
That patch is the fix for https://bugs.llvm.org/show_bug.cgi?id=40703 "wrong line number info for obj file compiled with -ffunction-sections" bug. The problem happened with only .o files. If object file contains several .text sections then line number information showed incorrectly. The reason for this is that DwarfLineTable could not detect section which corresponds to specified address(because address is the local to the section). And as the result it could not select proper sequence in the line table. The fix is to pass SectionIndex with the address. So that it would be possible to differentiate addresses from various sections. With this fix llvm-objdump shows correct line numbers for disassembled code. Differential review: https://reviews.llvm.org/D58194 llvm-svn: 354972
599 lines
22 KiB
C++
599 lines
22 KiB
C++
//===- llvm/unittests/llvm-cfi-verify/GraphBuilder.cpp --------------===//
|
|
//
|
|
// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
|
|
// See https://llvm.org/LICENSE.txt for license information.
|
|
// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
|
|
//
|
|
//===----------------------------------------------------------------------===//
|
|
|
|
#include "../tools/llvm-cfi-verify/lib/GraphBuilder.h"
|
|
#include "../tools/llvm-cfi-verify/lib/FileAnalysis.h"
|
|
#include "gmock/gmock.h"
|
|
#include "gtest/gtest.h"
|
|
|
|
#include "llvm/BinaryFormat/ELF.h"
|
|
#include "llvm/MC/MCAsmInfo.h"
|
|
#include "llvm/MC/MCContext.h"
|
|
#include "llvm/MC/MCDisassembler/MCDisassembler.h"
|
|
#include "llvm/MC/MCInst.h"
|
|
#include "llvm/MC/MCInstPrinter.h"
|
|
#include "llvm/MC/MCInstrAnalysis.h"
|
|
#include "llvm/MC/MCInstrDesc.h"
|
|
#include "llvm/MC/MCInstrInfo.h"
|
|
#include "llvm/MC/MCObjectFileInfo.h"
|
|
#include "llvm/MC/MCRegisterInfo.h"
|
|
#include "llvm/MC/MCSubtargetInfo.h"
|
|
#include "llvm/Object/Binary.h"
|
|
#include "llvm/Object/COFF.h"
|
|
#include "llvm/Object/ELFObjectFile.h"
|
|
#include "llvm/Object/ObjectFile.h"
|
|
#include "llvm/Support/Casting.h"
|
|
#include "llvm/Support/CommandLine.h"
|
|
#include "llvm/Support/Error.h"
|
|
#include "llvm/Support/MemoryBuffer.h"
|
|
#include "llvm/Support/TargetRegistry.h"
|
|
#include "llvm/Support/TargetSelect.h"
|
|
#include "llvm/Support/raw_ostream.h"
|
|
|
|
#include <cstdlib>
|
|
#include <sstream>
|
|
|
|
using Instr = ::llvm::cfi_verify::FileAnalysis::Instr;
|
|
using ::testing::AllOf;
|
|
using ::testing::Each;
|
|
using ::testing::ElementsAre;
|
|
using ::testing::Eq;
|
|
using ::testing::Field;
|
|
using ::testing::IsEmpty;
|
|
using ::testing::Matches;
|
|
using ::testing::Pair;
|
|
using ::testing::PrintToString;
|
|
using ::testing::Property;
|
|
using ::testing::SizeIs;
|
|
using ::testing::UnorderedElementsAre;
|
|
using ::testing::Value;
|
|
|
|
namespace llvm {
|
|
namespace cfi_verify {
|
|
// Printing helpers for gtest.
