bbc953fed4
The instrumentation generated by -fsanitize=vptr does not null check a user pointer before loading from it. This causes crashes in the face of UB member calls (this=nullptr), i.e it's causing user programs to crash only after UBSan is turned on. The fix is to make run-time null checking a prerequisite for enabling -fsanitize=vptr, and to then teach UBSan to reuse these run-time null checks to make -fsanitize=vptr safe. Testing: check-clang, check-ubsan, a stage2 ubsan-enabled build Differential Revision: https://reviews.llvm.org/D35735 https://bugs.llvm.org/show_bug.cgi?id=33881 llvm-svn: 309007
41 lines
2.0 KiB
C++
41 lines
2.0 KiB
C++
// RUN: %clang_cc1 -std=c++11 -triple x86_64-unknown-linux -emit-llvm -fsanitize=null %s -o - | FileCheck %s --check-prefix=CHECK --check-prefix=CHECK-NULL --check-prefix=ITANIUM
|
|
// RUN: %clang_cc1 -std=c++11 -triple x86_64-windows -emit-llvm -fsanitize=null %s -o - | FileCheck %s --check-prefix=CHECK --check-prefix=CHECK-NULL --check-prefix=MSABI
|
|
// RUN: %clang_cc1 -std=c++11 -triple x86_64-unknown-linux -emit-llvm -fsanitize=null,vptr %s -o - | FileCheck %s --check-prefix=CHECK --check-prefix=CHECK-VPTR --check-prefix=ITANIUM
|
|
// RUN: %clang_cc1 -std=c++11 -triple x86_64-windows -emit-llvm -fsanitize=null,vptr %s -o - | FileCheck %s --check-prefix=CHECK --check-prefix=CHECK-VPTR --check-prefix=MSABI
|
|
struct T {
|
|
virtual ~T() {}
|
|
virtual int v() { return 1; }
|
|
};
|
|
|
|
struct U : T {
|
|
~U();
|
|
virtual int v() { return 2; }
|
|
};
|
|
|
|
U::~U() {}
|
|
|
|
// ITANIUM: define i32 @_Z5get_vP1T
|
|
// MSABI: define i32 @"\01?get_v
|
|
int get_v(T* t) {
|
|
// First, we check that vtable is not loaded before a type check.
|
|
// CHECK-NULL-NOT: load {{.*}} (%struct.T*{{.*}})**, {{.*}} (%struct.T*{{.*}})***
|
|
// CHECK-NULL: [[UBSAN_CMP_RES:%[0-9]+]] = icmp ne %struct.T* %{{[_a-z0-9]+}}, null
|
|
// CHECK-NULL-NEXT: br i1 [[UBSAN_CMP_RES]], label %{{.*}}, label %{{.*}}
|
|
// CHECK-NULL: call void @__ubsan_handle_type_mismatch_v1_abort
|
|
// Second, we check that vtable is actually loaded once the type check is done.
|
|
// CHECK-NULL: load {{.*}} (%struct.T*{{.*}})**, {{.*}} (%struct.T*{{.*}})***
|
|
return t->v();
|
|
}
|
|
|
|
// ITANIUM: define void @_Z9delete_itP1T
|
|
// MSABI: define void @"\01?delete_it
|
|
void delete_it(T *t) {
|
|
// First, we check that vtable is not loaded before a type check.
|
|
// CHECK-VPTR-NOT: load {{.*}} (%struct.T*{{.*}})**, {{.*}} (%struct.T*{{.*}})***
|
|
// CHECK-VPTR: br i1 {{.*}} label %{{.*}}
|
|
// CHECK-VPTR: call void @__ubsan_handle_dynamic_type_cache_miss_abort
|
|
// Second, we check that vtable is actually loaded once the type check is done.
|
|
// CHECK-VPTR: load {{.*}} (%struct.T*{{.*}})**, {{.*}} (%struct.T*{{.*}})***
|
|
delete t;
|
|
}
|