From c4cfd9451c04abf2130819a91fd5f1965c8468f1 Mon Sep 17 00:00:00 2001 From: Stephan Bergmann Date: Thu, 28 Dec 2017 12:45:23 +0000 Subject: -fsanitize=vptr warnings on bad static types in dynamic_cast and typeid ...when such an operation is done on an object during con-/destruction. (This adds a test case to compiler-rt/test/ubsan/TestCases/TypeCheck/vptr.cpp that, unlike the existing test cases there, wants to detect multiple UBSan warnings in one go. Therefore, that file had to be changed from globally using -fno-sanitize-recover to individually using halt_on_error only where appropriate.) This is the compiler-rt part of a patch covering both cfe and compiler-rt. Differential Revision: https://reviews.llvm.org/D40295 git-svn-id: https://llvm.org/svn/llvm-project/compiler-rt/trunk@321518 91177308-0d34-0410-b5e6-96231b3b80d8 --- lib/ubsan/ubsan_handlers.cc | 3 +- test/ubsan/TestCases/TypeCheck/vptr.cpp | 115 +++++++++++++++++++++++++------- 2 files changed, 93 insertions(+), 25 deletions(-) diff --git a/lib/ubsan/ubsan_handlers.cc b/lib/ubsan/ubsan_handlers.cc index f674c027c..bcda746a1 100644 --- a/lib/ubsan/ubsan_handlers.cc +++ b/lib/ubsan/ubsan_handlers.cc @@ -38,7 +38,8 @@ bool ignoreReport(SourceLocation SLoc, ReportOptions Opts, ErrorType ET) { const char *TypeCheckKinds[] = { "load of", "store to", "reference binding to", "member access within", "member call on", "constructor call on", "downcast of", "downcast of", - "upcast of", "cast to virtual base of", "_Nonnull binding to"}; + "upcast of", "cast to virtual base of", "_Nonnull binding to", + "dynamic operation on"}; } static void handleTypeMismatchImpl(TypeMismatchData *Data, ValueHandle Pointer, diff --git a/test/ubsan/TestCases/TypeCheck/vptr.cpp b/test/ubsan/TestCases/TypeCheck/vptr.cpp index 1db41ddd0..d7848c4ce 100644 --- a/test/ubsan/TestCases/TypeCheck/vptr.cpp +++ b/test/ubsan/TestCases/TypeCheck/vptr.cpp @@ -1,41 +1,53 @@ -// RUN: %clangxx -frtti -fsanitize=null,vptr -fno-sanitize-recover=null,vptr -g %s -O3 -o %t -mllvm -enable-tail-merge=false -// RUN: %run %t rT && %run %t mT && %run %t fT && %run %t cT -// RUN: %run %t rU && %run %t mU && %run %t fU && %run %t cU -// RUN: %run %t rS && %run %t rV && %run %t oV -// RUN: %env_ubsan_opts=print_stacktrace=1 not %run %t mS 2>&1 | FileCheck %s --check-prefix=CHECK-MEMBER --check-prefix=CHECK-%os-MEMBER --strict-whitespace -// RUN: %env_ubsan_opts=print_stacktrace=1 not %run %t fS 2>&1 | FileCheck %s --check-prefix=CHECK-MEMFUN --strict-whitespace -// RUN: %env_ubsan_opts=print_stacktrace=1 not %run %t cS 2>&1 | FileCheck %s --check-prefix=CHECK-DOWNCAST --check-prefix=CHECK-%os-DOWNCAST --strict-whitespace -// RUN: %env_ubsan_opts=print_stacktrace=1 not %run %t mV 2>&1 | FileCheck %s --check-prefix=CHECK-MEMBER --check-prefix=CHECK-%os-MEMBER --strict-whitespace -// RUN: %env_ubsan_opts=print_stacktrace=1 not %run %t fV 2>&1 | FileCheck %s --check-prefix=CHECK-MEMFUN --strict-whitespace -// RUN: %env_ubsan_opts=print_stacktrace=1 not %run %t cV 2>&1 | FileCheck %s --check-prefix=CHECK-DOWNCAST --check-prefix=CHECK-%os-DOWNCAST --strict-whitespace -// RUN: %env_ubsan_opts=print_stacktrace=1 not %run %t oU 2>&1 | FileCheck %s --check-prefix=CHECK-OFFSET --check-prefix=CHECK-%os-OFFSET --strict-whitespace -// RUN: %env_ubsan_opts=print_stacktrace=1 not %run %t m0 2>&1 | FileCheck %s --check-prefix=CHECK-INVALID-MEMBER --check-prefix=CHECK-%os-NULL-MEMBER --strict-whitespace -// RUN: %env_ubsan_opts=print_stacktrace=1 not %run %t m0 2>&1 | FileCheck %s --check-prefix=CHECK-INVALID-MEMBER --check-prefix=CHECK-%os-NULL-MEMBER --strict-whitespace -// RUN: not %run %t nN 2>&1 | FileCheck %s --check-prefix=CHECK-NULL-MEMFUN --strict-whitespace +// RUN: %clangxx -frtti -fsanitize=null,vptr -g %s -O3 -o %t -mllvm -enable-tail-merge=false +// RUN: %env_ubsan_opts=halt_on_error=1 %run %t rT +// RUN: %env_ubsan_opts=halt_on_error=1 %run %t mT +// RUN: %env_ubsan_opts=halt_on_error=1 %run %t fT +// RUN: %env_ubsan_opts=halt_on_error=1 %run %t cT +// RUN: %env_ubsan_opts=halt_on_error=1 %run %t rU +// RUN: %env_ubsan_opts=halt_on_error=1 %run %t mU +// RUN: %env_ubsan_opts=halt_on_error=1 %run %t fU +// RUN: %env_ubsan_opts=halt_on_error=1 %run %t cU +// RUN: %env_ubsan_opts=halt_on_error=1 %run %t rS +// RUN: %env_ubsan_opts=halt_on_error=1 %run %t rV +// RUN: %env_ubsan_opts=halt_on_error=1 %run %t oV +// RUN: %env_ubsan_opts=halt_on_error=1 %run %t zN +// RUN: %env_ubsan_opts=halt_on_error=1:print_stacktrace=1 not %run %t mS 2>&1 | FileCheck %s --check-prefix=CHECK-MEMBER --check-prefix=CHECK-%os-MEMBER --strict-whitespace +// RUN: %env_ubsan_opts=halt_on_error=1:print_stacktrace=1 not %run %t fS 2>&1 | FileCheck %s --check-prefix=CHECK-MEMFUN --strict-whitespace +// RUN: %env_ubsan_opts=halt_on_error=1:print_stacktrace=1 not %run %t cS 2>&1 | FileCheck %s --check-prefix=CHECK-DOWNCAST --check-prefix=CHECK-%os-DOWNCAST --strict-whitespace +// RUN: %env_ubsan_opts=halt_on_error=1:print_stacktrace=1 not %run %t mV 2>&1 | FileCheck %s --check-prefix=CHECK-MEMBER --check-prefix=CHECK-%os-MEMBER --strict-whitespace +// RUN: %env_ubsan_opts=halt_on_error=1:print_stacktrace=1 not %run %t fV 2>&1 | FileCheck %s --check-prefix=CHECK-MEMFUN --strict-whitespace +// RUN: %env_ubsan_opts=halt_on_error=1:print_stacktrace=1 not %run %t cV 2>&1 | FileCheck %s --check-prefix=CHECK-DOWNCAST --check-prefix=CHECK-%os-DOWNCAST --strict-whitespace +// RUN: %env_ubsan_opts=halt_on_error=1:print_stacktrace=1 not %run %t oU 2>&1 | FileCheck %s --check-prefix=CHECK-OFFSET --check-prefix=CHECK-%os-OFFSET --strict-whitespace +// RUN: %env_ubsan_opts=halt_on_error=1:print_stacktrace=1 not %run %t m0 2>&1 | FileCheck %s --check-prefix=CHECK-INVALID-MEMBER --check-prefix=CHECK-%os-NULL-MEMBER --strict-whitespace +// RUN: %env_ubsan_opts=halt_on_error=1:print_stacktrace=1 not %run %t m0 2>&1 | FileCheck %s --check-prefix=CHECK-INVALID-MEMBER --check-prefix=CHECK-%os-NULL-MEMBER --strict-whitespace +// RUN: %env_ubsan_opts=halt_on_error=1 not %run %t nN 2>&1 | FileCheck %s --check-prefix=CHECK-NULL-MEMFUN --strict-whitespace +// RUN: %env_ubsan_opts=print_stacktrace=1 %run %t dT 2>&1 | FileCheck %s --check-prefix=CHECK-DYNAMIC --check-prefix=CHECK-%os-DYNAMIC --strict-whitespace // RUN: (echo "vptr_check:S"; echo "vptr_check:T"; echo "vptr_check:U") > %t.supp -// RUN: %env_ubsan_opts=suppressions='"%t.supp"' %run %t mS -// RUN: %env_ubsan_opts=suppressions='"%t.supp"' %run %t fS -// RUN: %env_ubsan_opts=suppressions='"%t.supp"' %run %t cS -// RUN: %env_ubsan_opts=suppressions='"%t.supp"' %run %t mV -// RUN: %env_ubsan_opts=suppressions='"%t.supp"' %run %t fV -// RUN: %env_ubsan_opts=suppressions='"%t.supp"' %run %t cV -// RUN: %env_ubsan_opts=suppressions='"%t.supp"' %run %t oU +// RUN: %env_ubsan_opts=halt_on_error=1:suppressions='"%t.supp"' %run %t mS +// RUN: %env_ubsan_opts=halt_on_error=1:suppressions='"%t.supp"' %run %t fS +// RUN: %env_ubsan_opts=halt_on_error=1:suppressions='"%t.supp"' %run %t cS +// RUN: %env_ubsan_opts=halt_on_error=1:suppressions='"%t.supp"' %run %t mV +// RUN: %env_ubsan_opts=halt_on_error=1:suppressions='"%t.supp"' %run %t fV +// RUN: %env_ubsan_opts=halt_on_error=1:suppressions='"%t.supp"' %run %t cV +// RUN: %env_ubsan_opts=halt_on_error=1:suppressions='"%t.supp"' %run %t oU +// RUN: %env_ubsan_opts=halt_on_error=1:suppressions='"%t.supp"' %run %t dT // RUN: echo "vptr_check:S" > %t.loc-supp -// RUN: %env_ubsan_opts=suppressions='"%t.loc-supp"' not %run %t x- 2>&1 | FileCheck %s --check-prefix=CHECK-LOC-SUPPRESS +// RUN: %env_ubsan_opts=halt_on_error=1:suppressions='"%t.loc-supp"' not %run %t x- 2>&1 | FileCheck %s --check-prefix=CHECK-LOC-SUPPRESS // REQUIRES: stable-runtime, cxxabi // UNSUPPORTED: win32 // Suppressions file not pushed to the device. // UNSUPPORTED: android #include +#include #include #include struct S { S() : a(0) {} - ~S() {} + ~S(); int a; int f() { return 0; } virtual int v() { return 0; } @@ -52,13 +64,23 @@ struct U : S, T { virtual int v() { return 2; } }; struct V : S {}; -// Make p global so that lsan does