123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907908909910911912913914915916917918 |
- //===-- ubsan_handlers.cpp ------------------------------------------------===//
- //
- // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
- // See https://llvm.org/LICENSE.txt for license information.
- // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
- //
- //===----------------------------------------------------------------------===//
- //
- // Error logging entry points for the UBSan runtime.
- //
- //===----------------------------------------------------------------------===//
- #include "ubsan_platform.h"
- #if CAN_SANITIZE_UB
- #include "ubsan_handlers.h"
- #include "ubsan_diag.h"
- #include "ubsan_flags.h"
- #include "ubsan_monitor.h"
- #include "ubsan_value.h"
- #include "sanitizer_common/sanitizer_common.h"
- using namespace __sanitizer;
- using namespace __ubsan;
- namespace __ubsan {
- bool ignoreReport(SourceLocation SLoc, ReportOptions Opts, ErrorType ET) {
- // We are not allowed to skip error report: if we are in unrecoverable
- // handler, we have to terminate the program right now, and therefore
- // have to print some diagnostic.
- //
- // Even if source location is disabled, it doesn't mean that we have
- // already report an error to the user: some concurrently running
- // thread could have acquired it, but not yet printed the report.
- if (Opts.FromUnrecoverableHandler)
- return false;
- return SLoc.isDisabled() || IsPCSuppressed(ET, Opts.pc, SLoc.getFilename());
- }
- /// Situations in which we might emit a check for the suitability of a
- /// pointer or glvalue. Needs to be kept in sync with CodeGenFunction.h in
- /// clang.
- enum TypeCheckKind {
- /// Checking the operand of a load. Must be suitably sized and aligned.
- TCK_Load,
- /// Checking the destination of a store. Must be suitably sized and aligned.
- TCK_Store,
- /// Checking the bound value in a reference binding. Must be suitably sized
- /// and aligned, but is not required to refer to an object (until the
- /// reference is used), per core issue 453.
- TCK_ReferenceBinding,
- /// Checking the object expression in a non-static data member access. Must
- /// be an object within its lifetime.
- TCK_MemberAccess,
- /// Checking the 'this' pointer for a call to a non-static member function.
- /// Must be an object within its lifetime.
- TCK_MemberCall,
- /// Checking the 'this' pointer for a constructor call.
- TCK_ConstructorCall,
- /// Checking the operand of a static_cast to a derived pointer type. Must be
- /// null or an object within its lifetime.
- TCK_DowncastPointer,
- /// Checking the operand of a static_cast to a derived reference type. Must
- /// be an object within its lifetime.
- TCK_DowncastReference,
- /// Checking the operand of a cast to a base object. Must be suitably sized
- /// and aligned.
- TCK_Upcast,
- /// Checking the operand of a cast to a virtual base object. Must be an
- /// object within its lifetime.
- TCK_UpcastToVirtualBase,
- /// Checking the value assigned to a _Nonnull pointer. Must not be null.
- TCK_NonnullAssign,
- /// Checking the operand of a dynamic_cast or a typeid expression. Must be
- /// null or an object within its lifetime.
- TCK_DynamicOperation
- };
- const char *TypeCheckKinds[] = {
- "load of", "store to", "reference binding to", "member access within",
- "member call on", "constructor call on", "downcast of", "downcast of",
- "upcast of", "cast to virtual base of", "_Nonnull binding to",
- "dynamic operation on"};
- }
- static void handleTypeMismatchImpl(TypeMismatchData *Data, ValueHandle Pointer,
- ReportOptions Opts) {
- Location Loc = Data->Loc.acquire();
- uptr Alignment = (uptr)1 << Data->LogAlignment;
- ErrorType ET;
- if (!Pointer)
- ET = (Data->TypeCheckKind == TCK_NonnullAssign)
- ? ErrorType::NullPointerUseWithNullability
- : ErrorType::NullPointerUse;
- else if (Pointer & (Alignment - 1))
- ET = ErrorType::MisalignedPointerUse;
- else
- ET = ErrorType::InsufficientObjectSize;
- // Use the SourceLocation from Data to track deduplication, even if it's
- // invalid.
