From patchwork Fri Feb 9 15:54:11 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Qing Zhao X-Patchwork-Id: 1897150 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=oracle.com header.i=@oracle.com header.a=rsa-sha256 header.s=corp-2023-11-20 header.b=mOcFMSNO; dkim=pass (1024-bit key; unprotected) header.d=oracle.onmicrosoft.com header.i=@oracle.onmicrosoft.com header.a=rsa-sha256 header.s=selector2-oracle-onmicrosoft-com header.b=a/gusIuC; dkim-atps=neutral Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=gcc.gnu.org (client-ip=2620:52:3:1:0:246e:9693:128c; helo=server2.sourceware.org; envelope-from=gcc-patches-bounces+incoming=patchwork.ozlabs.org@gcc.gnu.org; receiver=patchwork.ozlabs.org) Received: from server2.sourceware.org (server2.sourceware.org [IPv6:2620:52:3:1:0:246e:9693:128c]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (secp384r1) server-digest SHA384) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4TWdk13DN7z23g7 for ; Sat, 10 Feb 2024 02:55:53 +1100 (AEDT) Received: from server2.sourceware.org (localhost [IPv6:::1]) by sourceware.org (Postfix) with ESMTP id 6266F3858407 for ; Fri, 9 Feb 2024 15:55:51 +0000 (GMT) X-Original-To: gcc-patches@gcc.gnu.org Delivered-To: gcc-patches@gcc.gnu.org Received: from mx0a-00069f02.pphosted.com (mx0a-00069f02.pphosted.com [205.220.165.32]) by sourceware.org (Postfix) with ESMTPS id 8CFCE3858283 for ; Fri, 9 Feb 2024 15:54:31 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org 8CFCE3858283 Authentication-Results: sourceware.org; dmarc=pass (p=none dis=none) header.from=oracle.com Authentication-Results: sourceware.org; spf=pass smtp.mailfrom=oracle.com ARC-Filter: OpenARC Filter v1.0.0 sourceware.org 8CFCE3858283 Authentication-Results: server2.sourceware.org; arc=pass smtp.remote-ip=205.220.165.32 ARC-Seal: i=2; a=rsa-sha256; d=sourceware.org; s=key; t=1707494074; cv=pass; b=O/9FeiwrVF7H6T607f7l34fb/BcuLSgYPanG2b7nBkQoRMU6EN6f0EopFXEfJHvdA7hZlBIqFInVDzA6lAd7p6DQ32yvUO6zJQVZrqXRmyowGjbk2YHvpB3ldSLcHs2ffsahHiek6xxoalSJKu6+REMAgtRWKm8MBNrl3wJMYz8= ARC-Message-Signature: i=2; a=rsa-sha256; d=sourceware.org; s=key; t=1707494074; c=relaxed/simple; bh=QWNdJyUSeW99rAMWgPFWQIwvp6mmUrXdvKZ7IXeHThw=; h=DKIM-Signature:DKIM-Signature:From:To:Subject:Date:Message-Id: MIME-Version; b=Bef3e5+vIw5ABrDzzqCQ3qK0V4q+DtwVIW5o9oHs8j39iZ1vr9oZHL05XhiuTT4oP/+930uR3bb1VZ8DJttMDXxJm/b3Nuxcw/6U5wFSWK2Q5ZKlr+NQkfThKKer7uEu2cByOjrBRK2Utyis601CKXx4dAotTAJEZR+Oqm/H8QE= ARC-Authentication-Results: i=2; server2.sourceware.org Received: from pps.filterd (m0246629.ppops.net [127.0.0.1]) by mx0b-00069f02.pphosted.com (8.17.1.19/8.17.1.19) with ESMTP id 419FYVKM009202; Fri, 