|
|
std::string HexStringifyContainer(const std::vector<uint64_t> &C) {
|
|
std::stringstream Stream;
|
|
if (C.empty()) {
|
|
return "{ }";
|
|
}
|
|
|
|
Stream << "{ ";
|
|
const auto &LastElemIt = std::end(C) - 1;
|
|
|
|
for (auto It = std::begin(C); It != LastElemIt; ++It) {
|
|
Stream << "0x" << std::hex << *It << ", ";
|
|
}
|
|
Stream << "0x" << std::hex << *LastElemIt << " }";
|
|
return Stream.str();
|
|
}
|
|
|
|
void PrintTo(const ConditionalBranchNode &BranchNode, ::std::ostream *os) {
|
|
*os << "ConditionalBranchNode<Address: 0x" << std::hex << BranchNode.Address
|
|
<< ", Target: 0x" << BranchNode.Target << ", Fallthrough: 0x"
|
|
<< BranchNode.Fallthrough
|
|
<< ", CFIProtection: " << BranchNode.CFIProtection << ">";
|
|
}
|
|
|
|
void PrintTo(const GraphResult &Result, ::std::ostream *os) {
|
|
*os << "Result BaseAddress: 0x" << std::hex << Result.BaseAddress << "\n";
|
|
|
|
if (Result.ConditionalBranchNodes.empty())
|
|
*os << " (No conditional branch nodes)\n";
|
|
|
|
for (const auto &Node : Result.ConditionalBranchNodes) {
|
|
*os << " ";
|
|
PrintTo(Node, os);
|
|
*os << "\n Fallthrough Path: " << std::hex
|
|
<< HexStringifyContainer(Result.flattenAddress(Node.Fallthrough))
|
|
<< "\n";
|
|
*os << " Target Path: " << std::hex
|
|
<< HexStringifyContainer(Result.flattenAddress(Node.Target)) << "\n";
|
|
}
|
|
|
|
if (Result.OrphanedNodes.empty())
|
|
*os << " (No orphaned nodes)";
|
|
|
|
for (const auto &Orphan : Result.OrphanedNodes) {
|
|
*os << " Orphan (0x" << std::hex << Orphan
|
|
<< ") Path: " << HexStringifyContainer(Result.flattenAddress(Orphan))
|
|
<< "\n";
|
|
}
|
|
}
|
|
|
|
namespace {
|
|
class ELFx86TestFileAnalysis : public FileAnalysis {
|
|
public:
|
|
ELFx86TestFileAnalysis()
|
|
: FileAnalysis(Triple("x86_64--"), SubtargetFeatures()) {}
|
|
|
|
// Expose this method publicly for testing.
|
|
void parseSectionContents(ArrayRef<uint8_t> SectionBytes,
|
|
object::SectionedAddress Address) {
|
|
FileAnalysis::parseSectionContents(SectionBytes, Address);
|
|
}
|
|
|
|
Error initialiseDisassemblyMembers() {
|
|
return FileAnalysis::initialiseDisassemblyMembers();
|
|
}
|
|
};
|
|
|
|
class BasicGraphBuilderTest : public ::testing::Test {
|
|
protected:
|
|
virtual void SetUp() {
|
|
IgnoreDWARFFlag = true;
|
|
SuccessfullyInitialised = true;
|
|
if (auto Err = Analysis.initialiseDisassemblyMembers()) {
|
|
handleAllErrors(std::move(Err), [&](const UnsupportedDisassembly &E) {
|
|
SuccessfullyInitialised = false;
|
|
outs()
|
|
<< "Note: CFIVerifyTests are disabled due to lack of x86 support "
|
|
"on this build.\n";
|
|
});
|
|
}
|
|
}
|
|
|
|
bool SuccessfullyInitialised;
|
|
ELFx86TestFileAnalysis Analysis;
|
|
};
|
|
|
