1 // REQUIRES: gwp_asan 2 // RUN: %clangxx_gwp_asan %s -o %t -DTEST_MALLOC 3 // RUN: %expect_crash %run %t 2>&1 | FileCheck %s --check-prefix CHECK-MALLOC 4 5 // Check both C++98 and C. 6 // RUN: %clangxx_gwp_asan -std=c++98 %s -o %t -DTEST_FREE 7 // RUN: %expect_crash %run %t 2>&1 | FileCheck %s --check-prefix CHECK-FREE 8 // RUN: cp %s %t.c && %clang_gwp_asan %t.c -o %t -DTEST_FREE 9 // RUN: %expect_crash %run %t 2>&1 | FileCheck %s --check-prefix CHECK-FREE 10 11 // Ensure GWP-ASan stub implementation of realloc() in Scudo works to-spec. In 12 // particular, the behaviour regarding realloc of size zero is interesting, as 13 // it's defined as free(). 14 15 #include <stdlib.h> 16 17 int main() { 18 #if defined(TEST_MALLOC) 19 // realloc(nullptr, size) is equivalent to malloc(size). 20 char *Ptr = reinterpret_cast<char *>(realloc(nullptr, 1)); 21 *Ptr = 0; 22 // Trigger an INVALID_FREE to the right. 23 free(Ptr + 1); 24 25 // CHECK-MALLOC: GWP-ASan detected a memory error 26 // CHECK-MALLOC: Invalid (Wild) Free at 0x{{[a-f0-9]+}} (1 byte to the right 27 // CHECK-MALLOC-SAME: of a 1-byte allocation 28 #elif defined(TEST_FREE) 29 char *Ptr = (char *) malloc(1); 30 // realloc(ptr, 0) is equivalent to free(ptr) and must return nullptr. Note 31 // that this is only the specification in C++98 and C. 32 if (realloc(Ptr, 0) != NULL) { 33 34 } 35 // Trigger a USE_AFTER_FREE. 36 *Ptr = 0; 37 38 // CHECK-FREE: GWP-ASan detected a memory error 39 // CHECK-FREE: Use After Free at 0x{{[a-f0-9]+}} (0 bytes into a 1-byte 40 // CHECK-FREE-SAME: allocation 41 #endif 42 43 return 0; 44 } 45