1*eb7dc991SJason Molenda #include <stdint.h> 2*eb7dc991SJason Molenda 3*eb7dc991SJason Molenda int global = 10; 4*eb7dc991SJason Molenda main()5*eb7dc991SJason Molendaint main() { 6*eb7dc991SJason Molenda int count = 5; 7*eb7dc991SJason Molenda int *count_p = &count; 8*eb7dc991SJason Molenda 9*eb7dc991SJason Molenda // Add some metadata in the top byte (this will crash unless the 10*eb7dc991SJason Molenda // test is running with TBI enabled, but we won't dereference it) 11*eb7dc991SJason Molenda 12*eb7dc991SJason Molenda intptr_t scratch = (intptr_t)count_p; 13*eb7dc991SJason Molenda scratch |= (3ULL << 60); 14*eb7dc991SJason Molenda int *count_invalid_p = (int *)scratch; 15*eb7dc991SJason Molenda 16*eb7dc991SJason Molenda int (*main_p)() = main; 17*eb7dc991SJason Molenda scratch = (intptr_t)main_p; 18*eb7dc991SJason Molenda scratch |= (3ULL << 60); 19*eb7dc991SJason Molenda int (*main_invalid_p)() = (int (*)())scratch; 20*eb7dc991SJason Molenda 21*eb7dc991SJason Molenda int *global_p = &global; 22*eb7dc991SJason Molenda scratch = (intptr_t)global_p; 23*eb7dc991SJason Molenda scratch |= (3ULL << 60); 24*eb7dc991SJason Molenda int *global_invalid_p = (int *)scratch; 25*eb7dc991SJason Molenda 26*eb7dc991SJason Molenda return count; // break here 27*eb7dc991SJason Molenda } 28