1 // Test how we produce the scariness score.
2
3 // UAR Mode: runtime
4 // RUN: %clangxx_asan -O0 %s -o %t
5 // On OSX and Windows, alloc_dealloc_mismatch=1 isn't 100% reliable, so it's
6 // off by default. It's safe for these tests, though, so we turn it on.
7 // RUN: export %env_asan_opts=detect_stack_use_after_return=1:handle_abort=1:print_scariness=1:alloc_dealloc_mismatch=1
8 // Make sure the stack is limited (may not be the default under GNU make)
9 // RUN: ulimit -s 4096
10 // RUN: not %run %t 1 2>&1 | FileCheck %s --check-prefix=CHECK1
11 // RUN: not %run %t 2 2>&1 | FileCheck %s --check-prefix=CHECK2
12 // RUN: not %run %t 3 2>&1 | FileCheck %s --check-prefix=CHECK3
13 // RUN: not %run %t 4 2>&1 | FileCheck %s --check-prefix=CHECK4
14 // RUN: not %run %t 5 2>&1 | FileCheck %s --check-prefix=CHECK5
15 // RUN: not %run %t 6 2>&1 | FileCheck %s --check-prefix=CHECK6
16 // RUN: not %run %t 7 2>&1 | FileCheck %s --check-prefix=CHECK7
17 // RUN: not %run %t 8 2>&1 | FileCheck %s --check-prefix=CHECK8
18 // RUN: not %run %t 9 2>&1 | FileCheck %s --check-prefix=CHECK9
19 // RUN: not %run %t 10 2>&1 | FileCheck %s --check-prefix=CHECK10
20 // RUN: not %run %t 11 2>&1 | FileCheck %s --check-prefix=CHECK11
21 // RUN: not %run %t 12 2>&1 | FileCheck %s --check-prefix=CHECK12
22 // RUN: not %run %t 13 2>&1 | FileCheck %s --check-prefix=CHECK13
23 // RUN: not %run %t 14 2>&1 | FileCheck %s --check-prefix=CHECK14
24 // RUN: not %run %t 15 2>&1 | FileCheck %s --check-prefix=CHECK15
25 // RUN: not %run %t 16 2>&1 | FileCheck %s --check-prefix=CHECK16
26 // RUN: not %run %t 17 2>&1 | FileCheck %s --check-prefix=CHECK17
27 // RUN: not %run %t 18 2>&1 | FileCheck %s --check-prefix=CHECK18
28 // RUN: not %run %t 19 2>&1 | FileCheck %s --check-prefix=CHECK19
29 // RUN: not %run %t 20 2>&1 | FileCheck %s --check-prefix=CHECK20
30 // RUN: not %run %t 21 2>&1 | FileCheck %s --check-prefix=CHECK21
31 // RUN: not %run %t 22 2>&1 | FileCheck %s --check-prefix=CHECK22
32 // RUN: not %run %t 23 2>&1 | FileCheck %s --check-prefix=CHECK23
33 // RUN: not %run %t 24 2>&1 | FileCheck %s --check-prefix=CHECK24
34 // RUN: not %run %t 25 2>&1 | FileCheck %s --check-prefix=CHECK25
35 // RUN: not %run %t 26 2>&1 | FileCheck %s --check-prefix=CHECK26
36 // RUN: not %run %t 27 2>&1 | FileCheck %s --check-prefix=CHECK27
37 //
38 // UAR Mode: always
39 // RUN: %clangxx_asan -O0 %s -o %t -fsanitize-address-use-after-return=always
40 // On OSX and Windows, alloc_dealloc_mismatch=1 isn't 100% reliable, so it's
41 // off by default. It's safe for these tests, though, so we turn it on.
