1 // RUN: %clang_hwasan %s -o %t
2 // RUN: not %run %t 40 2>&1 | FileCheck %s --check-prefix=CHECK40
3 // RUN: not %run %t 80 2>&1 | FileCheck %s --check-prefix=CHECK80
4 // RUN: not %run %t -30 2>&1 | FileCheck %s --check-prefix=CHECKm30
5 // RUN: not %run %t -30 1000000 2>&1 | FileCheck %s --check-prefix=CHECKMm30
6 // RUN: not %run %t 1000000 1000000 2>&1 | FileCheck %s --check-prefix=CHECKM
7
8 // Test OOB within the granule.
9 // RUN: not %run %t 31 2>&1 | FileCheck %s --check-prefix=CHECK31
10 // RUN: not %run %t 30 20 2>&1 | FileCheck %s --check-prefix=CHECK20
11
12 // REQUIRES: stable-runtime
13
14 #include <stdlib.h>
15 #include <stdio.h>
16 #include <sanitizer/hwasan_interface.h>
17
18 #include "utils.h"
19
20 static volatile char sink;
21
main(int argc,char ** argv)22 int main(int argc, char **argv) {
23 __hwasan_enable_allocator_tagging();
24 int offset = argc < 2 ? 40 : atoi(argv[1]);
25 int size = argc < 3 ? 30 : atoi(argv[2]);
26 char * volatile x = (char*)malloc(size);
27 untag_fprintf(stderr, "base: %p access: %p\n", x, &x[offset]);
28 sink = x[offset];
29
30 // CHECK40: allocated heap chunk; size: 32 offset: 8
31 // CHECK40: is located 10 bytes to the right of 30-byte region
32 //
33 // CHECK80: allocated heap chunk; size: 32 offset: 16
34 // CHECK80: is located 50 bytes to the right of 30-byte region
35 //
36 // CHECKm30: is located 30 bytes to the left of 30-byte region
37 //
38 // CHECKMm30: is a large allocated heap chunk; size: 1003520 offset: -30
39 // CHECKMm30: is located 30 bytes to the left of 1000000-byte region
40 //
41 // CHECKM: is a large allocated heap chunk; size: 1003520 offset: 1000000
42 // CHECKM: is located 0 bytes to the right of 1000000-byte region
43 //
44 // CHECK31: tags: [[TAG:..]]/0e (ptr/mem)
45 // CHECK31: is located 1 bytes to the right of 30-byte region
46 // CHECK31: Memory tags around the buggy address
47 // CHECK31: [0e]
48 // CHECK31: Tags for short granules around the buggy address
49 // CHECK31: {{\[}}[[TAG]]]
50 //
51 // CHECK20: is located 10 bytes to the right of 20-byte region [0x{{.*}}0,0x{{.*}}4)
52 free(x);
53 }
54