maxjhandsome
/
llvm-project
forked from OSchip/llvm-project
1
0
Fork 0
Code Issues Pull Requests Packages Releases Wiki Activity

[asan] Support line numbers in StackVarDescr 

When -fsanitize-address-use-after-scope is used, the instrumentation produces line numbers in stack frame descriptions. This patch make sure the ASan runtime supports this format (ParseFrameDescription needs to be able to parse "varname:line") and prepares lit tests to allow line numbers in ASan report output.

Differential Revision: https://reviews.llvm.org/D31484

llvm-svn: 299043
This commit is contained in:
Kuba Mracek 2017-03-30 00:41:09 +00:00
parent 51c1365501
commit 8ed2928d2c
32 changed files with 63 additions and 51 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
compiler-rt/lib/asan/asan_descriptions.cc
View File

@ -252,6 +252,9 @@ static void PrintAccessAndVarIntersection(const StackVarDescr &var, uptr addr,
str.append("%c", var.name_pos[i]);
}
str.append("'");
if (var.line > 0) {
str.append(" (line %d)", var.line);
}
if (pos_descr) {
Decorator d;
// FIXME: we may want to also print the size of the access here,

12
compiler-rt/lib/asan/asan_report.cc
View File

@ -88,7 +88,8 @@ bool ParseFrameDescription(const char *frame_descr,
char *p;
// This string is created by the compiler and has the following form:
// "n alloc_1 alloc_2 ... alloc_n"
// where alloc_i looks like "offset size len ObjectName".
// where alloc_i looks like "offset size len ObjectName"
// or "offset size len ObjectName:line".
uptr n_objects = (uptr)internal_simple_strtoll(frame_descr, &p, 10);
if (n_objects == 0)
return false;
@ -101,7 +102,14 @@ bool ParseFrameDescription(const char *frame_descr,
return false;
}
p++;
StackVarDescr var = {beg, size, p, len};
char *colon_pos = internal_strchr(p, ':');
uptr line = 0;
uptr name_len = len;
if (colon_pos != nullptr && colon_pos < p + len) {
name_len = colon_pos - p;
line = (uptr)internal_simple_strtoll(colon_pos + 1, nullptr, 10);
}
StackVarDescr var = {beg, size, p, name_len, line};
vars->push_back(var);
p += len;
}

1
compiler-rt/lib/asan/asan_report.h
View File

@ -23,6 +23,7 @@ struct StackVarDescr {
uptr size;
const char *name_pos;
uptr name_len;
uptr line;
};
// Returns the number of globals close to the provided address and copies

4
compiler-rt/test/asan/TestCases/Linux/memmem_test.cc
View File

@ -15,10 +15,10 @@ int main(int argc, char **argv) {
// A1: AddressSanitizer: stack-buffer-overflow
// A1: {{#0.*memmem}}
// A1-NEXT: {{#1.*main}}
// A1: 'a1' <== Memory access at offset
// A1: 'a1'{{.*}} <== Memory access at offset
//
// A2: AddressSanitizer: stack-buffer-overflow
// A2: {{#0.*memmem}}
// A2: 'a2' <== Memory access at offset
// A2: 'a2'{{.*}} <== Memory access at offset
return res == NULL;
}

4
compiler-rt/test/asan/TestCases/Posix/stack-use-after-return.cc
View File

@ -53,11 +53,11 @@ void Func2(char *x) {
// CHECK: WRITE of size 1 {{.*}} thread T0
// CHECK: #0{{.*}}Func2{{.*}}stack-use-after-return.cc:[[@LINE-2]]
// CHECK: is located in stack of thread T0 at offset
// CHECK: 'local' <== Memory access at offset {{16|32}} is inside this variable
// CHECK: 'local'{{.*}} <== Memory access at offset {{16|32}} is inside this variable
// THREAD: WRITE of size 1 {{.*}} thread T{{[1-9]}}
// THREAD: #0{{.*}}Func2{{.*}}stack-use-after-return.cc:[[@LINE-6]]
// THREAD: is located in stack of thread T{{[1-9]}} at offset
// THREAD: 'local' <== Memory access at offset {{16|32}} is inside this variable
// THREAD: 'local'{{.*}} <== Memory access at offset {{16|32}} is inside this variable
// CHECK-20: T0: FakeStack created:{{.*}} stack_size_log: 20
// CHECK-24: T0: FakeStack created:{{.*}} stack_size_log: 24
}