- if (ignoreReport(Loc.getSourceLocation(), Opts, ET))
- return;
- SymbolizedStackHolder FallbackLoc;
- if (Data->Loc.isInvalid()) {
- FallbackLoc.reset(getCallerLocation(Opts.pc));
- Loc = FallbackLoc;
- }
- ScopedReport R(Opts, Loc, ET);
- switch (ET) {
- case ErrorType::NullPointerUse:
- case ErrorType::NullPointerUseWithNullability:
- Diag(Loc, DL_Error, ET, "%0 null pointer of type %1")
- << TypeCheckKinds[Data->TypeCheckKind] << Data->Type;
- break;
- case ErrorType::MisalignedPointerUse:
- Diag(Loc, DL_Error, ET, "%0 misaligned address %1 for type %3, "
- "which requires %2 byte alignment")
- << TypeCheckKinds[Data->TypeCheckKind] << (void *)Pointer << Alignment
- << Data->Type;
- break;
- case ErrorType::InsufficientObjectSize:
- Diag(Loc, DL_Error, ET, "%0 address %1 with insufficient space "
- "for an object of type %2")
- << TypeCheckKinds[Data->TypeCheckKind] << (void *)Pointer << Data->Type;
- break;
- default:
- UNREACHABLE("unexpected error type!");
- }
- if (Pointer)
- Diag(Pointer, DL_Note, ET, "pointer points here");
- }
- void __ubsan::__ubsan_handle_type_mismatch_v1(TypeMismatchData *Data,
- ValueHandle Pointer) {
- GET_REPORT_OPTIONS(false);
- handleTypeMismatchImpl(Data, Pointer, Opts);
- }
- void __ubsan::__ubsan_handle_type_mismatch_v1_abort(TypeMismatchData *Data,
- ValueHandle Pointer) {
- GET_REPORT_OPTIONS(true);
- handleTypeMismatchImpl(Data, Pointer, Opts);
- Die();
- }
- static void handleAlignmentAssumptionImpl(AlignmentAssumptionData *Data,
- ValueHandle Pointer,
- ValueHandle Alignment,
- ValueHandle Offset,
- ReportOptions Opts) {
- Location Loc = Data->Loc.acquire();
- SourceLocation AssumptionLoc = Data->AssumptionLoc.acquire();
- ErrorType ET = ErrorType::AlignmentAssumption;
- if (ignoreReport(Loc.getSourceLocation(), Opts, ET))
- return;
- ScopedReport R(Opts, Loc, ET);
- uptr RealPointer = Pointer - Offset;
- uptr LSB = LeastSignificantSetBitIndex(RealPointer);
- uptr ActualAlignment = uptr(1) << LSB;
- uptr Mask = Alignment - 1;
- uptr MisAlignmentOffset = RealPointer & Mask;
- if (!Offset) {
- Diag(Loc, DL_Error, ET,
- "assumption of %0 byte alignment for pointer of type %1 failed")
- << Alignment << Data->Type;
- } else {
- Diag(Loc, DL_Error, ET,
- "assumption of %0 byte alignment (with offset of %1 byte) for pointer "
- "of type %2 failed")
- << Alignment << Offset << Data->Type;
- }
- if (!AssumptionLoc.isInvalid())
- Diag(AssumptionLoc, DL_Note, ET, "alignment assumption was specified here");
- Diag(RealPointer, DL_Note, ET,
- "%0address is %1 aligned, misalignment offset is %2 bytes")
- << (Offset ? "offset " : "") << ActualAlignment << MisAlignmentOffset;
- }
- void __ubsan::__ubsan_handle_alignment_assumption(AlignmentAssumptionData *Data,
- ValueHandle Pointer,
- ValueHandle Alignment,
- ValueHandle Offset) {
- GET_REPORT_OPTIONS(false);
- handleAlignmentAssumptionImpl(Data, Pointer, Alignment, Offset, Opts);
- }
- void __ubsan::__ubsan_handle_alignment_assumption_abort(
- AlignmentAssumptionData *Data, ValueHandle Pointer, ValueHandle Alignment,
- ValueHandle Offset) {
- GET_REPORT_OPTIONS(true);
- handleAlignmentAssumptionImpl(Data, Pointer, Alignment, Offset, Opts);
- Die();
- }
- /// \brief Common diagnostic emission for various forms of integer overflow.
- template <typename T>
- static void handleIntegerOverflowImpl(OverflowData *Data, ValueHandle LHS,
- const char *Operator, T RHS,
- ReportOptions Opts) {
- SourceLocation Loc = Data->Loc.acquire();
- bool IsSigned = Data->Type.isSignedIntegerTy();
- ErrorType ET = IsSigned ? ErrorType::SignedIntegerOverflow
- : ErrorType::UnsignedIntegerOverflow;
- if (ignoreReport(Loc, Opts, ET))
- return;
- // If this is an unsigned overflow in non-fatal mode, potentially ignore it.
