1 //===-- asan_mem_test.cc --------------------------------------------------===//
2 //
3 // The LLVM Compiler Infrastructure
4 //
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
7 //
8 //===----------------------------------------------------------------------===//
9 //
10 // This file is a part of AddressSanitizer, an address sanity checker.
11 //
12 //===----------------------------------------------------------------------===//
13 #include "asan_test_utils.h"
14
15 template<typename T>
MemSetOOBTestTemplate(size_t length)16 void MemSetOOBTestTemplate(size_t length) {
17 if (length == 0) return;
18 size_t size = Ident(sizeof(T) * length);
19 T *array = Ident((T*)malloc(size));
20 int element = Ident(42);
21 int zero = Ident(0);
22 void *(*MEMSET)(void *s, int c, size_t n) = Ident(memset);
23 // memset interval inside array
24 MEMSET(array, element, size);
25 MEMSET(array, element, size - 1);
26 MEMSET(array + length - 1, element, sizeof(T));
27 MEMSET(array, element, 1);
28
29 // memset 0 bytes
30 MEMSET(array - 10, element, zero);
31 MEMSET(array - 1, element, zero);
32 MEMSET(array, element, zero);
33 MEMSET(array + length, 0, zero);
34 MEMSET(array + length + 1, 0, zero);
35
36 // try to memset bytes to the right of array
37 EXPECT_DEATH(MEMSET(array, 0, size + 1),
38 RightOOBWriteMessage(0));
39 EXPECT_DEATH(MEMSET((char*)(array + length) - 1, element, 6),
40 RightOOBWriteMessage(0));
41 EXPECT_DEATH(MEMSET(array + 1, element, size + sizeof(T)),
42 RightOOBWriteMessage(0));
43 // whole interval is to the right
44 EXPECT_DEATH(MEMSET(array + length + 1, 0, 10),
45 RightOOBWriteMessage(sizeof(T)));
46
47 // try to memset bytes to the left of array
48 EXPECT_DEATH(MEMSET((char*)array - 1, element, size),
49 LeftOOBWriteMessage(1));
50 EXPECT_DEATH(MEMSET((char*)array - 5, 0, 6),
51 LeftOOBWriteMessage(5));
52 if (length >= 100) {
53 // Large OOB, we find it only if the redzone is large enough.
54 EXPECT_DEATH(memset(array - 5, element, size + 5 * sizeof(T)),
55 LeftOOBWriteMessage(5 * sizeof(T)));
56 }
57 // whole interval is to the left
58 EXPECT_DEATH(MEMSET(array - 2, 0, sizeof(T)),
59 LeftOOBWriteMessage(2 * sizeof(T)));
60
61 // try to memset bytes both to the left & to the right
62 EXPECT_DEATH(MEMSET((char*)array - 2, element, size + 4),
63 LeftOOBWriteMessage(2));
64
65 free(array);
66 }
67
TEST(AddressSanitizer,MemSetOOBTest)68 TEST(AddressSanitizer, MemSetOOBTest) {
69 MemSetOOBTestTemplate<char>(100);
70 MemSetOOBTestTemplate<int>(5);
71 MemSetOOBTestTemplate<double>(256);
72 // We can test arrays of structres/classes here, but what for?
73 }
74
75 // Try to allocate two arrays of 'size' bytes that are near each other.
76 // Strictly speaking we are not guaranteed to find such two pointers,
77 // but given the structure of asan's allocator we will.
AllocateTwoAdjacentArrays(char ** x1,char ** x2,size_t size)78 static bool AllocateTwoAdjacentArrays(char **x1, char **x2, size_t size) {
79 vector<uintptr_t> v;
80 bool res = false;
81 for (size_t i = 0; i < 1000U && !res; i++) {
82 v.push_back(reinterpret_cast<uintptr_t>(new char[size]));
83 if (i == 0) continue;
84 sort(v.begin(), v.end());
85 for (size_t j = 1; j < v.size(); j++) {
86 assert(v[j] > v[j-1]);
87 if ((size_t)(v[j] - v[j-1]) < size * 2) {
88 *x2 = reinterpret_cast<char*>(v[j]);
89 *x1 = reinterpret_cast<char*>(v[j-1]);
90 res = true;
91 break;
92 }
93 }
94 }
95
96 for (size_t i = 0; i < v.size(); i++) {
97 char *p = reinterpret_cast<char *>(v[i]);
98 if (res && p == *x1) continue;
99 if (res && p == *x2) continue;
100 delete [] p;
101 }
102 return res;
103 }
104
TEST(AddressSanitizer,LargeOOBInMemset)105 TEST(AddressSanitizer, LargeOOBInMemset) {
106 for (size_t size = 200; size < 100000; size += size / 2) {
107 char *x1, *x2;
108 if (!Ident(AllocateTwoAdjacentArrays)(&x1, &x2, size))
109 continue;
110 // fprintf(stderr, " large oob memset: %p %p %zd\n", x1, x2, size);
111 // Do a memset on x1 with huge out-of-bound access that will end up in x2.
