| // Test how we produce the scariness score. |
| |
| // UAR Mode: runtime |
| // Case 26 loads a __asan_poison_memory_region-poisoned local variable, which is |
| // only instrumented when StackSafetyAnalysis is disabled. |
| // RUN: %clangxx_asan -O0 -mllvm -asan-use-stack-safety=0 %s -o %t |
| // On OSX and Windows, alloc_dealloc_mismatch=1 isn't 100% reliable, so it's |
| // off by default. It's safe for these tests, though, so we turn it on. |
| // RUN: export %env_asan_opts=symbolize=0:detect_stack_use_after_return=1:handle_abort=1:print_scariness=1:alloc_dealloc_mismatch=1 |
| // Make sure the stack is limited (may not be the default under GNU make) |
| // RUN: ulimit -s 4096 |
| // RUN: not %run %t 1 2>&1 | FileCheck %s --check-prefix=CHECK1 |
| // RUN: not %run %t 2 2>&1 | FileCheck %s --check-prefix=CHECK2 |
| // RUN: not %run %t 3 2>&1 | FileCheck %s --check-prefix=CHECK3 |
| // RUN: not %run %t 4 2>&1 | FileCheck %s --check-prefix=CHECK4 |
| // RUN: not %run %t 5 2>&1 | FileCheck %s --check-prefix=CHECK5 |
| // RUN: not %run %t 6 2>&1 | FileCheck %s --check-prefix=CHECK6 |
| // RUN: not %run %t 7 2>&1 | FileCheck %s --check-prefix=CHECK7 |
| // RUN: not %run %t 8 2>&1 | FileCheck %s --check-prefix=CHECK8 |
| // RUN: not %run %t 9 2>&1 | FileCheck %s --check-prefix=CHECK9 |
| // RUN: not %run %t 10 2>&1 | FileCheck %s --check-prefix=CHECK10 |
| // RUN: not %run %t 11 2>&1 | FileCheck %s --check-prefix=CHECK11 |
| // RUN: not %run %t 12 2>&1 | FileCheck %s --check-prefix=CHECK12 |
| // RUN: not %run %t 13 2>&1 | FileCheck %s --check-prefix=CHECK13 |
| // RUN: not %run %t 14 2>&1 | FileCheck %s --check-prefix=CHECK14 |
| // RUN: not %run %t 15 2>&1 | FileCheck %s --check-prefix=CHECK15 |
| // RUN: not %run %t 16 2>&1 | FileCheck %s --check-prefix=CHECK16 |
| // RUN: not %run %t 17 2>&1 | FileCheck %s --check-prefix=CHECK17 |
| // RUN: not %run %t 18 2>&1 | FileCheck %s --check-prefix=CHECK18 |
| // RUN: not %run %t 19 2>&1 | FileCheck %s --check-prefix=CHECK19 |
| // RUN: not %run %t 20 2>&1 | FileCheck %s --check-prefix=CHECK20 |
| // RUN: not %run %t 21 2>&1 | FileCheck %s --check-prefix=CHECK21 |
| // RUN: not %run %t 22 2>&1 | FileCheck %s --check-prefix=CHECK22 |
| // RUN: not %run %t 23 2>&1 | FileCheck %s --check-prefix=CHECK23 |
| // RUN: not %run %t 24 2>&1 | FileCheck %s --check-prefix=CHECK24 |
| // RUN: not %run %t 25 2>&1 | FileCheck %s --check-prefix=CHECK25 |
| // RUN: not %run %t 26 2>&1 | FileCheck %s --check-prefix=CHECK26 |
| // RUN: not %run %t 27 2>&1 | FileCheck %s --check-prefix=CHECK27 |
| // |
| // UAR Mode: always |
| // RUN: %clangxx_asan -O0 %s -o %t -fsanitize-address-use-after-return=always -mllvm -asan-use-stack-safety=0 |
| // On OSX and Windows, alloc_dealloc_mismatch=1 isn't 100% reliable, so it's |
| // off by default. It's safe for these tests, though, so we turn it on. |
| // RUN: export %env_asan_opts=symbolize=0:handle_abort=1:print_scariness=1:alloc_dealloc_mismatch=1 |
| // Make sure the stack is limited (may not be the default under GNU make) |
| // RUN: ulimit -s 4096 |
| // RUN: not %run %t 1 2>&1 | FileCheck %s --check-prefix=CHECK1 |
| // RUN: not %run %t 2 2>&1 | FileCheck %s --check-prefix=CHECK2 |
| // RUN: not %run %t 3 2>&1 | FileCheck %s --check-prefix=CHECK3 |
| // RUN: not %run %t 4 2>&1 | FileCheck %s --check-prefix=CHECK4 |
| // RUN: not %run %t 5 2>&1 | FileCheck %s --check-prefix=CHECK5 |
| // RUN: not %run %t 6 2>&1 | FileCheck %s --check-prefix=CHECK6 |
