| Message ID | 20240329160703.4012941-5-qing.zhao@oracle.com |
|---|---|
| State | New |
| Headers | show |
| Series | New attribute "counted_by" to annotate bounds for C99 FAM(PR108896) | expand |
The C front-end changes in this patch are OK for GCC 15.
On 2024-03-29 12:07, Qing Zhao wrote: > gcc/c-family/ChangeLog: > > * c-ubsan.cc (get_bound_from_access_with_size): New function. > (ubsan_instrument_bounds): Handle call to .ACCESS_WITH_SIZE. > > gcc/testsuite/ChangeLog: > > * gcc.dg/ubsan/flex-array-counted-by-bounds-2.c: New test. > * gcc.dg/ubsan/flex-array-counted-by-bounds-3.c: New test. > * gcc.dg/ubsan/flex-array-counted-by-bounds-4.c: New test. > * gcc.dg/ubsan/flex-array-counted-by-bounds.c: New test. > --- This version looks fine to me for stage 1, but I'm not a maintainer so you'll need an ack from one to commit. Thanks, Sid > gcc/c-family/c-ubsan.cc | 42 +++++++++++++++++ > .../ubsan/flex-array-counted-by-bounds-2.c | 45 ++++++++++++++++++ > .../ubsan/flex-array-counted-by-bounds-3.c | 34 ++++++++++++++ > .../ubsan/flex-array-counted-by-bounds-4.c | 34 ++++++++++++++ > .../ubsan/flex-array-counted-by-bounds.c | 46 +++++++++++++++++++ > 5 files changed, 201 insertions(+) > create mode 100644 gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds-2.c > create mode 100644 gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds-3.c > create mode 100644 gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds-4.c > create mode 100644 gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds.c > > diff --git a/gcc/c-family/c-ubsan.cc b/gcc/c-family/c-ubsan.cc > index 940982819ddf..7cd3c6aa5b88 100644 > --- a/gcc/c-family/c-ubsan.cc > +++ b/gcc/c-family/c-ubsan.cc > @@ -376,6 +376,40 @@ ubsan_instrument_return (location_t loc) > return build_call_expr_loc (loc, t, 1, build_fold_addr_expr_loc (loc, data)); > } > > +/* Get the tree that represented the number of counted_by, i.e, the maximum > + number of the elements of the object that the call to .ACCESS_WITH_SIZE > + points to, this number will be the bound of the corresponding array. */ > +static tree > +get_bound_from_access_with_size (tree call) > +{ > + if (!is_access_with_size_p (call)) > + return NULL_TREE; > + > + tree ref_to_size = CALL_EXPR_ARG (call, 1); > + unsigned int class_of_size = TREE_INT_CST_LOW (CALL_EXPR_ARG (call, 2)); > + tree type = TREE_TYPE (CALL_EXPR_ARG (call, 3)); > + tree size = fold_build2 (MEM_REF, type, unshare_expr (ref_to_size), > + build_int_cst (ptr_type_node, 0)); > + /* If size is negative value, treat it as zero. */ > + if (!TYPE_UNSIGNED (type)) > + { > + tree cond = fold_build2 (LT_EXPR, boolean_type_node, > + unshare_expr (size), build_zero_cst (type)); > + size = fold_build3 (COND_EXPR, type, cond, > + build_zero_cst (type), size); > + } > + > + /* Only when class_of_size is 1, i.e, the number of the elements of > + the object type, return the size. */ > + if (class_of_size != 1) > + return NULL_TREE; > + else > + size = fold_convert (sizetype, size); > + > + return size; > +} > + > + > /* Instrument array bounds for ARRAY_REFs. We create special builtin, > that gets expanded in the sanopt pass, and make an array dimension > of it. ARRAY is the array, *INDEX is an index to the array. > @@ -401,6 +435,14 @@ ubsan_instrument_bounds (location_t loc, tree array, tree *index, > && COMPLETE_TYPE_P (type) > && integer_zerop (TYPE_SIZE (type))) > bound = build_int_cst (TREE_TYPE (TYPE_MIN_VALUE (domain)), -1); > + else if (INDIRECT_REF_P (array) > + && is_access_with_size_p ((TREE_OPERAND (array, 0)))) > + { > + bound = get_bound_from_access_with_size ((TREE_OPERAND (array, 0))); > + bound = fold_build2 (MINUS_EXPR, TREE_TYPE (bound), > + bound, > + build_int_cst (TREE_TYPE (bound), 1)); > + } > else > return NULL_TREE; > } > diff --git a/gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds-2.c b/gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds-2.c > new file mode 100644 > index 000000000000..b503320628d2 > --- /dev/null > +++ b/gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds-2.c > @@ -0,0 +1,45 @@ > +/* Test the attribute counted_by and its usage in > + bounds sanitizer combined with VLA. */ > +/* { dg-do run } */ > +/* { dg-options "-fsanitize=bounds" } */ > +/* { dg-output "index 11 out of bounds for type 'int \\\[\\\*\\\]\\\[\\\*\\\]'\[^\n\r]*(\n|\r\n|\r)" } */ > +/* { dg-output "\[^\n\r]*index 20 out of bounds for type 'int \\\[\\\*\\\]\\\[\\\*\\\]\\\[\\\*\\\]'\[^\n\r]*(\n|\r\n|\r)" } */ > +/* { dg-output "\[^\n\r]*index 11 out of bounds for type 'int \\\[\\\*\\\]\\\[\\\*\\\]'\[^\n\r]*(\n|\r\n|\r)" } */ > +/* { dg-output "\[^\n\r]*index 10 out of bounds for type 'int \\\[\\\*\\\]'\[^\n\r]*(\n|\r\n|\r)" } */ > + > + > +#include <stdlib.h> > + > +void __attribute__((__noinline__)) setup_and_test_vla (int n, int m) > +{ > + struct foo { > + int n; > + int p[][n] __attribute__((counted_by(n))); > + } *f; > + > + f = (struct foo *) malloc (sizeof(struct foo) + m*sizeof(int[n])); > + f->n = m; > + f->p[m][n-1]=1; > + return; > +} > + > +void __attribute__((__noinline__)) setup_and_test_vla_1 (int n1, int n2, int m) > +{ > + struct foo { > + int n; > + int p[][n2][n1] __attribute__((counted_by(n))); > + } *f; > + > + f = (struct foo *) malloc (sizeof(struct foo) + m*sizeof(int[n2][n1])); > + f->n = m; > + f->p[m][n2][n1]=1; > + return; > +} > + > +int main(int argc, char *argv[]) > +{ > + setup_and_test_vla (10, 11); > + setup_and_test_vla_1 (10, 11, 20); > + return 0; > +} > + > diff --git a/gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds-3.c b/gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds-3.c > new file mode 100644 > index 000000000000..9da25644af3e > --- /dev/null > +++ b/gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds-3.c > @@ -0,0 +1,34 @@ > +/* Test the attribute counted_by and its usage in bounds > + sanitizer. when counted_by field is negative value. */ > +/* { dg-do run } */ > +/* { dg-options "-fsanitize=bounds" } */ > + > +#include <stdlib.h> > + > +struct annotated { > + int b; > + int c[] __attribute__ ((counted_by (b))); > +} *array_annotated; > + > +void __attribute__((__noinline__)) setup (int annotated_count) > +{ > + array_annotated > + = (struct annotated *)malloc (sizeof (struct annotated)); > + array_annotated->b = annotated_count; > + > + return; > +} > + > +void __attribute__((__noinline__)) test (int annotated_index) > +{ > + array_annotated->c[annotated_index] = 2; > +} > + > +int main(int argc, char *argv[]) > +{ > + setup (-3); > + test (2); > + return 0; > +} > + > +/* { dg-output "24:21: runtime error: index 2 out of bounds for type" } */ > diff --git a/gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds-4.c b/gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds-4.c > new file mode 100644 > index 000000000000..bd7e144274fc > --- /dev/null > +++ b/gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds-4.c > @@ -0,0 +1,34 @@ > +/* Test the attribute counted_by and its usage in bounds > + sanitizer. when counted_by field is zero value. */ > +/* { dg-do run } */ > +/* { dg-options "-fsanitize=bounds" } */ > + > +#include <stdlib.h> > + > +struct annotated { > + int b; > + int c[] __attribute__ ((counted_by (b))); > +} *array_annotated; > + > +void __attribute__((__noinline__)) setup (int annotated_count) > +{ > + array_annotated > + = (struct