9 Feb 2024 15:54:30 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : content-transfer-encoding : content-type : mime-version; s=corp-2023-11-20; bh=NVs5N3JU6rpeTiI4CFfGlJke/DLoz1UnDQ+whSU3fEg=; b=mOcFMSNO9BaH0szFqyC53ZNQSDqQIVPef3UJ3+sWD9dTs66UNH8kqy9UsgtELwRtdnbU 3Q4SpZaA1mD4e+oJ7xJgANkDBvb+mYsDWciOUrIGg7jQTD3lq9YcmO1bK2rA8OWK4XKV UmnmHApKKbHiLcI+8Uw9dqRACAy/ePSCtXLVyXphNkaMftxFckOjSzDx0P8rDqXkuRt9 Ll0N0bGKjVLihuaq0qnihRcax6xvIt7JhbTjMfJfSGRIPkh0lirtWxvtoQ4LuJ2ifkk9 ini7XMsXJ7pwkXXnu5vDlUfvS/yKNYfC+GPvPqzMI7re+Jb+dfPOauAwcSCPQVSU6epR 3Q== Received: from phxpaimrmta03.imrmtpd1.prodappphxaev1.oraclevcn.com (phxpaimrmta03.appoci.oracle.com [138.1.37.129]) by mx0b-00069f02.pphosted.com (PPS) with ESMTPS id 3w1dcbqj2x-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Fri, 09 Feb 2024 15:54:29 +0000 Received: from pps.filterd (phxpaimrmta03.imrmtpd1.prodappphxaev1.oraclevcn.com [127.0.0.1]) by phxpaimrmta03.imrmtpd1.prodappphxaev1.oraclevcn.com (8.17.1.19/8.17.1.19) with ESMTP id 419F3U95007040; Fri, 9 Feb 2024 15:54:29 GMT Received: from nam10-mw2-obe.outbound.protection.outlook.com (mail-mw2nam10lp2101.outbound.protection.outlook.com [104.47.55.101]) by phxpaimrmta03.imrmtpd1.prodappphxaev1.oraclevcn.com (PPS) with ESMTPS id 3w1bxcs4m5-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Fri, 09 Feb 2024 15:54:29 +0000 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=g/uiCUU6Wycgum0EdwAkejPzNHxrvBpPhVoaG5cftKSpo9RLt2zIrEa2cPAVvcARsLofhGtgs6QXEzhLBUgrXUaJyH0bDzQsC83Fsy7GxguYgzMfFrfpg+ZZj6jZtkNR+qmnfyqQEaHIqGizaWMKTsB45BqwDX7T+o3lZUO/vgFLixqs7o0wb/qV0slLcORzpdW2uZ55vT7CKz2tE8bt2Am1ptURo8lCNyWK22kcLpk5rk8cWn5PK5p5owNstexS7zNb17Q/Zc+92Bv/tZUpxq8Z3+9ptgdQMsSYj1cs7LOmkjBwdonstCMOoIqOVWzn/s3sh4UsWW1FGzbitcwGgA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=NVs5N3JU6rpeTiI4CFfGlJke/DLoz1UnDQ+whSU3fEg=; b=eRQtQxDiV85APxm9XkKT6XomOmj8IegbUsz/L0gs1P2A2MD8TFb4m95iueOmhANPQaSWJJXTubbvVTOkmOVsfiVPubak67DCLKAGQHGiYBQQBVVp++oAWV6Wgl10lzDi9qiqCdt2m9js4ceiy6U494q21EhsX1auNWIVffUoncB3+pNlhFuc33VnmLiRSIelzJZLUEkkaLxhpsM4QIr4WbSt9oyzwRx6noq15Jg3eAjylTUaSXN0ebICb0uO81aIpomWBWMm6P0g8nfOA/cs6VlYfCfGbHLJT3R9bEAyqbhjvQNN7jaaktUewCl9mYdm6Aiz7lLVlGfu4vbUY+nFuw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=oracle.com; dmarc=pass action=none header.from=oracle.com; dkim=pass header.d=oracle.