2
compiler-rt/test/asan/TestCases/Windows/dll_intercept_memchr.cc
View File

@ -22,6 +22,6 @@ int test_function() {
// CHECK-NEXT: test_function {{.*}}dll_intercept_memchr.cc:[[@LINE-5]]
// CHECK: Address [[ADDR]] is located in stack of thread T0 at offset {{.*}} in frame
// CHECK-NEXT: test_function {{.*}}dll_intercept_memchr.cc
// CHECK: 'buff' <== Memory access at offset {{.*}} overflows this variable
// CHECK: 'buff'{{.*}} <== Memory access at offset {{.*}} overflows this variable
return 0;
}

2
compiler-rt/test/asan/TestCases/Windows/dll_intercept_memcpy.cc
View File

@ -27,6 +27,6 @@ int test_function() {
// CHECK-NEXT: test_function {{.*}}dll_intercept_memcpy.cc:[[@LINE-4]]
// CHECK: Address [[ADDR]] is located in stack of thread T0 at offset {{.*}} in frame
// CHECK-NEXT: test_function {{.*}}dll_intercept_memcpy.cc
// CHECK: 'buff2' <== Memory access at offset {{.*}} overflows this variable
// CHECK: 'buff2'{{.*}} <== Memory access at offset {{.*}} overflows this variable
return 0;
}

2
compiler-rt/test/asan/TestCases/Windows/dll_intercept_memcpy_indirect.cc
View File

@ -29,6 +29,6 @@ int test_function() {
// CHECK-NEXT: test_function {{.*}}dll_intercept_memcpy_indirect.cc:[[@LINE-5]]
// CHECK: Address [[ADDR]] is located in stack of thread T0 at offset {{.*}} in frame
// CHECK-NEXT: test_function {{.*}}dll_intercept_memcpy_indirect.cc
// CHECK: 'buff2' <== Memory access at offset {{.*}} overflows this variable
// CHECK: 'buff2'{{.*}} <== Memory access at offset {{.*}} overflows this variable
return 0;
}

2
compiler-rt/test/asan/TestCases/Windows/dll_intercept_memset.cc
View File

@ -27,6 +27,6 @@ int test_function() {
// CHECK-NEXT: test_function {{.*}}dll_intercept_memset.cc:[[@LINE-4]]
// CHECK: Address [[ADDR]] is located in stack of thread T0 at offset {{.*}} in frame
// CHECK-NEXT: test_function {{.*}}dll_intercept_memset.cc
// CHECK: 'buff' <== Memory access at offset {{.*}} overflows this variable
// CHECK: 'buff'{{.*}} <== Memory access at offset {{.*}} overflows this variable
return 0;
}

2
compiler-rt/test/asan/TestCases/Windows/dll_noreturn.cc
View File

@ -17,7 +17,7 @@ void noreturn_f() {
//
// CHECK: Address [[ADDR]] is located in stack of thread T0 at offset [[OFFSET:.*]] in frame
// CHECK-NEXT: noreturn_f{{.*}}dll_noreturn.cc
// CHECK: 'buffer' <== Memory access at offset [[OFFSET]] underflows this variable
// CHECK: 'buffer'{{.*}} <== Memory access at offset [[OFFSET]] underflows this variable
// CHECK-LABEL: SUMMARY
}

2
compiler-rt/test/asan/TestCases/Windows/dll_poison_unpoison.cc
View File

@ -30,6 +30,6 @@ int test_function() {
//
// CHECK: [[ADDR]] is located in stack of thread T0 at offset [[OFFSET:.*]] in frame
// CHECK-NEXT: test_function{{.*}}\dll_poison_unpoison.cc
// CHECK: 'buffer' <== Memory access at offset [[OFFSET]] is inside this variable
// CHECK: 'buffer'{{.*}} <== Memory access at offset [[OFFSET]] is inside this variable
return 0;
}