annotated *)malloc (sizeof (struct annotated)); > + array_annotated->b = annotated_count; > + > + return; > +} > + > +void __attribute__((__noinline__)) test (int annotated_index) > +{ > + array_annotated->c[annotated_index] = 2; > +} > + > +int main(int argc, char *argv[]) > +{ > + setup (0); > + test (1); > + return 0; > +} > + > +/* { dg-output "24:21: runtime error: index 1 out of bounds for type" } */ > diff --git a/gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds.c b/gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds.c > new file mode 100644 > index 000000000000..e2b911dde626 > --- /dev/null > +++ b/gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds.c > @@ -0,0 +1,46 @@ > +/* Test the attribute counted_by and its usage in > + bounds sanitizer. */ > +/* { dg-do run } */ > +/* { dg-options "-fsanitize=bounds" } */ > + > +#include <stdlib.h> > + > +struct flex { > + int b; > + int c[]; > +} *array_flex; > + > +struct annotated { > + int b; > + int c[] __attribute__ ((counted_by (b))); > +} *array_annotated; > + > +void __attribute__((__noinline__)) setup (int normal_count, int annotated_count) > +{ > + array_flex > + = (struct flex *)malloc (sizeof (struct flex) > + + normal_count * sizeof (int)); > + array_flex->b = normal_count; > + > + array_annotated > + = (struct annotated *)malloc (sizeof (struct annotated) > + + annotated_count * sizeof (int)); > + array_annotated->b = annotated_count; > + > + return; > +} > + > +void __attribute__((__noinline__)) test (int normal_index, int annotated_index) > +{ > + array_flex->c[normal_index] = 1; > + array_annotated->c[annotated_index] = 2; > +} > + > +int main(int argc, char *argv[]) > +{ > + setup (10, 10); > + test (10, 10); > + return 0; > +} > + > +/* { dg-output "36:21: runtime error: index 10 out of bounds for type" } */
Sid, Thanks a lot for the review. > On Apr 10, 2024, at 17:46, Siddhesh Poyarekar <siddhesh@gotplt.org> wrote: > > On 2024-03-29 12:07, Qing Zhao wrote: >> gcc/c-family/ChangeLog: >> * c-ubsan.cc (get_bound_from_access_with_size): New function. >> (ubsan_instrument_bounds): Handle call to .ACCESS_WITH_SIZE. >> gcc/testsuite/ChangeLog: >> * gcc.dg/ubsan/flex-array-counted-by-bounds-2.c: New test. >> * gcc.dg/ubsan/flex-array-counted-by-bounds-3.c: New test. >> * gcc.dg/ubsan/flex-array-counted-by-bounds-4.c: New test. >> * gcc.dg/ubsan/flex-array-counted-by-bounds.c: New test. >> --- > > This version looks fine to me for stage 1, but I'm not a maintainer so you'll need an ack from one to commit. This patch is purely C FE changes. Joseph already approved it. thanks. Qing > > Thanks, > Sid > >> gcc/c-family/c-ubsan.cc | 42 +++++++++++++++++ >> .../ubsan/flex-array-counted-by-bounds-2.c | 45 ++++++++++++++++++ >> .../ubsan/flex-array-counted-by-bounds-3.c | 34 ++++++++++++++ >> .../ubsan/flex-array-counted-by-bounds-4.c | 34 ++++++++++++++ >> .../ubsan/flex-array-counted-by-bounds.c | 46 +++++++++++++++++++ >> 5 files changed, 201 insertions(+) >> create mode 100644 gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds-2.c >> create mode 100644 gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds-3.c >> create mode 100644 gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds-4.c >> create mode 100644 gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds.c >> diff --git a/gcc/c-family/c-ubsan.cc b/gcc/c-family/c-ubsan.cc >> index 940982819ddf..7cd3c6aa5b88 100644 >> --- a/gcc/c-family/c-ubsan.cc >> +++ b/gcc/c-family/c-ubsan.cc >> @@ -376,6 +376,40 @@ ubsan_instrument_return (location_t loc) >> return build_call_expr_loc (loc, t, 1, build_fold_addr_expr_loc (loc, data)); >> } >> +/* Get the tree that