LSAN_INITED;
+  GET_STACK_TRACE_MALLOC;
+  return lsan_reallocarray(q, nmemb, size, stack);
+}
+
 INTERCEPTOR(int, posix_memalign, void **memptr, uptr alignment, uptr size) {
   ENSURE_LSAN_INITED;
   GET_STACK_TRACE_MALLOC;
   return lsan_posix_memalign(memptr, alignment, size, stack);
 }
 
 INTERCEPTOR(void*, valloc, uptr size) {
   ENSURE_LSAN_INITED;

compiler-rt/lib/msan/msan.h

 
 void MsanAllocatorInit();
 void MsanAllocatorThreadFinish();
 void MsanDeallocate(StackTrace *stack, void *ptr);
 
 void *msan_malloc(uptr size, StackTrace *stack);
 void *msan_calloc(uptr nmemb, uptr size, StackTrace *stack);
 void *msan_realloc(void *ptr, uptr size, StackTrace *stack);
+void *msan_reallocarray(void *ptr, uptr nmemb, uptr size, StackTrace *stack);
 void *msan_valloc(uptr size, StackTrace *stack);
 void *msan_pvalloc(uptr size, StackTrace *stack);
 void *msan_aligned_alloc(uptr alignment, uptr size, StackTrace *stack);
 void *msan_memalign(uptr alignment, uptr size, StackTrace *stack);
 int msan_posix_memalign(void **memptr, uptr alignment, uptr size,
                         StackTrace *stack);
 
 void InstallTrapHandler();

compiler-rt/lib/msan/msan_allocator.cc

if (!ptr)
     return SetErrnoOnNull(MsanAllocate(stack, size, sizeof(u64), false));
   if (size == 0) {
     MsanDeallocate(stack, ptr);
     return nullptr;
   }
   return SetErrnoOnNull(MsanReallocate(stack, ptr, size, sizeof(u64)));
 }
 
+void *msan_reallocarray(void *ptr, uptr nmemb, uptr size, StackTrace *stack) {
+  if (UNLIKELY(CheckForCallocOverflow(size, nmemb))) {
+    errno = errno_ENOMEM;
+    if (AllocatorMayReturnNull())
+      return nullptr;
+    ReportReallocArrayOverflow(nmemb, size, stack);
+  }
+  return msan_realloc(ptr, nmemb * size, stack);
+}
+
 void *msan_valloc(uptr size, StackTrace *stack) {
   return SetErrnoOnNull(MsanAllocate(stack, size, GetPageSizeCached(), false));
 }
 
 void *msan_pvalloc(uptr size, StackTrace *stack) {
   uptr PageSize = GetPageSizeCached();
   if (UNLIKELY(CheckForPvallocOverflow(size, PageSize))) {
     errno = errno_ENOMEM;

compiler-rt/lib/msan/msan_interceptors.cc

if (UNLIKELY(!msan_inited)) {
       new_ptr = msan_malloc(copy_size, &stack);
     }
     internal_memcpy(new_ptr, ptr, copy_size);
     return new_ptr;
   }
   return msan_realloc(ptr, size, &stack);
 }
 
+INTERCEPTOR(void *, reallocarray, void *ptr, SIZE_T nmemb, SIZE_T size) {
+  GET_MALLOC_STACK_TRACE;
+  return msan_reallocarray(ptr, nmemb, size, &stack);
+}
+
 INTERCEPTOR(void *, malloc, SIZE_T size) {
   GET_MALLOC_STACK_TRACE;
   if (UNLIKELY(!msan_inited))
     // Hack: dlsym calls malloc before REAL(malloc) is retrieved from dlsym.
     return AllocateFromLocalPool(size);
   return msan_malloc(size, &stack);
 }
 