2
compiler-rt/test/asan/TestCases/Windows/dll_stack_use_after_return.cc
View File

@ -22,7 +22,7 @@ int test_function() {
//
// CHECK: Address [[ADDR]] is located in stack of thread T0 at offset [[OFFSET:.*]] in frame
// CHECK-NEXT: #0 {{.*}} foo{{.*}}dll_stack_use_after_return.cc
// CHECK: 'stack_buffer' <== Memory access at offset [[OFFSET]] is inside this variable
// CHECK: 'stack_buffer'{{.*}} <== Memory access at offset [[OFFSET]] is inside this variable
return 0;
}

2
compiler-rt/test/asan/TestCases/Windows/dll_thread_stack_array_left_oob.cc
View File

@ -16,7 +16,7 @@ DWORD WINAPI thread_proc(void *context) {
// CHECK: Address [[ADDR]] is located in stack of thread T1 at offset [[OFFSET:.*]] in frame
// CHECK-NEXT: thread_proc{{.*}}dll_thread_stack_array_left_oob.cc
//
// CHECK: 'stack_buffer' <== Memory access at offset [[OFFSET]] underflows this variable
// CHECK: 'stack_buffer'{{.*}} <== Memory access at offset [[OFFSET]] underflows this variable
return 0;
}

2
compiler-rt/test/asan/TestCases/Windows/intercept_memcpy.cc
View File

@ -27,5 +27,5 @@ int main() {
// CHECK-NEXT: main {{.*}}intercept_memcpy.cc:[[@LINE-5]]
// CHECK: Address [[ADDR]] is located in stack of thread T0 at offset {{.*}} in frame
// CHECK-NEXT: #0 {{.*}} main
// CHECK: 'buff2' <== Memory access at offset {{.*}} overflows this variable
// CHECK: 'buff2'{{.*}} <== Memory access at offset {{.*}} overflows this variable
}

2
compiler-rt/test/asan/TestCases/Windows/intercept_strlen.cc
View File

@ -22,6 +22,6 @@ int main() {
// CHECK-NEXT: main {{.*}}intercept_strlen.cc:[[@LINE-5]]
// CHECK: Address [[ADDR]] is located in stack of thread T0 at offset {{.*}} in frame
// CHECK-NEXT: main {{.*}}intercept_strlen.cc
// CHECK: 'str' <== Memory access at offset {{.*}} overflows this variable
// CHECK: 'str'{{.*}} <== Memory access at offset {{.*}} overflows this variable
return len < 6;
}

2
compiler-rt/test/asan/TestCases/Windows/stack_array_left_oob.cc
View File

@ -12,5 +12,5 @@ int main() {
// CHECK-NEXT: {{#0 .* main .*stack_array_left_oob.cc}}:[[@LINE-3]]
// CHECK: Address [[ADDR]] is located in stack of thread T0 at offset [[OFFSET:.*]] in frame
// CHECK-NEXT: {{#0 .* main .*stack_array_left_oob.cc}}
// CHECK: 'buffer' <== Memory access at offset [[OFFSET]] underflows this variable
// CHECK: 'buffer'{{.*}} <== Memory access at offset [[OFFSET]] underflows this variable
}

2
compiler-rt/test/asan/TestCases/Windows/stack_array_right_oob.cc
View File

@ -12,5 +12,5 @@ int main() {
// CHECK-NEXT: {{#0 .* main .*stack_array_right_oob.cc}}:[[@LINE-3]]
// CHECK: Address [[ADDR]] is located in stack of thread T0 at offset [[OFFSET:.*]] in frame
// CHECK-NEXT: {{#0 .* main .*stack_array_right_oob.cc}}
// CHECK: 'buffer' <== Memory access at offset [[OFFSET]] overflows this variable
// CHECK: 'buffer'{{.*}} <== Memory access at offset [[OFFSET]] overflows this variable
}

