1 //===-- ubsan_handlers_cxx.cc ---------------------------------------------===// 2 // 3 // The LLVM Compiler Infrastructure 4 // 5 // This file is distributed under the University of Illinois Open Source 6 // License. See LICENSE.TXT for details. 7 // 8 //===----------------------------------------------------------------------===// 9 // 10 // Error logging entry points for the UBSan runtime, which are only used for C++ 11 // compilations. This file is permitted to use language features which require 12 // linking against a C++ ABI library. 13 // 14 //===----------------------------------------------------------------------===// 15 16 #include "ubsan_platform.h" 17 #if CAN_SANITIZE_UB 18 #include "ubsan_handlers_cxx.h" 19 #include "ubsan_diag.h" 20 #include "ubsan_type_hash.h" 21 22 #include "sanitizer_common/sanitizer_common.h" 23 #include "sanitizer_common/sanitizer_suppressions.h" 24 25 using namespace __sanitizer; 26 using namespace __ubsan; 27 28 namespace __ubsan { 29 extern const char *TypeCheckKinds[]; 30 } 31 32 // Returns true if UBSan has printed an error report. 33 static bool HandleDynamicTypeCacheMiss( 34 DynamicTypeCacheMissData *Data, ValueHandle Pointer, ValueHandle Hash, 35 ReportOptions Opts) { 36 if (checkDynamicType((void*)Pointer, Data->TypeInfo, Hash)) 37 // Just a cache miss. The type matches after all. 38 return false; 39 40 // Check if error report should be suppressed. 41 DynamicTypeInfo DTI = getDynamicTypeInfoFromObject((void*)Pointer); 42 if (DTI.isValid() && IsVptrCheckSuppressed(DTI.getMostDerivedTypeName())) 43 return false; 44 45 SourceLocation Loc = Data->Loc.acquire(); 46 ErrorType ET = ErrorType::DynamicTypeMismatch; 47 if (ignoreReport(Loc, Opts, ET)) 48 return false; 49 50 ScopedReport R(Opts, Loc, ET); 51 52 Diag(Loc, DL_Error, 53 "%0 address %1 which does not point to an object of type %2") 54 << TypeCheckKinds[Data->TypeCheckKind] << (void*)Pointer << Data->Type; 55 56 // If possible, say what type it actually points to. 57 if (!DTI.isValid()) 58 Diag(Pointer, DL_Note, "object has invalid vptr") 59 << TypeName(DTI.getMostDerivedTypeName()) 60 << Range(Pointer, Pointer + sizeof(uptr), "invalid vptr"); 61 else if (!DTI.getOffset()) 62 Diag(Pointer, DL_Note, "object is of type %0") 63 << TypeName(DTI.getMostDerivedTypeName()) 64 << Range(Pointer, Pointer + sizeof(uptr), "vptr for %0"); 65 else 66 // FIXME: Find the type at the specified offset, and include that 67 // in the note. 68 Diag(Pointer - DTI.getOffset(), DL_Note, 69 "object is base class subobject at offset %0 within object of type %1") 70 << DTI.getOffset() << TypeName(DTI.getMostDerivedTypeName()) 71 << TypeName(DTI.getSubobjectTypeName()) 72 << Range(Pointer, Pointer + sizeof(uptr), 73 "vptr for %2 base class of %1"); 74 return true; 75 } 76 77 void __ubsan::__ubsan_handle_dynamic_type_cache_miss( 78 DynamicTypeCacheMissData *Data, ValueHandle Pointer, ValueHandle Hash) { 79 GET_REPORT_OPTIONS(false); 80 HandleDynamicTypeCacheMiss(Data, Pointer, Hash, Opts); 81 } 82 void __ubsan::__ubsan_handle_dynamic_type_cache_miss_abort( 83 DynamicTypeCacheMissData *Data, ValueHandle Pointer, ValueHandle Hash) { 84 // Note: -fsanitize=vptr is always recoverable. 85 GET_REPORT_OPTIONS(false); 86 if (HandleDynamicTypeCacheMiss(Data, Pointer, Hash, Opts)) 87 Die(); 88 } 89 90 static void HandleCFIBadType(CFIBadTypeData *Data, ValueHandle Vtable, 91 ReportOptions Opts) { 92 SourceLocation Loc = Data->Loc.acquire(); 93 ErrorType ET = ErrorType::CFIBadType; 94 95 if (ignoreReport(Loc, Opts, ET)) 96 return; 97 98 ScopedReport R(Opts, Loc, ET); 99 DynamicTypeInfo DTI = getDynamicTypeInfoFromVtable((void*)Vtable); 100 101 static const char *TypeCheckKinds[] = { 102 "virtual call", 103 "non-virtual call", 104 "base-to-derived cast", 105 "cast to unrelated type", 106 }; 107 108 Diag(Loc, DL_Error, "control flow integrity check for type %0 failed during " 109 "%1 (vtable address %2)") 110 << Data->Type << TypeCheckKinds[Data->TypeCheckKind] << (void *)Vtable; 111 112 // If possible, say what type it actually points to. 113 if (!DTI.isValid()) 114 Diag(Vtable, DL_Note, "invalid vtable"); 115 else 116 Diag(Vtable, DL_Note, "vtable is of type %0") 117 << TypeName(DTI.getMostDerivedTypeName()); 118 } 119 120 void __ubsan::__ubsan_handle_cfi_bad_type(CFIBadTypeData *Data, 121 ValueHandle Vtable) { 122 GET_REPORT_OPTIONS(false); 123 HandleCFIBadType(Data, Vtable, Opts); 124 } 125 126 void __ubsan::__ubsan_handle_cfi_bad_type_abort(CFIBadTypeData *Data, 127 ValueHandle Vtable) { 128 GET_REPORT_OPTIONS(true); 129 HandleCFIBadType(Data, Vtable, Opts); 130 Die(); 131 } 132 133 #endif // CAN_SANITIZE_UB 134