- if (!IsSigned && !Opts.FromUnrecoverableHandler &&
- flags()->silence_unsigned_overflow)
- return;
- ScopedReport R(Opts, Loc, ET);
- Diag(Loc, DL_Error, ET, "%0 integer overflow: "
- "%1 %2 %3 cannot be represented in type %4")
- << (IsSigned ? "signed" : "unsigned") << Value(Data->Type, LHS)
- << Operator << RHS << Data->Type;
- }
- #define UBSAN_OVERFLOW_HANDLER(handler_name, op, unrecoverable) \
- void __ubsan::handler_name(OverflowData *Data, ValueHandle LHS, \
- ValueHandle RHS) { \
- GET_REPORT_OPTIONS(unrecoverable); \
- handleIntegerOverflowImpl(Data, LHS, op, Value(Data->Type, RHS), Opts); \
- if (unrecoverable) \
- Die(); \
- }
- UBSAN_OVERFLOW_HANDLER(__ubsan_handle_add_overflow, "+", false)
- UBSAN_OVERFLOW_HANDLER(__ubsan_handle_add_overflow_abort, "+", true)
- UBSAN_OVERFLOW_HANDLER(__ubsan_handle_sub_overflow, "-", false)
- UBSAN_OVERFLOW_HANDLER(__ubsan_handle_sub_overflow_abort, "-", true)
- UBSAN_OVERFLOW_HANDLER(__ubsan_handle_mul_overflow, "*", false)
- UBSAN_OVERFLOW_HANDLER(__ubsan_handle_mul_overflow_abort, "*", true)
- static void handleNegateOverflowImpl(OverflowData *Data, ValueHandle OldVal,
- ReportOptions Opts) {
- SourceLocation Loc = Data->Loc.acquire();
- bool IsSigned = Data->Type.isSignedIntegerTy();
- ErrorType ET = IsSigned ? ErrorType::SignedIntegerOverflow
- : ErrorType::UnsignedIntegerOverflow;
- if (ignoreReport(Loc, Opts, ET))
- return;
- if (!IsSigned && flags()->silence_unsigned_overflow)
- return;
- ScopedReport R(Opts, Loc, ET);
- if (IsSigned)
- Diag(Loc, DL_Error, ET,
- "negation of %0 cannot be represented in type %1; "
- "cast to an unsigned type to negate this value to itself")
- << Value(Data->Type, OldVal) << Data->Type;
- else
- Diag(Loc, DL_Error, ET, "negation of %0 cannot be represented in type %1")
- << Value(Data->Type, OldVal) << Data->Type;
- }
- void __ubsan::__ubsan_handle_negate_overflow(OverflowData *Data,
- ValueHandle OldVal) {
- GET_REPORT_OPTIONS(false);
- handleNegateOverflowImpl(Data, OldVal, Opts);
- }
- void __ubsan::__ubsan_handle_negate_overflow_abort(OverflowData *Data,
- ValueHandle OldVal) {
- GET_REPORT_OPTIONS(true);
- handleNegateOverflowImpl(Data, OldVal, Opts);
- Die();
- }
- static void handleDivremOverflowImpl(OverflowData *Data, ValueHandle LHS,
- ValueHandle RHS, ReportOptions Opts) {
- SourceLocation Loc = Data->Loc.acquire();
- Value LHSVal(Data->Type, LHS);
- Value RHSVal(Data->Type, RHS);
- ErrorType ET;
- if (RHSVal.isMinusOne())
- ET = ErrorType::SignedIntegerOverflow;
- else if (Data->Type.isIntegerTy())
- ET = ErrorType::IntegerDivideByZero;
- else
- ET = ErrorType::FloatDivideByZero;
- if (ignoreReport(Loc, Opts, ET))
- return;
- ScopedReport R(Opts, Loc, ET);
- switch (ET) {
- case ErrorType::SignedIntegerOverflow:
- Diag(Loc, DL_Error, ET,
- "division of %0 by -1 cannot be represented in type %1")
- << LHSVal << Data->Type;
- break;
- default:
- Diag(Loc, DL_Error, ET, "division by zero");
- break;
- }
- }
- void __ubsan::__ubsan_handle_divrem_overflow(OverflowData *Data,
- ValueHandle LHS, ValueHandle RHS) {
- GET_REPORT_OPTIONS(false);
- handleDivremOverflowImpl(Data, LHS, RHS, Opts);
- }
- void __ubsan::__ubsan_handle_divrem_overflow_abort(OverflowData *Data,
- ValueHandle LHS,
- ValueHandle RHS) {
- GET_REPORT_OPTIONS(true);
- handleDivremOverflowImpl(Data, LHS, RHS, Opts);
- Die();
- }
- static void handleShiftOutOfBoundsImpl(ShiftOutOfBoundsData *Data,
- ValueHandle LHS, ValueHandle RHS,
- ReportOptions Opts) {
- SourceLocation Loc = Data->Loc.acquire();
- Value LHSVal(Data->LHSType, LHS);
- Value RHSVal(Data->RHSType, RHS);
- ErrorType ET;
- if (RHSVal.isNegative() ||
- RHSVal.getPositiveIntValue() >= Data->LHSType.getIntegerBitWidth())
