1 // RUN: %clangxx_cfi_dso_diag -std=c++11 %s -o %t 2 // RUN: %t zero 2>&1 | FileCheck --check-prefix=CHECK-ZERO %s 3 // RUN: %t unaddressable 2>&1 | FileCheck --check-prefix=CHECK-UNADDR %s 4 // RUN: %t 2>&1 | FileCheck --check-prefix=CHECK-TYPEINFO %s 5 6 // RUN: %clangxx_cfi_diag -std=c++11 %s -o %t2 7 // RUN: %t2 zero 2>&1 | FileCheck --check-prefix=CHECK-ZERO %s 8 // RUN: %t2 unaddressable 2>&1 | FileCheck --check-prefix=CHECK-UNADDR %s 9 // RUN: %t2 2>&1 | FileCheck --check-prefix=CHECK-TYPEINFO %s 10 11 // REQUIRES: cxxabi 12 13 #include <stdio.h> 14 #include <stdint.h> 15 #include <stdlib.h> 16 #include <string.h> 17 #include <sys/mman.h> 18 19 struct A { 20 virtual void f(); 21 }; 22 23 void A::f() {} 24 25 int main(int argc, char *argv[]) { 26 char *volatile p = reinterpret_cast<char *>(new A()); 27 if (argc > 1 && strcmp(argv[1], "unaddressable") == 0) { 28 void *vtable = mmap(nullptr, 4096, PROT_NONE, MAP_PRIVATE | MAP_ANONYMOUS, 0, 0); 29 // Create an object with a vtable in an unaddressable memory region. 30 *(uintptr_t *)p = (uintptr_t)vtable + 64; 31 // CHECK-UNADDR: runtime error: control flow integrity check for type 'A' failed during cast 32 // CHECK-UNADDR: note: invalid vtable 33 // CHECK-UNADDR: <memory cannot be printed> 34 // CHECK-UNADDR: runtime error: control flow integrity check for type 'A' failed during cast 35 // CHECK-UNADDR: note: invalid vtable 36 // CHECK-UNADDR: <memory cannot be printed> 37 } else if (argc > 1 && strcmp(argv[1], "zero") == 0) { 38 // Create an object with a vtable outside of any known DSO, but still in an 39 // addressable area. 40 void *vtable = calloc(1, 128); 41 *(uintptr_t *)p = (uintptr_t)vtable + 64; 42 // CHECK-ZERO: runtime error: control flow integrity check for type 'A' failed during cast 43 // CHECK-ZERO: note: invalid vtable 44 // CHECK-ZERO: 00 00 00 00 00 00 00 00 45 // CHECK-ZERO: runtime error: control flow integrity check for type 'A' failed during cast 46 // CHECK-ZERO: note: invalid vtable 47 // CHECK-ZERO: 00 00 00 00 00 00 00 00 48 } else { 49 // Create an object with a seemingly fine vtable, but with an unaddressable 50 // typeinfo pointer. 51 void *vtable = calloc(1, 128); 52 memset(vtable, 0xFE, 128); 53 *(uintptr_t *)p = (uintptr_t)vtable + 64; 54 // CHECK-TYPEINFO: runtime error: control flow integrity check for type 'A' failed during cast 55 // CHECK-TYPEINFO: note: invalid vtable 56 // CHECK-TYPEINFO: fe fe fe fe fe fe fe fe 57 // CHECK-TYPEINFO: runtime error: control flow integrity check for type 'A' failed during cast 58 // CHECK-TYPEINFO: note: invalid vtable 59 // CHECK-TYPEINFO: fe fe fe fe fe fe fe fe 60 } 61 62 A *volatile pa = reinterpret_cast<A *>(p); 63 pa = reinterpret_cast<A *>(p); 64 } 65