| // RUN: not %run %t 7 2>&1 | FileCheck %s --check-prefix=CHECK7 |
| // RUN: not %run %t 8 2>&1 | FileCheck %s --check-prefix=CHECK8 |
| // RUN: not %run %t 9 2>&1 | FileCheck %s --check-prefix=CHECK9 |
| // RUN: not %run %t 10 2>&1 | FileCheck %s --check-prefix=CHECK10 |
| // RUN: not %run %t 11 2>&1 | FileCheck %s --check-prefix=CHECK11 |
| // RUN: not %run %t 12 2>&1 | FileCheck %s --check-prefix=CHECK12 |
| // RUN: not %run %t 13 2>&1 | FileCheck %s --check-prefix=CHECK13 |
| // RUN: not %run %t 14 2>&1 | FileCheck %s --check-prefix=CHECK14 |
| // RUN: not %run %t 15 2>&1 | FileCheck %s --check-prefix=CHECK15 |
| // RUN: not %run %t 16 2>&1 | FileCheck %s --check-prefix=CHECK16 |
| // RUN: not %run %t 17 2>&1 | FileCheck %s --check-prefix=CHECK17 |
| // RUN: not %run %t 18 2>&1 | FileCheck %s --check-prefix=CHECK18 |
| // RUN: not %run %t 19 2>&1 | FileCheck %s --check-prefix=CHECK19 |
| // RUN: not %run %t 20 2>&1 | FileCheck %s --check-prefix=CHECK20 |
| // RUN: not %run %t 21 2>&1 | FileCheck %s --check-prefix=CHECK21 |
| // RUN: not %run %t 22 2>&1 | FileCheck %s --check-prefix=CHECK22 |
| // RUN: not %run %t 23 2>&1 | FileCheck %s --check-prefix=CHECK23 |
| // RUN: not %run %t 24 2>&1 | FileCheck %s --check-prefix=CHECK24 |
| // RUN: not %run %t 25 2>&1 | FileCheck %s --check-prefix=CHECK25 |
| // RUN: not %run %t 26 2>&1 | FileCheck %s --check-prefix=CHECK26 |
| // RUN: not %run %t 27 2>&1 | FileCheck %s --check-prefix=CHECK27 |
| // Parts of the test are too platform-specific: |
| // REQUIRES: x86_64-target-arch |
| // REQUIRES: shell |
| #include <stdlib.h> |
| #include <stdio.h> |
| #include <string.h> |
| #include <algorithm> |
| |
| #include <sanitizer/asan_interface.h> |
| |
| enum ReadOrWrite { Read = 0, Write = 1 }; |
| |
| struct S32 { |
| char x[32]; |
| }; |
| |
| template<class T> |
| void HeapBuferOverflow(int Idx, ReadOrWrite w) { |
| T *t = new T[100]; |
| static T sink; |
| if (w) |
| t[100 + Idx] = T(); |
| else |
| sink = t[100 + Idx]; |
| delete [] t; |
| } |
| |
| template<class T> |
| void HeapUseAfterFree(int Idx, ReadOrWrite w) { |
| T *t = new T[100]; |
| static T sink; |
| sink = t[0]; |
| delete [] t; |
| if (w) |
| t[Idx] = T(); |
| else |
| sink = t[Idx]; |
| } |
| |
| template<class T> |
| void StackBufferOverflow(int Idx, ReadOrWrite w) { |
| T t[100]; |
| static T sink; |
| sink = t[Idx]; |
| if (w) |
| t[100 + Idx] = T(); |
| else |
| sink = t[100 + Idx]; |
| } |
| |
| template<class T> |
| T *LeakStack() { |
| T t[100]; |
| static volatile T *x; |
| x = &t[0]; |
| return (T*)x; |
| } |
| |
| template<class T> |
| void StackUseAfterReturn(int Idx, ReadOrWrite w) { |
| static T sink; |
| T *t = LeakStack<T>(); |
| if (w) |
| t[100 + Idx] = T(); |
| else |
| sink = t[100 + Idx]; |
| } |
| |
| char g1[100]; |
| short g2[100]; |
| int g4[100]; |
| int64_t g8[100]; |
| S32 gm[100]; |
| |
| void DoubleFree() { |
| int *x = new int; |
| static volatile int two = 2; |
| for (int i = 0; i < two; i++) |
| delete x; |
| } |
| |
| void StackOverflow(int Idx) { |
| int some_stack[256]; |
| static volatile int *x; |
| x = &some_stack[0]; |
| if (Idx > 0) |
| StackOverflow(Idx - 1); |
| } |
| |
| void UseAfterPoison() { |
| int buf[100]; |
| __asan_poison_memory_region(buf, sizeof(buf)); |
| static volatile int sink; |
| sink = buf[42]; |
| } |
| |
| int main(int argc, char **argv) { |
| size_t scale; |
| size_t offset; |
| __asan_get_shadow_mapping(&scale, &offset); |
| size_t grain = 1 << scale; |
| |
| char arr[100]; |
| static volatile int zero = 0; |