- ET = ErrorType::InvalidShiftExponent;
- else
- ET = ErrorType::InvalidShiftBase;
- if (ignoreReport(Loc, Opts, ET))
- return;
- ScopedReport R(Opts, Loc, ET);
- if (ET == ErrorType::InvalidShiftExponent) {
- if (RHSVal.isNegative())
- Diag(Loc, DL_Error, ET, "shift exponent %0 is negative") << RHSVal;
- else
- Diag(Loc, DL_Error, ET,
- "shift exponent %0 is too large for %1-bit type %2")
- << RHSVal << Data->LHSType.getIntegerBitWidth() << Data->LHSType;
- } else {
- if (LHSVal.isNegative())
- Diag(Loc, DL_Error, ET, "left shift of negative value %0") << LHSVal;
- else
- Diag(Loc, DL_Error, ET,
- "left shift of %0 by %1 places cannot be represented in type %2")
- << LHSVal << RHSVal << Data->LHSType;
- }
- }
- void __ubsan::__ubsan_handle_shift_out_of_bounds(ShiftOutOfBoundsData *Data,
- ValueHandle LHS,
- ValueHandle RHS) {
- GET_REPORT_OPTIONS(false);
- handleShiftOutOfBoundsImpl(Data, LHS, RHS, Opts);
- }
- void __ubsan::__ubsan_handle_shift_out_of_bounds_abort(
- ShiftOutOfBoundsData *Data,
- ValueHandle LHS,
- ValueHandle RHS) {
- GET_REPORT_OPTIONS(true);
- handleShiftOutOfBoundsImpl(Data, LHS, RHS, Opts);
- Die();
- }
- static void handleOutOfBoundsImpl(OutOfBoundsData *Data, ValueHandle Index,
- ReportOptions Opts) {
- SourceLocation Loc = Data->Loc.acquire();
- ErrorType ET = ErrorType::OutOfBoundsIndex;
- if (ignoreReport(Loc, Opts, ET))
- return;
- ScopedReport R(Opts, Loc, ET);
- Value IndexVal(Data->IndexType, Index);
- Diag(Loc, DL_Error, ET, "index %0 out of bounds for type %1")
- << IndexVal << Data->ArrayType;
- }
- void __ubsan::__ubsan_handle_out_of_bounds(OutOfBoundsData *Data,
- ValueHandle Index) {
- GET_REPORT_OPTIONS(false);
- handleOutOfBoundsImpl(Data, Index, Opts);
- }
- void __ubsan::__ubsan_handle_out_of_bounds_abort(OutOfBoundsData *Data,
- ValueHandle Index) {
- GET_REPORT_OPTIONS(true);
- handleOutOfBoundsImpl(Data, Index, Opts);
- Die();
- }
- static void handleBuiltinUnreachableImpl(UnreachableData *Data,
- ReportOptions Opts) {
- ErrorType ET = ErrorType::UnreachableCall;
- ScopedReport R(Opts, Data->Loc, ET);
- Diag(Data->Loc, DL_Error, ET,
- "execution reached an unreachable program point");
- }
- void __ubsan::__ubsan_handle_builtin_unreachable(UnreachableData *Data) {
- GET_REPORT_OPTIONS(true);
- handleBuiltinUnreachableImpl(Data, Opts);
- Die();
- }
- static void handleMissingReturnImpl(UnreachableData *Data, ReportOptions Opts) {
- ErrorType ET = ErrorType::MissingReturn;
- ScopedReport R(Opts, Data->Loc, ET);
- Diag(Data->Loc, DL_Error, ET,
- "execution reached the end of a value-returning function "
- "without returning a value");
- }
- void __ubsan::__ubsan_handle_missing_return(UnreachableData *Data) {
- GET_REPORT_OPTIONS(true);
- handleMissingReturnImpl(Data, Opts);
- Die();
- }
- static void handleVLABoundNotPositive(VLABoundData *Data, ValueHandle Bound,
- ReportOptions Opts) {
- SourceLocation Loc = Data->Loc.acquire();
- ErrorType ET = ErrorType::NonPositiveVLAIndex;
- if (ignoreReport(Loc, Opts, ET))
- return;
- ScopedReport R(Opts, Loc, ET);
- Diag(Loc, DL_Error, ET, "variable length array bound evaluates to "
- "non-positive value %0")
- << Value(Data->Type, Bound);
- }
- void __ubsan::__ubsan_handle_vla_bound_not_positive(VLABoundData *Data,
- ValueHandle Bound) {
- GET_REPORT_OPTIONS(false);
- handleVLABoundNotPositive(Data, Bound, Opts);
- }
- void __ubsan::__ubsan_handle_vla_bound_not_positive_abort(VLABoundData *Data,
- ValueHandle Bound) {
- GET_REPORT_OPTIONS(true);
- handleVLABoundNotPositive(Data, Bound, Opts);
- Die();
- }
- static bool looksLikeFloatCastOverflowDataV1(void *Data) {
- // First field is either a pointer to filename or a pointer to a
- // TypeDescriptor.