42 // RUN: export %env_asan_opts=handle_abort=1:print_scariness=1:alloc_dealloc_mismatch=1
43 // Make sure the stack is limited (may not be the default under GNU make)
44 // RUN: ulimit -s 4096
45 // RUN: not %run %t 1 2>&1 | FileCheck %s --check-prefix=CHECK1
46 // RUN: not %run %t 2 2>&1 | FileCheck %s --check-prefix=CHECK2
47 // RUN: not %run %t 3 2>&1 | FileCheck %s --check-prefix=CHECK3
48 // RUN: not %run %t 4 2>&1 | FileCheck %s --check-prefix=CHECK4
49 // RUN: not %run %t 5 2>&1 | FileCheck %s --check-prefix=CHECK5
50 // RUN: not %run %t 6 2>&1 | FileCheck %s --check-prefix=CHECK6
51 // RUN: not %run %t 7 2>&1 | FileCheck %s --check-prefix=CHECK7
52 // RUN: not %run %t 8 2>&1 | FileCheck %s --check-prefix=CHECK8
53 // RUN: not %run %t 9 2>&1 | FileCheck %s --check-prefix=CHECK9
54 // RUN: not %run %t 10 2>&1 | FileCheck %s --check-prefix=CHECK10
55 // RUN: not %run %t 11 2>&1 | FileCheck %s --check-prefix=CHECK11
56 // RUN: not %run %t 12 2>&1 | FileCheck %s --check-prefix=CHECK12
57 // RUN: not %run %t 13 2>&1 | FileCheck %s --check-prefix=CHECK13
58 // RUN: not %run %t 14 2>&1 | FileCheck %s --check-prefix=CHECK14
59 // RUN: not %run %t 15 2>&1 | FileCheck %s --check-prefix=CHECK15
60 // RUN: not %run %t 16 2>&1 | FileCheck %s --check-prefix=CHECK16
61 // RUN: not %run %t 17 2>&1 | FileCheck %s --check-prefix=CHECK17
62 // RUN: not %run %t 18 2>&1 | FileCheck %s --check-prefix=CHECK18
63 // RUN: not %run %t 19 2>&1 | FileCheck %s --check-prefix=CHECK19
64 // RUN: not %run %t 20 2>&1 | FileCheck %s --check-prefix=CHECK20
65 // RUN: not %run %t 21 2>&1 | FileCheck %s --check-prefix=CHECK21
66 // RUN: not %run %t 22 2>&1 | FileCheck %s --check-prefix=CHECK22
67 // RUN: not %run %t 23 2>&1 | FileCheck %s --check-prefix=CHECK23
68 // RUN: not %run %t 24 2>&1 | FileCheck %s --check-prefix=CHECK24
69 // RUN: not %run %t 25 2>&1 | FileCheck %s --check-prefix=CHECK25
70 // RUN: not %run %t 26 2>&1 | FileCheck %s --check-prefix=CHECK26
71 // RUN: not %run %t 27 2>&1 | FileCheck %s --check-prefix=CHECK27
72 // Parts of the test are too platform-specific:
73 // REQUIRES: x86_64-target-arch
74 // REQUIRES: shell
75 #include <stdlib.h>
76 #include <stdio.h>
77 #include <string.h>
78 #include <algorithm>
79
80 #include <sanitizer/asan_interface.h>
81
82 enum ReadOrWrite { Read = 0, Write = 1 };
83
84 struct S32 {
85 char x[32];
86 };
87
88 template<class T>
HeapBuferOverflow(int Idx,ReadOrWrite w)89 void HeapBuferOverflow(int Idx, ReadOrWrite w) {
90 T *t = new T[100];
91 static T sink;
92 if (w)
93 t[100 + Idx] = T();
94 else
95 sink = t[100 + Idx];
96 delete [] t;
97 }
98
99 template<class T>
HeapUseAfterFree(int Idx,ReadOrWrite w)100 void HeapUseAfterFree(int Idx, ReadOrWrite w) {
101 T *t = new T[100];
102 static T sink;
103 sink = t[0];
104 delete [] t;
105 if (w)
106 t[Idx] = T();
107 else
108 sink = t[Idx];
109 }
110
111 template<class T>
StackBufferOverflow(int Idx,ReadOrWrite w)112 void StackBufferOverflow(int Idx, ReadOrWrite w) {
113 T t[100];
114 static T sink;
115 sink = t[Idx];
116 if (w)
117 t[100 + Idx] = T();
118 else
119 sink = t[100 + Idx];
120 }
121
122 template<class T>
LeakStack()123 T *LeakStack() {
124 T t[100];
125 static volatile T *x;
126 x = &t[0];
127 return (T*)x;
128 }
129
130 template<class T>
StackUseAfterReturn(int Idx,ReadOrWrite w)131 void StackUseAfterReturn(int Idx, ReadOrWrite w) {
132 static T sink;
133 T *t = LeakStack<T>();
134 if (w)
135 t[100 + Idx] = T();
136 else
137 sink = t[100 + Idx];
138 }
139
140 char g1[100];
141 short g2[100];
142 int g4[100];
143 int64_t g8[100];
144 S32 gm[100];
145
DoubleFree()146 void DoubleFree() {
147 int *x = new int;
148 static volatile int two = 2;
149 for (int i = 0; i < two; i++)
150 delete x;
151 }
152
StackOverflow(int Idx)153 void StackOverflow(int Idx) {
154 int some_stack[256];
155 static volatile int *x;
156 x = &some_stack[0];
157 if (Idx > 0)
158 StackOverflow(Idx - 1);
159 }
160
UseAfterPoison()161 void UseAfterPoison() {
162 int buf[100];
163 __asan_poison_memory_region(buf, sizeof(buf));
164 static volatile int sink;
165 sink = buf[42];
166 }
167
main(int argc,char ** argv)168 int main(int argc, char **argv) {
169 size_t scale;
170 size_t offset;
171 __asan_get_shadow_mapping(&scale, &offset);
172 size_t grain = 1 << scale;
173
174 char arr[100];
175 static volatile int zero = 0;
176 static volatile int *zero_ptr = 0;
177 static volatile int *wild_addr = (int*)0x10000000; // System-dependent.
