d11ea6518c
Each function's PC is recorded in the ring buffer. From there we can access the function's local variables and reconstruct the tag of each one with the help of the information printed by llvm-symbolizer's new FRAME command. We can then find the variable that was likely being accessed by matching the pointer's tag against the reconstructed tag. Differential Revision: https://reviews.llvm.org/D63469 llvm-svn: 364607
44 lines
1.6 KiB
C
44 lines
1.6 KiB
C
// Tests use-after-return detection and reporting.
|
|
// RUN: %clang_hwasan -g %s -o %t && not %run %t 2>&1 | FileCheck %s
|
|
// RUN: %clang_hwasan -g %s -o %t && not %env_hwasan_opts=symbolize=0 %run %t 2>&1 | FileCheck %s --check-prefix=NOSYM
|
|
|
|
// REQUIRES: stable-runtime
|
|
|
|
void USE(void *x) { // pretend_to_do_something(void *x)
|
|
__asm__ __volatile__("" : : "r" (x) : "memory");
|
|
}
|
|
|
|
__attribute__((noinline))
|
|
char *buggy() {
|
|
char zzz[0x1000];
|
|
char *volatile p = zzz;
|
|
return p;
|
|
}
|
|
|
|
__attribute__((noinline)) void Unrelated1() { int A[2]; USE(&A[0]); }
|
|
__attribute__((noinline)) void Unrelated2() { int BB[3]; USE(&BB[0]); }
|
|
__attribute__((noinline)) void Unrelated3() { int CCC[4]; USE(&CCC[0]); }
|
|
|
|
int main() {
|
|
char *p = buggy();
|
|
Unrelated1();
|
|
Unrelated2();
|
|
Unrelated3();
|
|
return *p;
|
|
// CHECK: READ of size 1 at
|
|
// CHECK: #0 {{.*}} in main{{.*}}stack-uar.c:[[@LINE-2]]
|
|
// CHECK: is located in stack of thread
|
|
// CHECK: Potentially referenced stack objects:
|
|
// CHECK-NEXT: zzz in buggy {{.*}}stack-uar.c:[[@LINE-19]]
|
|
// CHECK-NEXT: Memory tags around the buggy address
|
|
|
|
// NOSYM: Previously allocated frames:
|
|
// NOSYM-NEXT: record_addr:0x{{.*}} record:0x{{.*}} ({{.*}}/stack-uar.c.tmp+0x{{.*}}){{$}}
|
|
// NOSYM-NEXT: record_addr:0x{{.*}} record:0x{{.*}} ({{.*}}/stack-uar.c.tmp+0x{{.*}}){{$}}
|
|
// NOSYM-NEXT: record_addr:0x{{.*}} record:0x{{.*}} ({{.*}}/stack-uar.c.tmp+0x{{.*}}){{$}}
|
|
// NOSYM-NEXT: record_addr:0x{{.*}} record:0x{{.*}} ({{.*}}/stack-uar.c.tmp+0x{{.*}}){{$}}
|
|
// NOSYM-NEXT: Memory tags around the buggy address
|
|
|
|
// CHECK: SUMMARY: HWAddressSanitizer: tag-mismatch {{.*}} in main
|
|
}
|