1 //===-- ubsan_handlers_cxx.cc ---------------------------------------------===//
2 //
3 // The LLVM Compiler Infrastructure
4 //
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
7 //
8 //===----------------------------------------------------------------------===//
9 //
10 // Error logging entry points for the UBSan runtime, which are only used for C++
11 // compilations. This file is permitted to use language features which require
12 // linking against a C++ ABI library.
13 //
14 //===----------------------------------------------------------------------===//
15
16 #include "ubsan_platform.h"
17 #if CAN_SANITIZE_UB
18 #include "ubsan_handlers_cxx.h"
19 #include "ubsan_diag.h"
20 #include "ubsan_type_hash.h"
21
22 #include "sanitizer_common/sanitizer_common.h"
23 #include "sanitizer_common/sanitizer_suppressions.h"
24
25 using namespace __sanitizer;
26 using namespace __ubsan;
27
28 namespace __ubsan {
29 extern const char *TypeCheckKinds[];
30 }
31
32 // Returns true if UBSan has printed an error report.
HandleDynamicTypeCacheMiss(DynamicTypeCacheMissData * Data,ValueHandle Pointer,ValueHandle Hash,ReportOptions Opts)33 static bool HandleDynamicTypeCacheMiss(
34 DynamicTypeCacheMissData *Data, ValueHandle Pointer, ValueHandle Hash,
35 ReportOptions Opts) {
36 if (checkDynamicType((void*)Pointer, Data->TypeInfo, Hash))
37 // Just a cache miss. The type matches after all.
38 return false;
39
40 // Check if error report should be suppressed.
41 DynamicTypeInfo DTI = getDynamicTypeInfoFromObject((void*)Pointer);
42 if (DTI.isValid() && IsVptrCheckSuppressed(DTI.getMostDerivedTypeName()))
43 return false;
44
45 SourceLocation Loc = Data->Loc.acquire();
46 ErrorType ET = ErrorType::DynamicTypeMismatch;
47 if (ignoreReport(Loc, Opts, ET))
48 return false;
49
50 ScopedReport R(Opts, Loc, ET);
51
52 Diag(Loc, DL_Error,
53 "%0 address %1 which does not point to an object of type %2")
54 << TypeCheckKinds[Data->TypeCheckKind] << (void*)Pointer << Data->Type;
55
56 // If possible, say what type it actually points to.
57 if (!DTI.isValid())
58 Diag(Pointer, DL_Note, "object has invalid vptr")
59 << TypeName(DTI.getMostDerivedTypeName())
60 << Range(Pointer, Pointer + sizeof(uptr), "invalid vptr");
61 else if (!DTI.getOffset())
62 Diag(Pointer, DL_Note, "object is of type %0")
63 << TypeName(DTI.getMostDerivedTypeName())
64 << Range(Pointer, Pointer + sizeof(uptr), "vptr for %0");
65 else
66 // FIXME: Find the type at the specified offset, and include that
67 // in the note.
68 Diag(Pointer - DTI.getOffset(), DL_Note,
69 "object is base class subobject at offset %0 within object of type %1")
70 << DTI.getOffset() << TypeName(DTI.getMostDerivedTypeName())
71 << TypeName(DTI.getSubobjectTypeName())
72 << Range(Pointer, Pointer + sizeof(uptr),
73 "vptr for %2 base class of %1");
74 return true;
75 }
76
__ubsan_handle_dynamic_type_cache_miss(DynamicTypeCacheMissData * Data,ValueHandle Pointer,ValueHandle Hash)77 void __ubsan::__ubsan_handle_dynamic_type_cache_miss(
78 DynamicTypeCacheMissData *Data, ValueHandle Pointer, ValueHandle Hash) {
79 GET_REPORT_OPTIONS(false);
80 HandleDynamicTypeCacheMiss(Data, Pointer, Hash, Opts);
81 }
__ubsan_handle_dynamic_type_cache_miss_abort(DynamicTypeCacheMissData * Data,ValueHandle Pointer,ValueHandle Hash)82 void __ubsan::__ubsan_handle_dynamic_type_cache_miss_abort(
83 DynamicTypeCacheMissData *Data, ValueHandle Pointer, ValueHandle Hash) {
84 // Note: -fsanitize=vptr is always recoverable.
85 GET_REPORT_OPTIONS(false);
86 if (HandleDynamicTypeCacheMiss(Data, Pointer, Hash, Opts))
87 Die();
88 }
89
HandleCFIBadType(CFIBadTypeData * Data,ValueHandle Vtable,ReportOptions Opts)90 static void HandleCFIBadType(CFIBadTypeData *Data, ValueHandle Vtable,
91 ReportOptions Opts) {
92 SourceLocation Loc = Data->Loc.acquire();
93 ErrorType ET = ErrorType::CFIBadType;
94
95 if (ignoreReport(Loc, Opts, ET))
96 return;
97
98 ScopedReport R(Opts, Loc, ET);
99 DynamicTypeInfo DTI = getDynamicTypeInfoFromVtable((void*)Vtable);
100
101 static const char *TypeCheckKinds[] = {
102 "virtual call",
103 "non-virtual call",
104 "base-to-derived cast",
105 "cast to unrelated type",
106 };
107
108 Diag(Loc, DL_Error, "control flow integrity check for type %0 failed during "
109 "%1 (vtable address %2)")
110 << Data->Type << TypeCheckKinds[Data->TypeCheckKind] << (void *)Vtable;
111
112 // If possible, say what type it actually points to.
113 if (!DTI.isValid())
114 Diag(Vtable, DL_Note, "invalid vtable");
115 else
116 Diag(Vtable, DL_Note, "vtable is of type %0")
117 << TypeName(DTI.getMostDerivedTypeName());
118 }
119
__ubsan_handle_cfi_bad_type(CFIBadTypeData * Data,ValueHandle Vtable)120 void __ubsan::__ubsan_handle_cfi_bad_type(CFIBadTypeData *Data,
121 ValueHandle Vtable) {
122 GET_REPORT_OPTIONS(false);
123 HandleCFIBadType(Data, Vtable, Opts);
124 }
125
__ubsan_handle_cfi_bad_type_abort(CFIBadTypeData * Data,ValueHandle Vtable)126 void __ubsan::__ubsan_handle_cfi_bad_type_abort(CFIBadTypeData *Data,
127 ValueHandle Vtable) {
128 GET_REPORT_OPTIONS(true);
129 HandleCFIBadType(Data, Vtable, Opts);
130 Die();
131 }
132
133 #endif // CAN_SANITIZE_UB
134