|
MATCHER_P2(HasPath, Result, Matcher, "has path " + PrintToString(Matcher)) {
|
|
const auto &Path = Result.flattenAddress(arg);
|
|
*result_listener << "the path is " << PrintToString(Path);
|
|
return Matches(Matcher)(Path);
|
|
}
|
|
|
|
TEST_F(BasicGraphBuilderTest, BuildFlowGraphTestSinglePathFallthroughUd2) {
|
|
if (!SuccessfullyInitialised)
|
|
return;
|
|
Analysis.parseSectionContents(
|
|
{
|
|
0x75, 0x02, // 0: jne 4 [+2]
|
|
0x0f, 0x0b, // 2: ud2
|
|
0xff, 0x10, // 4: callq *(%rax)
|
|
},
|
|
{0xDEADBEEF, 0x0});
|
|
const auto Result =
|
|
GraphBuilder::buildFlowGraph(Analysis, {0xDEADBEEF + 4, 0x0});
|
|
|
|
EXPECT_THAT(Result.OrphanedNodes, IsEmpty());
|
|
EXPECT_THAT(Result.ConditionalBranchNodes, SizeIs(1));
|
|
EXPECT_THAT(Result.ConditionalBranchNodes,
|
|
Each(Field(&ConditionalBranchNode::CFIProtection, Eq(true))));
|
|
EXPECT_THAT(
|
|
Result.ConditionalBranchNodes,
|
|
Contains(AllOf(Field(&ConditionalBranchNode::Address, Eq(0xDEADBEEF)),
|
|
Field(&ConditionalBranchNode::Target,
|
|
HasPath(Result, ElementsAre(0xDEADBEEF + 4))),
|
|
Field(&ConditionalBranchNode::Fallthrough,
|
|
HasPath(Result, ElementsAre(0xDEADBEEF + 2))))))
|
|
<< PrintToString(Result);
|
|
}
|
|
|
|
TEST_F(BasicGraphBuilderTest, BuildFlowGraphTestSinglePathJumpUd2) {
|
|
if (!SuccessfullyInitialised)
|
|
return;
|
|
Analysis.parseSectionContents(
|
|
{
|
|
0x75, 0x02, // 0: jne 4 [+2]
|
|
0xff, 0x10, // 2: callq *(%rax)
|
|
0x0f, 0x0b, // 4: ud2
|
|
},
|
|
{0xDEADBEEF, 0x0});
|
|
const auto Result =
|
|
GraphBuilder::buildFlowGraph(Analysis, {0xDEADBEEF + 2, 0x0});
|
|
|
|
EXPECT_THAT(Result.OrphanedNodes, IsEmpty());
|
|
EXPECT_THAT(Result.ConditionalBranchNodes, SizeIs(1));
|
|
EXPECT_THAT(Result.ConditionalBranchNodes,
|
|
Each(Field(&ConditionalBranchNode::CFIProtection, Eq(true))));
|
|
EXPECT_THAT(
|
|
Result.ConditionalBranchNodes,
|
|
Contains(AllOf(Field(&ConditionalBranchNode::Address, Eq(0xDEADBEEF)),
|
|
Field(&ConditionalBranchNode::Target,
|
|
HasPath(Result, ElementsAre(0xDEADBEEF + 4))),
|
|
Field(&ConditionalBranchNode::Fallthrough,
|
|
HasPath(Result, ElementsAre(0xDEADBEEF + 2))))))
|
|
<< PrintToString(Result);
|
|
}
|
|
|
|
TEST_F(BasicGraphBuilderTest, BuildFlowGraphTestDualPathDualUd2) {
|
|
if (!SuccessfullyInitialised)
|
|
return;
|
|
Analysis.parseSectionContents(
|
|
{
|
|
0x75, 0x03, // 0: jne 5 [+3]
|
|
0x90, // 2: nop
|
|
0xff, 0x10, // 3: callq *(%rax)
|
|
0x0f, 0x0b, // 5: ud2
|
|
0x75, 0xf9, // 7: jne 2 [-7]
|
|
0x0f, 0x0b, // 9: ud2
|
|
},
|
|
{0xDEADBEEF, 0x0});
|
|
const auto Result =
|
|
GraphBuilder::buildFlowGraph(Analysis, {0xDEADBEEF + 3, 0x0});
|
|
|
|
EXPECT_THAT(Result.OrphanedNodes, IsEmpty());
|
|