void InitializeInterceptors() {
   INTERCEPT_FUNCTION(posix_memalign);
   MSAN_MAYBE_INTERCEPT_MEMALIGN;
   MSAN_MAYBE_INTERCEPT___LIBC_MEMALIGN;
   INTERCEPT_FUNCTION(valloc);
   MSAN_MAYBE_INTERCEPT_PVALLOC;
   INTERCEPT_FUNCTION(malloc);
   INTERCEPT_FUNCTION(calloc);
   INTERCEPT_FUNCTION(realloc);
+  INTERCEPT_FUNCTION(reallocarray);
   INTERCEPT_FUNCTION(free);
   MSAN_MAYBE_INTERCEPT_CFREE;
   MSAN_MAYBE_INTERCEPT_MALLOC_USABLE_SIZE;
   MSAN_MAYBE_INTERCEPT_MALLINFO;
   MSAN_MAYBE_INTERCEPT_MALLOPT;
   MSAN_MAYBE_INTERCEPT_MALLOC_STATS;
   INTERCEPT_FUNCTION(fread);
   MSAN_MAYBE_INTERCEPT_FREAD_UNLOCKED;

compiler-rt/lib/sanitizer_common/sanitizer_allocator.cc

void *InternalRealloc(void *addr, uptr size, InternalAllocatorCache *cache) {
   size = size + sizeof(u64);
   CHECK_EQ(kBlockMagic, ((u64*)addr)[0]);
   void *p = RawInternalRealloc(addr, size, cache);
   if (UNLIKELY(!p))
     ReportInternalAllocatorOutOfMemory(size);
   return (char*)p + sizeof(u64);
 }
 
+void *InternalReallocArray(void *addr, uptr count, uptr size,
+                           InternalAllocatorCache *cache) {
+  if (UNLIKELY(CheckForCallocOverflow(count, size))) {
+    Report(
+        "FATAL: %s: reallocarray parameters overflow: count * size (%zd * %zd) "
+        "cannot be represented in type size_t\n",
+        SanitizerToolName, count, size);
+    Die();
+  }
+  return InternalRealloc(addr, count * size, cache);
+}
+
 void *InternalCalloc(uptr count, uptr size, InternalAllocatorCache *cache) {
   if (UNLIKELY(CheckForCallocOverflow(count, size))) {
     Report("FATAL: %s: calloc parameters overflow: count * size (%zd * %zd) "
            "cannot be represented in type size_t\n", SanitizerToolName, count,
            size);
     Die();
   }
   void *p = InternalAlloc(count * size, cache);

compiler-rt/lib/sanitizer_common/sanitizer_allocator_internal.h

 
 typedef CombinedAllocator<PrimaryInternalAllocator, InternalAllocatorCache,
                           SecondaryInternalAllocator> InternalAllocator;
 
 void *InternalAlloc(uptr size, InternalAllocatorCache *cache = nullptr,
                     uptr alignment = 0);
 void *InternalRealloc(void *p, uptr size,
                       InternalAllocatorCache *cache = nullptr);
-void *InternalCalloc(uptr countr, uptr size,
+void *InternalReallocArray(void *p, uptr count, uptr size,
+                           InternalAllocatorCache *cache = nullptr);
+void *InternalCalloc(uptr count, uptr size,
                      InternalAllocatorCache *cache = nullptr);
 void InternalFree(void *p, InternalAllocatorCache *cache = nullptr);
 InternalAllocator *internal_allocator();
 
 } // namespace __sanitizer
 
 #endif // SANITIZER_ALLOCATOR_INTERNAL_H

compiler-rt/lib/sanitizer_common/sanitizer_allocator_report.h

 
 #include "sanitizer_internal_defs.h"
 #include "sanitizer_stacktrace.h"
 
 namespace __sanitizer {
 
 void NORETURN ReportCallocOverflow(uptr count, uptr size,
                                    const StackTrace *stack);
+void NORETURN ReportReallocArrayOverflow(uptr count, uptr size,
+                                         const StackTrace *stack);
 void NORETURN ReportPvallocOverflow(uptr size, const StackTrace *stack);
 void NORETURN ReportInvalidAllocationAlignment(uptr alignment,
                                                const StackTrace *stack);
 void NORETURN ReportInvalidAlignedAllocAlignment(uptr size, uptr alignment,
                                                  const StackTrace *stack);
 void NORETURN ReportInvalidPosixMemalignAlignment(uptr alignment,
                                                   const StackTrace *stack);
 void NORETURN ReportAllocationSizeTooBig(uptr user_size, uptr max_size,
                                          const StackTrace *stack);
 void NORETURN ReportOutOfMemory(uptr requested_size, const StackTrace *stack);
 
