[sanitizer] More string interceptors: strstr, strcasestr, strspn, strcspn, strpbrk.

Patch by Maria Guseva.

Differential Revision: http://reviews.llvm.org/D9017


git-svn-id: https://llvm.org/svn/llvm-project/compiler-rt/trunk@238406 91177308-0d34-0410-b5e6-96231b3b80d8

15 files changed, 327 insertions, 0 deletions

diff --git a/test/asan/TestCases/strcasestr-1.c b/test/asan/TestCases/strcasestr-1.c
new file mode 100644
index 000000000..642549e25
--- /dev/null
+++ b/test/asan/TestCases/strcasestr-1.c
@@ -0,0 +1,23 @@
+// Test haystack overflow in strcasestr function
+// RUN: %clang_asan %s -o %t && ASAN_OPTIONS=strict_string_checks=true not %run %t 2>&1 | FileCheck %s
+
+// Test intercept_strstr asan option
+// RUN: ASAN_OPTIONS=intercept_strstr=false %run %t 2>&1
+
+// There's no interceptor for strcasestr on Windows
+// XFAIL: win32
+
+#define _GNU_SOURCE
+#include <assert.h>
+#include <string.h>
+
+int main(int argc, char **argv) {
+  char *r = 0;
+  char s2[] = "c";
+  char s1[] = {'a', 'b'};
+  char s3 = 0;
+  r = strcasestr(s1, s2);
+  // CHECK:'s{{[1|3]}}' <== Memory access at offset {{[0-9]+ .*}}flows this variable
+  assert(r == 0);
+  return 0;
+}
diff --git a/test/asan/TestCases/strcasestr-2.c b/test/asan/TestCases/strcasestr-2.c
new file mode 100644
index 000000000..a1b59885e
--- /dev/null
+++ b/test/asan/TestCases/strcasestr-2.c
@@ -0,0 +1,23 @@
+// Test needle overflow in strcasestr function
+// RUN: %clang_asan %s -o %t && ASAN_OPTIONS=strict_string_checks=true not %run %t 2>&1 | FileCheck %s
+
+// Test intercept_strstr asan option
+// RUN: ASAN_OPTIONS=intercept_strstr=false %run %t 2>&1
+
+// There's no interceptor for strcasestr on Windows
+// XFAIL: win32
+
+#define _GNU_SOURCE
+#include <assert.h>
+#include <string.h>
+
+int main(int argc, char **argv) {
+  char *r = 0;
+  char s1[] = "ab";
+  char s2[] = {'c'};
+  char s3 = 0;
+  r = strcasestr(s1, s2);
+  assert(r == 0);
+  // CHECK:'s{{[2|3]}}' <== Memory access at offset {{[0-9]+ .*}}flows this variable
+  return 0;
+}
diff --git a/test/asan/TestCases/strcasestr_strict.c b/test/asan/TestCases/strcasestr_strict.c
new file mode 100644
index 000000000..9448bb3d0
--- /dev/null
+++ b/test/asan/TestCases/strcasestr_strict.c
@@ -0,0 +1,28 @@
+// Test strict_string_checks option in strcasestr function
+// RUN: %clang_asan %s -o %t && %run %t 2>&1
+// RUN: ASAN_OPTIONS=strict_string_checks=false %run %t 2>&1
+// RUN: ASAN_OPTIONS=strict_string_checks=true not %run %t 2>&1 | FileCheck %s
+
+// There's no interceptor for strcasestr on Windows
+// XFAIL: win32
+
+#define _GNU_SOURCE
+#include <assert.h>
+#include <stdlib.h>
+#include <string.h>
+
+int main(int argc, char **argv) {
+  size_t size = 100;
+  char *s1 = (char*)malloc(size);
+  char *s2 = (char*)malloc(size);
+  memset(s1, 'o', size);
+  memset(s2, 'O', size);
+  s2[size - 1]='\0';
+  char* r = strcasestr(s1, s2);
+  // CHECK: {{.*ERROR: AddressSanitizer: heap-buffer-overflow on address}}
+  // CHECK: READ of size 101
+  assert(r == s1);
+  free(s1);
+  free(s2);
+  return 0;
+}
diff --git a/test/asan/TestCases/strcspn-1.c b/test/asan/TestCases/strcspn-1.c
new file mode 100644
index 000000000..edbfa2592
--- /dev/null