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.onmicrosoft.com; s=selector2-oracle-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=NVs5N3JU6rpeTiI4CFfGlJke/DLoz1UnDQ+whSU3fEg=; b=a/gusIuC9/RgGgRy1jVOH/PfQTUiL0BDOOEClW7drQtKW+ZCaXOnXSZgrUlBBrMcH8IUwfmzf4pVF/dNNpGaUYmPXc4PNdiJJUDRij6hCOYvpGv8QAXdhFt2/6ASQv1TwO8z+w75CuM+L51vt1IlyrhStIVWe22TRL5wSuFZj+w= Received: from CH3PR10MB7957.namprd10.prod.outlook.com (2603:10b6:610:1bf::19) by DS0PR10MB7955.namprd10.prod.outlook.com (2603:10b6:8:1b4::16) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7249.39; Fri, 9 Feb 2024 15:54:27 +0000 Received: from CH3PR10MB7957.namprd10.prod.outlook.com ([fe80::6234:e7a1:b517:c44]) by CH3PR10MB7957.namprd10.prod.outlook.com ([fe80::6234:e7a1:b517:c44%6]) with mapi id 15.20.7249.037; Fri, 9 Feb 2024 15:54:27 +0000 From: Qing Zhao To: josmyers@redhat.com, richard.guenther@gmail.com, siddhesh@gotplt.org, uecker@tugraz.at, jakub@redhat.com Cc: keescook@chromium.org, isanbard@gmail.com, gcc-patches@gcc.gnu.org, Qing Zhao Subject: [PATCH v5 4/4] Use the .ACCESS_WITH_SIZE in bound sanitizer. Date: Fri, 9 Feb 2024 15:54:11 +0000 Message-Id: <20240209155411.160245-5-qing.zhao@oracle.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20240209155411.160245-1-qing.zhao@oracle.com> References: <20240209155411.160245-1-qing.zhao@oracle.com> X-ClientProxiedBy: SA0PR11CA0065.namprd11.prod.outlook.com (2603:10b6:806:d2::10) To CH3PR10MB7957.namprd10.prod.outlook.com (2603:10b6:610:1bf::19) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: CH3PR10MB7957:EE_|DS0PR10MB7955:EE_ X-MS-Office365-Filtering-Correlation-Id: 35a3c827-996e-4ce0-ff44-08dc298764db X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: hxaCWgSWAdtfwno8hESzwLH0S+bMjvyTWF7XiXV2RWy5pnPaSWzvuvoB+dne1xF4DziIWl7BcYM21fcFO3YrizhjOgEXu6LvX0i553D/wme+GM9Ob8F+/iahGFDNZZ2slV8JoKFm7pNr/5Qmqb++VXEFp+ROY9D+glApXMT+3EzIXrO3K0St5B3vgAzjl+tFunqUo4hG9iNuBFlnKRJkUME4i7pALzYokrKrY4v6Ie8s/zppCgxtrcgRLf6mIVaFIjyGg9dtPdWbPesed+aI7DzGoH8/XVtvlgFZStTJ691+m8EGixCx6yJnl/dsyjgQyZUzqxWJQ7HICOYdWyjsbyCo1EZAKOQHPAoCXRhnEJUh9+CR6oUyS15r3awbkRAHHKbfME8OcniYTkZkc4H1NZWdEOm25vI256hK2sruYbPkFTWLlNk0wLl8SxN4W7xL/GmDWWhIoGWziNv853LVW+oTlJEFpwgiYkJD1YZoImJw/88GENyoTAHWHaLE2CAWv3Smpzc2XhOWTNtGSuuTbm3DObmSvUFhOkfqZ0xs07M= X-Forefront-Antispam-Report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:CH3PR10MB7957.namprd10.prod.outlook.com; PTR:; CAT:NONE; SFS:(13230031)(346002)(136003)(366004)(376002)(39860400002)(396003)(230922051799003)(1800799012)(64100799003)(451199024)(186009)(6506007)(6512007)(6666004)(41300700001)(84970400001)(2906002)(5660300002)(44832011)(8676002)(8936002)(4326008)(36756003)(86362001)(66556008)(316002)(66476007)(66946007)(6486002)(478600001)(83380400001)(38100700002)(26005)(107886003)(1076003)(2616005); DIR:OUT; SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: 