// Test how we produce the scariness score. // RUN: %clangxx_asan -O0 %s -o %t // On OSX and Windows, alloc_dealloc_mismatch=1 isn't 100% reliable, so it's // off by default. It's safe for these tests, though, so we turn it on. // RUN: export %env_asan_opts=detect_stack_use_after_return=1:handle_abort=1:print_scariness=1:alloc_dealloc_mismatch=1 // Make sure the stack is limited (may not be the default under GNU make) // RUN: ulimit -s 4096 // RUN: not %run %t 1 2>&1 | FileCheck %s --check-prefix=CHECK1 // RUN: not %run %t 2 2>&1 | FileCheck %s --check-prefix=CHECK2 // RUN: not %run %t 3 2>&1 | FileCheck %s --check-prefix=CHECK3 // RUN: not %run %t 4 2>&1 | FileCheck %s --check-prefix=CHECK4 // RUN: not %run %t 5 2>&1 | FileCheck %s --check-prefix=CHECK5 // RUN: not %run %t 6 2>&1 | FileCheck %s --check-prefix=CHECK6 // RUN: not %run %t 7 2>&1 | FileCheck %s --check-prefix=CHECK7 // RUN: not %run %t 8 2>&1 | FileCheck %s --check-prefix=CHECK8 // RUN: not %run %t 9 2>&1 | FileCheck %s --check-prefix=CHECK9 // RUN: not %run %t 10 2>&1 | FileCheck %s --check-prefix=CHECK10 // RUN: not %run %t 11 2>&1 | FileCheck %s --check-prefix=CHECK11 // RUN: not %run %t 12 2>&1 | FileCheck %s --check-prefix=CHECK12 // RUN: not %run %t 13 2>&1 | FileCheck %s --check-prefix=CHECK13 // RUN: not %run %t 14 2>&1 | FileCheck %s --check-prefix=CHECK14 // RUN: not %run %t 15 2>&1 | FileCheck %s --check-prefix=CHECK15 // RUN: not %run %t 16 2>&1 | FileCheck %s --check-prefix=CHECK16 // RUN: not %run %t 17 2>&1 | FileCheck %s --check-prefix=CHECK17 // RUN: not %run %t 18 2>&1 | FileCheck %s --check-prefix=CHECK18 // RUN: not %run %t 19 2>&1 | FileCheck %s --check-prefix=CHECK19 // RUN: not %run %t 20 2>&1 | FileCheck %s --check-prefix=CHECK20 // RUN: not %run %t 21 2>&1 | FileCheck %s --check-prefix=CHECK21 // RUN: not %run %t 22 2>&1 | FileCheck %s --check-prefix=CHECK22 // RUN: not %run %t 23 2>&1 | FileCheck %s --check-prefix=CHECK23 // RUN: not %run %t 24 2>&1 | FileCheck %s --check-prefix=CHECK24 // RUN: not %run %t 25 2>&1 | FileCheck %s --check-prefix=CHECK25 // RUN: not %run %t 26 2>&1 | FileCheck %s --check-prefix=CHECK26 // RUN: not %run %t 27 2>&1 | FileCheck %s --check-prefix=CHECK27 // Parts of the test are too platform-specific: // REQUIRES: x86_64-target-arch // REQUIRES: shell #include #include #include #include #include enum ReadOrWrite { Read = 0, Write = 1 }; struct S32 { char x[32]; }; template void HeapBuferOverflow(int Idx, ReadOrWrite w) { T *t = new T[100]; static T sink; if (w) t[100 + Idx] = T(); else sink = t[100 + Idx]; delete [] t; } template void HeapUseAfterFree(int Idx, ReadOrWrite w) { T *t = new T[100]; static T sink; sink = t[0]; delete [] t; if (w) t[Idx] = T(); else sink = t[Idx]; } template void StackBufferOverflow(int Idx, ReadOrWrite w) { T t[100]; static T sink; sink = t[Idx]; if (w) t[100 + Idx] = T(); else sink = t[100 + Idx]; } template T *LeakStack() { T t[100]; static volatile T *x; x = &t[0]; return (T*)x; } template void StackUseAfterReturn(int Idx, ReadOrWrite w) { static T sink; T *t = LeakStack(); if (w) t[100 + Idx] = T(); else sink = t[100 + Idx]; } char g1[100]; short g2[100]; int g4[100]; int64_t g8[100]; S32 gm[100]; void DoubleFree() { int *x = new int; static volatile int two = 2; for (int i = 0; i < two; i++) delete x; } void StackOverflow(int Idx) { int some_stack[10000]; static volatile int *x; x = &some_stack[0]; if (Idx > 0) StackOverflow(Idx - 