b458bb8c04
A heap or global buffer that is far away from the faulting address is unlikely to be the cause, especially if there is a potential use-after-free as well, so we want to show it after the other causes. Reviewed By: eugenis Differential Revision: https://reviews.llvm.org/D104781
48 lines
1.7 KiB
C
48 lines
1.7 KiB
C
// Tests use-after-return detection and reporting.
|
|
// RUN: %clang_hwasan -g %s -o %t && not %run %t 2>&1 | FileCheck %s
|
|
// RUN: %clang_hwasan -g %s -o %t && not %env_hwasan_opts=symbolize=0 %run %t 2>&1 | FileCheck %s --check-prefix=NOSYM
|
|
|
|
// REQUIRES: stable-runtime
|
|
|
|
// Stack histories currently are not recorded on x86.
|
|
// XFAIL: x86_64
|
|
|
|
void USE(void *x) { // pretend_to_do_something(void *x)
|
|
__asm__ __volatile__("" : : "r" (x) : "memory");
|
|
}
|
|
|
|
__attribute__((noinline))
|
|
char *buggy() {
|
|
char zzz[0x1000];
|
|
char *volatile p = zzz;
|
|
return p;
|
|
}
|
|
|
|
__attribute__((noinline)) void Unrelated1() { int A[2]; USE(&A[0]); }
|
|
__attribute__((noinline)) void Unrelated2() { int BB[3]; USE(&BB[0]); }
|
|
__attribute__((noinline)) void Unrelated3() { int CCC[4]; USE(&CCC[0]); }
|
|
|
|
int main() {
|
|
char *p = buggy();
|
|
Unrelated1();
|
|
Unrelated2();
|
|
Unrelated3();
|
|
return *p;
|
|
// CHECK: READ of size 1 at
|
|
// CHECK: #0 {{.*}} in main{{.*}}stack-uar.c:[[@LINE-2]]
|
|
// CHECK: Cause: stack tag-mismatch
|
|
// CHECK: is located in stack of thread
|
|
// CHECK: Potentially referenced stack objects:
|
|
// CHECK-NEXT: zzz in buggy {{.*}}stack-uar.c:[[@LINE-20]]
|
|
// CHECK-NEXT: Memory tags around the buggy address
|
|
|
|
// NOSYM: Previously allocated frames:
|
|
// NOSYM-NEXT: record_addr:0x{{.*}} record:0x{{.*}} ({{.*}}/stack-uar.c.tmp+0x{{.*}}){{$}}
|
|
// NOSYM-NEXT: record_addr:0x{{.*}} record:0x{{.*}} ({{.*}}/stack-uar.c.tmp+0x{{.*}}){{$}}
|
|
// NOSYM-NEXT: record_addr:0x{{.*}} record:0x{{.*}} ({{.*}}/stack-uar.c.tmp+0x{{.*}}){{$}}
|
|
// NOSYM-NEXT: record_addr:0x{{.*}} record:0x{{.*}} ({{.*}}/stack-uar.c.tmp+0x{{.*}}){{$}}
|
|
// NOSYM-NEXT: Memory tags around the buggy address
|
|
|
|
// CHECK: SUMMARY: HWAddressSanitizer: tag-mismatch {{.*}} in main
|
|
}
|