gcc/ChangeLog:
2014-06-20 Yury Gribov <y.gribov@samsung.com>
Max Ostapenko <m.ostapenko@partner.samsung.com>
PR sanitizer/61547
* asan.c (instrument_strlen_call): Fixed instrumentation of
trailing byte.
gcc/testsuite/ChangeLog:
2014-06-20 Yury Gribov <y.gribov@samsung.com>
Max Ostapenko <m.ostapenko@partner.samsung.com>
PR sanitizer/61547
* c-c++-common/asan/strlen-overflow-1.c: New test.
@@ -2036,19 +2036,19 @@ instrument_strlen_call (gimple_stmt_iterator *iter)
build_check_stmt (loc, gimple_assign_lhs (str_arg_ssa), NULL_TREE, 1, iter,
/*non_zero_len_p*/true, /*before_p=*/true,
- /*is_store=*/false, /*is_scalar_access*/false, /*align*/0);
+ /*is_store=*/false, /*is_scalar_access*/true, /*align*/0);
- gimple stmt =
- gimple_build_assign_with_ops (PLUS_EXPR,
- make_ssa_name (TREE_TYPE (len), NULL),
- len,
- build_int_cst (TREE_TYPE (len), 1));
- gimple_set_location (stmt, loc);
- gsi_insert_after (iter, stmt, GSI_NEW_STMT);
+ gimple g =
+ gimple_build_assign_with_ops (POINTER_PLUS_EXPR,
+ make_ssa_name (cptr_type, NULL),
+ gimple_assign_lhs (str_arg_ssa),
+ len);
+ gimple_set_location (g, loc);
+ gsi_insert_after (iter, g, GSI_NEW_STMT);
- build_check_stmt (loc, gimple_assign_lhs (stmt), len, 1, iter,
+ build_check_stmt (loc, gimple_assign_lhs (g), NULL_TREE, 1, iter,
/*non_zero_len_p*/true, /*before_p=*/false,
- /*is_store=*/false, /*is_scalar_access*/false, /*align*/0);
+ /*is_store=*/false, /*is_scalar_access*/true, /*align*/0);
return true;
}
new file mode 100644
@@ -0,0 +1,31 @@
+/* { dg-do run } */
+/* { dg-skip-if "" { *-*-* } { "-flto" } { "" } } */
+/* { dg-shouldfail "asan" } */
+
+#include <sanitizer/asan_interface.h>
+
+char a[2] = "0";
+
+#ifdef __cplusplus
+extern "C"
+#endif
+__SIZE_TYPE__ strlen (const char *p) {
+ /* Simulate error */
+ if (p == a)
+ return 1;
+
+ __SIZE_TYPE__ n = 0;
+ for (; *p; ++n, ++p);
+ return n;
+}
+
+int main () {
+ char *p = &a[0];
+ asm ("" : "+r"(p));
+ __asan_poison_memory_region ((char *)&a[1], 1);
+ return __builtin_strlen (a);
+}
+
+/* { dg-output "READ of size 1 at 0x\[0-9a-f\]+ thread T0.*(\n|\r\n|\r)" } */
+/* { dg-output " #0 0x\[0-9a-f\]+ (in _*main (\[^\n\r]*strlen-overflow-1.c:26|\[^\n\r]*:0)|\[(\]).*(\n|\r\n|\r)" } */
+/* { dg-output "\[^\n\r]*0x\[0-9a-f\]+ is located 1 bytes inside of global variable" } */