112 EXPECT_DEATH(Ident(memset)(x1, 0, size * 2),
113 "is located 0 bytes to the right");
114 delete [] x1;
115 delete [] x2;
116 return;
117 }
118 assert(0 && "Did not find two adjacent malloc-ed pointers");
119 }
120
121 // Same test for memcpy and memmove functions
122 template <typename T, class M>
MemTransferOOBTestTemplate(size_t length)123 void MemTransferOOBTestTemplate(size_t length) {
124 if (length == 0) return;
125 size_t size = Ident(sizeof(T) * length);
126 T *src = Ident((T*)malloc(size));
127 T *dest = Ident((T*)malloc(size));
128 int zero = Ident(0);
129
130 // valid transfer of bytes between arrays
131 M::transfer(dest, src, size);
132 M::transfer(dest + 1, src, size - sizeof(T));
133 M::transfer(dest, src + length - 1, sizeof(T));
134 M::transfer(dest, src, 1);
135
136 // transfer zero bytes
137 M::transfer(dest - 1, src, 0);
138 M::transfer(dest + length, src, zero);
139 M::transfer(dest, src - 1, zero);
140 M::transfer(dest, src, zero);
141
142 // try to change mem to the right of dest
143 EXPECT_DEATH(M::transfer(dest + 1, src, size),
144 RightOOBWriteMessage(0));
145 EXPECT_DEATH(M::transfer((char*)(dest + length) - 1, src, 5),
146 RightOOBWriteMessage(0));
147
148 // try to change mem to the left of dest
149 EXPECT_DEATH(M::transfer(dest - 2, src, size),
150 LeftOOBWriteMessage(2 * sizeof(T)));
151 EXPECT_DEATH(M::transfer((char*)dest - 3, src, 4),
152 LeftOOBWriteMessage(3));
153
154 // try to access mem to the right of src
155 EXPECT_DEATH(M::transfer(dest, src + 2, size),
156 RightOOBReadMessage(0));
157 EXPECT_DEATH(M::transfer(dest, (char*)(src + length) - 3, 6),
158 RightOOBReadMessage(0));
159
160 // try to access mem to the left of src
161 EXPECT_DEATH(M::transfer(dest, src - 1, size),
162 LeftOOBReadMessage(sizeof(T)));
163 EXPECT_DEATH(M::transfer(dest, (char*)src - 6, 7),
164 LeftOOBReadMessage(6));
165
166 // Generally we don't need to test cases where both accessing src and writing
167 // to dest address to poisoned memory.
168
169 T *big_src = Ident((T*)malloc(size * 2));
170 T *big_dest = Ident((T*)malloc(size * 2));
171 // try to change mem to both sides of dest
172 EXPECT_DEATH(M::transfer(dest - 1, big_src, size * 2),
173 LeftOOBWriteMessage(sizeof(T)));
174 // try to access mem to both sides of src
175 EXPECT_DEATH(M::transfer(big_dest, src - 2, size * 2),
176 LeftOOBReadMessage(2 * sizeof(T)));
177
178 free(src);
179 free(dest);
180 free(big_src);
181 free(big_dest);
182 }
183
184 class MemCpyWrapper {
185 public:
transfer(void * to,const void * from,size_t size)186 static void* transfer(void *to, const void *from, size_t size) {
187 return Ident(memcpy)(to, from, size);
188 }
189 };
190
TEST(AddressSanitizer,MemCpyOOBTest)191 TEST(AddressSanitizer, MemCpyOOBTest) {
192 MemTransferOOBTestTemplate<char, MemCpyWrapper>(100);
193 MemTransferOOBTestTemplate<int, MemCpyWrapper>(1024);
194 }
195
196 class MemMoveWrapper {
197 public:
transfer(void * to,const void * from,size_t size)198 static void* transfer(void *to, const void *from, size_t size) {
199 return Ident(memmove)(to, from, size);
200 }
201 };
202
TEST(AddressSanitizer,MemMoveOOBTest)203 TEST(AddressSanitizer, MemMoveOOBTest) {
204 MemTransferOOBTestTemplate<char, MemMoveWrapper>(100);
205 MemTransferOOBTestTemplate<int, MemMoveWrapper>(1024);
206 }
207
208
TEST(AddressSanitizer,MemCmpOOBTest)209 TEST(AddressSanitizer, MemCmpOOBTest) {
210 size_t size = Ident(100);
211 char *s1 = MallocAndMemsetString(size);
212 char *s2 = MallocAndMemsetString(size);
213 // Normal memcmp calls.
214 Ident(memcmp(s1, s2, size));
215 Ident(memcmp(s1 + size - 1, s2 + size - 1, 1));
216 Ident(memcmp(s1 - 1, s2 - 1, 0));
217 // One of arguments points to not allocated memory.
218 EXPECT_DEATH(Ident(memcmp)(s1 - 1, s2, 1), LeftOOBReadMessage(1));
219 EXPECT_DEATH(Ident(memcmp)(s1, s2 - 1, 1), LeftOOBReadMessage(1));
220 EXPECT_DEATH(Ident(memcmp)(s1 + size, s2, 1), RightOOBReadMessage(0));
221 EXPECT_DEATH(Ident(memcmp)(s1, s2 + size, 1), RightOOBReadMessage(0));
222 // Hit unallocated memory and die.
223 EXPECT_DEATH(Ident(memcmp)(s1 + 1, s2 + 1, size), RightOOBReadMessage(0));
224 EXPECT_DEATH(Ident(memcmp)(s1 + size - 1, s2, 2), RightOOBReadMessage(0));
225 // Zero bytes are not terminators and don't prevent from OOB.
226 s1[size - 1] = '\0';
227 s2[size - 1] = '\0';
228 EXPECT_DEATH(Ident(memcmp)(s1, s2, size + 1), RightOOBReadMessage(0));
229
230 // Even if the buffers differ in the first byte, we still assume that
231 // memcmp may access the whole buffer and thus reporting the overflow here:
232 s1[0] = 1;
233 s2[0] = 123;
234 EXPECT_DEATH(Ident(memcmp)(s1, s2, size + 1), RightOOBReadMessage(0));
235
236 free(s1);
237 free(s2);
238 }
239
240
241
242