2
compiler-rt/test/asan/TestCases/Windows/stack_use_after_return.cc
View File

@ -18,5 +18,5 @@ int main() {
// CHECK: is located in stack of thread T0 at offset [[OFFSET:.*]] in frame
// CHECK-NEXT: {{#0 0x.* in foo.*stack_use_after_return.cc}}
//
// CHECK: 'stack_buffer' <== Memory access at offset [[OFFSET]] is inside this variable
// CHECK: 'stack_buffer'{{.*}} <== Memory access at offset [[OFFSET]] is inside this variable
}

2
compiler-rt/test/asan/TestCases/Windows/wrong_downcast_on_stack.cc
View File

@ -20,7 +20,7 @@ int main(void) {
// CHECK-NEXT: {{#0 0x[0-9a-f]* in main .*wrong_downcast_on_stack.cc}}:[[@LINE-3]]
// CHECK: [[ADDR]] is located in stack of thread T0 at offset [[OFFSET:[0-9]+]] in frame
// CHECK-NEXT: {{#0 0x[0-9a-f]* in main }}
// CHECK: 'p' <== Memory access at offset [[OFFSET]] overflows this variable
// CHECK: 'p'{{.*}} <== Memory access at offset [[OFFSET]] overflows this variable
return 0;
}

24
compiler-rt/test/asan/TestCases/stack-buffer-overflow-with-position.cc
View File

@ -30,15 +30,15 @@ int main(int argc, char **argv) {
// make sure BBB and CCC are not removed;
return *(short*)(p) + BBB[argc % 2] + CCC[argc % 2];
}
// CHECK-m2: 'AAA' <== {{.*}}underflows this variable
// CHECK-m1: 'AAA' <== {{.*}}partially underflows this variable
// CHECK-9: 'AAA' <== {{.*}}partially overflows this variable
// CHECK-10: 'AAA' <== {{.*}}overflows this variable
// CHECK-30: 'BBB' <== {{.*}}underflows this variable
// CHECK-31: 'BBB' <== {{.*}}partially underflows this variable
// CHECK-41: 'BBB' <== {{.*}}partially overflows this variable
// CHECK-42: 'BBB' <== {{.*}}overflows this variable
// CHECK-62: 'CCC' <== {{.*}}underflows this variable
// CHECK-63: 'CCC' <== {{.*}}partially underflows this variable
// CHECK-73: 'CCC' <== {{.*}}partially overflows this variable
// CHECK-74: 'CCC' <== {{.*}}overflows this variable
// CHECK-m2: 'AAA'{{.*}} <== {{.*}}underflows this variable
// CHECK-m1: 'AAA'{{.*}} <== {{.*}}partially underflows this variable
// CHECK-9: 'AAA'{{.*}} <== {{.*}}partially overflows this variable
// CHECK-10: 'AAA'{{.*}} <== {{.*}}overflows this variable
// CHECK-30: 'BBB'{{.*}} <== {{.*}}underflows this variable
// CHECK-31: 'BBB'{{.*}} <== {{.*}}partially underflows this variable
// CHECK-41: 'BBB'{{.*}} <== {{.*}}partially overflows this variable
// CHECK-42: 'BBB'{{.*}} <== {{.*}}overflows this variable
// CHECK-62: 'CCC'{{.*}} <== {{.*}}underflows this variable
// CHECK-63: 'CCC'{{.*}} <== {{.*}}partially underflows this variable
// CHECK-73: 'CCC'{{.*}} <== {{.*}}partially overflows this variable
// CHECK-74: 'CCC'{{.*}} <== {{.*}}overflows this variable

2
compiler-rt/test/asan/TestCases/strcasestr-1.c
View File

@ -19,7 +19,7 @@ int main(int argc, char **argv) {
char s1[4] = "abC";
__asan_poison_memory_region ((char *)&s1[2], 2);
r = strcasestr(s1, s2);
// CHECK:'s1' <== Memory access at offset {{[0-9]+}} partially overflows this variable
// CHECK:'s1'{{.*}} <== Memory access at offset {{[0-9]+}} partially overflows this variable
assert(r == s1 + 2);
return 0;
}