| static volatile int *zero_ptr = 0; |
| static volatile int *wild_addr = (int*)0x10000000; // System-dependent. |
| if (argc != 2) return 1; |
| int kind = atoi(argv[1]); |
| switch (kind) { |
| case 1: HeapBuferOverflow<char>(0, Read); break; |
| case 2: HeapBuferOverflow<int>(0, Read); break; |
| case 3: HeapBuferOverflow<short>(0, Write); break; |
| case 4: HeapBuferOverflow<int64_t>( |
| 2 * std::max(1, (int)(grain / sizeof(int64_t))), Write); break; |
| case 5: HeapBuferOverflow<S32>(4, Write); break; |
| case 6: HeapUseAfterFree<char>(0, Read); break; |
| case 7: HeapUseAfterFree<int>(0, Write); break; |
| case 8: HeapUseAfterFree<int64_t>(0, Read); break; |
| case 9: HeapUseAfterFree<S32>(0, Write); break; |
| case 10: StackBufferOverflow<char>(0, Write); break; |
| case 11: StackBufferOverflow<int64_t>(0, Read); break; |
| case 12: |
| if (scale <= 3) { |
| StackBufferOverflow<int>(16, Write); |
| } else { |
| // At large shadow granularity, there is not enough redzone |
| // between stack elements to detect far-from-bounds. Pretend |
| // that this test passes. |
| fprintf(stderr, "SCARINESS: 61 " |
| "(4-byte-write-stack-buffer-overflow-far-from-bounds)\n"); |
| return 1; |
| } |
| break; |
| case 13: StackUseAfterReturn<char>(0, Read); break; |
| case 14: StackUseAfterReturn<S32>(0, Write); break; |
| case 15: g1[zero + 100] = 0; break; |
| case 16: gm[0] = gm[zero + 100 + 1]; break; |
| case 17: DoubleFree(); break; |
| case 18: StackOverflow(1000000); break; |
| case 19: *zero_ptr = 0; break; |
| case 20: *wild_addr = 0; break; |
| case 21: zero = *wild_addr; break; |
| case 22: ((void (*)(void))wild_addr)(); break; |
| case 23: delete (new int[10]); break; |
| case 24: free((char*)malloc(100) + 10); break; |
| case 25: memcpy(arr, arr+10, 20); break; |
| case 26: UseAfterPoison(); break; |
| case 27: abort(); |
| // CHECK1: SCARINESS: 12 (1-byte-read-heap-buffer-overflow) |
| // CHECK2: SCARINESS: 17 (4-byte-read-heap-buffer-overflow) |
| // CHECK3: SCARINESS: 33 (2-byte-write-heap-buffer-overflow) |
| // CHECK4: SCARINESS: 52 (8-byte-write-heap-buffer-overflow-far-from-bounds) |
| // CHECK5: SCARINESS: 55 (multi-byte-write-heap-buffer-overflow-far-from-bounds) |
| // CHECK6: SCARINESS: 40 (1-byte-read-heap-use-after-free) |
| // CHECK7: SCARINESS: 46 (4-byte-write-heap-use-after-free) |
| // CHECK8: SCARINESS: 51 (8-byte-read-heap-use-after-free) |
| // CHECK9: SCARINESS: 55 (multi-byte-write-heap-use-after-free) |
| // CHECK10: SCARINESS: 46 (1-byte-write-stack-buffer-overflow) |
| // CHECK11: SCARINESS: 38 (8-byte-read-stack-buffer-overflow) |
| // CHECK12: SCARINESS: 61 (4-byte-write-stack-buffer-overflow-far-from-bounds) |
| // CHECK13: SCARINESS: 50 (1-byte-read-stack-use-after-return) |
| // CHECK14: SCARINESS: 65 (multi-byte-write-stack-use-after-return) |
| // CHECK15: SCARINESS: 31 (1-byte-write-global-buffer-overflow) |
| // CHECK16: SCARINESS: 36 (multi-byte-read-global-buffer-overflow-far-from-bounds) |
| // CHECK17: SCARINESS: 42 (double-free) |
| // CHECK18: SCARINESS: 10 (stack-overflow) |
| // CHECK19: SCARINESS: 10 (null-deref) |
| // CHECK20: SCARINESS: 30 (wild-addr-write) |
| // CHECK21: SCARINESS: 20 (wild-addr-read) |
| // CHECK22: SCARINESS: 60 (wild-jump) |
| // CHECK23: SCARINESS: 10 (alloc-dealloc-mismatch) |
| // CHECK24: SCARINESS: 40 (bad-free) |
| // CHECK25: SCARINESS: 10 (memcpy-param-overlap) |
| // CHECK26: SCARINESS: 27 (4-byte-read-use-after-poison) |
| // CHECK27: SCARINESS: 10 (signal) |
| } |
| } |