From patchwork Fri Mar 29 16:07:02 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Qing Zhao X-Patchwork-Id: 1917869 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=oracle.com header.i=@oracle.com header.a=rsa-sha256 header.s=corp-2023-11-20 header.b=TZKrsn7F; dkim=pass (1024-bit key; unprotected) header.d=oracle.onmicrosoft.com header.i=@oracle.onmicrosoft.com header.a=rsa-sha256 header.s=selector2-oracle-onmicrosoft-com header.b=ZuYxww1U; dkim-atps=neutral Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=gcc.gnu.org (client-ip=2620:52:3:1:0:246e:9693:128c; helo=server2.sourceware.org; envelope-from=gcc-patches-bounces+incoming=patchwork.ozlabs.org@gcc.gnu.org; receiver=patchwork.ozlabs.org) Received: from server2.sourceware.org (server2.sourceware.org [IPv6:2620:52:3:1:0:246e:9693:128c]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (secp384r1) server-digest SHA384) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4V5lkf57qRz1yXw for ; Sat, 30 Mar 2024 03:10:50 +1100 (AEDT) Received: from server2.sourceware.org (localhost [IPv6:::1]) by sourceware.org (Postfix) with ESMTP id EDC433858CDB for ; Fri, 29 Mar 2024 16:10:48 +0000 (GMT) X-Original-To: gcc-patches@gcc.gnu.org Delivered-To: gcc-patches@gcc.gnu.org Received: from mx0b-00069f02.pphosted.com (mx0b-00069f02.pphosted.com [205.220.177.32]) by sourceware.org (Postfix) with ESMTPS id 1788C385842D for ; Fri, 29 Mar 2024 16:07:27 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org 1788C385842D Authentication-Results: sourceware.org; dmarc=pass (p=none dis=none) header.from=oracle.com Authentication-Results: sourceware.org; spf=pass smtp.mailfrom=oracle.com ARC-Filter: OpenARC Filter v1.0.0 sourceware.org 1788C385842D Authentication-Results: server2.sourceware.org; arc=pass smtp.remote-ip=205.220.177.32 ARC-Seal: i=2; a=rsa-sha256; d=sourceware.org; s=key; t=1711728452; cv=pass; b=K5566DZi0CHGwzS7B3lp7+KJOH+UmAJgvUt3J7Ft0RJ6pn1m0v8RzyS3gc8IryZJExFm0m6er2669hpQ0RXpxRJvBzh5fX0jStF+tBmCCJC4/J5Y4RML5WX3JJMcokn5AkVPKmaLJRRuIyyyiJPCQoFVjs0xppesP7WMERkZoT0= ARC-Message-Signature: i=2; a=rsa-sha256; d=sourceware.org; s=key; t=1711728452; c=relaxed/simple; bh=VYUdRmfEB4cFFMIRemDI8zFmG/JE6raxBSU4mCyIkg0=; h=DKIM-Signature:DKIM-Signature:From:To:Subject:Date:Message-Id: MIME-Version; b=rOrpkmTk6nSrPviFpBDAWFeBnUkUpgZk+P5u3bmY0JtyZRKPJHpqlKDSnqvAie5rfyf5fyx9dvY+3NpFoRhnDT+2P+wPeDssVZjCnzaAmgDWeMbRkLa9fawEDJlTfPUocKL/yiMsqLtApyN3Fy0N+FIKJMj422pWSPwEhZ70jIc= ARC-Authentication-Results: i=2; server2.sourceware.org Received: from pps.filterd (m0246631.ppops.net [127.0.0.1]) by mx0b-00069f02.pphosted.com (8.17.1.19/8.17.1.19) with ESMTP id 42TFNnWZ030325; Fri, 29 Mar 2024 16:07:26 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : content-transfer-encoding : content-type : mime-version; s=corp-2023-11-20; bh=oKYSrntSY5aRPtPOaaLCJLyKDz2RVKzXgLdz/F6HqBM=; b=TZKrsn7FfTg0n0hoIlHEIT6gJayVnYiXh93rj1aD06sxcijnFpL7QlqHZ5qAGfxvyWtH /8T1D706ST8MlqJDnp0VeEjIX72okSanTX7XHx8/LdMTyQ77At8C3c5oyqt/fRFbFLI9 wBrObUxSDWaoIlfsNQ158R0dORbS/4wTLGkPutWRpkLx42br4K71x+1esni2QuE6Jt38 //w9NPdfeOBDe4myS4mn8rnN2bZQmgydv9uJqdcl8weOUp97y6dpqRmlfi5Xws8CfDEu bGHqs8z1djD2LUOKT3biQmvZF8LrGlgHDJOiGMLhGd8O7S6KL1kiJVBEa/Q4/IYsHHtf oA== Received: from iadpaimrmta02.imrmtpd1.prodappiadaev1.oraclevcn.com (iadpaimrmta02.appoci.oracle.com [147.154.18.20]) by mx0b-00069f02.pphosted.com (PPS) with ESMTPS id 3x1nv4bwy8-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Fri, 29 Mar 2024 16:07:25 +0000 Received: from pps.filterd (iadpaimrmta02.imrmtpd1.prodappiadaev1.oraclevcn.com [127.0.0.1]) by iadpaimrmta02.imrmtpd1.prodappiadaev1.oraclevcn.com (8.17.1.19/8.17.1.19) with ESMTP id 42TEg9gK019129; Fri, 29 Mar 2024 16:07:25 GMT Received: from nam04-bn8-obe.outbound.protection.outlook.com (mail-bn8nam04lp2040.outbound.protection.outlook.com [104.47.74.40]) by iadpaimrmta02.imrmtpd1.prodappiadaev1.oraclevcn.com (PPS) with ESMTPS id 3x1nhhqv7a-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Fri, 29 Mar 2024 16:07:25 +0000 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=MQYn0IB7ZvEtYioK7QdzCp7bC07jECLy3pCC4c9JkWcDX+MrLaZQBlk0JVPoZkWIRfd++lTiuz1z9y8i/tfmzX27ifCWuvTUKvhJkQ7zvbL2qcgFoeiejuXJKDa6pQfHQ5SKFjnwCRQYjDCZVvQZv0R5+DExI5bJMgupmQxhww61tWpj2UqjRH0GntTVZeEPBp+K6m0ihkLT0TLa+LsgcSKaitXFHopZ3zx0+HcKA4hQubONEzOd83530NLIWmjxgcFPOq55lt06w0TGJBsMuoYDyYfs7hshWVI+mHU1QypvtmCiyoJNXJTQv3/+oVF7OGUPnlVvzQ/9rKlGOyOeQw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=oKYSrntSY5aRPtPOaaLCJLyKDz2RVKzXgLdz/F6HqBM=; b=YgELT5+XVvirTWH3bdtnFXXYHhHTYdoIMGqnVTHCHa/NBZSjffDIcQQ97wvJK1pnPjXCQfszUvZJzwUhDWR0Xdk6b9b0T4GUOaRaHkG1oyASjdAHt1VzoPjjfSkGGx58isq8AyJJfz8cbe42nOP3EVyu7ZbeRzd9AEqZWkE6Bc6+dcUa7VcXyGYkrnfWQaJ1Qu92Yez1Y4K36rTWDsI4usaKRE7R4ur7Cx9HewsH7eCTT1dV0XD0xPEEtvU4omq/LXkt61aEFZK/N2K2hhwcIWIFheKEyY3goVlYLou6tDWZFU4N6MUbyiorGNVxDQAPVbKrd7OwVJRL2BBok5LktQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=oracle.com; dmarc=pass action=none header.from=oracle.com; dkim=pass header.d=oracle.