 }  // namespace __sanitizer
 
 #endif  // SANITIZER_ALLOCATOR_REPORT_H

compiler-rt/lib/sanitizer_common/sanitizer_allocator_report.cc

void NORETURN ReportCallocOverflow(uptr count, uptr size,
     ScopedAllocatorErrorReport report("calloc-overflow", stack);
     Report("ERROR: %s: calloc parameters overflow: count * size (%zd * %zd) "
            "cannot be represented in type size_t\n", SanitizerToolName, count,
            size);
   }
   Die();
 }
 
+void NORETURN ReportReallocArrayOverflow(uptr count, uptr size,
+                                         const StackTrace *stack) {
+  {
+    ScopedAllocatorErrorReport report("reallocarray-overflow", stack);
+    Report(
+        "ERROR: %s: reallocarray parameters overflow: count * size (%zd * %zd) "
+        "cannot be represented in type size_t\n",
+        SanitizerToolName, count, size);
+  }
+  Die();
+}
+
 void NORETURN ReportPvallocOverflow(uptr size, const StackTrace *stack) {
   {
     ScopedAllocatorErrorReport report("pvalloc-overflow", stack);
     Report("ERROR: %s: pvalloc parameters overflow: size 0x%zx rounded up to "
            "system page size 0x%zx cannot be represented in type size_t\n",
            SanitizerToolName, size, GetPageSizeCached());
   }
   Die();

compiler-rt/lib/sanitizer_common/sanitizer_platform_interceptors.h

 #define SANITIZER_INTERCEPT_MEMALIGN \
   (!SI_FREEBSD && !SI_MAC && !SI_NETBSD && !SI_OPENBSD && SI_NOT_RTEMS)
 #define SANITIZER_INTERCEPT_PVALLOC \
   (!SI_FREEBSD && !SI_MAC && !SI_NETBSD && !SI_OPENBSD && SI_NOT_FUCHSIA && \
   SI_NOT_RTEMS)
 #define SANITIZER_INTERCEPT_CFREE \
   (!SI_FREEBSD && !SI_MAC && !SI_NETBSD && !SI_OPENBSD && SI_NOT_FUCHSIA && \
   SI_NOT_RTEMS)
+#define SANITIZER_INTERCEPT_REALLOCARRAY SI_POSIX
 #define SANITIZER_INTERCEPT_ALIGNED_ALLOC (!SI_MAC && SI_NOT_RTEMS)
 #define SANITIZER_INTERCEPT_MALLOC_USABLE_SIZE (!SI_MAC && !SI_OPENBSD)
 #define SANITIZER_INTERCEPT_MCHECK_MPROBE SI_LINUX_NOT_ANDROID
 #define SANITIZER_INTERCEPT_WCSCAT SI_POSIX
 #define SANITIZER_INTERCEPT_SIGNAL_AND_SIGACTION (!SI_WINDOWS && SI_NOT_FUCHSIA)
 #define SANITIZER_INTERCEPT_BSD_SIGNAL SI_ANDROID
 
 #define SANITIZER_INTERCEPT_ACCT (SI_NETBSD || SI_OPENBSD || SI_FREEBSD)

compiler-rt/lib/tsan/rtl/tsan_interceptors.cc

TSAN_INTERCEPTOR(void*, realloc, void *p, uptr size) {
   {
     SCOPED_INTERCEPTOR_RAW(realloc, p, size);
     p = user_realloc(thr, pc, p, size);
   }
   invoke_malloc_hook(p, size);
   return p;
 }
 
+TSAN_INTERCEPTOR(void*, reallocarray, void *p, uptr size, uptr n) {
+  if (in_symbolizer())
+    return InternalReallocArray(p, size, n);
+  if (p)
+    invoke_free_hook(p);
+  {
+    SCOPED_INTERCEPTOR_RAW(reallocarray, p, size, n);
+    p = user_reallocarray(thr, pc, p, size, n);
+  }
+  invoke_malloc_hook(p, size);
+  return p;
+}
+
 TSAN_INTERCEPTOR(void, free, void *p) {
   if (p == 0)
     return;
   if (in_symbolizer())
     return InternalFree(p);
   invoke_free_hook(p);
   SCOPED_INTERCEPTOR_RAW(free, p);
   user_free(thr, pc, p);