not complain. +namespace { + struct W {}; +} + T *p = 0; +bool dtorCheck = false; + volatile void *sink1, *sink2; int access_p(T *p, char type); +S::~S() { + if (dtorCheck) + access_p(p, '~'); +} + int main(int argc, char **argv) { assert(argc > 1); fprintf(stderr, "Test case: %s\n", argv[1]); @@ -180,6 +202,51 @@ int access_p(T *p, char type) { case 'n': // CHECK-NULL-MEMFUN: vptr.cpp:[[@LINE+1]]:15: runtime error: member call on null pointer of type 'T' return p->g(); + + case 'd': + dtorCheck = true; + delete p; + dtorCheck = false; + return 0; + case '~': + // CHECK-DYNAMIC: vptr.cpp:[[@LINE+6]]:11: runtime error: dynamic operation on address [[PTR:0x[0-9a-f]*]] which does not point to an object of type 'T' + // CHECK-DYNAMIC-NEXT: [[PTR]]: note: object is of type 'S' + // CHECK-DYNAMIC-NEXT: {{^ .. .. .. .. .. .. .. .. .. .. .. .. }} + // CHECK-DYNAMIC-NEXT: {{^ \^~~~~~~~~~~(~~~~~~~~~~~~)? *$}} + // CHECK-DYNAMIC-NEXT: {{^ vptr for}} 'S' + // CHECK-Linux-DYNAMIC: #0 {{.*}}access_p{{.*}}vptr.cpp:[[@LINE+1]] + (void)dynamic_cast(p); + // CHECK-DYNAMIC: vptr.cpp:[[@LINE+6]]:11: runtime error: dynamic operation on address [[PTR:0x[0-9a-f]*]] which does not point to an object of type 'T' + // CHECK-DYNAMIC-NEXT: [[PTR]]: note: object is of type 'S' + // CHECK-DYNAMIC-NEXT: {{^ .. .. .. .. .. .. .. .. .. .. .. .. }} + // CHECK-DYNAMIC-NEXT: {{^ \^~~~~~~~~~~(~~~~~~~~~~~~)? *$}} + // CHECK-DYNAMIC-NEXT: {{^ vptr for}} 'S' + // CHECK-Linux-DYNAMIC: #0 {{.*}}access_p{{.*}}vptr.cpp:[[@LINE+1]] + (void)dynamic_cast(p); + try { + // CHECK-DYNAMIC: vptr.cpp:[[@LINE+6]]:13: runtime error: dynamic operation on address [[PTR:0x[0-9a-f]*]] which does not point to an object of type 'T' + // CHECK-DYNAMIC-NEXT: [[PTR]]: note: object is of type 'S' + // CHECK-DYNAMIC-NEXT: {{^ .. .. .. .. .. .. .. .. .. .. .. .. }} + // CHECK-DYNAMIC-NEXT: {{^ \^~~~~~~~~~~(~~~~~~~~~~~~)? *$}} + // CHECK-DYNAMIC-NEXT: {{^ vptr for}} 'S' + // CHECK-Linux-DYNAMIC: #0 {{.*}}access_p{{.*}}vptr.cpp:[[@LINE+1]] + (void)dynamic_cast(*p); + } catch (std::bad_cast &) {} + // CHECK-DYNAMIC: vptr.cpp:[[@LINE+6]]:18: runtime error: dynamic operation on address [[PTR:0x[0-9a-f]*]] which does not point to an object of type 'T' + // CHECK-DYNAMIC-NEXT: [[PTR]]: note: object is of type 'S' + // CHECK-DYNAMIC-NEXT: {{^ .. .. .. .. .. .. .. .. .. .. .. .. }} + // CHECK-DYNAMIC-NEXT: {{^ \^~~~~~~~~~~(~~~~~~~~~~~~)? *$}} + // CHECK-DYNAMIC-NEXT: {{^ vptr for}} 'S' + // CHECK-Linux-DYNAMIC: #0 {{.*}}access_p{{.*}}vptr.cpp:[[@LINE+1]] + (void)typeid(*p); + return 0; + + case 'z': + (void)dynamic_cast(p); + try { + (void)typeid(*p); + } catch (std::bad_typeid &) {} + return 0; } return 0; } -- cgit v1.2.3