1 // RUN: %clang_cc1 -x c -triple x86_64-apple-darwin10 -w -emit-llvm -o - %s -fsanitize=pointer-overflow | FileCheck %s --check-prefixes=CHECK,CHECK-C 2 // RUN: %clang_cc1 -x c++ -triple x86_64-apple-darwin10 -w -emit-llvm -o - %s -fsanitize=pointer-overflow | FileCheck %s --check-prefixes=CHECK,CHECK-CPP 3 4 #ifdef __cplusplus 5 extern "C" { 6 #endif 7 8 // CHECK-LABEL: define{{.*}} void @fixed_len_array 9 void fixed_len_array(int k) { 10 // CHECK: getelementptr inbounds [10 x [10 x i32]], [10 x [10 x i32]]* [[ARR:%.*]], i64 0, i64 [[IDXPROM:%.*]] 11 // CHECK-NEXT: [[SMUL:%.*]] = call { i64, i1 } @llvm.smul.with.overflow.i64(i64 40, i64 [[IDXPROM]]), !nosanitize 12 // CHECK-NEXT: [[SMULOFLOW:%.*]] = extractvalue { i64, i1 } [[SMUL]], 1, !nosanitize 13 // CHECK-NEXT: [[SMULVAL:%.*]] = extractvalue { i64, i1 } [[SMUL]], 0, !nosanitize 14 // CHECK-NEXT: [[BASE:%.*]] = ptrtoint [10 x [10 x i32]]* [[ARR]] to i64, !nosanitize 15 // CHECK-NEXT: [[COMPGEP:%.*]] = add i64 [[BASE]], [[SMULVAL]], !nosanitize 16 // CHECK: call void @__ubsan_handle_pointer_overflow{{.*}}, i64 [[BASE]], i64 [[COMPGEP]]){{.*}}, !nosanitize 17 18 // CHECK: getelementptr inbounds [10 x i32], [10 x i32]* {{.*}}, i64 0, i64 [[IDXPROM1:%.*]] 19 // CHECK-NEXT: @llvm.smul.with.overflow.i64(i64 4, i64 [[IDXPROM1]]), !nosanitize 20 // CHECK: call void @__ubsan_handle_pointer_overflow{{.*}} 21 22 int arr[10][10]; 23 arr[k][k]; 24 } 25 26 // CHECK-LABEL: define{{.*}} void @variable_len_array 27 void variable_len_array(int n, int k) { 28 // CHECK: getelementptr inbounds i32, i32* {{.*}}, i64 [[IDXPROM:%.*]] 29 // CHECK-NEXT: @llvm.smul.with.overflow.i64(i64 4, i64 [[IDXPROM]]), !nosanitize 30 // CHECK: call void @__ubsan_handle_pointer_overflow{{.*}} 31 32 // CHECK: getelementptr inbounds i32, i32* {{.*}}, i64 [[IDXPROM1:%.*]] 33 // CHECK-NEXT: @llvm.smul.with.overflow.i64(i64 4, i64 [[IDXPROM1]]), !nosanitize 34 // CHECK: call void @__ubsan_handle_pointer_overflow{{.*}} 35 36 int arr[n][n]; 37 arr[k][k]; 38 } 39 40 // CHECK-LABEL: define{{.*}} void @pointer_array 41 void pointer_array(int **arr, int k) { 42 // CHECK: @llvm.smul.with.overflow.i64(i64 8, i64 {{.*}}), !nosanitize 43 // CHECK: call void @__ubsan_handle_pointer_overflow{{.*}} 44 45 // CHECK: @llvm.smul.with.overflow.i64(i64 4, i64 {{.*}}), !nosanitize 46 // CHECK: call void @__ubsan_handle_pointer_overflow{{.*}} 47 48 arr[k][k]; 49 } 50 51 // CHECK-LABEL: define{{.*}} void @pointer_array_unsigned_indices 52 void pointer_array_unsigned_indices(int **arr, unsigned k) { 53 // CHECK: icmp uge 54 // CHECK-NOT: select 55 // CHECK: call void @__ubsan_handle_pointer_overflow{{.*}} 56 // CHECK: icmp uge 57 // CHECK-NOT: select 58 // CHECK: call void @__ubsan_handle_pointer_overflow{{.*}} 59 arr[k][k]; 60 } 61 62 // CHECK-LABEL: define{{.*}} void @pointer_array_mixed_indices 63 void pointer_array_mixed_indices(int **arr, int i, unsigned j) { 64 // CHECK: select 65 // CHECK: call void @__ubsan_handle_pointer_overflow{{.*}} 66 // CHECK-NOT: select 67 // CHECK: call void @__ubsan_handle_pointer_overflow{{.*}} 68 arr[i][j]; 69 } 70 71 struct S1 { 72 int pad1; 73 union { 74 char leaf; 75 struct S1 *link; 76 } u; 77 struct S1 *arr; 78 }; 79 80 // TODO: Currently, structure GEPs are not checked, so there are several 81 // potentially unsafe GEPs here which we don't instrument. 82 // 83 // CHECK-LABEL: define{{.*}} void @struct_index 84 void struct_index(struct S1 *p) { 85 // CHECK: getelementptr inbounds %struct.S1, %struct.S1* [[P:%.*]], i64 10 86 // CHECK-NEXT: [[BASE:%.*]] = ptrtoint %struct.S1* [[P]] to i64, !nosanitize 87 // CHECK-NEXT: [[COMPGEP:%.*]] = add i64 [[BASE]], 240, !nosanitize 88 // CHECK: select 89 // CHECK: @__ubsan_handle_pointer_overflow{{.*}} i64 [[BASE]], i64 [[COMPGEP]]) {{.*}}, !nosanitize 90 91 // CHECK-NOT: @__ubsan_handle_pointer_overflow 92 93 p->arr[10].u.link->u.leaf; 94 } 95 96 typedef void (*funcptr_t)(void); 97 98 // CHECK-LABEL: define{{.*}} void @function_pointer_arith 99 void function_pointer_arith(funcptr_t *p, int k) { 100 // CHECK: add i64 {{.*}}, 8, !nosanitize 101 // CHECK-NOT: select 102 // CHECK: @__ubsan_handle_pointer_overflow{{.*}} 103 ++p; 104 105 // CHECK: @llvm.smul.with.overflow.i64(i64 8, i64 {{.*}}), !nosanitize 106 // CHECK: select 107 // CHECK: call void @__ubsan_handle_pointer_overflow{{.*}} 108 p + k; 109 } 110 111 // CHECK-LABEL: define{{.*}} void @dont_emit_checks_for_no_op_GEPs 112 // CHECK-C: __ubsan_handle_pointer_overflow 113 // CHECK-CPP-NOT: __ubsan_handle_pointer_overflow 114 void dont_emit_checks_for_no_op_GEPs(char *p) { 115 &p[0]; 116 117 int arr[10][10]; 118 &arr[0][0]; 119 } 120 121 #ifdef __cplusplus 122 } 123 #endif 124