represented the number of counted_by, i.e, the maximum >> + number of the elements of the object that the call to .ACCESS_WITH_SIZE >> + points to, this number will be the bound of the corresponding array. */ >> +static tree >> +get_bound_from_access_with_size (tree call) >> +{ >> + if (!is_access_with_size_p (call)) >> + return NULL_TREE; >> + >> + tree ref_to_size = CALL_EXPR_ARG (call, 1); >> + unsigned int class_of_size = TREE_INT_CST_LOW (CALL_EXPR_ARG (call, 2)); >> + tree type = TREE_TYPE (CALL_EXPR_ARG (call, 3)); >> + tree size = fold_build2 (MEM_REF, type, unshare_expr (ref_to_size), >> + build_int_cst (ptr_type_node, 0)); >> + /* If size is negative value, treat it as zero. */ >> + if (!TYPE_UNSIGNED (type)) >> + { >> + tree cond = fold_build2 (LT_EXPR, boolean_type_node, >> + unshare_expr (size), build_zero_cst (type)); >> + size = fold_build3 (COND_EXPR, type, cond, >> + build_zero_cst (type), size); >> + } >> + >> + /* Only when class_of_size is 1, i.e, the number of the elements of >> + the object type, return the size. */ >> + if (class_of_size != 1) >> + return NULL_TREE; >> + else >> + size = fold_convert (sizetype, size); >> + >> + return size; >> +} >> + >> + >> /* Instrument array bounds for ARRAY_REFs. We create special builtin, >> that gets expanded in the sanopt pass, and make an array dimension >> of it. ARRAY is the array, *INDEX is an index to the array. >> @@ -401,6 +435,14 @@ ubsan_instrument_bounds (location_t loc, tree array, tree *index, >> && COMPLETE_TYPE_P (type) >> && integer_zerop (TYPE_SIZE (type))) >> bound = build_int_cst (TREE_TYPE (TYPE_MIN_VALUE (domain)), -1); >> + else if (INDIRECT_REF_P (array) >> + && is_access_with_size_p ((TREE_OPERAND (array, 0)))) >> + { >> + bound = get_bound_from_access_with_size ((TREE_OPERAND (array, 0))); >> + bound = fold_build2 (MINUS_EXPR, TREE_TYPE (bound), >> + bound, >> + build_int_cst (TREE_TYPE (bound), 1)); >> + } >> else >> return NULL_TREE; >> } >> diff --git a/gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds-2.c b/gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds-2.c >> new file mode 100644 >> index 000000000000..b503320628d2 >> --- /dev/null >> +++ b/gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds-2.c >> @@ -0,0 +1,45 @@ >> +/* Test the attribute counted_by and its usage in >> + bounds sanitizer combined with VLA. */ >> +/* { dg-do run } */ >> +/* { dg-options "-fsanitize=bounds" } */ >> +/* { dg-output "index 11 out of bounds for type 'int \\\[\\\*\\\]\\\[\\\*\\\]'\[^\n\r]*(\n|\r\n|\r)" } */ >> +/* { dg-output "\[^\n\r]*index 20 out of bounds for type 'int \\\[\\\*\\\]\\\[\\\*\\\]\\\[\\\*\\\]'\[^\n\r]*(\n|\r\n|\r)" } */ >> +/* { dg-output "\[^\n\r]*index 11 out of bounds for type 'int \\\[\\\*\\\]\\\[\\\*\\\]'\[^\n\r]*(\n|\r\n|\r)" } */ >> +/* { dg-output "\[^\n\r]*index 10 out of bounds for type 'int \\\[\\\*\\\]'\[^\n\r]*(\n|\r\n|\r)" } */ >> + >> + >> +#include <stdlib.h> >> + >> +void __attribute__((__noinline__)) setup_and_test_vla (int n, int m) >> +{ >> + struct foo { >> + int n; >> + int p[][n] __attribute__((counted_by(n))); >> + } *f; >> + >> + f = (struct foo *) malloc (sizeof(struct foo) + m*sizeof(int[n])); >> + f->n = m; >> + f->p[m][n-1]=1; >> + return; >> +} >> + >> +void __attribute__((__noinline__)) setup_and_test_vla_1 (int n1, int n2, int m) >> +{ >> + struct foo { >> + int n; >> + int p[][n2][n1] __attribute__((counted_by(n))); >> + } *f; >> + >> + f = (struct foo *) malloc (sizeof(struct foo) + m*sizeof(int[n2][n1])); >> + f->n = m; >> + f->p[m][n2][n1]=1; >> + return; >> +} >> + >> +int main(int argc, char *argv[]) >> +{ >> + setup_and_test_vla (10, 11); >> + setup_and_test_vla_1 (10, 11, 20); >> + return 0; >> +} >> + >> diff --git a/gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds-3.c b/gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds-3.c >> new file mode 100644 >> index 000000000000..9da25644af3e >> --- /dev/null >> +++ b/gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds-3.c >> @@ -0,0 +1,34 @@ >> +/* Test the attribute counted_by and its usage in bounds >> + sanitizer. when counted_by field is negative value. */ >> +/* { dg-do run } */ >> +/* { dg-options "-fsanitize=bounds" } */ >> + >> +#include <stdlib.h> >> + >> +struct annotated { >> + int b; >> + int c[] __attribute__ ((counted_by (b))); >> +} *array_annotated; >> + >> +void __attribute__((__noinline__)) setup (int annotated_count) >> +{ >> + array_annotated >> + = (struct annotated *)malloc (sizeof (struct annotated)); >> + array_annotated->b = annotated_count; >> + >> + return; >> +} >> + >> +void __attribute__((__noinline__)) test (int annotated_index) >> +{ >> + array_annotated->c[annotated_index] = 2; >> +} >> + >> +int main(int argc, char *argv[]) >> +{ >> + setup (-3); >> + test (2); >> + return 0; >> +} >> + >> +/* { dg-output "24:21: runtime error: index 2 out of bounds for type" } */ >> diff --git a/gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds-4.c b/gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds-4.c >> new file mode 100644 >> index 000000000000..bd7e144274fc >> --- /dev/null >> +++ b/gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds-4.c >> @@ -0,0 +1,34 @@ >> +/* Test the attribute counted_by and its usage in bounds >> + sanitizer. when counted_by field is zero value. */ >> +/* { dg-do run } */ >> +/* { dg-options "-fsanitize=bounds" } */ >> + >> +#include <stdlib.h> >> + >> +struct annotated { >> + int b; >> + int c[] __attribute__ ((counted_by (b))); >> +} *array_annotated; >> + >> +void __attribute__((__noinline__)) setup (int annotated_count) >> +{ >> + array_annotated >> + = (struct annotated *)malloc (sizeof (struct annotated)); >> + array_annotated->b = annotated_count; >> + >> + return; >> +} >> + >> +void __attribute__((__noinline__)) test (int annotated_index) >> +{ >> + array_annotated->c[annotated_index] = 2; >> +} >> + >> +int main(int argc, char *argv[]) >> +{ >> + setup (0); >> + test (1); >> + return 0; >> +} >> + >> +/* { dg-output "24:21: runtime error: index 1 out of bounds for type" } */ >> diff --git a/gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds.c b/gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds.c >> new file mode 100644 >> index 000000000000..e2b911dde626 >> --- /dev/null >> +++ b/gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds.c >> @@ -0,0 +1,46 @@ >> +/* Test the attribute counted_by and its usage in >> + bounds sanitizer. */ >> +/* { dg-do run } */ >> +/* { dg-options "-fsanitize=bounds" } */ >> + >> +#include <stdlib.h> >> + >> +struct flex { >> + int b; >> + int c[]; >> +} *array_flex; >> + >> +struct annotated { >> + int b; >> + int c[] __attribute__ ((counted_by (b))); >> +} *array_annotated; >> + >> +void __attribute__((__noinline__)) setup (int normal_count, int annotated_count) >> +{ >> + array_flex >> + = (struct flex *)malloc (sizeof (struct flex) >> + + normal_count * sizeof (int)); >> + array_flex->b = normal_count; >> + >> + array_annotated >> + = (struct annotated *)malloc (sizeof (struct annotated) >> + + annotated_count * sizeof (int)); >> + array_annotated->b = annotated_count; >> + >> + return; >> +} >> + >> +void __attribute__((__noinline__)) test (int normal_index, int annotated_index) >> +{ >> + array_flex->c[normal_index] = 1; >> + array_annotated->c[annotated_index] = 2; >> +} >> + >> +int main(int argc, char *argv[]) >> +{ >> + setup (10, 10); >> + test (10, 10); >> + return 0; >> +} >> + >> +/* { dg-output "36:21: runtime error: index 10 out of bounds for type" } */