2
compiler-rt/test/asan/TestCases/strcasestr-2.c
View File

@ -20,6 +20,6 @@ int main(int argc, char **argv) {
__asan_poison_memory_region ((char *)&s2[2], 2);
r = strcasestr(s1, s2);
assert(r == 0);
// CHECK:'s2' <== Memory access at offset {{[0-9]+}} partially overflows this variable
// CHECK:'s2'{{.*}} <== Memory access at offset {{[0-9]+}} partially overflows this variable
return 0;
}

2
compiler-rt/test/asan/TestCases/strcspn-1.c
View File

@ -14,7 +14,7 @@ int main(int argc, char **argv) {
char s1[4] = "caB";
__asan_poison_memory_region ((char *)&s1[2], 2);
r = strcspn(s1, s2);
// CHECK:'s1' <== Memory access at offset {{[0-9]+}} partially overflows this variable
// CHECK:'s1'{{.*}} <== Memory access at offset {{[0-9]+}} partially overflows this variable
assert(r == 1);
return 0;
}

2
compiler-rt/test/asan/TestCases/strcspn-2.c
View File

@ -14,7 +14,7 @@ int main(int argc, char **argv) {
char s2[4] = "abc";
__asan_poison_memory_region ((char *)&s2[2], 2);
r = strcspn(s1, s2);
// CHECK:'s2' <== Memory access at offset {{[0-9]+}} partially overflows this variable
// CHECK:'s2'{{.*}} <== Memory access at offset {{[0-9]+}} partially overflows this variable
assert(r == 0);
return 0;
}

2
compiler-rt/test/asan/TestCases/strpbrk-1.c
View File

@ -14,7 +14,7 @@ int main(int argc, char **argv) {
char s1[4] = "cab";
__asan_poison_memory_region ((char *)&s1[2], 2);
r = strpbrk(s1, s2);
// CHECK:'s1' <== Memory access at offset {{[0-9]+}} partially overflows this variable
// CHECK:'s1'{{.*}} <== Memory access at offset {{[0-9]+}} partially overflows this variable
assert(r == s1 + 1);
return 0;
}

2
compiler-rt/test/asan/TestCases/strpbrk-2.c
View File

@ -14,7 +14,7 @@ int main(int argc, char **argv) {
char s2[4] = "bca";
__asan_poison_memory_region ((char *)&s2[2], 2);
r = strpbrk(s1, s2);
// CHECK:'s2' <== Memory access at offset {{[0-9]+}} partially overflows this variable
// CHECK:'s2'{{.*}} <== Memory access at offset {{[0-9]+}} partially overflows this variable
assert(r == s1);
return 0;
}

2
compiler-rt/test/asan/TestCases/strspn-1.c
View File

@ -14,7 +14,7 @@ int main(int argc, char **argv) {
char s1[4] = "acb";
__asan_poison_memory_region ((char *)&s1[2], 2);
r = strspn(s1, s2);
// CHECK:'s1' <== Memory access at offset {{[0-9]+}} partially overflows this variable
// CHECK:'s1'{{.*}} <== Memory access at offset {{[0-9]+}} partially overflows this variable
assert(r == 1);
return 0;
}

2
compiler-rt/test/asan/TestCases/strspn-2.c
View File

@ -14,7 +14,7 @@ int main(int argc, char **argv) {
char s2[5] = "abcd";
__asan_poison_memory_region ((char *)&s2[3], 2);
r = strspn(s1, s2);
// CHECK:'s2' <== Memory access at offset {{[0-9]+}} partially overflows this variable
// CHECK:'s2'{{.*}} <== Memory access at offset {{[0-9]+}} partially overflows this variable
assert(r >= 2);
return 0;
}

2
compiler-rt/test/asan/TestCases/strstr-1.c
View File

@ -15,7 +15,7 @@ int main(int argc, char **argv) {
char s1[4] = "acb";
__asan_poison_memory_region ((char *)&s1[2], 2);
r = strstr(s1, s2);
// CHECK:'s1' <== Memory access at offset {{[0-9]+}} {{partially overflows this variable|is inside this variable}}
// CHECK:'s1'{{.*}} <== Memory access at offset {{[0-9]+}} {{partially overflows this variable|is inside this variable}}
assert(r == s1 + 1);
return 0;
}

