1 // Test how we produce the scariness score. 2 3 // RUN: %clangxx_asan -O0 %s -o %t 4 // RUN: export %env_asan_opts=detect_stack_use_after_return=1:handle_abort=1:print_scariness=1 5 // Make sure the stack is limited (may not be the default under GNU make) 6 // RUN: ulimit -s 4096 7 // RUN: not %run %t 1 2>&1 | FileCheck %s --check-prefix=CHECK1 8 // RUN: not %run %t 2 2>&1 | FileCheck %s --check-prefix=CHECK2 9 // RUN: not %run %t 3 2>&1 | FileCheck %s --check-prefix=CHECK3 10 // RUN: not %run %t 4 2>&1 | FileCheck %s --check-prefix=CHECK4 11 // RUN: not %run %t 5 2>&1 | FileCheck %s --check-prefix=CHECK5 12 // RUN: not %run %t 6 2>&1 | FileCheck %s --check-prefix=CHECK6 13 // RUN: not %run %t 7 2>&1 | FileCheck %s --check-prefix=CHECK7 14 // RUN: not %run %t 8 2>&1 | FileCheck %s --check-prefix=CHECK8 15 // RUN: not %run %t 9 2>&1 | FileCheck %s --check-prefix=CHECK9 16 // RUN: not %run %t 10 2>&1 | FileCheck %s --check-prefix=CHECK10 17 // RUN: not %run %t 11 2>&1 | FileCheck %s --check-prefix=CHECK11 18 // RUN: not %run %t 12 2>&1 | FileCheck %s --check-prefix=CHECK12 19 // RUN: not %run %t 13 2>&1 | FileCheck %s --check-prefix=CHECK13 20 // RUN: not %run %t 14 2>&1 | FileCheck %s --check-prefix=CHECK14 21 // RUN: not %run %t 15 2>&1 | FileCheck %s --check-prefix=CHECK15 22 // RUN: not %run %t 16 2>&1 | FileCheck %s --check-prefix=CHECK16 23 // RUN: not %run %t 17 2>&1 | FileCheck %s --check-prefix=CHECK17 24 // RUN: not %run %t 18 2>&1 | FileCheck %s --check-prefix=CHECK18 25 // RUN: not %run %t 19 2>&1 | FileCheck %s --check-prefix=CHECK19 26 // RUN: not %run %t 20 2>&1 | FileCheck %s --check-prefix=CHECK20 27 // RUN: not %run %t 21 2>&1 | FileCheck %s --check-prefix=CHECK21 28 // RUN: not %run %t 22 2>&1 | FileCheck %s --check-prefix=CHECK22 29 // RUN: not %run %t 23 2>&1 | FileCheck %s --check-prefix=CHECK23 30 // RUN: not %run %t 24 2>&1 | FileCheck %s --check-prefix=CHECK24 31 // RUN: not %run %t 25 2>&1 | FileCheck %s --check-prefix=CHECK25 32 // RUN: not %run %t 26 2>&1 | FileCheck %s --check-prefix=CHECK26 33 // RUN: not %run %t 27 2>&1 | FileCheck %s --check-prefix=CHECK27 34 // Parts of the test are too platform-specific: 35 // REQUIRES: x86_64-target-arch 36 // REQUIRES: shell 37 #include <stdlib.h> 38 #include <stdio.h> 39 #include <string.h> 40 41 #include <sanitizer/asan_interface.h> 42 43 enum ReadOrWrite { Read = 0, Write = 1 }; 44 45 struct S32 { 46 char x[32]; 47 }; 48 49 template<class T> 50 void HeapBuferOverflow(int Idx, ReadOrWrite w) { 51 T *t = new T[100]; 52 static T sink; 53 if (w) 54 t[100 + Idx] = T(); 55 else 56 sink = t[100 + Idx]; 57 delete [] t; 58 } 59 60 template<class T> 61 void HeapUseAfterFree(int Idx, ReadOrWrite w) { 62 T *t = new T[100]; 63 static T sink; 64 sink = t[0]; 65 delete [] t; 66 if (w) 67 t[Idx] = T(); 68 else 69 sink = t[Idx]; 70 } 71 72 template<class T> 73 void StackBufferOverflow(int Idx, ReadOrWrite w) { 74 T t[100]; 75 static T sink; 76 sink = t[Idx]; 77 if (w) 78 t[100 + Idx] = T(); 79 else 80 sink = t[100 + Idx]; 81 } 82 83 template<class T> 84 T *LeakStack() { 85 T t[100]; 86 static volatile T *x; 87 x = &t[0]; 88 return (T*)x; 89 } 90 91 template<class T> 92 void StackUseAfterReturn(int Idx, ReadOrWrite w) { 93 static T sink; 94 T *t = LeakStack<T>(); 95 if (w) 96 t[100 + Idx] = T(); 97 else 98 sink = t[100 + Idx]; 99 } 100 101 char g1[100]; 102 short g2[100]; 103 int g4[100]; 104 int64_t g8[100]; 105 S32 gm[100]; 106 107 void DoubleFree() { 108 int *x = new int; 109 static volatile int two = 2; 110 for (int i = 0; i < two; i++) 111 delete x; 112 } 113 114 void StackOverflow(int Idx) { 115 int some_stack[10000]; 116 static volatile int *x; 117 x = &some_stack[0]; 118 if (Idx > 0) 119 StackOverflow(Idx - 1); 120 } 121 122 void UseAfterPoison() { 123 int buf[100]; 124 __asan_poison_memory_region(buf, sizeof(buf)); 125 static volatile int sink; 126 sink = buf[42]; 127 } 128 129 int main(int argc, char **argv) { 130 char arr[100]; 131 static volatile int zero = 0; 132 static volatile int *zero_ptr = 0; 133 static volatile int *wild_addr = (int*)0x10000000; // System-dependent. 134 if (argc != 2) return 1; 135 int kind = atoi(argv[1]); 136 switch (kind) { 137 case 1: HeapBuferOverflow<char>(0, Read); break; 138 case 2: HeapBuferOverflow<int>(0, Read); break; 139 case 3: HeapBuferOverflow<short>(0, Write); break; 140 case 4: HeapBuferOverflow<int64_t>(2, Write); break; 141 case 5: HeapBuferOverflow<S32>(4, Write); break; 142 case 6: HeapUseAfterFree<char>(0, Read); break; 143 case 7: HeapUseAfterFree<int>(0, Write); break; 144 case 8: HeapUseAfterFree<int64_t>(0, Read); break; 145 case 9: HeapUseAfterFree<S32>(0, Write); break; 146 case 10: StackBufferOverflow<char>(0, Write); break; 147 case 11: StackBufferOverflow<int64_t>(0, Read); break; 148 case 12: StackBufferOverflow<int>(4, Write); break; 149 case 13: StackUseAfterReturn<char>(0, Read); break; 150 case 14: StackUseAfterReturn<S32>(0, Write); break; 151 case 15: g1[zero + 100] = 0; break; 152 case 16: gm[0] = gm[zero + 100 + 1]; break; 153 case 17: DoubleFree(); break; 154 case 18: StackOverflow(1000000); break; 155 case 19: *zero_ptr = 0; break; 156 case 20: *wild_addr = 0; break; 157 case 21: zero = *wild_addr; break; 158 case 22: abort(); break; 159 case 23: ((void (*)(void))wild_addr)(); break; 160 case 24: delete (new int[10]); break; 161 case 25: free((char*)malloc(100) + 10); break; 162 case 26: memcpy(arr, arr+10, 20); break; 163 case 27: UseAfterPoison(); break; 164 // CHECK1: SCARINESS: 12 (1-byte-read-heap-buffer-overflow) 165 // CHECK2: SCARINESS: 17 (4-byte-read-heap-buffer-overflow) 166 // CHECK3: SCARINESS: 33 (2-byte-write-heap-buffer-overflow) 167 // CHECK4: SCARINESS: 52 (8-byte-write-heap-buffer-overflow-far-from-bounds) 168 // CHECK5: SCARINESS: 55 (multi-byte-write-heap-buffer-overflow-far-from-bounds) 169 // CHECK6: SCARINESS: 40 (1-byte-read-heap-use-after-free) 170 // CHECK7: SCARINESS: 46 (4-byte-write-heap-use-after-free) 171 // CHECK8: SCARINESS: 51 (8-byte-read-heap-use-after-free) 172 // CHECK9: SCARINESS: 55 (multi-byte-write-heap-use-after-free) 173 // CHECK10: SCARINESS: 46 (1-byte-write-stack-buffer-overflow) 174 // CHECK11: SCARINESS: 38 (8-byte-read-stack-buffer-overflow) 175 // CHECK12: SCARINESS: 61 (4-byte-write-stack-buffer-overflow-far-from-bounds) 176 // CHECK13: SCARINESS: 50 (1-byte-read-stack-use-after-return) 177 // CHECK14: SCARINESS: 65 (multi-byte-write-stack-use-after-return) 178 // CHECK15: SCARINESS: 31 (1-byte-write-global-buffer-overflow) 179 // CHECK16: SCARINESS: 36 (multi-byte-read-global-buffer-overflow-far-from-bounds) 180 // CHECK17: SCARINESS: 42 (double-free) 181 // CHECK18: SCARINESS: 10 (stack-overflow) 182 // CHECK19: SCARINESS: 10 (null-deref) 183 // CHECK20: SCARINESS: 30 (wild-addr-write) 184 // CHECK21: SCARINESS: 20 (wild-addr-read) 185 // CHECK22: SCARINESS: 10 (signal) 186 // CHECK23: SCARINESS: 60 (wild-jump) 187 // CHECK24: SCARINESS: 10 (alloc-dealloc-mismatch) 188 // CHECK25: SCARINESS: 40 (bad-free) 189 // CHECK26: SCARINESS: 10 (memcpy-param-overlap) 190 // CHECK27: SCARINESS: 27 (4-byte-read-use-after-poison) 191 } 192 } 193