diff --git a/gcc/c-family/c-ubsan.cc b/gcc/c-family/c-ubsan.cc index 940982819ddf..7cd3c6aa5b88 100644 --- a/gcc/c-family/c-ubsan.cc +++ b/gcc/c-family/c-ubsan.cc @@ -376,6 +376,40 @@ ubsan_instrument_return (location_t loc) return build_call_expr_loc (loc, t, 1, build_fold_addr_expr_loc (loc, data)); } +/* Get the tree that represented the number of counted_by, i.e, the maximum + number of the elements of the object that the call to .ACCESS_WITH_SIZE + points to, this number will be the bound of the corresponding array. */ +static tree +get_bound_from_access_with_size (tree call) +{ + if (!is_access_with_size_p (call)) + return NULL_TREE; + + tree ref_to_size = CALL_EXPR_ARG (call, 1); + unsigned int class_of_size = TREE_INT_CST_LOW (CALL_EXPR_ARG (call, 2)); + tree type = TREE_TYPE (CALL_EXPR_ARG (call, 3)); + tree size = fold_build2 (MEM_REF, type, unshare_expr (ref_to_size), + build_int_cst (ptr_type_node, 0)); + /* If size is negative value, treat it as zero. */ + if (!TYPE_UNSIGNED (type)) + { + tree cond = fold_build2 (LT_EXPR, boolean_type_node, + unshare_expr (size), build_zero_cst (type)); + size = fold_build3 (COND_EXPR, type, cond, + build_zero_cst (type), size); + } + + /* Only when class_of_size is 1, i.e, the number of the elements of + the object type, return the size. */ + if (class_of_size != 1) + return NULL_TREE; + else + size = fold_convert (sizetype, size); + + return size; +} + + /* Instrument array bounds for ARRAY_REFs. We create special builtin, that gets expanded in the sanopt pass, and make an array dimension of it. ARRAY is the array, *INDEX is an index to the array. @@ -401,6 +435,14 @@ ubsan_instrument_bounds (location_t loc, tree array, tree *index, && COMPLETE_TYPE_P (type) && integer_zerop (TYPE_SIZE (type))) bound = build_int_cst (TREE_TYPE (TYPE_MIN_VALUE (domain)), -1); + else if (INDIRECT_REF_P (array) + && is_access_with_size_p ((TREE_OPERAND (array, 0)))) + { + bound = get_bound_from_access_with_size ((TREE_OPERAND (array, 0))); + bound = fold_build2 (MINUS_EXPR, TREE_TYPE (bound), + bound, + build_int_cst (TREE_TYPE (bound), 1)); + } else return NULL_TREE; } diff --git a/gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds-2.c b/gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds-2.c new file mode 100644 index 000000000000..b503320628d2 --- /dev/null +++ b/gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds-2.c @@ -0,0 +1,45 @@ +/* Test the attribute counted_by and its usage in + bounds sanitizer combined with VLA. */ +/* { dg-do run } */ +/* { dg-options "-fsanitize=bounds" } */ +/* { dg-output "index 11 out of bounds for type 'int \\\[\\\*\\\]\\\[\\\*\\\]'\[^\n\r]*(\n|\r\n|\r)" } */ +/* { dg-output "\[^\n\r]*index 20 out of bounds for type 'int \\\[\\\*\\\]\\\[\\\*\\\]\\\[\\\*\\\]'\[^\n\r]*(\n|\r\n|\r)" } */ +/* { dg-output "\[^\n\r]*index 11 out of bounds for type 'int \\\[\\\*\\\]\\\[\\\*\\\]'\[^\n\r]*(\n|\r\n|\r)" } */ +/* { dg-output "\[^\n\r]*index 10 out of bounds for type 'int \\\[\\\*\\\]'\[^\n\r]*(\n|\r\n|\r)" } */ + + +#include <stdlib.h> + +void __attribute__((__noinline__)) setup_and_test_vla (int n, int m) +{ + struct foo { + int n; + int p[][n] __attribute__((counted_by(n))); + } *f; + + f = (struct foo *) malloc (sizeof(struct foo) + m*sizeof(int[n])); + f->n = m; + f->p[m][n-1]=1; + return; +} + +void __attribute__((__noinline__)) setup_and_test_vla_1 (int n1, int n2, int m) +{ + struct foo { + int n; + int p[][n2][n1] __attribute__((counted_by(n))); + } *f; + + f = (struct foo *) malloc (sizeof(struct foo) + m*sizeof(int[n2][n1])); + f->n = m; + f->p[m][n2][n1]=1; + return; +} + +int main(int argc, char *argv[]) +{ + setup_and_test_vla (10, 11); + setup_and_test_vla_1 (10, 11, 20); + return 0; +} + diff --git a/gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds-3.c b/gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds-3.c new file mode 100644 index 000000000000..9da25644af3e --- /dev/null +++ b/gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds-3.c @@ -0,0 +1,34 @@ +/* Test the attribute counted_by and its usage in bounds + sanitizer. when counted_by field is negative value. */ +/* { dg-do run } */ +/* { dg-options "-fsanitize=bounds" } */ + +#include <stdlib.h> + +struct annotated { + int b; + int c[] __attribute__ ((counted_by (b))); +} *array_annotated; + +void __attribute__((__noinline__)) setup (int annotated_count) +{ + array_annotated + = (struct annotated *)malloc (sizeof (struct annotated)); + array_annotated->b = annotated_count; + + return; +} + +void __attribute__((__noinline__)) test (int annotated_index) +{ + array_annotated->c[annotated_index] = 2; +} + +int main(int argc, char *argv[]) +{ + setup (-3); + test (2); + return 0; +} + +/* { dg-output "24:21: runtime error: index 2 out of bounds for type" } */ diff --git a/gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds-4.c b/gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds-4.c new file mode 100644 index 000000000000..bd7e144274fc --- /dev/null +++ b/gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds-4.c @@ -0,0 +1,34 @@ +/* Test the attribute counted_by and its usage in bounds + sanitizer. when counted_by field is zero value. */ +/* { dg-do run } */ +/* { dg-options "-fsanitize=bounds" } */ + +#include <stdlib.h> + +struct annotated { + int b; + int c[] __attribute__ ((counted_by (b))); +} *array_annotated; + +void __attribute__((__noinline__)) setup (int annotated_count) +{ + array_annotated + = (struct annotated *)malloc (sizeof (struct annotated)); + array_annotated->b = annotated_count; + + return; +} + +void __attribute__((__noinline__)) test (int annotated_index) +{ + array_annotated->c[annotated_index] = 2; +} + +int main(int argc, char *argv[]) +{ + setup (0); + test (1); + return 0; +} + +/* { dg-output "24:21: runtime error: index 1 out of bounds for type" } */ diff --git a/gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds.c b/gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds.c new file mode 100644 index 000000000000..e2b911dde626 --- /dev/null +++ b/gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds.c @@ -0,0 +1,46 @@ +/* Test the attribute counted_by and its usage in + bounds sanitizer. */ +/* { dg-do run } */ +/* { dg-options "-fsanitize=bounds" } */ + +#include <stdlib.h> + +struct flex { + int b; + int c[]; +} *array_flex; + +struct annotated { + int b; + int c[] __attribute__ ((counted_by (b))); +} *array_annotated; + +void __attribute__((__noinline__)) setup (int normal_count, int annotated_count) +{ + array_flex + = (struct flex *)malloc (sizeof (struct flex) + + normal_count * sizeof (int)); + array_flex->b = normal_count; + + array_annotated + = (struct annotated *)malloc (sizeof (struct annotated) + + annotated_count * sizeof (int)); + array_annotated->b = annotated_count; + + return; +} + +void __attribute__((__noinline__)) test (int normal_index, int annotated_index) +{ + array_flex->c[normal_index] = 1; + array_annotated->c[annotated_index] = 2; +} + +int main(int argc, char *argv[]) +{ + setup (10, 10); + test (10, 10); + return 0; +} + +/* { dg-output "36:21: runtime error: index 10 out of bounds for type" } */