1); } void UseAfterPoison() { int buf[100]; __asan_poison_memory_region(buf, sizeof(buf)); static volatile int sink; sink = buf[42]; } int main(int argc, char **argv) { size_t scale; size_t offset; __asan_get_shadow_mapping(&scale, &offset); size_t grain = 1 << scale; char arr[100]; static volatile int zero = 0; static volatile int *zero_ptr = 0; static volatile int *wild_addr = (int*)0x10000000; // System-dependent. if (argc != 2) return 1; int kind = atoi(argv[1]); switch (kind) { case 1: HeapBuferOverflow(0, Read); break; case 2: HeapBuferOverflow(0, Read); break; case 3: HeapBuferOverflow(0, Write); break; case 4: HeapBuferOverflow( 2 * std::max(1, (int)(grain / sizeof(int64_t))), Write); break; case 5: HeapBuferOverflow(4, Write); break; case 6: HeapUseAfterFree(0, Read); break; case 7: HeapUseAfterFree(0, Write); break; case 8: HeapUseAfterFree(0, Read); break; case 9: HeapUseAfterFree(0, Write); break; case 10: StackBufferOverflow(0, Write); break; case 11: StackBufferOverflow(0, Read); break; case 12: if (scale <= 3) StackBufferOverflow(16, Write); else { // At large shadow granularity, there is not enough redzone // between stack elements to detect far-from-bounds. Pretend // that this test passes. fprintf(stderr, "SCARINESS: 61 " "(4-byte-write-stack-buffer-overflow-far-from-bounds)\n"); return 1; } break; case 13: StackUseAfterReturn(0, Read); break; case 14: StackUseAfterReturn(0, Write); break; case 15: g1[zero + 100] = 0; break; case 16: gm[0] = gm[zero + 100 + 1]; break; case 17: DoubleFree(); break; case 18: StackOverflow(1000000); break; case 19: *zero_ptr = 0; break; case 20: *wild_addr = 0; break; case 21: zero = *wild_addr; break; case 22: ((void (*)(void))wild_addr)(); break; case 23: delete (new int[10]); break; case 24: free((char*)malloc(100) + 10); break; case 25: memcpy(arr, arr+10, 20); break; case 26: UseAfterPoison(); break; case 27: abort(); // CHECK1: SCARINESS: 12 (1-byte-read-heap-buffer-overflow) // CHECK2: SCARINESS: 17 (4-byte-read-heap-buffer-overflow) // CHECK3: SCARINESS: 33 (2-byte-write-heap-buffer-overflow) // CHECK4: SCARINESS: 52 (8-byte-write-heap-buffer-overflow-far-from-bounds) // CHECK5: SCARINESS: 55 (multi-byte-write-heap-buffer-overflow-far-from-bounds) // CHECK6: SCARINESS: 40 (1-byte-read-heap-use-after-free) // CHECK7: SCARINESS: 46 (4-byte-write-heap-use-after-free) // CHECK8: SCARINESS: 51 (8-byte-read-heap-use-after-free) // CHECK9: SCARINESS: 55 (multi-byte-write-heap-use-after-free) // CHECK10: SCARINESS: 46 (1-byte-write-stack-buffer-overflow) // CHECK11: SCARINESS: 38 (8-byte-read-stack-buffer-overflow) // CHECK12: SCARINESS: 61 (4-byte-write-stack-buffer-overflow-far-from-bounds) // CHECK13: SCARINESS: 50 (1-byte-read-stack-use-after-return) // CHECK14: SCARINESS: 65 (multi-byte-write-stack-use-after-return) // CHECK15: SCARINESS: 31 (1-byte-write-global-buffer-overflow) // CHECK16: SCARINESS: 36 (multi-byte-read-global-buffer-overflow-far-from-bounds) // CHECK17: SCARINESS: 42 (double-free) // CHECK18: SCARINESS: 10 (stack-overflow) // CHECK19: SCARINESS: 10 (null-deref) // CHECK20: SCARINESS: 30 (wild-addr-write) // CHECK21: SCARINESS: 20 (wild-addr-read) // CHECK22: SCARINESS: 60 (wild-jump) // CHECK23: SCARINESS: 10 (alloc-dealloc-mismatch) // CHECK24: SCARINESS: 40 (bad-free) // CHECK25: SCARINESS: 10 (memcpy-param-overlap) // CHECK26: SCARINESS: 27 (4-byte-read-use-after-poison) // CHECK27: SCARINESS: 10 (signal) } }