48qJLFOuHDRIWL/7ahlOgeq3CkZ2ZZkSZoFvz5LmSbxiqAyHTsMW0g+CU6RorGZ4ark9NaBE4YBr0lQO9nqj4r7udC8WOg216qNYW/LQa6N9RnAuiMDC543ohox1oB0ZuFftcdOYqtNf4d4HiQ3K/NFa84bJJwPJ1p5zbGJBDGUjog2+s3XFjsVTANRqLf68DYdgklVGU8t6/PfgfOoowk6pD9WJkhf3PpDCxujzkjIXtjJPN52Pk5iwSXbFoND9jjwTUGL7n+zVL0bWrUdNIkzmSvqggUyjO50tR00KNYZ7kZlaLNp/OB2FsoNj65BVinHAe8Q6h9fjbpC6HS5HT0Vk/Dfu4TOjAOvRaPXNMOZ43ijbsMtxtIg6+SDCyfqNhJSQNHSzzQwoMowokustdy/BqPPhsWSnkdB2Ac7U65DEIXOHQyscEU1HqBJ/cwwUtmCvBFIHDOIcw5MSAduo1/lNfEfLVmqkRrhUAuNlHVLqylOjNCx0tYNeq1/js26uKSwBUC9Nepf2S3PV/v0kZplW8xfSYpkh5KdfuI+7yBQIDpvK80CAYTaMEoQ/O9NFd/c3InEPEeNzVc/rkuHJ/2i+xsY8d5GooJjPcbcZKtF8e527TUMFmy/0YqZ0WQnIFAz6Al/TByrYdc/ugtu/rC+NRpxN/1hDVh/mdhoUz+H0usRayydO3P0Wnn4AX4qNQBno6YWPPsriXHS26J4+iz9MXKfnb4XVB4orlSbZ6jxyX9jWxhPRcr7wnykrOQu48BWXjKJrLhgbO1pvRG8ssGnPUfVC8SNi1YMHMdji4TCkq67iuTFZwFWLG8yo694Dyhi+v7XEQoHaRTUJf8Y0d9VWLCMfuAh/IEr2ru6qRDn3Dgpggf0nzQlG97H6g2peog5GNZ7HBKX8D1ydGT55FS8+w+luy62UMLNp39CvJPtdSfCk9Qet3Rqw8IF7q5j/FvHXPMaL9jJEH25X6/764O0EBJLBfKxaH4kdbV7s0FjLvtDd/mckEMqNIcoldMiNIoJhvpXlUqx81JRyWwjeZ+7XRcYVUr3zlbDPEror/gGe4rnNVlvmfdq/tfFn+J9JtxMD/W2AEdg6SX6qXpDg2qde+dQIeBw7P4V9m+PtUJwHuLuJ41G7JbaKkL/AKz6Cbij0Gdy6XcsWOkdBa7j70v1P0T+7Nhz988J1GE2L+4vvmIxrR7m9OwFiIuYH1FHIN8KFWSQaPBlbMFpC3vG1MHpP1zeCXxpI5zPBanbVfJuK0qzpyfXxt0+A7t5k/w/N8M2TkwxGko7Gwp7hAKX+It2AE0Hy2hurMgfXzWDtWh2bVawZl+hfNFfviQodrlGz05FQoKpYD6j+hjcoLY7pZ/zXnuBYOSXHYyyq0Byki3vHMFT1zM8762ra3prlEQ5KPyssRAzW3Me2e3bWNe9nX8BLMBzcbSlu6MF2yRcRzdX3brxKmdBPc8O7bIsQ+WzEGonNwxTnGxscKPKQRbbTxPv+HnYErQ9o6kVEB/CG7qGJagr97mUp3T8pSUFYhDx9C7Os5DLNynD+Ohs2r2F/GSMgtSlh0NxBsEoHMKWgcBL8jZ0TTwwYNsfZkGZqHiIb X-MS-Exchange-AntiSpam-ExternalHop-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-ExternalHop-MessageData-0: 7uIqSf0n70/KhgqGNN0E9TysE23AuJNY7ggP3wh0/We6tSbmDn3vQaeL8eWYthb0ci66rrnLFAgYWk5yl6/pvpfh9NnzLaD5tm8IvZ4vS2qouBoIhqAHHgFDayD5MkZSwntSgfUkAN0fq97RAJqiXEcZ4w8KPVkKw1bKbEfd8cy5dpR4rqmOqs17he6zw89aY044J1qt1HdTBLNHn0EjJXSabIztw2Xzq4mfHBNbnQ83DkNu2Qsypg8dRgqx7CDQ5i9eUhbTV+XQH85/8wJxSelYnbp+QuyktDcoiI/mW9ca6nJfJvJg48rEgY2KlB+whmKahnTpzWe+/lmVeq3LLgatLoNPVfHAE13gTRxsT0Q5421+/yZr8mvRi0vUS7xvl66mdcgaZGqVNHaBhjNLbMEH1KRX3DmKk7MBqqr1eFJLNoGBNAZrKrZgw1iBJDAbRMLLE9uOayRBS2NVXMdRA4G2eiDmMNWw1ZYrhWFvgM85g6md5ARGqa2TlWX2TDBR76U8h1t9Hb5Pqf41OsdKCrscQNqbJp2oTIxrUbTGUm4ZVW842UVgDkYp/AswFQW8JtUJXcAndoBcBxP28LiQ96i50LidcQftSyYaJS6hWRg= X-OriginatorOrg: oracle.com X-MS-Exchange-CrossTenant-Network-Message-Id: 35a3c827-996e-4ce0-ff44-08dc298764db X-MS-Exchange-CrossTenant-AuthSource: CH3PR10MB7957.namprd10.