Re: [PATCH 01/10] Initial import of asan from the Google branch into trunk

[Tobias Burnus <burnus at net-b dot de>]

Dodji Seketeli wrote:
> This patch imports the initial state of asan as it was in the
> Google branch.
>
> It provides basic infrastructure for asan to instrument memory
> accesses on the heap, at -O3.  Note that it supports neither stack nor
> global variable protection.

I tried the 01/10 to 10/10 patch series but it doesn't trigger for the 
following test case:

#include <stdlib.h>
#include <stdio.h>

int
main() {
  int *i;
  i = malloc(10*sizeof(*i));
  free(i);  /* <<< Free memory. */
  i[10] = 5;  /* <<< out of boundary even if not freed. */
  printf("%d\n", i[11]);  /* <<< out of boundary even if not freed. */
  return 0;
}

(All of them are reported by Clang.) If I look at the dump (or 
assembler), I see the call to __asan_init, __asan_report_store4 and 
__asan_report_load4. However, when running the program ltrace only shows 
the calls to: __libc_start_main, __asan_init, malloc, free and printf. I 
haven't debugged why the condition is false [see attachment for the dump].


Other issues:

* libasan does not seem to be a multilib, at least I only find the 64bit 
version on x86-64-gnu-linux such that "-m32" compilation fails.

* -fno-address-sanitizer doesn't work (it does in Clang); it is 
explicitly disabled via RejectNegative in gcc/common.opt

* Probably fixed on the branch: gcc/gcc.c still has "fasan" instead of 
"faddress-sanitizer" for the spec:
+    %{fasan:-lasan}

Tobias
#include <stdlib.h>
#include <stdio.h>

int
main() {
  int *i;
  i = malloc(10*sizeof(*i));
  free(i);  /* <<< Free memory. */
  i[10] = 5;  /* <<< out of boundary even if not freed. */
  printf("%d\n", i[11]);  /* <<< out of boundary even if not freed. */
  return 0;
}

Attachment: hjf.c.156t.asan0
Description: Text document