+++ b/test/asan/TestCases/strcspn-1.c
@@ -0,0 +1,19 @@
+// Test string s1 overflow in strcspn function
+// RUN: %clang_asan %s -o %t && ASAN_OPTIONS=strict_string_checks=true not %run %t 2>&1 | FileCheck %s
+
+// Test intercept_strspn asan option
+// RUN: ASAN_OPTIONS=intercept_strspn=false %run %t 2>&1
+
+#include <assert.h>
+#include <string.h>
+
+int main(int argc, char **argv) {
+  size_t r;
+  char s2[] = "ab";
+  char s1[] = {'c', 'd'};
+  char s3 = 0;
+  r = strcspn(s1, s2);
+  // CHECK:'s{{[1|3]}}' <== Memory access at offset {{[0-9]+ .*}}flows this variable
+  assert(r >= sizeof(s1));
+  return 0;
+}
diff --git a/test/asan/TestCases/strcspn-2.c b/test/asan/TestCases/strcspn-2.c
new file mode 100644
index 000000000..c4e2691e5
--- /dev/null
+++ b/test/asan/TestCases/strcspn-2.c
@@ -0,0 +1,19 @@
+// Test stopset overflow in strcspn function
+// RUN: %clang_asan %s -o %t && ASAN_OPTIONS=strict_string_checks=true not %run %t 2>&1 | FileCheck %s
+
+// Test intercept_strcspn asan option
+// RUN: ASAN_OPTIONS=intercept_strspn=false %run %t 2>&1
+
+#include <assert.h>
+#include <string.h>
+
+int main(int argc, char **argv) {
+  size_t r;
+  char s1[] = "ab";
+  char s2[] = {'c', 'd'};
+  char s3 = 0;
+  r = strcspn(s1, s2);
+  // CHECK:'s{{[2|3]}}' <== Memory access at offset {{[0-9]+ .*}}flows this variable
+  assert(r == sizeof(s1) - 1);
+  return 0;
+}
diff --git a/test/asan/TestCases/strcspn_strict.c b/test/asan/TestCases/strcspn_strict.c
new file mode 100644
index 000000000..384615288
--- /dev/null
+++ b/test/asan/TestCases/strcspn_strict.c
@@ -0,0 +1,26 @@
+// Test strict_string_checks option in strcspn function
+// RUN: %clang_asan %s -o %t && %run %t 2>&1
+// RUN: ASAN_OPTIONS=strict_string_checks=false %run %t 2>&1
+// RUN: ASAN_OPTIONS=strict_string_checks=true not %run %t 2>&1 | FileCheck %s
+
+#include <assert.h>
+#include <stdlib.h>
+#include <string.h>
+
+int main(int argc, char **argv) {
+  size_t size = 100;
+  char fill = 'o';
+  char *s1 = (char*)malloc(size);
+  char *s2 = (char*)malloc(size);
+  memset(s1, fill, size);
+  s1[0] = 'z';
+  memset(s2, fill, size);
+  s2[size-1] = '\0';
+  size_t r = strcspn(s1, s2);
+  // CHECK: {{.*ERROR: AddressSanitizer: heap-buffer-overflow on address}}
+  // CHECK: READ of size 101
+  assert(r == 1);
+  free(s1);
+  free(s2);
+  return 0;
+}
diff --git a/test/asan/TestCases/strpbrk-1.c b/test/asan/TestCases/strpbrk-1.c
new file mode 100644
index 000000000..65d79aa79
--- /dev/null
+++ b/test/asan/TestCases/strpbrk-1.c
@@ -0,0 +1,19 @@
+// Test string s1 overflow in strpbrk function
+// RUN: %clang_asan %s -o %t && ASAN_OPTIONS=strict_string_checks=true not %run %t 2>&1 | FileCheck %s
+
+// Test intercept_strpbrk asan option
+// RUN: ASAN_OPTIONS=intercept_strpbrk=false %run %t 2>&1
+
+#include <assert.h>
+#include <string.h>
+
+int main(int argc, char **argv) {
+  char *r;
+  char s2[] = "ab";
+  char s1[] = {'c', 'd'};
+  char s3[] = "a";
+  r = strpbrk(s1, s2);
+  // CHECK:'s{{[1|3]}}' <== Memory access at offset {{[0-9]+ .*}}flows this variable
+  assert(r <= s3);
+  return 0;
+}
diff --git a/test/asan/TestCases/strpbrk-2.c b/test/asan/TestCases/strpbrk-2.c
new file mode 100644
index 000000000..556c8da68
