1 //===-- asan_mem_test.cc --------------------------------------------------===// 2 // 3 // The LLVM Compiler Infrastructure 4 // 5 // This file is distributed under the University of Illinois Open Source 6 // License. See LICENSE.TXT for details. 7 // 8 //===----------------------------------------------------------------------===// 9 // 10 // This file is a part of AddressSanitizer, an address sanity checker. 11 // 12 //===----------------------------------------------------------------------===// 13 #include "asan_test_utils.h" 14 15 template<typename T> 16 void MemSetOOBTestTemplate(size_t length) { 17 if (length == 0) return; 18 size_t size = Ident(sizeof(T) * length); 19 T *array = Ident((T*)malloc(size)); 20 int element = Ident(42); 21 int zero = Ident(0); 22 void *(*MEMSET)(void *s, int c, size_t n) = Ident(memset); 23 // memset interval inside array 24 MEMSET(array, element, size); 25 MEMSET(array, element, size - 1); 26 MEMSET(array + length - 1, element, sizeof(T)); 27 MEMSET(array, element, 1); 28 29 // memset 0 bytes 30 MEMSET(array - 10, element, zero); 31 MEMSET(array - 1, element, zero); 32 MEMSET(array, element, zero); 33 MEMSET(array + length, 0, zero); 34 MEMSET(array + length + 1, 0, zero); 35 36 // try to memset bytes to the right of array 37 EXPECT_DEATH(MEMSET(array, 0, size + 1), 38 RightOOBWriteMessage(0)); 39 EXPECT_DEATH(MEMSET((char*)(array + length) - 1, element, 6), 40 RightOOBWriteMessage(0)); 41 EXPECT_DEATH(MEMSET(array + 1, element, size + sizeof(T)), 42 RightOOBWriteMessage(0)); 43 // whole interval is to the right 44 EXPECT_DEATH(MEMSET(array + length + 1, 0, 10), 45 RightOOBWriteMessage(sizeof(T))); 46 47 // try to memset bytes to the left of array 48 EXPECT_DEATH(MEMSET((char*)array - 1, element, size), 49 LeftOOBWriteMessage(1)); 50 EXPECT_DEATH(MEMSET((char*)array - 5, 0, 6), 51 LeftOOBWriteMessage(5)); 52 if (length >= 100) { 53 // Large OOB, we find it only if the redzone is large enough. 54 EXPECT_DEATH(memset(array - 5, element, size + 5 * sizeof(T)), 55 LeftOOBWriteMessage(5 * sizeof(T))); 56 } 57 // whole interval is to the left 58 EXPECT_DEATH(MEMSET(array - 2, 0, sizeof(T)), 59 LeftOOBWriteMessage(2 * sizeof(T))); 60 61 // try to memset bytes both to the left & to the right 62 EXPECT_DEATH(MEMSET((char*)array - 2, element, size + 4), 63 LeftOOBWriteMessage(2)); 64 65 free(array); 66 } 67 68 TEST(AddressSanitizer, MemSetOOBTest) { 69 MemSetOOBTestTemplate<char>(100); 70 MemSetOOBTestTemplate<int>(5); 71 MemSetOOBTestTemplate<double>(256); 72 // We can test arrays of structres/classes here, but what for? 73 } 74 75 // Try to allocate two arrays of 'size' bytes that are near each other. 76 // Strictly speaking we are not guaranteed to find such two pointers, 77 // but given the structure of asan's allocator we will. 78 static bool AllocateTwoAdjacentArrays(char **x1, char **x2, size_t size) { 79 vector<uintptr_t> v; 80 bool res = false; 81 for (size_t i = 0; i < 1000U && !res; i++) { 82 v.push_back(reinterpret_cast<uintptr_t>(new char[size])); 83 if (i == 0) continue; 84 sort(v.begin(), v.end()); 85 for (size_t j = 1; j < v.size(); j++) { 86 assert(v[j] > v[j-1]); 87 if ((size_t)(v[j] - v[j-1]) < size * 2) { 88 *x2 = reinterpret_cast<char*>(v[j]); 89 *x1 = reinterpret_cast<char*>(v[j-1]); 90 res = true; 91 break; 92 } 93 } 94 } 95 96 for (size_t i = 0; i < v.size(); i++) { 97 char *p = reinterpret_cast<char *>(v[i]); 98 if (res && p == *x1) continue; 99 if (res && p == *x2) continue; 100 delete [] p; 101 } 102 return res; 103 } 104 105 TEST(AddressSanitizer, LargeOOBInMemset) { 106 for (size_t size = 200; size < 100000; size += size / 2) { 107 char *x1, *x2; 108 if (!Ident(AllocateTwoAdjacentArrays)(&x1, &x2, size)) 109 continue; 110 // fprintf(stderr, " large oob memset: %p %p %zd\n", x1, x2, size); 111 // Do a memset on x1 with huge out-of-bound access that will end up in x2. 