1 //===-- ubsan_handlers_cxx.cc ---------------------------------------------===// 2 // 3 // This file is distributed under the University of Illinois Open Source 4 // License. See LICENSE.TXT for details. 5 // 6 //===----------------------------------------------------------------------===// 7 // 8 // Error logging entry points for the UBSan runtime, which are only used for C++ 9 // compilations. This file is permitted to use language features which require 10 // linking against a C++ ABI library. 11 // 12 //===----------------------------------------------------------------------===// 13 14 #include "ubsan_platform.h" 15 #if CAN_SANITIZE_UB 16 #include "ubsan_handlers.h" 17 #include "ubsan_handlers_cxx.h" 18 #include "ubsan_diag.h" 19 #include "ubsan_type_hash.h" 20 21 #include "sanitizer_common/sanitizer_common.h" 22 #include "sanitizer_common/sanitizer_suppressions.h" 23 24 using namespace __sanitizer; 25 using namespace __ubsan; 26 27 namespace __ubsan { 28 extern const char *TypeCheckKinds[]; 29 } 30 31 // Returns true if UBSan has printed an error report. 32 static bool HandleDynamicTypeCacheMiss( 33 DynamicTypeCacheMissData *Data, ValueHandle Pointer, ValueHandle Hash, 34 ReportOptions Opts) { 35 if (checkDynamicType((void*)Pointer, Data->TypeInfo, Hash)) 36 // Just a cache miss. The type matches after all. 37 return false; 38 39 // Check if error report should be suppressed. 40 DynamicTypeInfo DTI = getDynamicTypeInfoFromObject((void*)Pointer); 41 if (DTI.isValid() && IsVptrCheckSuppressed(DTI.getMostDerivedTypeName())) 42 return false; 43 44 SourceLocation Loc = Data->Loc.acquire(); 45 ErrorType ET = ErrorType::DynamicTypeMismatch; 46 if (ignoreReport(Loc, Opts, ET)) 47 return false; 48 49 ScopedReport R(Opts, Loc, ET); 50 51 Diag(Loc, DL_Error, ET, 52 "%0 address %1 which does not point to an object of type %2") 53 << TypeCheckKinds[Data->TypeCheckKind] << (void*)Pointer << Data->Type; 54 55 // If possible, say what type it actually points to. 56 if (!DTI.isValid()) { 57 if (DTI.getOffset() < -VptrMaxOffsetToTop || DTI.getOffset() > VptrMaxOffsetToTop) { 58 Diag(Pointer, DL_Note, ET, 59 "object has a possibly invalid vptr: abs(offset to top) too big") 60 << TypeName(DTI.getMostDerivedTypeName()) 61 << Range(Pointer, Pointer + sizeof(uptr), "possibly invalid vptr"); 62 } else { 63 Diag(Pointer, DL_Note, ET, "object has invalid vptr") 64 << TypeName(DTI.getMostDerivedTypeName()) 65 << Range(Pointer, Pointer + sizeof(uptr), "invalid vptr"); 66 } 67 } else if (!DTI.getOffset()) 68 Diag(Pointer, DL_Note, ET, "object is of type %0") 69 << TypeName(DTI.getMostDerivedTypeName()) 70 << Range(Pointer, Pointer + sizeof(uptr), "vptr for %0"); 71 else 72 // FIXME: Find the type at the specified offset, and include that 73 // in the note. 74 Diag(Pointer - DTI.getOffset(), DL_Note, ET, 75 "object is base class subobject at offset %0 within object of type %1") 76 << DTI.getOffset() << TypeName(DTI.getMostDerivedTypeName()) 77 << TypeName(DTI.getSubobjectTypeName()) 78 << Range(Pointer, Pointer + sizeof(uptr), 79 "vptr for %2 base class of %1"); 80 return true; 81 } 82 83 void __ubsan::__ubsan_handle_dynamic_type_cache_miss( 84 DynamicTypeCacheMissData *Data, ValueHandle Pointer, ValueHandle Hash) { 85 GET_REPORT_OPTIONS(false); 86 HandleDynamicTypeCacheMiss(Data, Pointer, Hash, Opts); 87 } 88 void __ubsan::__ubsan_handle_dynamic_type_cache_miss_abort( 89 DynamicTypeCacheMissData *Data, ValueHandle Pointer, ValueHandle Hash) { 90 // Note: -fsanitize=vptr is always recoverable. 91 GET_REPORT_OPTIONS(false); 92 if (HandleDynamicTypeCacheMiss(Data, Pointer, Hash, Opts)) 93 Die(); 94 } 95 96 #ifdef UBSAN_CAN_USE_CXXABI 97 namespace __ubsan { 98 void __ubsan_handle_cfi_bad_type(CFICheckFailData *Data, ValueHandle Vtable, 99 bool ValidVtable, ReportOptions Opts) { 100 SourceLocation Loc = Data->Loc.acquire(); 101 ErrorType ET = ErrorType::CFIBadType; 102 103 if (ignoreReport(Loc, Opts, ET)) 104 return; 105 106 ScopedReport R(Opts, Loc, ET); 107 DynamicTypeInfo DTI = ValidVtable 108 ? getDynamicTypeInfoFromVtable((void *)Vtable) 109 : DynamicTypeInfo(0, 0, 0); 110 111 const char *CheckKindStr; 112 switch (Data->CheckKind) { 113 case CFITCK_VCall: 114 CheckKindStr = "virtual call"; 115 break; 116 case CFITCK_NVCall: 117 CheckKindStr = "non-virtual call"; 118 break; 119 case CFITCK_DerivedCast: 120 CheckKindStr = "base-to-derived cast"; 121 break; 122 case CFITCK_UnrelatedCast: 123 CheckKindStr = "cast to unrelated type"; 124 break; 125 case CFITCK_VMFCall: 126 CheckKindStr = "virtual pointer to member function call"; 127 break; 128 case CFITCK_ICall: 129 case CFITCK_NVMFCall: 130 Die(); 131 } 132 133 Diag(Loc, DL_Error, ET, 134 "control flow integrity check for type %0 failed during " 135 "%1 (vtable address %2)") 136 << Data->Type << CheckKindStr << (void *)Vtable; 137 138 // If possible, say what type it actually points to. 139 if (!DTI.isValid()) 140 Diag(Vtable, DL_Note, ET, "invalid vtable"); 141 else 142 Diag(Vtable, DL_Note, ET, "vtable is of type %0") 143 << TypeName(DTI.getMostDerivedTypeName()); 144 145 // If the failure involved different DSOs for the check location and vtable, 146 // report the DSO names. 147 const char *DstModule = Symbolizer::GetOrInit()->GetModuleNameForPc(Vtable); 148 if (!DstModule) 149 DstModule = "(unknown)"; 150 151 const char *SrcModule = Symbolizer::GetOrInit()->GetModuleNameForPc(Opts.pc); 152 if (!SrcModule) 153 SrcModule = "(unknown)"; 154 155 if (internal_strcmp(SrcModule, DstModule)) 156 Diag(Loc, DL_Note, ET, "check failed in %0, vtable located in %1") 157 << SrcModule << DstModule; 158 } 159 } // namespace __ubsan 160 #endif 161 162 #endif // CAN_SANITIZE_UB 163