2
compiler-rt/test/asan/TestCases/strstr-2.c
View File

@ -15,7 +15,7 @@ int main(int argc, char **argv) {
char s2[4] = "cab";
__asan_poison_memory_region ((char *)&s2[2], 2);
r = strstr(s1, s2);
// CHECK:'s2' <== Memory access at offset {{[0-9]+}} partially overflows this variable
// CHECK:'s2'{{.*}} <== Memory access at offset {{[0-9]+}} partially overflows this variable
assert(r == 0);
return 0;
}

10
compiler-rt/test/asan/TestCases/strtok.c
View File

@ -35,7 +35,7 @@ void test1() {
char token_delimiter[2] = "b";
__asan_poison_memory_region ((char *)&token_delimiter[1], 2);
token = strtok(s, token_delimiter);
// CHECK1:'token_delimiter' <== Memory access at offset {{[0-9]+}} partially overflows this variable
// CHECK1: 'token_delimiter'{{.*}} <== Memory access at offset {{[0-9]+}} partially overflows this variable
}
// Check that we find overflows in the delimiters on the second call (str == NULL)
@ -48,7 +48,7 @@ void test2() {
assert(strcmp(token, "a") == 0);
__asan_poison_memory_region ((char *)&token_delimiter[1], 2);
token = strtok(NULL, token_delimiter);
// CHECK2:'token_delimiter' <== Memory access at offset {{[0-9]+}} partially overflows this variable
// CHECK2: 'token_delimiter'{{.*}} <== Memory access at offset {{[0-9]+}} partially overflows this variable
}
// Check that we find overflows in the string (only on the first call) with strict_string_checks.
@ -58,7 +58,7 @@ void test3() {
char token_delimiter[2] = "b";
__asan_poison_memory_region ((char *)&s[3], 2);
token = strtok(s, token_delimiter);
// CHECK3:'s' <== Memory access at offset {{[0-9]+}} partially overflows this variable
// CHECK3: 's'{{.*}} <== Memory access at offset {{[0-9]+}} partially overflows this variable
}
// Check that we do not crash when strtok returns NULL with strict_string_checks.
@ -78,7 +78,7 @@ void test5() {
__asan_poison_memory_region ((char *)&s[2], 2);
__asan_poison_memory_region ((char *)&token_delimiter[1], 2);
token = strtok(s, token_delimiter);
// CHECK5:'s' <== Memory access at offset {{[0-9]+}} partially overflows this variable
// CHECK5: 's'{{.*}} <== Memory access at offset {{[0-9]+}} partially overflows this variable
}
// Check that we find overflows in the delimiters (only on the first call) with !strict_string_checks.
@ -88,7 +88,7 @@ void test6() {
char token_delimiter[1] = {'d'};
__asan_poison_memory_region ((char *)&token_delimiter[1], 2);
token = strtok(s, &token_delimiter[1]);
// CHECK6:'token_delimiter' <== Memory access at offset {{[0-9]+}} overflows this variable
// CHECK6: 'token_delimiter'{{.*}} <== Memory access at offset {{[0-9]+}} overflows this variable
}
int main(int argc, char **argv) {

8
compiler-rt/test/asan/TestCases/use-after-scope-inlined.cc
View File

@ -21,8 +21,8 @@ int main(int argc, char *argv[]) {
// CHECK: READ of size 4 at 0x{{.*}} thread T0
// CHECK: #0 0x{{.*}} in main
// CHECK: {{.*}}use-after-scope-inlined.cc:[[@LINE-4]]
// CHECK: Address 0x{{.*}} is located in stack of thread T0 at offset
// CHECK: [[OFFSET:[^ ]*]] in frame
// CHECK: main
// CHECK: {{\[}}[[OFFSET]], {{.*}}) 'x.i:[[@LINE-15]]'
// CHECK: Address 0x{{.*}} is located in stack of thread T0 at offset [[OFFSET:[^ ]*]] in frame
// CHECK: {{.*}} in main
// CHECK: This frame has
// CHECK: {{\[}}[[OFFSET]], {{.*}}) 'x.i' (line [[@LINE-15]])
}