 #if SANITIZER_NETBSD
   TSAN_INTERCEPT(_longjmp);
 #endif
 
   TSAN_INTERCEPT(malloc);
   TSAN_INTERCEPT(__libc_memalign);
   TSAN_INTERCEPT(calloc);
   TSAN_INTERCEPT(realloc);
+  TSAN_INTERCEPT(reallocarray);
   TSAN_INTERCEPT(free);
   TSAN_INTERCEPT(cfree);
   TSAN_INTERCEPT(munmap);
   TSAN_MAYBE_INTERCEPT_MEMALIGN;
   TSAN_INTERCEPT(valloc);
   TSAN_MAYBE_INTERCEPT_PVALLOC;
   TSAN_INTERCEPT(posix_memalign);
 

compiler-rt/lib/tsan/rtl/tsan_mman.h

 void *user_alloc_internal(ThreadState *thr, uptr pc, uptr sz,
                           uptr align = kDefaultAlignment, bool signal = true);
 // Does not accept NULL.
 void user_free(ThreadState *thr, uptr pc, void *p, bool signal = true);
 // Interceptor implementations.
 void *user_alloc(ThreadState *thr, uptr pc, uptr sz);
 void *user_calloc(ThreadState *thr, uptr pc, uptr sz, uptr n);
 void *user_realloc(ThreadState *thr, uptr pc, void *p, uptr sz);
+void *user_reallocarray(ThreadState *thr, uptr pc, void *p, uptr sz, uptr n);
 void *user_memalign(ThreadState *thr, uptr pc, uptr align, uptr sz);
 int user_posix_memalign(ThreadState *thr, uptr pc, void **memptr, uptr align,
                         uptr sz);
 void *user_aligned_alloc(ThreadState *thr, uptr pc, uptr align, uptr sz);
 void *user_valloc(ThreadState *thr, uptr pc, uptr sz);
 void *user_pvalloc(ThreadState *thr, uptr pc, uptr sz);
 uptr user_alloc_usable_size(const void *p);
 

compiler-rt/lib/tsan/rtl/tsan_mman.cc

if (UNLIKELY(CheckForCallocOverflow(size, n))) {
     ReportCallocOverflow(n, size, &stack);
   }
   void *p = user_alloc_internal(thr, pc, n * size);
   if (p)
     internal_memset(p, 0, n * size);
   return SetErrnoOnNull(p);
 }
 
+void *user_reallocarray(ThreadState *thr, uptr pc, void *p, uptr size, uptr n) {
+  if (UNLIKELY(CheckForCallocOverflow(size, n))) {
+    if (AllocatorMayReturnNull())
+      return SetErrnoOnNull(nullptr);
+    GET_STACK_TRACE_FATAL(thr, pc);
+    ReportReallocArrayOverflow(size, n, &stack);
+  }
+  return user_realloc(thr, pc, p, size * n);
+}
+
 void OnUserAlloc(ThreadState *thr, uptr pc, uptr p, uptr sz, bool write) {
   DPrintf("#%d: alloc(%zu) = %p\n", thr->tid, sz, p);
   ctx->metamap.AllocBlock(thr, pc, p, sz);
   if (write && thr->ignore_reads_and_writes == 0)
     MemoryRangeImitateWrite(thr, pc, (uptr)p, sz);
   else
     MemoryResetRange(thr, pc, (uptr)p, sz);
 }

compiler-rt/test/hwasan/TestCases/realloc-test.cc

 // Test basic realloc functionality.
-// RUN: %clang_hwasan %s -o %t
-// RUN: %run %t
+// RUN: %clang_hwasan %s -o %t && %run %t
+// RUN: %clang_hwasan %s -DREALLOCARRAY -o %t && %run %t
 
-#include <stdlib.h>
 #include <assert.h>
 #include <sanitizer/hwasan_interface.h>
 