178 if (argc != 2) return 1;
179 int kind = atoi(argv[1]);
180 switch (kind) {
181 case 1: HeapBuferOverflow<char>(0, Read); break;
182 case 2: HeapBuferOverflow<int>(0, Read); break;
183 case 3: HeapBuferOverflow<short>(0, Write); break;
184 case 4: HeapBuferOverflow<int64_t>(
185 2 * std::max(1, (int)(grain / sizeof(int64_t))), Write); break;
186 case 5: HeapBuferOverflow<S32>(4, Write); break;
187 case 6: HeapUseAfterFree<char>(0, Read); break;
188 case 7: HeapUseAfterFree<int>(0, Write); break;
189 case 8: HeapUseAfterFree<int64_t>(0, Read); break;
190 case 9: HeapUseAfterFree<S32>(0, Write); break;
191 case 10: StackBufferOverflow<char>(0, Write); break;
192 case 11: StackBufferOverflow<int64_t>(0, Read); break;
193 case 12:
194 if (scale <= 3) {
195 StackBufferOverflow<int>(16, Write);
196 } else {
197 // At large shadow granularity, there is not enough redzone
198 // between stack elements to detect far-from-bounds. Pretend
199 // that this test passes.
200 fprintf(stderr, "SCARINESS: 61 "
201 "(4-byte-write-stack-buffer-overflow-far-from-bounds)\n");
202 return 1;
203 }
204 break;
205 case 13: StackUseAfterReturn<char>(0, Read); break;
206 case 14: StackUseAfterReturn<S32>(0, Write); break;
207 case 15: g1[zero + 100] = 0; break;
208 case 16: gm[0] = gm[zero + 100 + 1]; break;
209 case 17: DoubleFree(); break;
210 case 18: StackOverflow(1000000); break;
211 case 19: *zero_ptr = 0; break;
212 case 20: *wild_addr = 0; break;
213 case 21: zero = *wild_addr; break;
214 case 22: ((void (*)(void))wild_addr)(); break;
215 case 23: delete (new int[10]); break;
216 case 24: free((char*)malloc(100) + 10); break;
217 case 25: memcpy(arr, arr+10, 20); break;
218 case 26: UseAfterPoison(); break;
219 case 27: abort();
220 // CHECK1: SCARINESS: 12 (1-byte-read-heap-buffer-overflow)
221 // CHECK2: SCARINESS: 17 (4-byte-read-heap-buffer-overflow)
222 // CHECK3: SCARINESS: 33 (2-byte-write-heap-buffer-overflow)
223 // CHECK4: SCARINESS: 52 (8-byte-write-heap-buffer-overflow-far-from-bounds)
224 // CHECK5: SCARINESS: 55 (multi-byte-write-heap-buffer-overflow-far-from-bounds)
225 // CHECK6: SCARINESS: 40 (1-byte-read-heap-use-after-free)
226 // CHECK7: SCARINESS: 46 (4-byte-write-heap-use-after-free)
227 // CHECK8: SCARINESS: 51 (8-byte-read-heap-use-after-free)
228 // CHECK9: SCARINESS: 55 (multi-byte-write-heap-use-after-free)
229 // CHECK10: SCARINESS: 46 (1-byte-write-stack-buffer-overflow)
230 // CHECK11: SCARINESS: 38 (8-byte-read-stack-buffer-overflow)
231 // CHECK12: SCARINESS: 61 (4-byte-write-stack-buffer-overflow-far-from-bounds)
232 // CHECK13: SCARINESS: 50 (1-byte-read-stack-use-after-return)
233 // CHECK14: SCARINESS: 65 (multi-byte-write-stack-use-after-return)
234 // CHECK15: SCARINESS: 31 (1-byte-write-global-buffer-overflow)
235 // CHECK16: SCARINESS: 36 (multi-byte-read-global-buffer-overflow-far-from-bounds)
236 // CHECK17: SCARINESS: 42 (double-free)
237 // CHECK18: SCARINESS: 10 (stack-overflow)
238 // CHECK19: SCARINESS: 10 (null-deref)
239 // CHECK20: SCARINESS: 30 (wild-addr-write)
240 // CHECK21: SCARINESS: 20 (wild-addr-read)
241 // CHECK22: SCARINESS: 60 (wild-jump)
242 // CHECK23: SCARINESS: 10 (alloc-dealloc-mismatch)
243 // CHECK24: SCARINESS: 40 (bad-free)
244 // CHECK25: SCARINESS: 10 (memcpy-param-overlap)
245 // CHECK26: SCARINESS: 27 (4-byte-read-use-after-poison)
246 // CHECK27: SCARINESS: 10 (signal)
247 }
248 }
249