- u8 *FilenameOrTypeDescriptor;
- internal_memcpy(&FilenameOrTypeDescriptor, Data,
- sizeof(FilenameOrTypeDescriptor));
- // Heuristic: For float_cast_overflow, the TypeKind will be either TK_Integer
- // (0x0), TK_Float (0x1) or TK_Unknown (0xff). If both types are known,
- // adding both bytes will be 0 or 1 (for BE or LE). If it were a filename,
- // adding two printable characters will not yield such a value. Otherwise,
- // if one of them is 0xff, this is most likely TK_Unknown type descriptor.
- u16 MaybeFromTypeKind =
- FilenameOrTypeDescriptor[0] + FilenameOrTypeDescriptor[1];
- return MaybeFromTypeKind < 2 || FilenameOrTypeDescriptor[0] == 0xff ||
- FilenameOrTypeDescriptor[1] == 0xff;
- }
- static void handleFloatCastOverflow(void *DataPtr, ValueHandle From,
- ReportOptions Opts) {
- SymbolizedStackHolder CallerLoc;
- Location Loc;
- const TypeDescriptor *FromType, *ToType;
- ErrorType ET = ErrorType::FloatCastOverflow;
- if (looksLikeFloatCastOverflowDataV1(DataPtr)) {
- auto Data = reinterpret_cast<FloatCastOverflowData *>(DataPtr);
- CallerLoc.reset(getCallerLocation(Opts.pc));
- Loc = CallerLoc;
- FromType = &Data->FromType;
- ToType = &Data->ToType;
- } else {
- auto Data = reinterpret_cast<FloatCastOverflowDataV2 *>(DataPtr);
- SourceLocation SLoc = Data->Loc.acquire();
- if (ignoreReport(SLoc, Opts, ET))
- return;
- Loc = SLoc;
- FromType = &Data->FromType;
- ToType = &Data->ToType;
- }
- ScopedReport R(Opts, Loc, ET);
- Diag(Loc, DL_Error, ET,
- "%0 is outside the range of representable values of type %2")
- << Value(*FromType, From) << *FromType << *ToType;
- }
- void __ubsan::__ubsan_handle_float_cast_overflow(void *Data, ValueHandle From) {
- GET_REPORT_OPTIONS(false);
- handleFloatCastOverflow(Data, From, Opts);
- }
- void __ubsan::__ubsan_handle_float_cast_overflow_abort(void *Data,
- ValueHandle From) {
- GET_REPORT_OPTIONS(true);
- handleFloatCastOverflow(Data, From, Opts);
- Die();
- }
- static void handleLoadInvalidValue(InvalidValueData *Data, ValueHandle Val,
- ReportOptions Opts) {
- SourceLocation Loc = Data->Loc.acquire();
- // This check could be more precise if we used different handlers for
- // -fsanitize=bool and -fsanitize=enum.
- bool IsBool = (0 == internal_strcmp(Data->Type.getTypeName(), "'bool'")) ||
- (0 == internal_strncmp(Data->Type.getTypeName(), "'BOOL'", 6));
- ErrorType ET =
- IsBool ? ErrorType::InvalidBoolLoad : ErrorType::InvalidEnumLoad;
- if (ignoreReport(Loc, Opts, ET))
- return;
- ScopedReport R(Opts, Loc, ET);
- Diag(Loc, DL_Error, ET,
- "load of value %0, which is not a valid value for type %1")
- << Value(Data->Type, Val) << Data->Type;
- }
- void __ubsan::__ubsan_handle_load_invalid_value(InvalidValueData *Data,
- ValueHandle Val) {
- GET_REPORT_OPTIONS(false);
- handleLoadInvalidValue(Data, Val, Opts);
- }
- void __ubsan::__ubsan_handle_load_invalid_value_abort(InvalidValueData *Data,
- ValueHandle Val) {
- GET_REPORT_OPTIONS(true);
- handleLoadInvalidValue(Data, Val, Opts);
- Die();
- }
- static void handleImplicitConversion(ImplicitConversionData *Data,
- ReportOptions Opts, ValueHandle Src,
- ValueHandle Dst) {
- SourceLocation Loc = Data->Loc.acquire();
- ErrorType ET = ErrorType::GenericUB;
- const TypeDescriptor &SrcTy = Data->FromType;
- const TypeDescriptor &DstTy = Data->ToType;
- bool SrcSigned = SrcTy.isSignedIntegerTy();
- bool DstSigned = DstTy.isSignedIntegerTy();
- switch (Data->Kind) {
- case ICCK_IntegerTruncation: { // Legacy, no longer used.