--- /dev/null
+++ b/test/asan/TestCases/strpbrk-2.c
@@ -0,0 +1,19 @@
+// Test stopset overflow in strpbrk function
+// RUN: %clang_asan %s -o %t && ASAN_OPTIONS=strict_string_checks=true not %run %t 2>&1 | FileCheck %s
+
+// Test intercept_strpbrk asan option
+// RUN: ASAN_OPTIONS=intercept_strpbrk=false %run %t 2>&1
+
+#include <assert.h>
+#include <string.h>
+
+int main(int argc, char **argv) {
+  char *r;
+  char s1[] = "a";
+  char s2[] = {'b', 'c'};
+  char s3 = 0;
+  r = strpbrk(s1, s2);
+  // CHECK:'s{{[2|3]}}' <== Memory access at offset {{[0-9]+ .*}}flows this variable
+  assert(r == (r ? s1 : 0));
+  return 0;
+}
diff --git a/test/asan/TestCases/strpbrk_strict.c b/test/asan/TestCases/strpbrk_strict.c
new file mode 100644
index 000000000..1bf48eccb
--- /dev/null
+++ b/test/asan/TestCases/strpbrk_strict.c
@@ -0,0 +1,25 @@
+// Test strict_string_checks option in strpbrk function
+// RUN: %clang_asan %s -o %t && %run %t 2>&1
+// RUN: ASAN_OPTIONS=strict_string_checks=false %run %t 2>&1
+// RUN: ASAN_OPTIONS=strict_string_checks=true not %run %t 2>&1 | FileCheck %s
+
+#include <assert.h>
+#include <stdlib.h>
+#include <string.h>
+
+int main(int argc, char **argv) {
+  size_t size = 100;
+  char fill = 'o';
+  char *s1 = (char*)malloc(size);
+  char *s2 = (char*)malloc(2);
+  memset(s1, fill, size);
+  s2[0] = fill;
+  s2[1]='\0';
+  char* r = strpbrk(s1, s2);
+  // CHECK: {{.*ERROR: AddressSanitizer: heap-buffer-overflow on address}}
+  // CHECK: READ of size 101
+  assert(r == s1);
+  free(s1);
+  free(s2);
+  return 0;
+}
diff --git a/test/asan/TestCases/strspn-1.c b/test/asan/TestCases/strspn-1.c
new file mode 100644
index 000000000..8672b082c
--- /dev/null
+++ b/test/asan/TestCases/strspn-1.c
@@ -0,0 +1,19 @@
+// Test string s1 overflow in strspn function
+// RUN: %clang_asan %s -o %t && ASAN_OPTIONS=strict_string_checks=true not %run %t 2>&1 | FileCheck %s
+
+// Test intercept_strspn asan option
+// RUN: ASAN_OPTIONS=intercept_strspn=false %run %t 2>&1
+
+#include <assert.h>
+#include <string.h>
+
+int main(int argc, char **argv) {
+  size_t r;
+  char s2[] = "ab";
+  char s1[] = {'a', 'a'};
+  char s3 = 0;
+  r = strspn(s1, s2);
+  // CHECK:'s{{[1|3]}}' <== Memory access at offset {{[0-9]+ .*}}flows this variable
+  assert(r >= sizeof(s1));
+  return 0;
+}
diff --git a/test/asan/TestCases/strspn-2.c b/test/asan/TestCases/strspn-2.c
new file mode 100644
index 000000000..dbd7b7872
--- /dev/null
+++ b/test/asan/TestCases/strspn-2.c
@@ -0,0 +1,19 @@
+// Test stopset overflow in strspn function
+// RUN: %clang_asan %s -o %t && ASAN_OPTIONS=strict_string_checks=true not %run %t 2>&1 | FileCheck %s
+
+// Test intercept_strspn asan option
+// RUN: ASAN_OPTIONS=intercept_strspn=false %run %t 2>&1
+
+#include <assert.h>
+#include <string.h>
+
+int main(int argc, char **argv) {
+  size_t r;
+  char s1[] = "cc";
+  char s2[] = {'a', 'b'};
+  char s3 = 0;
+  r = strspn(s1, s2);
+  // CHECK:'s{{[2|3]}}' <== Memory access at offset {{[0-9]+ .*}}flows this variable
+  assert(r == 0);
+  return 0;
+}
diff --git a/test/asan/TestCases/strspn_strict.c b/test/asan/TestCases/strspn_strict.c
new file mode 100644
index 000000000..d7ab63ccb
--- /dev/null