EXPECT_THAT(Result.ConditionalBranchNodes, SizeIs(2));
|
|
EXPECT_THAT(Result.ConditionalBranchNodes,
|
|
Each(Field(&ConditionalBranchNode::CFIProtection, Eq(true))));
|
|
EXPECT_THAT(
|
|
Result.ConditionalBranchNodes,
|
|
Contains(AllOf(
|
|
Field(&ConditionalBranchNode::Address, Eq(0xDEADBEEF)),
|
|
Field(&ConditionalBranchNode::Fallthrough,
|
|
HasPath(Result, ElementsAre(0xDEADBEEF + 2, 0xDEADBEEF + 3))),
|
|
Field(&ConditionalBranchNode::Target,
|
|
HasPath(Result, ElementsAre(0xDEADBEEF + 5))))))
|
|
<< PrintToString(Result);
|
|
EXPECT_THAT(
|
|
Result.ConditionalBranchNodes,
|
|
Contains(AllOf(
|
|
Field(&ConditionalBranchNode::Address, Eq(0xDEADBEEF + 7)),
|
|
Field(&ConditionalBranchNode::Fallthrough,
|
|
HasPath(Result, ElementsAre(0xDEADBEEF + 9))),
|
|
Field(&ConditionalBranchNode::Target,
|
|
HasPath(Result, ElementsAre(0xDEADBEEF + 2, 0xDEADBEEF + 3))))))
|
|
<< PrintToString(Result);
|
|
}
|
|
|
|
TEST_F(BasicGraphBuilderTest, BuildFlowGraphTestDualPathSingleUd2) {
|
|
if (!SuccessfullyInitialised)
|
|
return;
|
|
Analysis.parseSectionContents(
|
|
{
|
|
0x75, 0x05, // 0: jne 7 [+5]
|
|
0x90, // 2: nop
|
|
0xff, 0x10, // 3: callq *(%rax)
|
|
0x75, 0xfb, // 5: jne 2 [-5]
|
|
0x0f, 0x0b, // 7: ud2
|
|
},
|
|
{0xDEADBEEF, 0x0});
|
|
GraphResult Result =
|
|
GraphBuilder::buildFlowGraph(Analysis, {0xDEADBEEF + 3, 0x0});
|
|
|
|
EXPECT_THAT(Result.OrphanedNodes, IsEmpty());
|
|
EXPECT_THAT(Result.ConditionalBranchNodes, SizeIs(2));
|
|
EXPECT_THAT(Result.ConditionalBranchNodes,
|
|
Each(Field(&ConditionalBranchNode::CFIProtection, Eq(true))));
|
|
EXPECT_THAT(
|
|
Result.ConditionalBranchNodes,
|
|
Contains(AllOf(
|
|
Field(&ConditionalBranchNode::Address, Eq(0xDEADBEEF)),
|
|
Field(&ConditionalBranchNode::Fallthrough,
|
|
HasPath(Result, ElementsAre(0xDEADBEEF + 2, 0xDEADBEEF + 3))),
|
|
Field(&ConditionalBranchNode::Target,
|
|
HasPath(Result, ElementsAre(0xDEADBEEF + 7))))))
|
|
<< PrintToString(Result);
|
|
EXPECT_THAT(
|
|
Result.ConditionalBranchNodes,
|
|
Contains(AllOf(
|
|
Field(&ConditionalBranchNode::Address, Eq(0xDEADBEEF + 5)),
|
|
Field(&ConditionalBranchNode::Fallthrough,
|
|
HasPath(Result, ElementsAre(0xDEADBEEF + 7))),
|
|
Field(&ConditionalBranchNode::Target,
|
|
HasPath(Result, ElementsAre(0xDEADBEEF + 2, 0xDEADBEEF + 3))))))
|
|
<< PrintToString(Result);
|
|
}
|
|
|
|
TEST_F(BasicGraphBuilderTest, BuildFlowGraphFailures) {
|
|
if (!SuccessfullyInitialised)
|
|
return;
|
|
Analysis.parseSectionContents(
|
|
{
|
|
0x90, // 0: nop
|
|
0x75, 0xfe, // 1: jne 1 [-2]
|
|
},
|
|
{0xDEADBEEF, 0x0});
|
|
GraphResult Result =
|
|
GraphBuilder::buildFlowGraph(Analysis, {0xDEADBEEF, 0x0});
|
|
EXPECT_THAT(Result.OrphanedNodes, IsEmpty());
|
|
