diff options
author | Vedant Kumar <vsk@apple.com> | 2017-06-12 18:42:51 +0000 |
---|---|---|
committer | Vedant Kumar <vsk@apple.com> | 2017-06-12 18:42:51 +0000 |
commit | 079b7657767dcc0fb284225c277d2b9ce73e423b (patch) | |
tree | 397be1511cdd1accb55cbc1eb8a563bdd306b6cb | |
parent | a2b9a14ce8ed68ce8678fb20a25a140a011a9198 (diff) | |
download | compiler-rt-079b7657767dcc0fb284225c277d2b9ce73e423b.tar.gz |
[ubsan] Detect invalid unsigned pointer index expression (compiler-rt)
Compiler-rt part of: https://reviews.llvm.org/D33910
Differential Revision: https://reviews.llvm.org/D33911
git-svn-id: https://llvm.org/svn/llvm-project/compiler-rt/trunk@305217 91177308-0d34-0410-b5e6-96231b3b80d8
-rw-r--r-- | lib/ubsan/ubsan_handlers.cc | 10 | ||||
-rw-r--r-- | test/ubsan/TestCases/Pointer/unsigned-index-expression.cpp | 13 |
2 files changed, 21 insertions, 2 deletions
diff --git a/lib/ubsan/ubsan_handlers.cc b/lib/ubsan/ubsan_handlers.cc index 80cc8ad25..5dabbd8e0 100644 --- a/lib/ubsan/ubsan_handlers.cc +++ b/lib/ubsan/ubsan_handlers.cc @@ -566,8 +566,14 @@ static void handlePointerOverflowImpl(PointerOverflowData *Data, ScopedReport R(Opts, Loc, ET); - Diag(Loc, DL_Error, "pointer index expression with base %0 overflowed to %1") - << (void *)Base << (void*)Result; + if ((sptr(Base) >= 0) == (sptr(Result) >= 0)) + Diag(Loc, DL_Error, "unsigned pointer index expression result is %0, " + "preceding its base %1") + << (void *)Result << (void *)Base; + else + Diag(Loc, DL_Error, + "pointer index expression with base %0 overflowed to %1") + << (void *)Base << (void *)Result; } void __ubsan::__ubsan_handle_pointer_overflow(PointerOverflowData *Data, diff --git a/test/ubsan/TestCases/Pointer/unsigned-index-expression.cpp b/test/ubsan/TestCases/Pointer/unsigned-index-expression.cpp new file mode 100644 index 000000000..991374b5a --- /dev/null +++ b/test/ubsan/TestCases/Pointer/unsigned-index-expression.cpp @@ -0,0 +1,13 @@ +// RUN: %clangxx -fsanitize=pointer-overflow %s -o %t +// RUN: %t 2>&1 | FileCheck %s + +int main(int argc, char *argv[]) { + char c; + char *p = &c; + unsigned long long offset = -1; + + // CHECK: unsigned-index-expression.cpp:[[@LINE+1]]:15: runtime error: unsigned pointer index expression result is 0x{{.*}}, preceding its base 0x{{.*}} + char *q = p + offset; + + return 0; +} |