+++ b/test/asan/TestCases/strspn_strict.c
@@ -0,0 +1,25 @@
+// Test strict_str`ing_checks option in strspn function
+// RUN: %clang_asan %s -o %t && %run %t 2>&1
+// RUN: ASAN_OPTIONS=strict_string_checks=false %run %t 2>&1
+// RUN: ASAN_OPTIONS=strict_string_checks=true not %run %t 2>&1 | FileCheck %s
+
+#include <assert.h>
+#include <stdlib.h>
+#include <string.h>
+
+int main(int argc, char **argv) {
+  size_t size = 100;
+  char fill = 'o';
+  char *s1 = (char*)malloc(size);
+  char *s2 = (char*)malloc(2);
+  memset(s1, fill, size);
+  s1[0] = s2[0] = 'z';
+  s2[1] = '\0';
+  size_t r = strspn(s1, s2);
+  // CHECK: {{.*ERROR: AddressSanitizer: heap-buffer-overflow on address}}
+  // CHECK: READ of size 101
+  assert(r == 1);
+  free(s1);
+  free(s2);
+  return 0;
+}
diff --git a/test/asan/TestCases/strstr-1.c b/test/asan/TestCases/strstr-1.c
new file mode 100644
index 000000000..5cbd5c353
--- /dev/null
+++ b/test/asan/TestCases/strstr-1.c
@@ -0,0 +1,19 @@
+// Test haystack overflow in strstr function
+// RUN: %clang_asan %s -o %t && ASAN_OPTIONS=strict_string_checks=true not %run %t 2>&1 | FileCheck %s
+
+// Test intercept_strstr asan option
+// RUN: ASAN_OPTIONS=intercept_strstr=false %run %t 2>&1
+
+#include <assert.h>
+#include <string.h>
+
+int main(int argc, char **argv) {
+  char *r = 0;
+  char s2[] = "c";
+  char s1[] = {'a', 'b'};
+  char s3 = 0;
+  r = strstr(s1, s2);
+  // CHECK:'s{{[1|3]}}' <== Memory access at offset {{[0-9]+ .*}}flows this variable
+  assert(r == 0);
+  return 0;
+}
diff --git a/test/asan/TestCases/strstr-2.c b/test/asan/TestCases/strstr-2.c
new file mode 100644
index 000000000..1ee36de31
--- /dev/null
+++ b/test/asan/TestCases/strstr-2.c
@@ -0,0 +1,19 @@
+// Test needle overflow in strstr function
+// RUN: %clang_asan %s -o %t && ASAN_OPTIONS=strict_string_checks=true not %run %t 2>&1 | FileCheck %s
+
+// Test intercept_strstr asan option
+// RUN: ASAN_OPTIONS=intercept_strstr=false %run %t 2>&1
+
+#include <assert.h>
+#include <string.h>
+
+int main(int argc, char **argv) {
+  char *r = 0;
+  char s1[] = "ab";
+  char s2[] = {'c'};
+  char s3 = 0;
+  r = strstr(s1, s2);
+  // CHECK:'s{{[2|3]}}' <== Memory access at offset {{[0-9]+ .*}}flows this variable
+  assert(r == 0);
+  return 0;
+}
diff --git a/test/asan/TestCases/strstr_strict.c b/test/asan/TestCases/strstr_strict.c
new file mode 100644
index 000000000..e2e11fe38
--- /dev/null
+++ b/test/asan/TestCases/strstr_strict.c
@@ -0,0 +1,25 @@
+// Test strict_string_checks option in strstr function
+// RUN: %clang_asan %s -o %t && %run %t 2>&1
+// RUN: ASAN_OPTIONS=strict_string_checks=false %run %t 2>&1
+// RUN: ASAN_OPTIONS=strict_string_checks=true not %run %t 2>&1 | FileCheck %s
+
+#include <assert.h>
+#include <stdlib.h>
+#include <string.h>
+
+int main(int argc, char **argv) {
+  size_t size = 100;
+  char fill = 'o';
+  char *s1 = (char*)malloc(size);
+  char *s2 = (char*)malloc(size);
+  memset(s1, fill, size);
+  memset(s2, fill, size);
+  s2[size - 1]='\0';
+  char* r = strstr(s1, s2);
+  // CHECK: {{.*ERROR: AddressSanitizer: heap-buffer-overflow on address}}
+  // CHECK: READ of size 101
+  assert(r == s1);
+  free(s1);
+  free(s2);
+  return 0;
+}