112 EXPECT_DEATH(Ident(memset)(x1, 0, size * 2), 113 "is located 0 bytes to the right"); 114 delete [] x1; 115 delete [] x2; 116 return; 117 } 118 assert(0 && "Did not find two adjacent malloc-ed pointers"); 119 } 120 121 // Same test for memcpy and memmove functions 122 template <typename T, class M> 123 void MemTransferOOBTestTemplate(size_t length) { 124 if (length == 0) return; 125 size_t size = Ident(sizeof(T) * length); 126 T *src = Ident((T*)malloc(size)); 127 T *dest = Ident((T*)malloc(size)); 128 int zero = Ident(0); 129 130 // valid transfer of bytes between arrays 131 M::transfer(dest, src, size); 132 M::transfer(dest + 1, src, size - sizeof(T)); 133 M::transfer(dest, src + length - 1, sizeof(T)); 134 M::transfer(dest, src, 1); 135 136 // transfer zero bytes 137 M::transfer(dest - 1, src, 0); 138 M::transfer(dest + length, src, zero); 139 M::transfer(dest, src - 1, zero); 140 M::transfer(dest, src, zero); 141 142 // try to change mem to the right of dest 143 EXPECT_DEATH(M::transfer(dest + 1, src, size), 144 RightOOBWriteMessage(0)); 145 EXPECT_DEATH(M::transfer((char*)(dest + length) - 1, src, 5), 146 RightOOBWriteMessage(0)); 147 148 // try to change mem to the left of dest 149 EXPECT_DEATH(M::transfer(dest - 2, src, size), 150 LeftOOBWriteMessage(2 * sizeof(T))); 151 EXPECT_DEATH(M::transfer((char*)dest - 3, src, 4), 152 LeftOOBWriteMessage(3)); 153 154 // try to access mem to the right of src 155 EXPECT_DEATH(M::transfer(dest, src + 2, size), 156 RightOOBReadMessage(0)); 157 EXPECT_DEATH(M::transfer(dest, (char*)(src + length) - 3, 6), 158 RightOOBReadMessage(0)); 159 160 // try to access mem to the left of src 161 EXPECT_DEATH(M::transfer(dest, src - 1, size), 162 LeftOOBReadMessage(sizeof(T))); 163 EXPECT_DEATH(M::transfer(dest, (char*)src - 6, 7), 164 LeftOOBReadMessage(6)); 165 166 // Generally we don't need to test cases where both accessing src and writing 167 // to dest address to poisoned memory. 168 169 T *big_src = Ident((T*)malloc(size * 2)); 170 T *big_dest = Ident((T*)malloc(size * 2)); 171 // try to change mem to both sides of dest 172 EXPECT_DEATH(M::transfer(dest - 1, big_src, size * 2), 173 LeftOOBWriteMessage(sizeof(T))); 174 // try to access mem to both sides of src 175 EXPECT_DEATH(M::transfer(big_dest, src - 2, size * 2), 176 LeftOOBReadMessage(2 * sizeof(T))); 177 178 free(src); 179 free(dest); 180 free(big_src); 181 free(big_dest); 182 } 183 184 class MemCpyWrapper { 185 public: 186 static void* transfer(void *to, const void *from, size_t size) { 187 return Ident(memcpy)(to, from, size); 188 } 189 }; 190 191 TEST(AddressSanitizer, MemCpyOOBTest) { 192 MemTransferOOBTestTemplate<char, MemCpyWrapper>(100); 193 MemTransferOOBTestTemplate<int, MemCpyWrapper>(1024); 194 } 195 196 class MemMoveWrapper { 197 public: 198 static void* transfer(void *to, const void *from, size_t size) { 199 return Ident(memmove)(to, from, size); 200 } 201 }; 202 203 TEST(AddressSanitizer, MemMoveOOBTest) { 204 MemTransferOOBTestTemplate<char, MemMoveWrapper>(100); 205 MemTransferOOBTestTemplate<int, MemMoveWrapper>(1024); 206 } 207 208 209 TEST(AddressSanitizer, MemCmpOOBTest) { 210 size_t size = Ident(100); 211 char *s1 = MallocAndMemsetString(size); 212 char *s2 = MallocAndMemsetString(size); 213 // Normal memcmp calls. 214 Ident(memcmp(s1, s2, size)); 215 Ident(memcmp(s1 + size - 1, s2 + size - 1, 1)); 216 Ident(memcmp(s1 - 1, s2 - 1, 0)); 217 // One of arguments points to not allocated memory. 218 EXPECT_DEATH(Ident(memcmp)(s1 - 1, s2, 1), LeftOOBReadMessage(1)); 219 EXPECT_DEATH(Ident(memcmp)(s1, s2 - 1, 1), LeftOOBReadMessage(1)); 220 EXPECT_DEATH(Ident(memcmp)(s1 + size, s2, 1), RightOOBReadMessage(0)); 221 EXPECT_DEATH(Ident(memcmp)(s1, s2 + size, 1), RightOOBReadMessage(0)); 222 // Hit unallocated memory and die. 223 EXPECT_DEATH(Ident(memcmp)(s1 + 1, s2 + 1, size), RightOOBReadMessage(0)); 224 EXPECT_DEATH(Ident(memcmp)(s1 + size - 1, s2, 2), RightOOBReadMessage(0)); 225 // Zero bytes are not terminators and don't prevent from OOB. 226 s1[size - 1] = '\0'; 227 s2[size - 1] = '\0'; 228 EXPECT_DEATH(Ident(memcmp)(s1, s2, size + 1), RightOOBReadMessage(0)); 229 230 // Even if the buffers differ in the first byte, we still assume that 231 // memcmp may access the whole buffer and thus reporting the overflow here: 232 s1[0] = 1; 233 s2[0] = 123; 234 EXPECT_DEATH(Ident(memcmp)(s1, s2, size + 1), RightOOBReadMessage(0)); 235 236 free(s1); 237 free(s2); 238 } 239 240 241 242