EXPECT_THAT(Result.ConditionalBranchNodes, IsEmpty());
|
|
|
|
Result = GraphBuilder::buildFlowGraph(Analysis, {0xDEADBEEF + 1, 0x0});
|
|
EXPECT_THAT(Result.OrphanedNodes, IsEmpty());
|
|
EXPECT_THAT(Result.ConditionalBranchNodes, IsEmpty());
|
|
|
|
Result = GraphBuilder::buildFlowGraph(Analysis, {0xDEADC0DE, 0x0});
|
|
EXPECT_THAT(Result.OrphanedNodes, IsEmpty());
|
|
EXPECT_THAT(Result.ConditionalBranchNodes, IsEmpty());
|
|
}
|
|
|
|
TEST_F(BasicGraphBuilderTest, BuildFlowGraphNoXrefs) {
|
|
if (!SuccessfullyInitialised)
|
|
return;
|
|
Analysis.parseSectionContents(
|
|
{
|
|
0xeb, 0xfe, // 0: jmp 0 [-2]
|
|
0xff, 0x10, // 2: callq *(%rax)
|
|
},
|
|
{0xDEADBEEF, 0x0});
|
|
GraphResult Result =
|
|
GraphBuilder::buildFlowGraph(Analysis, {0xDEADBEEF + 2, 0x0});
|
|
EXPECT_THAT(Result.ConditionalBranchNodes, IsEmpty());
|
|
EXPECT_THAT(Result.OrphanedNodes, ElementsAre(0xDEADBEEF + 2));
|
|
EXPECT_THAT(Result.IntermediateNodes, IsEmpty());
|
|
}
|
|
|
|
TEST_F(BasicGraphBuilderTest, BuildFlowGraphConditionalInfiniteLoop) {
|
|
if (!SuccessfullyInitialised)
|
|
return;
|
|
Analysis.parseSectionContents(
|
|
{
|
|
0x75, 0xfe, // 0: jne 0 [-2]
|
|
0xff, 0x10, // 2: callq *(%rax)
|
|
},
|
|
{0xDEADBEEF, 0x0});
|
|
GraphResult Result =
|
|
GraphBuilder::buildFlowGraph(Analysis, {0xDEADBEEF + 2, 0x0});
|
|
EXPECT_THAT(Result.OrphanedNodes, IsEmpty());
|
|
EXPECT_THAT(Result.ConditionalBranchNodes, SizeIs(1));
|
|
EXPECT_THAT(
|
|
Result.ConditionalBranchNodes,
|
|
Each(AllOf(Field(&ConditionalBranchNode::CFIProtection, Eq(false)),
|
|
Field(&ConditionalBranchNode::Target,
|
|
HasPath(Result, ElementsAre(0xDEADBEEF))),
|
|
Field(&ConditionalBranchNode::Fallthrough,
|
|
HasPath(Result, ElementsAre(0xDEADBEEF + 2))))))
|
|
<< PrintToString(Result);
|
|
}
|
|
|
|
TEST_F(BasicGraphBuilderTest, BuildFlowGraphUnconditionalInfiniteLoop) {
|
|
if (!SuccessfullyInitialised)
|
|
return;
|
|
Analysis.parseSectionContents(
|
|
{
|
|
0x75, 0x02, // 0: jne 4 [+2]
|
|
0xeb, 0xfc, // 2: jmp 0 [-4]
|
|
0xff, 0x10, // 4: callq *(%rax)
|
|
},
|
|
{0xDEADBEEF, 0x0});
|
|
GraphResult Result =
|
|
GraphBuilder::buildFlowGraph(Analysis, {0xDEADBEEF + 4, 0x0});
|
|
EXPECT_THAT(Result.OrphanedNodes, IsEmpty());
|
|
EXPECT_THAT(Result.ConditionalBranchNodes, SizeIs(1));
|
|
EXPECT_THAT(
|
|
Result.ConditionalBranchNodes,
|
|
Contains(
|
|
AllOf(Field(&ConditionalBranchNode::Address, Eq(0xDEADBEEF)),
|
|
Field(&ConditionalBranchNode::Fallthrough,
|
|
HasPath(Result, ElementsAre(0xDEADBEEF + 2, 0xDEADBEEF))),
|
|
Field(&ConditionalBranchNode::Target,
|
|
HasPath(Result, ElementsAre(0xDEADBEEF + 4))))))
|
|
<< PrintToString(Result);
|
|
}
|
|
|
|
TEST_F(BasicGraphBuilderTest, BuildFlowGraphNoFlowsToIndirection) {
|
|
