1 // Test how we produce the scariness score.
3 // RUN: %clangxx_asan -O0 %s -o %t
4 // On OSX and Windows, alloc_dealloc_mismatch=1 isn't 100% reliable, so it's
5 // off by default. It's safe for these tests, though, so we turn it on.
6 // RUN: export %env_asan_opts=detect_stack_use_after_return=1:handle_abort=1:print_scariness=1:alloc_dealloc_mismatch=1
7 // Make sure the stack is limited (may not be the default under GNU make)
9 // RUN: not %run %t 1 2>&1 | FileCheck %s --check-prefix=CHECK1
10 // RUN: not %run %t 2 2>&1 | FileCheck %s --check-prefix=CHECK2
11 // RUN: not %run %t 3 2>&1 | FileCheck %s --check-prefix=CHECK3
12 // RUN: not %run %t 4 2>&1 | FileCheck %s --check-prefix=CHECK4
13 // RUN: not %run %t 5 2>&1 | FileCheck %s --check-prefix=CHECK5
14 // RUN: not %run %t 6 2>&1 | FileCheck %s --check-prefix=CHECK6
15 // RUN: not %run %t 7 2>&1 | FileCheck %s --check-prefix=CHECK7
16 // RUN: not %run %t 8 2>&1 | FileCheck %s --check-prefix=CHECK8
17 // RUN: not %run %t 9 2>&1 | FileCheck %s --check-prefix=CHECK9
18 // RUN: not %run %t 10 2>&1 | FileCheck %s --check-prefix=CHECK10
19 // RUN: not %run %t 11 2>&1 | FileCheck %s --check-prefix=CHECK11
20 // RUN: not %run %t 12 2>&1 | FileCheck %s --check-prefix=CHECK12
21 // RUN: not %run %t 13 2>&1 | FileCheck %s --check-prefix=CHECK13
22 // RUN: not %run %t 14 2>&1 | FileCheck %s --check-prefix=CHECK14
23 // RUN: not %run %t 15 2>&1 | FileCheck %s --check-prefix=CHECK15
24 // RUN: not %run %t 16 2>&1 | FileCheck %s --check-prefix=CHECK16
25 // RUN: not %run %t 17 2>&1 | FileCheck %s --check-prefix=CHECK17
26 // RUN: not %run %t 18 2>&1 | FileCheck %s --check-prefix=CHECK18
27 // RUN: not %run %t 19 2>&1 | FileCheck %s --check-prefix=CHECK19
28 // RUN: not %run %t 20 2>&1 | FileCheck %s --check-prefix=CHECK20
29 // RUN: not %run %t 21 2>&1 | FileCheck %s --check-prefix=CHECK21
30 // RUN: not %run %t 22 2>&1 | FileCheck %s --check-prefix=CHECK22
31 // RUN: not %run %t 23 2>&1 | FileCheck %s --check-prefix=CHECK23
32 // RUN: not %run %t 24 2>&1 | FileCheck %s --check-prefix=CHECK24
33 // RUN: not %run %t 25 2>&1 | FileCheck %s --check-prefix=CHECK25
34 // RUN: not %run %t 26 2>&1 | FileCheck %s --check-prefix=CHECK26
35 // RUN: not %run %t 27 2>&1 | FileCheck %s --check-prefix=CHECK27
36 // Parts of the test are too platform-specific:
37 // REQUIRES: x86_64-target-arch
44 #include <sanitizer/asan_interface.h>
46 enum ReadOrWrite { Read = 0, Write = 1 };
53 void HeapBuferOverflow(int Idx, ReadOrWrite w) {
64 void HeapUseAfterFree(int Idx, ReadOrWrite w) {
76 void StackBufferOverflow(int Idx, ReadOrWrite w) {
95 void StackUseAfterReturn(int Idx, ReadOrWrite w) {
97 T *t = LeakStack<T>();
112 static volatile int two = 2;
113 for (int i = 0; i < two; i++)
117 void StackOverflow(int Idx) {
119 static volatile int *x;
122 StackOverflow(Idx - 1);
125 void UseAfterPoison() {
127 __asan_poison_memory_region(buf, sizeof(buf));
128 static volatile int sink;
132 int main(int argc, char **argv) {
135 __asan_get_shadow_mapping(&scale, &offset);
136 size_t grain = 1 << scale;
139 static volatile int zero = 0;
140 static volatile int *zero_ptr = 0;
141 static volatile int *wild_addr = (int*)0x10000000; // System-dependent.