+#ifdef REALLOCARRAY
+extern "C" void *reallocarray(void *, size_t nmemb, size_t size);
+#define REALLOC(p, s) reallocarray(p, 1, s)
+#else
+#include <stdlib.h>
+#define REALLOC(p, s) realloc(p, s)
+#endif
+
 int main() {
   __hwasan_enable_allocator_tagging();
-  char *x = (char*)realloc(nullptr, 4);
+  char *x = (char*)REALLOC(nullptr, 4);
   x[0] = 10;
   x[1] = 20;
   x[2] = 30;
   x[3] = 40;
-  char *x1 = (char*)realloc(x, 5);
+  char *x1 = (char*)REALLOC(x, 5);
   assert(x1 != x);  // not necessary true for C,
                     // but true today for hwasan.
   assert(x1[0] == 10 && x1[1] == 20 && x1[2] == 30 && x1[3] == 40);
   x1[4] = 50;
 
-  char *x2 = (char*)realloc(x1, 6);
+  char *x2 = (char*)REALLOC(x1, 6);
   x2[5] = 60;
   assert(x2 != x1);
   assert(x2[0] == 10 && x2[1] == 20 && x2[2] == 30 && x2[3] == 40 &&
          x2[4] == 50 && x2[5] == 60);
 
-  char *x3 = (char*)realloc(x2, 6);
+  char *x3 = (char*)REALLOC(x2, 6);
   assert(x3 != x2);
   assert(x3[0] == 10 && x3[1] == 20 && x3[2] == 30 && x3[3] == 40 &&
          x3[4] == 50 && x3[5] == 60);
 
-  char *x4 = (char*)realloc(x3, 5);
+  char *x4 = (char*)REALLOC(x3, 5);
   assert(x4 != x3);
   assert(x4[0] == 10 && x4[1] == 20 && x4[2] == 30 && x4[3] == 40 &&
          x4[4] == 50);
 }

compiler-rt/test/hwasan/TestCases/sanitizer_malloc.cc

int main() {
   sink = (void *)&__sanitizer_free;
   sink = (void *)&__sanitizer_cfree;
   sink = (void *)&__sanitizer_malloc_usable_size;
   sink = (void *)&__sanitizer_mallinfo;
   sink = (void *)&__sanitizer_mallopt;
   sink = (void *)&__sanitizer_malloc_stats;
   sink = (void *)&__sanitizer_calloc;
   sink = (void *)&__sanitizer_realloc;
+  sink = (void *)&__sanitizer_reallocarray;
   sink = (void *)&__sanitizer_malloc;
 
   // sanity check
   void *p = __sanitizer_malloc(100);
   p = __sanitizer_realloc(p, 200);
   __sanitizer_free(p);
 }

compiler-rt/test/hwasan/TestCases/sizes.cpp

 // This test requires operator new to be intercepted by the hwasan runtime,
 // so we need to avoid linking against libc++.
 // RUN: %clangxx_hwasan %s -nostdlib++ -lstdc++ -o %t
 // RUN: %env_hwasan_opts=allocator_may_return_null=0 not %run %t malloc 2>&1          | FileCheck %s --check-prefix=CHECK-max
 // RUN: %env_hwasan_opts=allocator_may_return_null=1     %run %t malloc 2>&1
 // RUN: %env_hwasan_opts=allocator_may_return_null=0 not %run %t malloc max 2>&1      | FileCheck %s --check-prefix=CHECK-max
 // RUN: %env_hwasan_opts=allocator_may_return_null=1     %run %t malloc max 2>&1
 // RUN: %env_hwasan_opts=allocator_may_return_null=0 not %run %t calloc 2>&1          | FileCheck %s --check-prefix=CHECK-calloc
 // RUN: %env_hwasan_opts=allocator_may_return_null=1     %run %t calloc 2>&1
+// RUN: %env_hwasan_opts=allocator_may_return_null=0 not %run %t reallocarray 2>&1    | FileCheck %s --check-prefix=CHECK-reallocarray
+// RUN: %env_hwasan_opts=allocator_may_return_null=1     %run %t reallocarray 2>&1
 // RUN: %env_hwasan_opts=allocator_may_return_null=0 not %run %t new 2>&1             | FileCheck %s --check-prefix=CHECK-max
 // RUN: %env_hwasan_opts=allocator_may_return_null=1 not %run %t new 2>&1             | FileCheck %s --check-prefix=CHECK-oom
 // RUN: %env_hwasan_opts=allocator_may_return_null=0 not %run %t new max 2>&1         | FileCheck %s --check-prefix=CHECK-max
 // RUN: %env_hwasan_opts=allocator_may_return_null=1 not %run %t new max 2>&1         | FileCheck %s --check-prefix=CHECK-oom
 // RUN: %env_hwasan_opts=allocator_may_return_null=0 not %run %t new-nothrow 2>&1     | FileCheck %s --check-prefix=CHECK-max
 // RUN: %env_hwasan_opts=allocator_may_return_null=1     %run %t new-nothrow 2>&1
 // RUN: %env_hwasan_opts=allocator_may_return_null=0 not %run %t new-nothrow max 2>&1 | FileCheck %s --check-prefix=CHECK-max
 // RUN: %env_hwasan_opts=allocator_may_return_null=1     %run %t new-nothrow max 2>&1
 // RUN:                                                 %run %t usable 2>&1
 