if (!SuccessfullyInitialised)
|
|
return;
|
|
Analysis.parseSectionContents(
|
|
{
|
|
0x75, 0x00, // 0: jne 2 [+0]
|
|
0xeb, 0xfc, // 2: jmp 0 [-4]
|
|
0xff, 0x10, // 4: callq *(%rax)
|
|
},
|
|
{0xDEADBEEF, 0x0});
|
|
GraphResult Result =
|
|
GraphBuilder::buildFlowGraph(Analysis, {0xDEADBEEF + 4, 0x0});
|
|
EXPECT_THAT(Result.OrphanedNodes, ElementsAre(0xDEADBEEF + 4));
|
|
EXPECT_THAT(Result.ConditionalBranchNodes, IsEmpty());
|
|
}
|
|
|
|
TEST_F(BasicGraphBuilderTest, BuildFlowGraphLengthExceededUpwards) {
|
|
if (!SuccessfullyInitialised)
|
|
return;
|
|
Analysis.parseSectionContents(
|
|
{
|
|
0x75, 0x06, // 0: jne 8 [+6]
|
|
0x90, // 2: nop
|
|
0x90, // 3: nop
|
|
0x90, // 4: nop
|
|
0x90, // 5: nop
|
|
0xff, 0x10, // 6: callq *(%rax)
|
|
0x0f, 0x0b, // 8: ud2
|
|
},
|
|
{0xDEADBEEF, 0x0});
|
|
uint64_t PrevSearchLengthForConditionalBranch =
|
|
SearchLengthForConditionalBranch;
|
|
SearchLengthForConditionalBranch = 2;
|
|
|
|
GraphResult Result =
|
|
GraphBuilder::buildFlowGraph(Analysis, {0xDEADBEEF + 6, 0x0});
|
|
EXPECT_THAT(Result.OrphanedNodes, SizeIs(1));
|
|
EXPECT_THAT(Result.OrphanedNodes,
|
|
Each(HasPath(Result, ElementsAre(0xDEADBEEF + 4, 0xDEADBEEF + 5,
|
|
0xDEADBEEF + 6))))
|
|
<< PrintToString(Result);
|
|
EXPECT_THAT(Result.ConditionalBranchNodes, IsEmpty());
|
|
|
|
SearchLengthForConditionalBranch = PrevSearchLengthForConditionalBranch;
|
|
}
|
|
|
|
TEST_F(BasicGraphBuilderTest, BuildFlowGraphLengthExceededDownwards) {
|
|
if (!SuccessfullyInitialised)
|
|
return;
|
|
Analysis.parseSectionContents(
|
|
{
|
|
0x75, 0x02, // 0: jne 4 [+2]
|
|
0xff, 0x10, // 2: callq *(%rax)
|
|
0x90, // 4: nop
|
|
0x90, // 5: nop
|
|
0x90, // 6: nop
|
|
0x90, // 7: nop
|
|
0x0f, 0x0b, // 8: ud2
|
|
},
|
|
{0xDEADBEEF, 0x0});
|
|
uint64_t PrevSearchLengthForUndef = SearchLengthForUndef;
|
|
SearchLengthForUndef = 2;
|
|
|
|
GraphResult Result =
|
|
GraphBuilder::buildFlowGraph(Analysis, {0xDEADBEEF + 2, 0x0});
|
|
EXPECT_THAT(Result.OrphanedNodes, IsEmpty());
|
|
EXPECT_THAT(
|
|
Result.ConditionalBranchNodes,
|
|
Each(AllOf(
|
|
Field(&ConditionalBranchNode::CFIProtection, Eq(false)),
|
|
Field(&ConditionalBranchNode::Address, Eq(0xDEADBEEF)),
|
|
Field(&ConditionalBranchNode::Target,
|
|
HasPath(Result, ElementsAre(0xDEADBEEF + 4, 0xDEADBEEF + 5))),
|
|
Field(&ConditionalBranchNode::Fallthrough,
|
|
HasPath(Result, ElementsAre(0xDEADBEEF + 2))))))
|
|
<< PrintToString(Result);
|
|
|
|
SearchLengthForUndef = PrevSearchLengthForUndef;
|
|
}
|
|
|
|
// This test ensures when avoiding doing repeated work we still generate the
|
|
// paths correctly. We don't need to recalculate the flow from 0x2 -> 0x3 as it
|
|
// should only need to be generated once.