142 if (argc != 2) return 1;
143 int kind = atoi(argv[1]);
145 case 1: HeapBuferOverflow<char>(0, Read); break;
146 case 2: HeapBuferOverflow<int>(0, Read); break;
147 case 3: HeapBuferOverflow<short>(0, Write); break;
148 case 4: HeapBuferOverflow<int64_t>(
149 2 * std::max(1, (int)(grain / sizeof(int64_t))), Write); break;
150 case 5: HeapBuferOverflow<S32>(4, Write); break;
151 case 6: HeapUseAfterFree<char>(0, Read); break;
152 case 7: HeapUseAfterFree<int>(0, Write); break;
153 case 8: HeapUseAfterFree<int64_t>(0, Read); break;
154 case 9: HeapUseAfterFree<S32>(0, Write); break;
155 case 10: StackBufferOverflow<char>(0, Write); break;
156 case 11: StackBufferOverflow<int64_t>(0, Read); break;
159 StackBufferOverflow<int>(16, Write);
161 // At large shadow granularity, there is not enough redzone
162 // between stack elements to detect far-from-bounds. Pretend
163 // that this test passes.
164 fprintf(stderr, "SCARINESS: 61 "
165 "(4-byte-write-stack-buffer-overflow-far-from-bounds)\n");
169 case 13: StackUseAfterReturn<char>(0, Read); break;
170 case 14: StackUseAfterReturn<S32>(0, Write); break;
171 case 15: g1[zero + 100] = 0; break;
172 case 16: gm[0] = gm[zero + 100 + 1]; break;
173 case 17: DoubleFree(); break;
174 case 18: StackOverflow(1000000); break;
175 case 19: *zero_ptr = 0; break;
176 case 20: *wild_addr = 0; break;
177 case 21: zero = *wild_addr; break;
178 case 22: ((void (*)(void))wild_addr)(); break;
179 case 23: delete (new int[10]); break;
180 case 24: free((char*)malloc(100) + 10); break;
181 case 25: memcpy(arr, arr+10, 20); break;
182 case 26: UseAfterPoison(); break;
184 // CHECK1: SCARINESS: 12 (1-byte-read-heap-buffer-overflow)
185 // CHECK2: SCARINESS: 17 (4-byte-read-heap-buffer-overflow)
186 // CHECK3: SCARINESS: 33 (2-byte-write-heap-buffer-overflow)
187 // CHECK4: SCARINESS: 52 (8-byte-write-heap-buffer-overflow-far-from-bounds)
188 // CHECK5: SCARINESS: 55 (multi-byte-write-heap-buffer-overflow-far-from-bounds)
189 // CHECK6: SCARINESS: 40 (1-byte-read-heap-use-after-free)
190 // CHECK7: SCARINESS: 46 (4-byte-write-heap-use-after-free)
191 // CHECK8: SCARINESS: 51 (8-byte-read-heap-use-after-free)
192 // CHECK9: SCARINESS: 55 (multi-byte-write-heap-use-after-free)
193 // CHECK10: SCARINESS: 46 (1-byte-write-stack-buffer-overflow)
194 // CHECK11: SCARINESS: 38 (8-byte-read-stack-buffer-overflow)
195 // CHECK12: SCARINESS: 61 (4-byte-write-stack-buffer-overflow-far-from-bounds)
196 // CHECK13: SCARINESS: 50 (1-byte-read-stack-use-after-return)
197 // CHECK14: SCARINESS: 65 (multi-byte-write-stack-use-after-return)
198 // CHECK15: SCARINESS: 31 (1-byte-write-global-buffer-overflow)
199 // CHECK16: SCARINESS: 36 (multi-byte-read-global-buffer-overflow-far-from-bounds)
200 // CHECK17: SCARINESS: 42 (double-free)
201 // CHECK18: SCARINESS: 10 (stack-overflow)
202 // CHECK19: SCARINESS: 10 (null-deref)
203 // CHECK20: SCARINESS: 30 (wild-addr-write)
204 // CHECK21: SCARINESS: 20 (wild-addr-read)
205 // CHECK22: SCARINESS: 60 (wild-jump)
206 // CHECK23: SCARINESS: 10 (alloc-dealloc-mismatch)
207 // CHECK24: SCARINESS: 40 (bad-free)
208 // CHECK25: SCARINESS: 10 (memcpy-param-overlap)
209 // CHECK26: SCARINESS: 27 (4-byte-read-use-after-poison)
210 // CHECK27: SCARINESS: 10 (signal)