- // Let's figure out what it should be as per the new types, and upgrade.
- // If both types are unsigned, then it's an unsigned truncation.
- // Else, it is a signed truncation.
- if (!SrcSigned && !DstSigned) {
- ET = ErrorType::ImplicitUnsignedIntegerTruncation;
- } else {
- ET = ErrorType::ImplicitSignedIntegerTruncation;
- }
- break;
- }
- case ICCK_UnsignedIntegerTruncation:
- ET = ErrorType::ImplicitUnsignedIntegerTruncation;
- break;
- case ICCK_SignedIntegerTruncation:
- ET = ErrorType::ImplicitSignedIntegerTruncation;
- break;
- case ICCK_IntegerSignChange:
- ET = ErrorType::ImplicitIntegerSignChange;
- break;
- case ICCK_SignedIntegerTruncationOrSignChange:
- ET = ErrorType::ImplicitSignedIntegerTruncationOrSignChange;
- break;
- }
- if (ignoreReport(Loc, Opts, ET))
- return;
- ScopedReport R(Opts, Loc, ET);
- // FIXME: is it possible to dump the values as hex with fixed width?
- Diag(Loc, DL_Error, ET,
- "implicit conversion from type %0 of value %1 (%2-bit, %3signed) to "
- "type %4 changed the value to %5 (%6-bit, %7signed)")
- << SrcTy << Value(SrcTy, Src) << SrcTy.getIntegerBitWidth()
- << (SrcSigned ? "" : "un") << DstTy << Value(DstTy, Dst)
- << DstTy.getIntegerBitWidth() << (DstSigned ? "" : "un");
- }
- void __ubsan::__ubsan_handle_implicit_conversion(ImplicitConversionData *Data,
- ValueHandle Src,
- ValueHandle Dst) {
- GET_REPORT_OPTIONS(false);
- handleImplicitConversion(Data, Opts, Src, Dst);
- }
- void __ubsan::__ubsan_handle_implicit_conversion_abort(
- ImplicitConversionData *Data, ValueHandle Src, ValueHandle Dst) {
- GET_REPORT_OPTIONS(true);
- handleImplicitConversion(Data, Opts, Src, Dst);
- Die();
- }
- static void handleInvalidBuiltin(InvalidBuiltinData *Data, ReportOptions Opts) {
- SourceLocation Loc = Data->Loc.acquire();
- ErrorType ET = ErrorType::InvalidBuiltin;
- if (ignoreReport(Loc, Opts, ET))
- return;
- ScopedReport R(Opts, Loc, ET);
- Diag(Loc, DL_Error, ET,
- "passing zero to %0, which is not a valid argument")
- << ((Data->Kind == BCK_CTZPassedZero) ? "ctz()" : "clz()");
- }
- void __ubsan::__ubsan_handle_invalid_builtin(InvalidBuiltinData *Data) {
- GET_REPORT_OPTIONS(true);
- handleInvalidBuiltin(Data, Opts);
- }
- void __ubsan::__ubsan_handle_invalid_builtin_abort(InvalidBuiltinData *Data) {
- GET_REPORT_OPTIONS(true);
- handleInvalidBuiltin(Data, Opts);
- Die();
- }
- static void handleInvalidObjCCast(InvalidObjCCast *Data, ValueHandle Pointer,
- ReportOptions Opts) {
- SourceLocation Loc = Data->Loc.acquire();
- ErrorType ET = ErrorType::InvalidObjCCast;
- if (ignoreReport(Loc, Opts, ET))
- return;
- ScopedReport R(Opts, Loc, ET);
- const char *GivenClass = getObjCClassName(Pointer);
- const char *GivenClassStr = GivenClass ? GivenClass : "<unknown type>";
- Diag(Loc, DL_Error, ET,
- "invalid ObjC cast, object is a '%0', but expected a %1")
- << GivenClassStr << Data->ExpectedType;
- }
- void __ubsan::__ubsan_handle_invalid_objc_cast(InvalidObjCCast *Data,
- ValueHandle Pointer) {
- GET_REPORT_OPTIONS(false);
- handleInvalidObjCCast(Data, Pointer, Opts);
- }
- void __ubsan::__ubsan_handle_invalid_objc_cast_abort(InvalidObjCCast *Data,
- ValueHandle Pointer) {
- GET_REPORT_OPTIONS(true);
- handleInvalidObjCCast(Data, Pointer, Opts);
- Die();
- }
- static void handleNonNullReturn(NonNullReturnData *Data, SourceLocation *LocPtr,
- ReportOptions Opts, bool IsAttr) {
- if (!LocPtr)
- UNREACHABLE("source location pointer is null!");
- SourceLocation Loc = LocPtr->acquire();