|
|
TEST_F(BasicGraphBuilderTest, BuildFlowGraphWithRepeatedWork) {
|
|
if (!SuccessfullyInitialised)
|
|
return;
|
|
Analysis.parseSectionContents(
|
|
{
|
|
0x75, 0x05, // 0: jne 7 [+5]
|
|
0x90, // 2: nop
|
|
0xff, 0x10, // 3: callq *(%rax)
|
|
0x75, 0xfb, // 5: jne 2 [-5]
|
|
0x0f, 0x0b, // 7: ud2
|
|
},
|
|
{0xDEADBEEF, 0x0});
|
|
GraphResult Result =
|
|
GraphBuilder::buildFlowGraph(Analysis, {0xDEADBEEF + 3, 0x0});
|
|
EXPECT_THAT(Result.OrphanedNodes, IsEmpty());
|
|
EXPECT_THAT(Result.ConditionalBranchNodes, SizeIs(2));
|
|
EXPECT_THAT(
|
|
Result.ConditionalBranchNodes,
|
|
Contains(AllOf(
|
|
Field(&ConditionalBranchNode::CFIProtection, Eq(true)),
|
|
Field(&ConditionalBranchNode::Address, Eq(0xDEADBEEF)),
|
|
Field(&ConditionalBranchNode::Target,
|
|
HasPath(Result, ElementsAre(0xDEADBEEF + 7))),
|
|
Field(&ConditionalBranchNode::Fallthrough,
|
|
HasPath(Result, ElementsAre(0xDEADBEEF + 2, 0xDEADBEEF + 3))))))
|
|
<< PrintToString(Result);
|
|
EXPECT_THAT(
|
|
Result.ConditionalBranchNodes,
|
|
Contains(AllOf(
|
|
Field(&ConditionalBranchNode::CFIProtection, Eq(true)),
|
|
Field(&ConditionalBranchNode::Address, Eq(0xDEADBEEF + 5)),
|
|
Field(&ConditionalBranchNode::Target,
|
|
HasPath(Result, ElementsAre(0xDEADBEEF + 2, 0xDEADBEEF + 3))),
|
|
Field(&ConditionalBranchNode::Fallthrough,
|
|
HasPath(Result, ElementsAre(0xDEADBEEF + 7))))))
|
|
<< PrintToString(Result);
|
|
EXPECT_THAT(Result.IntermediateNodes, SizeIs(1));
|
|
EXPECT_THAT(Result.IntermediateNodes,
|
|
UnorderedElementsAre(Pair(0xDEADBEEF + 2, 0xDEADBEEF + 3)));
|
|
}
|
|
|
|
TEST_F(BasicGraphBuilderTest, BuildFlowGraphComplexExample) {
|
|
if (!SuccessfullyInitialised)
|
|
return;
|
|
// The following code has this graph:
|
|
// +----------+ +--------------+
|
|
// | 20 | <--- | 0 |
|
|
// +----------+ +--------------+
|
|
// | |
|
|
// v v
|
|
// +----------+ +--------------+
|
|
// | 21 | | 2 |
|
|
// +----------+ +--------------+
|
|
// | |
|
|
// v v
|
|
// +----------+ +--------------+
|
|
// | 22 (ud2) | +-> | 7 |
|
|
// +----------+ | +--------------+
|
|
// ^ | |
|
|
// | | v
|
|
// +----------+ | +--------------+
|
|
// | 4 | | | 8 |
|
|
// +----------+ | +--------------+
|
|
// | | |
|
|
// v | v
|
|
// +----------+ | +--------------+ +------------+
|
|
// | 6 | -+ | 9 (indirect) | <- | 13 |
|
|
// +----------+ +--------------+ +------------+
|
|
// ^ |
|
|
// | v
|
|
// +--------------+ +------------+
|
|
// | 11 | | 15 (error) |
|
|
// +--------------+ +------------+
