This is the mail archive of the
gcc-patches@gcc.gnu.org
mailing list for the GCC project.
Re: [RFC PATCH] -fsanitize=pointer-overflow support (PR sanitizer/80998)
- From: Jakub Jelinek <jakub at redhat dot com>
- To: Richard Biener <rguenther at suse dot de>
- Cc: Martin Liška <mliska at suse dot cz>, gcc-patches at gcc dot gnu dot org
- Date: Wed, 21 Jun 2017 10:00:48 +0200
- Subject: Re: [RFC PATCH] -fsanitize=pointer-overflow support (PR sanitizer/80998)
- Authentication-results: sourceware.org; auth=none
- Authentication-results: ext-mx03.extmail.prod.ext.phx2.redhat.com; dmarc=none (p=none dis=none) header.from=redhat.com
- Authentication-results: ext-mx03.extmail.prod.ext.phx2.redhat.com; spf=pass smtp.mailfrom=jakub at redhat dot com
- Dkim-filter: OpenDKIM Filter v2.11.0 mx1.redhat.com C97D27C85E
- Dmarc-filter: OpenDMARC Filter v1.3.2 mx1.redhat.com C97D27C85E
- References: <20170619182515.GA2123@tucnak> <alpine.LSU.2.20.1706200928120.22867@zhemvz.fhfr.qr>
- Reply-to: Jakub Jelinek <jakub at redhat dot com>
On Tue, Jun 20, 2017 at 09:41:43AM +0200, Richard Biener wrote:
> > 2) libcpp/line-map.c has this:
> > static int
> > location_adhoc_data_update (void **slot, void *data)
> > {
> > *((char **) slot) += *((int64_t *) data);
> > return 1;
> > }
> > where the (why int64_t always?, we really need just intptr_t) adjusts
> > one pointer from an unrelated one (result of realloc). That is a UB
> > and actually can trigger this sanitization if the two regions are
> > far away from each other, e.g. on i686-linux:
> > ../../libcpp/line-map.c:102:21: runtime error: pointer index expression with base 0x0899e308 overflowed to 0xf74c4ab8
> > ../../libcpp/line-map.c:102:21: runtime error: pointer index expression with base 0x08add7c0 overflowed to 0xf74c9a08
> > ../../libcpp/line-map.c:102:21: runtime error: pointer index expression with base 0x092ba308 overflowed to 0xf741cab8
> > ../../libcpp/line-map.c:102:21: runtime error: pointer index expression with base 0x0a3757c0 overflowed to 0xf7453a08
> > Shall we perform the addition in uintptr_t instead to make it
> > implementation defined rather than UB?
>
> Yes.
Here is a patch for 2), bootstrap-ubsan bootstrapped/regtested on
x86_64-linux and i686-linux, ok for trunk?
Note both ptrdiff_t and uintptr_t are already used in libcpp, so I think
it shouldn't create new portability issues.
2017-06-21 Jakub Jelinek <jakub@redhat.com>
* line-map.c (location_adhoc_data_update): Perform addition in
uintptr_t type rather than char * type. Read *data using
ptrdiff_t type instead of int64_t.
(get_combined_adhoc_loc): Change offset type to ptrdiff_t from
int64_t.
--- libcpp/line-map.c.jj 2017-06-19 08:28:18.000000000 +0200
+++ libcpp/line-map.c 2017-06-20 16:43:25.193063344 +0200
@@ -99,7 +99,8 @@ location_adhoc_data_eq (const void *l1,
static int
location_adhoc_data_update (void **slot, void *data)
{
- *((char **) slot) += *((int64_t *) data);
+ *((char **) slot)
+ = (char *) ((uintptr_t) *((char **) slot) + *((ptrdiff_t *) data));
return 1;
}
@@ -221,7 +222,7 @@ get_combined_adhoc_loc (struct line_maps
set->location_adhoc_data_map.allocated)
{
char *orig_data = (char *) set->location_adhoc_data_map.data;
- int64_t offset;
+ ptrdiff_t offset;
/* Cast away extern "C" from the type of xrealloc. */
line_map_realloc reallocator = (set->reallocator
? set->reallocator
Jakub