[msan] Support %ms in scanf.

[guiand]

LGTM. Does this support the a format specifier as well, or just m?

[eugenis]

The problem with "a" is that we do not always know what it means exactly (could be a float), and it's dangerous to dereference the pointer.

[vitalybuka]

compiler-rt/lib/sanitizer_common/sanitizer_common_interceptors_format.inc

346–349

for consistency, we use real for similar stuff in other interceptors and without temp var

[eugenis]

.

[eugenis]

compiler-rt/lib/sanitizer_common/sanitizer_common_interceptors_format.inc

346–349

This file uses internal_strlen everywhere. I've got rid of the temp variable.

compiler-rt/lib/sanitizer_common/sanitizer_common_interceptors_format.inc

if (n_inputs < 0)
       break;
     if (size == FSS_STRLEN) {
       size = internal_strlen((const char *)argp) + 1;
     } else if (size == FSS_WCSLEN) {
       // FIXME: actually use wcslen() to calculate it.
       size = 0;
     }
     COMMON_INTERCEPTOR_WRITE_RANGE(ctx, argp, size);
+    // For %ms/%mc, write the allocated output buffer as well.
+    if (dir.allocate) {
+      char *buf = *(char **)argp;
+      if (buf)
+        COMMON_INTERCEPTOR_WRITE_RANGE(ctx, buf, internal_strlen(buf) + 1);
+    }
   }
 }
 
 #if SANITIZER_INTERCEPT_PRINTF
 
 struct PrintfDirective {
   int fieldWidth;
   int fieldPrecision;
   int argIdx; // width argument index, or -1 if not specified ("%*n$")

compiler-rt/lib/sanitizer_common/tests/sanitizer_format_interceptor_test.cpp

 static const unsigned LC = sizeof(wchar_t);
 static const unsigned D = sizeof(double);
 static const unsigned LD = sizeof(long double);
 static const unsigned F = sizeof(float);
 static const unsigned P = sizeof(char *);
 
 static void verifyFormatResults(const char *format, unsigned n,
                                 const std::vector<unsigned> &computed_sizes,
-                                va_list expected_sizes) {
-  // "+ 1" because of format string
+                                const std::vector<unsigned> &expected_sizes) {
+  // "+ 1" because of the format string
   ASSERT_EQ(n + 1,
             computed_sizes.size()) << "Unexpected number of format arguments: '"
                                    << format << "'";
   for (unsigned i = 0; i < n; ++i)
-    EXPECT_EQ(va_arg(expected_sizes, unsigned), computed_sizes[i + 1])
+    EXPECT_EQ(expected_sizes[i], computed_sizes[i + 1])
         << "Unexpect write size for argument " << i << ", format string '"
         << format << "'";
 }
 
 static const char test_buf[] = "Test string.";
 static const size_t test_buf_size = sizeof(test_buf);
 
 static const unsigned SCANF_ARGS_MAX = 16;
 
 static void testScanf3(void *ctx, int result, bool allowGnuMalloc,
                        const char *format, ...) {
   va_list ap;
   va_start(ap, format);
   scanf_common(ctx, result, allowGnuMalloc, format, ap);
   va_end(ap);
 }
 
 static void testScanf2(const char *format, int scanf_result,
                        bool allowGnuMalloc, unsigned n,
-                       va_list expected_sizes) {
-  std::vector<unsigned> scanf_sizes;
+                       va_list expected_sizes_va) {
+  std::vector<unsigned> scanf_sizes, expected_sizes;
+  for (unsigned i = 0; i < n; ++i)
+    expected_sizes.push_back(va_arg(expected_sizes_va, unsigned));
+
   // 16 args should be enough.
   testScanf3((void *)&scanf_sizes, scanf_result, allowGnuMalloc, format,
              test_buf, test_buf, test_buf, test_buf, test_buf, test_buf,
              test_buf, test_buf, test_buf, test_buf, test_buf, test_buf,
              test_buf, test_buf, test_buf, test_buf);
   verifyFormatResults(format, n, scanf_sizes, expected_sizes);
 }
 
TEST(SanitizerCommonInterceptors, Scanf) {
 
   testScanf("%*[^:]%n:%d:%1[ ]%n", 4, I, I, 2, I);
 
   testScanf("%*d%u", 1, I);
 
   testScanf("%c%d", 2, C, I);
   testScanf("%A%lf", 2, F, D);
 
-  testScanf("%ms %Lf", 2, P, LD);
   testScanf("s%Las", 1, LD);
   testScanf("%ar", 1, F);
 
   // In the cases with std::min below the format spec can be interpreted as
   // either floating-something, or (GNU extension) callee-allocated string.
   // Our conservative implementation reports one of the two possibilities with
   // the least store range.
   testScanf("%a[", 0);
TEST(SanitizerCommonInterceptors, Scanf) {
   testScanfPartial("%d%n%n%d //1\n", 1, 3, I, I, I);
   testScanfPartial("%d%n%n%d //2\n", 2, 4, I, I, I, I);
 
   testScanfPartial("%d%n%n%d %s %s", 3, 5, I, I, I, I, test_buf_size);
   testScanfPartial("%d%n%n%d %s %s", 4, 6, I, I, I, I, test_buf_size,
                    test_buf_size);
 }
 
+TEST(SanitizerCommonInterceptors, ScanfAllocate) {
+  const char *buf = "123456";
+
+  // Can not use testScanf() because this case needs a valid pointer to a string
+  // in the scanf argument.
+  {
+    std::vector<unsigned> scanf_sizes;
+    testScanf3((void *)&scanf_sizes, 2, /*allowGnuMalloc=*/false, "%ms", &buf);
+    verifyFormatResults("%ms", 2, scanf_sizes,
+                        {P, (unsigned)(strlen(buf) + 1)});
+  }
+
+  {
+    std::vector<unsigned> scanf_sizes;
+    testScanf3((void *)&scanf_sizes, 2, /*allowGnuMalloc=*/false, "%mc", &buf);
+    verifyFormatResults("%mc", 2, scanf_sizes,
+                        {P, (unsigned)(strlen(buf) + 1)});
+  }
+}
+
 static void testPrintf3(void *ctx, const char *format, ...) {
   va_list ap;
   va_start(ap, format);
   printf_common(ctx, format, ap);
   va_end(ap);
 }
 
 static void testPrintf2(const char *format, unsigned n,
-                       va_list expected_sizes) {
-  std::vector<unsigned> printf_sizes;
+                        va_list expected_sizes_va) {
+  std::vector<unsigned> printf_sizes, expected_sizes;
+  for (unsigned i = 0; i < n; ++i)
+    expected_sizes.push_back(va_arg(expected_sizes_va, unsigned));
+
   // 16 args should be enough.
   testPrintf3((void *)&printf_sizes, format,
              test_buf, test_buf, test_buf, test_buf, test_buf, test_buf,
              test_buf, test_buf, test_buf, test_buf, test_buf, test_buf,
              test_buf, test_buf, test_buf, test_buf);
   verifyFormatResults(format, n, printf_sizes, expected_sizes);
 }
 

compiler-rt/test/msan/scanf-allocate.cpp

+// RUN: %clangxx_msan -O0 %s -o %t && %run %t >%t.out 2>&1
+// FileCheck %s <%t.out
+
+#include <sanitizer/msan_interface.h>
+#include <stdio.h>
+#include <string.h>
+
+int main(int argc, char **argv) {
+  char *str;
+  sscanf("#string#", "%ms", &str);
+  printf("str = %s\n", str);
+  __msan_check_mem_is_initialized(str, strlen(str) + 1);
+  // CHECK: #string#
+}