- ErrorType ET = IsAttr ? ErrorType::InvalidNullReturn
- : ErrorType::InvalidNullReturnWithNullability;
- if (ignoreReport(Loc, Opts, ET))
- return;
- ScopedReport R(Opts, Loc, ET);
- Diag(Loc, DL_Error, ET,
- "null pointer returned from function declared to never return null");
- if (!Data->AttrLoc.isInvalid())
- Diag(Data->AttrLoc, DL_Note, ET, "%0 specified here")
- << (IsAttr ? "returns_nonnull attribute"
- : "_Nonnull return type annotation");
- }
- void __ubsan::__ubsan_handle_nonnull_return_v1(NonNullReturnData *Data,
- SourceLocation *LocPtr) {
- GET_REPORT_OPTIONS(false);
- handleNonNullReturn(Data, LocPtr, Opts, true);
- }
- void __ubsan::__ubsan_handle_nonnull_return_v1_abort(NonNullReturnData *Data,
- SourceLocation *LocPtr) {
- GET_REPORT_OPTIONS(true);
- handleNonNullReturn(Data, LocPtr, Opts, true);
- Die();
- }
- void __ubsan::__ubsan_handle_nullability_return_v1(NonNullReturnData *Data,
- SourceLocation *LocPtr) {
- GET_REPORT_OPTIONS(false);
- handleNonNullReturn(Data, LocPtr, Opts, false);
- }
- void __ubsan::__ubsan_handle_nullability_return_v1_abort(
- NonNullReturnData *Data, SourceLocation *LocPtr) {
- GET_REPORT_OPTIONS(true);
- handleNonNullReturn(Data, LocPtr, Opts, false);
- Die();
- }
- static void handleNonNullArg(NonNullArgData *Data, ReportOptions Opts,
- bool IsAttr) {
- SourceLocation Loc = Data->Loc.acquire();
- ErrorType ET = IsAttr ? ErrorType::InvalidNullArgument
- : ErrorType::InvalidNullArgumentWithNullability;
- if (ignoreReport(Loc, Opts, ET))
- return;
- ScopedReport R(Opts, Loc, ET);
- Diag(Loc, DL_Error, ET,
- "null pointer passed as argument %0, which is declared to "
- "never be null")
- << Data->ArgIndex;
- if (!Data->AttrLoc.isInvalid())
- Diag(Data->AttrLoc, DL_Note, ET, "%0 specified here")
- << (IsAttr ? "nonnull attribute" : "_Nonnull type annotation");
- }
- void __ubsan::__ubsan_handle_nonnull_arg(NonNullArgData *Data) {
- GET_REPORT_OPTIONS(false);
- handleNonNullArg(Data, Opts, true);
- }
- void __ubsan::__ubsan_handle_nonnull_arg_abort(NonNullArgData *Data) {
- GET_REPORT_OPTIONS(true);
- handleNonNullArg(Data, Opts, true);
- Die();
- }
- void __ubsan::__ubsan_handle_nullability_arg(NonNullArgData *Data) {
- GET_REPORT_OPTIONS(false);
- handleNonNullArg(Data, Opts, false);
- }
- void __ubsan::__ubsan_handle_nullability_arg_abort(NonNullArgData *Data) {
- GET_REPORT_OPTIONS(true);
- handleNonNullArg(Data, Opts, false);
- Die();
- }
- static void handlePointerOverflowImpl(PointerOverflowData *Data,
- ValueHandle Base,
- ValueHandle Result,
- ReportOptions Opts) {
- SourceLocation Loc = Data->Loc.acquire();
- ErrorType ET;
- if (Base == 0 && Result == 0)
- ET = ErrorType::NullptrWithOffset;
- else if (Base == 0 && Result != 0)
- ET = ErrorType::NullptrWithNonZeroOffset;
- else if (Base != 0 && Result == 0)
- ET = ErrorType::NullptrAfterNonZeroOffset;
- else
- ET = ErrorType::PointerOverflow;
- if (ignoreReport(Loc, Opts, ET))
- return;
- ScopedReport R(Opts, Loc, ET);
- if (ET == ErrorType::NullptrWithOffset) {
- Diag(Loc, DL_Error, ET, "applying zero offset to null pointer");
- } else if (ET == ErrorType::NullptrWithNonZeroOffset) {
- Diag(Loc, DL_Error, ET, "applying non-zero offset %0 to null pointer")
- << Result;
- } else if (ET == ErrorType::NullptrAfterNonZeroOffset) {
- Diag(
- Loc, DL_Error, ET,
- "applying non-zero offset to non-null pointer %0 produced null pointer")
- << (void *)Base;
- } else if ((sptr(Base) >= 0) == (sptr(Result) >= 0)) {
- if (Base > Result)
