1 // RUN: %clang_cc1 -x c -triple x86_64-apple-darwin10 -w -emit-llvm -o - %s -fsanitize=pointer-overflow | FileCheck %s --check-prefixes=CHECK,CHECK-C
2 // RUN: %clang_cc1 -x c++ -triple x86_64-apple-darwin10 -w -emit-llvm -o - %s -fsanitize=pointer-overflow | FileCheck %s --check-prefixes=CHECK,CHECK-CPP
3
4 #ifdef __cplusplus
5 extern "C" {
6 #endif
7
8 // CHECK-LABEL: define void @fixed_len_array
fixed_len_array(int k)9 void fixed_len_array(int k) {
10 // CHECK: getelementptr inbounds [10 x [10 x i32]], [10 x [10 x i32]]* [[ARR:%.*]], i64 0, i64 [[IDXPROM:%.*]]
11 // CHECK-NEXT: [[SMUL:%.*]] = call { i64, i1 } @llvm.smul.with.overflow.i64(i64 40, i64 [[IDXPROM]]), !nosanitize
12 // CHECK-NEXT: [[SMULOFLOW:%.*]] = extractvalue { i64, i1 } [[SMUL]], 1, !nosanitize
13 // CHECK-NEXT: [[SMULVAL:%.*]] = extractvalue { i64, i1 } [[SMUL]], 0, !nosanitize
14 // CHECK-NEXT: [[BASE:%.*]] = ptrtoint [10 x [10 x i32]]* [[ARR]] to i64, !nosanitize
15 // CHECK-NEXT: [[COMPGEP:%.*]] = add i64 [[BASE]], [[SMULVAL]], !nosanitize
16 // CHECK: call void @__ubsan_handle_pointer_overflow{{.*}}, i64 [[BASE]], i64 [[COMPGEP]]){{.*}}, !nosanitize
17
18 // CHECK: getelementptr inbounds [10 x i32], [10 x i32]* {{.*}}, i64 0, i64 [[IDXPROM1:%.*]]
19 // CHECK-NEXT: @llvm.smul.with.overflow.i64(i64 4, i64 [[IDXPROM1]]), !nosanitize
20 // CHECK: call void @__ubsan_handle_pointer_overflow{{.*}}
21
22 int arr[10][10];
23 arr[k][k];
24 }
25
26 // CHECK-LABEL: define void @variable_len_array
variable_len_array(int n,int k)27 void variable_len_array(int n, int k) {
28 // CHECK: getelementptr inbounds i32, i32* {{.*}}, i64 [[IDXPROM:%.*]]
29 // CHECK-NEXT: @llvm.smul.with.overflow.i64(i64 4, i64 [[IDXPROM]]), !nosanitize
30 // CHECK: call void @__ubsan_handle_pointer_overflow{{.*}}
31
32 // CHECK: getelementptr inbounds i32, i32* {{.*}}, i64 [[IDXPROM1:%.*]]
33 // CHECK-NEXT: @llvm.smul.with.overflow.i64(i64 4, i64 [[IDXPROM1]]), !nosanitize
34 // CHECK: call void @__ubsan_handle_pointer_overflow{{.*}}
35
36 int arr[n][n];
37 arr[k][k];
38 }
39
40 // CHECK-LABEL: define void @pointer_array
pointer_array(int ** arr,int k)41 void pointer_array(int **arr, int k) {
42 // CHECK: @llvm.smul.with.overflow.i64(i64 8, i64 {{.*}}), !nosanitize
43 // CHECK: call void @__ubsan_handle_pointer_overflow{{.*}}
44
45 // CHECK: @llvm.smul.with.overflow.i64(i64 4, i64 {{.*}}), !nosanitize
46 // CHECK: call void @__ubsan_handle_pointer_overflow{{.*}}
47
48 arr[k][k];
49 }
50
51 // CHECK-LABEL: define void @pointer_array_unsigned_indices
pointer_array_unsigned_indices(int ** arr,unsigned k)52 void pointer_array_unsigned_indices(int **arr, unsigned k) {
53 // CHECK: icmp uge
54 // CHECK-NOT: select
55 // CHECK: call void @__ubsan_handle_pointer_overflow{{.*}}
56 // CHECK: icmp uge
57 // CHECK-NOT: select
58 // CHECK: call void @__ubsan_handle_pointer_overflow{{.*}}
59 arr[k][k];
60 }
61
62 // CHECK-LABEL: define void @pointer_array_mixed_indices
pointer_array_mixed_indices(int ** arr,int i,unsigned j)63 void pointer_array_mixed_indices(int **arr, int i, unsigned j) {
64 // CHECK: select
65 // CHECK: call void @__ubsan_handle_pointer_overflow{{.*}}
66 // CHECK-NOT: select
67 // CHECK: call void @__ubsan_handle_pointer_overflow{{.*}}
68 arr[i][j];
69 }
70
71 struct S1 {
72 int pad1;
73 union {
74 char leaf;
75 struct S1 *link;
76 } u;
77 struct S1 *arr;
78 };
79
80 // TODO: Currently, structure GEPs are not checked, so there are several
81 // potentially unsafe GEPs here which we don't instrument.
82 //
83 // CHECK-LABEL: define void @struct_index
struct_index(struct S1 * p)84 void struct_index(struct S1 *p) {
85 // CHECK: getelementptr inbounds %struct.S1, %struct.S1* [[P:%.*]], i64 10
86 // CHECK-NEXT: [[BASE:%.*]] = ptrtoint %struct.S1* [[P]] to i64, !nosanitize
87 // CHECK-NEXT: [[COMPGEP:%.*]] = add i64 [[BASE]], 240, !nosanitize
88 // CHECK: select
89 // CHECK: @__ubsan_handle_pointer_overflow{{.*}} i64 [[BASE]], i64 [[COMPGEP]]) {{.*}}, !nosanitize
90
91 // CHECK-NOT: @__ubsan_handle_pointer_overflow
92
93 p->arr[10].u.link->u.leaf;
94 }
95
96 typedef void (*funcptr_t)(void);
97
98 // CHECK-LABEL: define void @function_pointer_arith
function_pointer_arith(funcptr_t * p,int k)99 void function_pointer_arith(funcptr_t *p, int k) {
100 // CHECK: add i64 {{.*}}, 8, !nosanitize
101 // CHECK-NOT: select
102 // CHECK: @__ubsan_handle_pointer_overflow{{.*}}
103 ++p;
104
105 // CHECK: @llvm.smul.with.overflow.i64(i64 8, i64 {{.*}}), !nosanitize
106 // CHECK: select
107 // CHECK: call void @__ubsan_handle_pointer_overflow{{.*}}
108 p + k;
109 }
110
111 // CHECK-LABEL: define void @dont_emit_checks_for_no_op_GEPs
112 // CHECK-C: __ubsan_handle_pointer_overflow
113 // CHECK-CPP-NOT: __ubsan_handle_pointer_overflow
dont_emit_checks_for_no_op_GEPs(char * p)114 void dont_emit_checks_for_no_op_GEPs(char *p) {
115 &p[0];
116
117 int arr[10][10];
118 &arr[0][0];
119 }
120
121 #ifdef __cplusplus
122 }
123 #endif
124