1 // RUN: %clangxx -frtti -fsanitize=vptr -fno-sanitize-recover=vptr -g %s -O3 -o %t 2 // RUN: not %run %t 2>&1 | FileCheck %s --check-prefix=CHECK-CORRUPTED-VTABLE --strict-whitespace 3 4 // UNSUPPORTED: win32 5 // REQUIRES: stable-runtime, cxxabi 6 #include <cstddef> 7 8 #include <typeinfo> 9 10 struct S { 11 S() {} 12 ~S() {} 13 virtual int v() { return 0; } 14 }; 15 16 // See the proper definition in ubsan_type_hash_itanium.cc 17 struct VtablePrefix { 18 signed long Offset; 19 std::type_info *TypeInfo; 20 }; 21 22 int main(int argc, char **argv) { 23 // Test that we don't crash on corrupted vtable when 24 // offset is too large or too small. 25 S Obj; 26 void *Ptr = &Obj; 27 VtablePrefix* RealPrefix = reinterpret_cast<VtablePrefix*>( 28 *reinterpret_cast<void**>(Ptr)) - 1; 29 30 VtablePrefix Prefix[2]; 31 Prefix[0].Offset = 1<<21; // Greater than VptrMaxOffset 32 Prefix[0].TypeInfo = RealPrefix->TypeInfo; 33 34 // Hack Vtable ptr for Obj. 35 *reinterpret_cast<void**>(Ptr) = static_cast<void*>(&Prefix[1]); 36 37 // CHECK-CORRUPTED-VTABLE: vptr-corrupted-vtable-itanium.cpp:[[@LINE+3]]:16: runtime error: member call on address [[PTR:0x[0-9a-f]*]] which does not point to an object of type 'S' 38 // CHECK-CORRUPTED-VTABLE-NEXT: [[PTR]]: note: object has a possibly invalid vptr: abs(offset to top) too big 39 S* Ptr2 = reinterpret_cast<S*>(Ptr); 40 return Ptr2->v(); 41 } 42