- Diag(Loc, DL_Error, ET,
- "addition of unsigned offset to %0 overflowed to %1")
- << (void *)Base << (void *)Result;
- else
- Diag(Loc, DL_Error, ET,
- "subtraction of unsigned offset from %0 overflowed to %1")
- << (void *)Base << (void *)Result;
- } else {
- Diag(Loc, DL_Error, ET,
- "pointer index expression with base %0 overflowed to %1")
- << (void *)Base << (void *)Result;
- }
- }
- void __ubsan::__ubsan_handle_pointer_overflow(PointerOverflowData *Data,
- ValueHandle Base,
- ValueHandle Result) {
- GET_REPORT_OPTIONS(false);
- handlePointerOverflowImpl(Data, Base, Result, Opts);
- }
- void __ubsan::__ubsan_handle_pointer_overflow_abort(PointerOverflowData *Data,
- ValueHandle Base,
- ValueHandle Result) {
- GET_REPORT_OPTIONS(true);
- handlePointerOverflowImpl(Data, Base, Result, Opts);
- Die();
- }
- static void handleCFIBadIcall(CFICheckFailData *Data, ValueHandle Function,
- ReportOptions Opts) {
- if (Data->CheckKind != CFITCK_ICall && Data->CheckKind != CFITCK_NVMFCall)
- Die();
- SourceLocation Loc = Data->Loc.acquire();
- ErrorType ET = ErrorType::CFIBadType;
- if (ignoreReport(Loc, Opts, ET))
- return;
- ScopedReport R(Opts, Loc, ET);
- const char *CheckKindStr = Data->CheckKind == CFITCK_NVMFCall
- ? "non-virtual pointer to member function call"
- : "indirect function call";
- Diag(Loc, DL_Error, ET,
- "control flow integrity check for type %0 failed during %1")
- << Data->Type << CheckKindStr;
- SymbolizedStackHolder FLoc(getSymbolizedLocation(Function));
- const char *FName = FLoc.get()->info.function;
- if (!FName)
- FName = "(unknown)";
- Diag(FLoc, DL_Note, ET, "%0 defined here") << FName;
- // If the failure involved different DSOs for the check location and icall
- // target, report the DSO names.
- const char *DstModule = FLoc.get()->info.module;
- if (!DstModule)
- DstModule = "(unknown)";
- const char *SrcModule = Symbolizer::GetOrInit()->GetModuleNameForPc(Opts.pc);
- if (!SrcModule)
- SrcModule = "(unknown)";
- if (internal_strcmp(SrcModule, DstModule))
- Diag(Loc, DL_Note, ET,
- "check failed in %0, destination function located in %1")
- << SrcModule << DstModule;
- }
- namespace __ubsan {
- #ifdef UBSAN_CAN_USE_CXXABI
- #ifdef _WIN32
- extern "C" void __ubsan_handle_cfi_bad_type_default(CFICheckFailData *Data,
- ValueHandle Vtable,
- bool ValidVtable,
- ReportOptions Opts) {
- Die();
- }
- WIN_WEAK_ALIAS(__ubsan_handle_cfi_bad_type, __ubsan_handle_cfi_bad_type_default)
- #else
- SANITIZER_WEAK_ATTRIBUTE
- #endif
- void __ubsan_handle_cfi_bad_type(CFICheckFailData *Data, ValueHandle Vtable,
- bool ValidVtable, ReportOptions Opts);
- #else
- void __ubsan_handle_cfi_bad_type(CFICheckFailData *Data, ValueHandle Vtable,
- bool ValidVtable, ReportOptions Opts) {
- Die();
- }
- #endif
- } // namespace __ubsan
- void __ubsan::__ubsan_handle_cfi_check_fail(CFICheckFailData *Data,
- ValueHandle Value,
- uptr ValidVtable) {
- GET_REPORT_OPTIONS(false);
- if (Data->CheckKind == CFITCK_ICall || Data->CheckKind == CFITCK_NVMFCall)
- handleCFIBadIcall(Data, Value, Opts);
- else
- __ubsan_handle_cfi_bad_type(Data, Value, ValidVtable, Opts);
- }
- void __ubsan::__ubsan_handle_cfi_check_fail_abort(CFICheckFailData *Data,
- ValueHandle Value,
- uptr ValidVtable) {
- GET_REPORT_OPTIONS(true);
- if (Data->CheckKind == CFITCK_ICall || Data->CheckKind == CFITCK_NVMFCall)
- handleCFIBadIcall(Data, Value, Opts);
- else
- __ubsan_handle_cfi_bad_type(Data, Value, ValidVtable, Opts);
- Die();
- }
- #endif // CAN_SANITIZE_UB
|