 // Tests for various edge cases related to sizes, notably the maximum size the
 // allocator can allocate. Tests that an integer overflow in the parameters of
 // calloc is caught.
 
 #include <assert.h>
 #include <malloc.h>
 #include <stdlib.h>
 #include <string.h>
 
 #include <limits>
 #include <new>
 
 #include <sanitizer/allocator_interface.h>
+#include <sanitizer/hwasan_interface.h>
 
 int main(int argc, char **argv) {
   assert(argc <= 3);
   bool test_size_max = argc == 3 && !strcmp(argv[2], "max");
 
   static const size_t kMaxAllowedMallocSize = 1ULL << 40;
   static const size_t kChunkHeaderSize = 16;
 
   size_t MallocSize = test_size_max ? std::numeric_limits<size_t>::max()
                                     : kMaxAllowedMallocSize;
 
   if (!strcmp(argv[1], "malloc")) {
     void *p = malloc(MallocSize);
     assert(!p);
     p = malloc(kMaxAllowedMallocSize - kChunkHeaderSize);
     assert(!p);
   } else if (!strcmp(argv[1], "calloc")) {
     // Trigger an overflow in calloc.
     size_t size = std::numeric_limits<size_t>::max();
     void *p = calloc((size / 0x1000) + 1, 0x1000);
     assert(!p);
+  } else if (!strcmp(argv[1], "reallocarray")) {
+    // Trigger an overflow in reallocarray.
+    size_t size = std::numeric_limits<size_t>::max();
+    void *p = __sanitizer_reallocarray(nullptr, (size / 0x1000) + 1, 0x1000);
+    assert(!p);
   } else if (!strcmp(argv[1], "new")) {
     void *p = operator new(MallocSize);
     assert(!p);
   } else if (!strcmp(argv[1], "new-nothrow")) {
     void *p = operator new(MallocSize, std::nothrow);
     assert(!p);
   } else if (!strcmp(argv[1], "usable")) {
     // Playing with the actual usable size of a chunk.
int main(int argc, char **argv) {
   }
 
   return 0;
 }
 
 // CHECK-max: {{ERROR: HWAddressSanitizer: requested allocation size .* exceeds maximum supported size}}
 // CHECK-oom: ERROR: HWAddressSanitizer: allocator is out of memory
 // CHECK-calloc: ERROR: HWAddressSanitizer: calloc parameters overflow
+// CHECK-reallocarray: ERROR: HWAddressSanitizer: reallocarray parameters overflow

compiler-rt/test/sanitizer_common/TestCases/reallocarray-overflow.cc

+// RUN: %clangxx  -O0 %s -o %t
+// RUN: %env_tool_opts=allocator_may_return_null=0 not %run %t 2>&1 | FileCheck %s
+// RUN: %env_tool_opts=allocator_may_return_null=1 %run %t 2>&1 | FileCheck %s --check-prefix=CHECK-NULL
+
+// REQUIRES: stable-runtime && !ubsan
+
+#include <stdio.h>
+
+extern "C" void *reallocarray(void *, size_t, size_t);
+
+int main() {
+  void *p = reallocarray(nullptr, -1, 1000);
+  // CHECK: {{ERROR: .*Sanitizer: reallocarray parameters overflow: count \* size \(.* \* 1000\) cannot be represented in type size_t}}
+
+  printf("reallocarray returned: %zu\n", (size_t)p);
+  // CHECK-NULL: reallocarray returned: 0
+
+  return 0;
+}