|
|
// Or, in image format: https://i.imgur.com/aX5fCoi.png
|
|
|
|
Analysis.parseSectionContents(
|
|
{
|
|
0x75, 0x12, // 0: jne 20 [+18]
|
|
0xeb, 0x03, // 2: jmp 7 [+3]
|
|
0x75, 0x10, // 4: jne 22 [+16]
|
|
0x90, // 6: nop
|
|
0x90, // 7: nop
|
|
0x90, // 8: nop
|
|
0xff, 0x10, // 9: callq *(%rax)
|
|
0xeb, 0xfc, // 11: jmp 9 [-4]
|
|
0x75, 0xfa, // 13: jne 9 [-6]
|
|
0xe8, 0x78, 0x56, 0x34, 0x12, // 15: callq OUTOFBOUNDS [+0x12345678]
|
|
0x90, // 20: nop
|
|
0x90, // 21: nop
|
|
0x0f, 0x0b, // 22: ud2
|
|
},
|
|
{0x1000, 0x0});
|
|
uint64_t PrevSearchLengthForUndef = SearchLengthForUndef;
|
|
SearchLengthForUndef = 5;
|
|
|
|
GraphResult Result =
|
|
GraphBuilder::buildFlowGraph(Analysis, {0x1000 + 9, 0x0});
|
|
|
|
EXPECT_THAT(Result.OrphanedNodes, SizeIs(1));
|
|
EXPECT_THAT(Result.ConditionalBranchNodes, SizeIs(3));
|
|
|
|
EXPECT_THAT(
|
|
Result.OrphanedNodes,
|
|
Each(AllOf(Eq(0x1000u + 11),
|
|
HasPath(Result, ElementsAre(0x1000 + 11, 0x1000 + 9)))))
|
|
<< PrintToString(Result);
|
|
|
|
EXPECT_THAT(Result.ConditionalBranchNodes,
|
|
Contains(AllOf(
|
|
Field(&ConditionalBranchNode::CFIProtection, Eq(true)),
|
|
Field(&ConditionalBranchNode::Address, Eq(0x1000u)),
|
|
Field(&ConditionalBranchNode::Target,
|
|
HasPath(Result, ElementsAre(0x1000 + 20, 0x1000 + 21,
|
|
0x1000 + 22))),
|
|
Field(&ConditionalBranchNode::Fallthrough,
|
|
HasPath(Result, ElementsAre(0x1000 + 2, 0x1000 + 7,
|
|
0x1000 + 8, 0x1000 + 9))))))
|
|
<< PrintToString(Result);
|
|
|
|
EXPECT_THAT(Result.ConditionalBranchNodes,
|
|
Contains(AllOf(
|
|
Field(&ConditionalBranchNode::CFIProtection, Eq(true)),
|
|
Field(&ConditionalBranchNode::Address, Eq(0x1000u + 4)),
|
|
Field(&ConditionalBranchNode::Target,
|
|
HasPath(Result, ElementsAre(0x1000 + 22))),
|
|
Field(&ConditionalBranchNode::Fallthrough,
|
|
HasPath(Result, ElementsAre(0x1000 + 6, 0x1000 + 7,
|
|
0x1000 + 8, 0x1000 + 9))))))
|
|
<< PrintToString(Result);
|
|
|
|
EXPECT_THAT(
|
|
Result.ConditionalBranchNodes,
|
|
Contains(AllOf(Field(&ConditionalBranchNode::CFIProtection, Eq(false)),
|
|
Field(&ConditionalBranchNode::Address, Eq(0x1000u + 13)),
|
|
Field(&ConditionalBranchNode::Target,
|
|
HasPath(Result, ElementsAre(0x1000 + 9))),
|
|
Field(&ConditionalBranchNode::Fallthrough,
|
|
HasPath(Result, ElementsAre(0x1000 + 15))))))
|
|
<< PrintToString(Result);
|
|
|
|
SearchLengthForUndef = PrevSearchLengthForUndef;
|
|
}
|
|
|
|
} // anonymous namespace
|
|
} // end namespace cfi_verify
|
|
} // end namespace llvm
|