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 09 Feb 2024 15:54:27.0561 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: EcnfS0PtBpkmaDNqf80qzZQTXTmSXQwjBJtUayw3MaiQ92ycwfjRmrTRaBQ3Wdajj+PoqkBeUzO2SGdZOEnAMw== X-MS-Exchange-Transport-CrossTenantHeadersStamped: DS0PR10MB7955 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.272,Aquarius:18.0.1011,Hydra:6.0.619,FMLib:17.11.176.26 definitions=2024-02-09_13,2024-02-08_01,2023-05-22_02 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 spamscore=0 suspectscore=0 mlxlogscore=911 bulkscore=0 mlxscore=0 adultscore=0 malwarescore=0 phishscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2311290000 definitions=main-2402090118 X-Proofpoint-GUID: K58qg52g5KonQ82ySMudYrZLH1KQ3U5A X-Proofpoint-ORIG-GUID: K58qg52g5KonQ82ySMudYrZLH1KQ3U5A X-Spam-Status: No, score=-10.3 required=5.0 tests=BAYES_00, DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, DKIM_VALID_EF, GIT_PATCH_0, RCVD_IN_MSPIKE_H5, RCVD_IN_MSPIKE_WL, SPF_HELO_NONE, SPF_NONE, TXREP, T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on server2.sourceware.org X-BeenThere: gcc-patches@gcc.gnu.org X-Mailman-Version: 2.1.30 Precedence: list List-Id: Gcc-patches mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: gcc-patches-bounces+incoming=patchwork.ozlabs.org@gcc.gnu.org gcc/c-family/ChangeLog: * c-ubsan.cc (get_bound_from_access_with_size): New function. (ubsan_instrument_bounds): Handle call to .ACCESS_WITH_SIZE. gcc/testsuite/ChangeLog: * gcc.dg/ubsan/flex-array-counted-by-bounds-2.c: New test. * gcc.dg/ubsan/flex-array-counted-by-bounds-3.c: New test. * gcc.dg/ubsan/flex-array-counted-by-bounds.c: New test. --- gcc/c-family/c-ubsan.cc | 42 +++++++++++++++++ .../ubsan/flex-array-counted-by-bounds-2.c | 45 ++++++++++++++++++ .../ubsan/flex-array-counted-by-bounds-3.c | 34 ++++++++++++++ .../ubsan/flex-array-counted-by-bounds.c | 46 +++++++++++++++++++ 4 files changed, 167 insertions(+) create mode 100644 gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds-2.c create mode 100644 gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds-3.c create mode 100644 gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds.c diff --git a/gcc/c-family/c-ubsan.cc b/gcc/c-family/c-ubsan.cc index 940982819ddf..164b29845b3a 100644 --- a/gcc/c-family/c-ubsan.cc +++ b/gcc/c-family/c-ubsan.cc @@ -376,6 +376,40 @@ ubsan_instrument_return (location_t loc) return build_call_expr_loc (loc, t, 1, build_fold_addr_expr_loc (loc, data)); } +/* Get the tree that represented the number of counted_by, i.e, the maximum + number of the elements of the object that the call to .ACCESS_WITH_SIZE + points to, this number will be the bound of the corresponding array. */ +static tree +get_bound_from_access_with_size (tree call) +{ + if (!is_access_with_size_p (call)) + return NULL_TREE; + + tree ref_to_size = CALL_EXPR_ARG (call, 1); + unsigned int type_of_size = TREE_INT_CST_LOW (CALL_EXPR_ARG (call, 2)); + tree type = TREE_TYPE (CALL_EXPR_ARG (call, 3)); + tree size = fold_build2 (MEM_REF, type, unshare_expr (ref_to_size), + build_int_cst (ptr_type_node, 0)); + /* If size is negative value, treat it as zero. */ + if (!TYPE_UNSIGNED (type)) + { + tree cond = fold_build2 (LT_EXPR, boolean_type_node, + unshare_expr (size), build_zero_cst (type)); + size = fold_build3 (COND_EXPR, type, cond, + build_zero_cst (type), size); + } + + /* Only when type_of_size is 1,i.e, the number of the elements of + the object type, return the size. */ + if (type_of_size != 1) + return NULL_TREE; + else + size = fold_convert (sizetype, size); + + return size; +} + + /* Instrument array bounds for ARRAY_REFs. We create special builtin, that gets expanded in the sanopt pass, and make an array dimension of it. ARRAY is the array, *INDEX is an index to the array. @@ -401,6 +435,14 @@ ubsan_instrument_bounds (location_t loc, tree array, tree *index, && COMPLETE_TYPE_P (type) && integer_zerop (TYPE_SIZE (type))) bound = build_int_cst (TREE_TYPE (TYPE_MIN_VALUE (domain)), -1); + else if (INDIRECT_REF_P (array) + && is_access_with_size_p ((TREE_OPERAND (array, 0)))) + { + bound = get_bound_from_access_with_size ((TREE_OPERAND (array, 0))); + bound = fold_build2 (MINUS_EXPR, TREE_TYPE (bound), + bound, + build_int_cst (TREE_TYPE (bound), 1)); + } else return NULL_TREE; } diff --git a/gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds-2.c b/gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds-2.c new file mode 100644 index 000000000000..148934975ee5 --- /dev/null +++ b/gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds-2.c @@ -0,0 +1,45 @@ +/* test the attribute counted_by and its usage in + bounds sanitizer combined with VLA. */ +/* { dg-do run } */ +/* { dg-options "-fsanitize=bounds" } */ +/* { dg-output "index 11 out of bounds for type 'int \\\[\\\*\\\]\\\[\\\*\\\]'\[^\n\r]*(\n|\r\n|\r)" } */ +/* { dg-output "\[^\n\r]*index 20 out of bounds for type 'int \\\[\\\*\\\]\\\[\\\*\\\]\\\[\\\*\\\]'\[^\n\r]*(\n|\r\n|\r)" } */ +/* { dg-output "\[^\n\r]*index 11 out of bounds for type 'int \\\[\\\*\\\]\\\[\\\*\\\]'\[^\n\r]*(\n|\r\n|\r)" } */ +/* { dg-output "\[^\n\r]*index 10 out of bounds for type 'int \\\[\\\*\\\]'\[^\n\r]*(\n|\r\n|\r)" } */ + + +#include + +void __attribute__((__noinline__)) setup_and_test_vla (int n, int m) +{ + struct foo { + int n; + int p[][n] __attribute__((counted_by(n))); + } *f; + + f = (struct foo *) malloc (sizeof(struct foo) + m*sizeof(int[n])); + f->n = m; + f->p[m][n-1]=1; + return; +} + +void __attribute__((__noinline__)) setup_and_test_vla_1 (int n1, int n2, int m) +{ + struct foo { + int n; + int p[][n2][n1] __attribute__((counted_by(n))); + } *f; + + f = (struct foo *) malloc (sizeof(struct foo) + m*sizeof(int[n2][n1])); + f->n = m; + f->p[m][n2][n1]=1; + return; +} + +int main(int argc, char *argv[]) +{ + setup_and_test_vla (10, 11); + setup_and_test_vla_1 (10, 11, 20); + return 0; +} + diff --git a/gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds-3.c b/gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds-3.c new file mode 100644 index 000000000000..33bdea1c430b --- /dev/null +++ b/gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds-3.c @@ -0,0 +1,34 @@ +/* test the attribute counted_by and its usage in bounds + sanitizer. when counted_by field is negative value. */ +/* { dg-do run } */ +/* { dg-options "-fsanitize=bounds" } */ + +#include + +struct annotated { + int b; + int c[] __attribute__ ((counted_by (b))); +} *array_annotated; + +void __attribute__((__noinline__)) setup (int annotated_count) +{ + array_annotated + = (struct annotated *)malloc (sizeof (struct annotated)); + array_annotated->b = annotated_count; + + return; +} + +void __attribute__((__noinline__)) test (int annotated_index) +{ + array_annotated->c[annotated_index] = 2; +} + +int main(int argc, char *argv[]) +{ + setup (-3); + test (2); + return 0; +} + +/* { dg-output "24:21: runtime error: index 2 out of bounds for type" } */ diff --git a/gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds.c b/gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds.c new file mode 100644 index 000000000000..81eaeb3f2681 --- /dev/null +++ b/gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds.c @@ -0,0 +1,46 @@ +/* test the attribute counted_by and its usage in + bounds sanitizer. */ +/* { dg-do run } */ +/* { dg-options "-fsanitize=bounds" } */ + +#include + +struct flex { + int b; + int c[]; +} *array_flex; + +struct annotated { + int b; + int c[] __attribute__ ((counted_by (b))); +} *array_annotated; + +void __attribute__((__noinline__)) setup (int normal_count, int annotated_count) +{ + array_flex + = (struct flex *)malloc (sizeof (struct flex) + + normal_count * sizeof (int)); + array_flex->b = normal_count; + + array_annotated + = (struct annotated *)malloc (sizeof (struct annotated) + + annotated_count * sizeof (int)); + array_annotated->b = annotated_count; + + return; +} + +void __attribute__((__noinline__)) test (int normal_index, int annotated_index) +{ + array_flex->c[normal_index] = 1; + array_annotated->c[annotated_index] = 2; +} + +int main(int argc, char *argv[]) +{ + setup (10, 10); + test (10, 10); + return 0; +} + +/* { dg-output "36:21: runtime error: index 10 out of bounds for type" } */