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.onmicrosoft.com; s=selector2-oracle-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=oKYSrntSY5aRPtPOaaLCJLyKDz2RVKzXgLdz/F6HqBM=; b=ZuYxww1UPUKRRiE+xEK43MSPGiSXpQ4HXPbtgKX22GL9iIMkc+ZvM8UBLv1Y30nAdVQPtveK2X7vbY1SD5HBQhXhgk957ztaRXWqRHpU6QnFLNzg/hWjp28q/dZAohWeb/PubdCBbEUNJt98mAi0k4GUPXbSSVZ2AOFtjQsJ4BY= Received: from CY8PR10MB6538.namprd10.prod.outlook.com (2603:10b6:930:5a::17) by SJ0PR10MB4638.namprd10.prod.outlook.com (2603:10b6:a03:2d8::18) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7409.31; Fri, 29 Mar 2024 16:07:23 +0000 Received: from CY8PR10MB6538.namprd10.prod.outlook.com ([fe80::2dae:7852:9563:b4bc]) by CY8PR10MB6538.namprd10.prod.outlook.com ([fe80::2dae:7852:9563:b4bc%6]) with mapi id 15.20.7409.039; Fri, 29 Mar 2024 16:07:23 +0000 From: Qing Zhao To: josmyers@redhat.com, richard.guenther@gmail.com, siddhesh@gotplt.org, uecker@tugraz.at Cc: keescook@chromium.org, isanbard@gmail.com, gcc-patches@gcc.gnu.org, Qing Zhao Subject: [PATCH v8 4/5] Use the .ACCESS_WITH_SIZE in bound sanitizer. Date: Fri, 29 Mar 2024 16:07:02 +0000 Message-Id: <20240329160703.4012941-5-qing.zhao@oracle.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20240329160703.4012941-1-qing.zhao@oracle.com> References: <20240329160703.4012941-1-qing.zhao@oracle.com> X-ClientProxiedBy: SJ0PR05CA0122.namprd05.prod.outlook.com (2603:10b6:a03:33d::7) To CY8PR10MB6538.namprd10.prod.outlook.com (2603:10b6:930:5a::17) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: CY8PR10MB6538:EE_|SJ0PR10MB4638:EE_ X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: iHKratZ+ll6DAZAlKPQs1ds45ejfiHU3OCUU1vn/4NTzKpjNYFh/DJytNIiUYCVWIoSZuThriK8yooMqEhzsxg2X8ZUB7uVqKTLpCtDQhfe5WNhKv2XG2cePh2DA4AGICnXvwQGrDO3s0Kddl1TmKOGPSutJwE/TaOk6cFPOttJd+48WFASFmebCK27prHNJoElb1j/iBjdEd6r0U8PtTAs1nk5ArcvOKXcDTJGhAA7UwatNnU032+fqGJO3s53W7GPPO+zpHV/+iYNL3g1KM8K7wiG8RK4lTvZBK/nnzAn7yivDMI/TflX5gmW98Ifch4zYQSA8nMBmnO09re7WxgIr0TE1rODwpdqWSteqNSQSPydbSJ1aF3UmzQLOk34etx56VA3AGM7ot44jCuC14D3YbKzMsS6zPtTY4A7Kl6/KeZRX1/h2y5ippoNJY03Uz0ndZEHrnwXlej+RjVTaqYqmwwJrbwGGVp67mzuZImfLPRpjl50UZ0HufoN7/fWjYjGRznHusgrAunO/gtmngUvaUJBhjkLXrskJx1QkGvI7NAO8cGZ7GcEtc9LqMQKOfQbG7hECutL88Wn8QhJrzEYQAVN1kJQ5vI/0wLNpLhWnWPUvvJ+y9DkNN/KJMzbH X-Forefront-Antispam-Report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:CY8PR10MB6538.namprd10.prod.outlook.com; PTR:; CAT:NONE; SFS:(13230031)(376005)(1800799015)(366007); DIR:OUT; SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: V82pc1aTEsquD+Lx+sQGBo1egr64iQdmPAdHva4V+oXbiRnG5iYenujMRXt0jfUIjhJ++yeT8KgLUdekEusOKu5EbyWAiVlJs9jXFmAgKcNKi+QuN1VcJNuZ6q2YXM9BlblLPWuFmy3kZwQ05UNuQzYwfQ6QyZisSZsUowBtQ1ANy0ecDLpU2zlVSDJ4TlydyeF4xK00CsPitSBgofVtBlPl2YG27DMXkTaDMe3wnw3Ewzes5vWD0RU5Dk+EfD8x6dYNmfqSM6opNHrR1q54AB/Sh/ZfDz15hlLfGdKzFKr4TcoQ0HfwGUGKgKGlC+D3H9NMopOPvbvOmwy+XIVzMFrF17IKqQEzM9kuO6tpgZfNIE7cKf7+9FbH+O9KJJY8LCpxzkZiBKN0tWskxNGhy+KWQFW/R9LKQk5y3ir8IUnRGq8iI3ewEIOHQcKmDUnA2BujXCUUlORs+XXRWesvfLAwJA1wvRoPj5pWnlqhNZ1gHSK+XzqfyVv+Ggz7KQ25Ysr9hIpXDdRoJeU/R3xq6MQA5Lew6Qdu/KwjRX9tTCnROh5rOSYA1MTLo0OdX8SHDnnFi4JJ1r/kxvLLIgww4OuPIvoTDNHHGl9n9wr69vR5+hDm7nq65aOfsOHzVgYzDceOuKx1vrshN+a0kXr/1EIVJgT4cLs14Y26pEcGHlzeGKkwOX+t4NKfBFj7kD0unGbAhS/smyqslFQa5KhPwKVi8d5OPh5/6UDZF35E8XxIP5iX+5tPMWk00BnzGoiqOQ0pQIokEuKZ5ruMz8eK6F8+6lJN78vQB28xiaS095XCpIW6LGZe68HNjP/VbRmtG5txPVWrWidREKI3rRjzconoob4LYsda/9UCXAaw5cUtFfuADkLHidplbD/nhnRt7lezwJBBo5ZOVBUhG9Asyu2g3PYrZB0jSkCCfFxG3GAtOlnkG5/Gmej7z+9V8TiC7uK9lvOuO7DrILg3qpGcBLy4gkGq/okkrXFLmAWOA9FabxT9/rlq8qEELH204/o6vr6QPAOWvVVIBsUAp/X+L5eh0R1BW4I+jdjDtHsYmE1nqNDg8oV7Kup02t86EBUFcNccpAdjCa1dap6Y1rIlBcudgpRwsuEH3Lj6CWg6A0FIteV2Bhat+ICoFsWeILcA09MCrINSMA5e3Rv1D/RIG9Si8gYU2UcuTvpitmZXj6jNK6D/HhsoJK2rIJHQrbNKyrPiX9DJeYSUJo4JU7rFjfvis9UqNY4Fl6/6jDA25mjuu4jBkzIzLAEBPu/hoECO7p2QFtalssC1nZru452Os8k0cgBbIMhoz+rrlIXMRhM017KCvPuml74XHfuOXdm2CsY+Clbwp35NT5OyB0HqX547S9zObbR6QRIzodIfU1ut7MoWJFr6cFq+AAtiBSo8gX7ZzCHzwWWKVlI4N2Zge5ERj/VsDCt3r8sJupqbS6YqKiiFOHwb4D4icsEIyAB/54/HZbX0dFJDdbvygwc5pE7k5tsE8QgB8OL9XvkJzTTsOaDDVqxtV0J16cEg6dRF8Yivq5fZqW5pM3RUgnd+rUZmN8n26QlDVG0hRIzzK/+RpqL+TqPW/jl7vKHlEXvl X-MS-Exchange-AntiSpam-ExternalHop-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-ExternalHop-MessageData-0: hPbdY+nU2PIZ4ThTCsi6STQUmuz3x/rkV6Lv7D2ocCjBWzuaKto6updJN054EqGubBfH2TH7ToppnMjCnz3w1vXqan8fpuwGXhBuzPjkO4/eTRB0Zdo2SzMUYr/MDUoi74UmnA/d/GOWf5ygFxjmQm66z8MwV23eJmIxVWz06NV+gtHu7QPW8FWfXlAIFQpBXHYNXZqlUn3hvwyZ4f4Sg/M66HfFCq1f6vWXyDotYOzW7CdONoaj9hYOJLKRakDLeaBvphROS/oADSpCSXoN/w5pJp5vyhowKA4+ad8pob04rWZpOw64l3+2+yh9BQE8e4SO4K/iHRiBbHy0zjUJqNebHxTC70atZ3lSSvKu0GfagXdfJAAuvqO4nRnicOtEO2QzJdxHR17/TmSIs6Lro4NShi7/xbJayRuGEvBm7byA+JWz3XXhGLRFaip9XhAOzdAdgQA7ZkaWRBAzZxsc4ZSkWDN3AfdmTs0UbQsv0mARUsDn+bbmp/+VlMtpYbxCJnGFdX4FH0V6CuhCCRn1FfJmS8FocZ0+etAhz0GWomzmkEDxK890ayAR9QLjmbymNnuYieQFNG85SsB47VWkIKcNe8zf7pZ2eihhKVrwjow= X-OriginatorOrg: oracle.com X-MS-Exchange-CrossTenant-Network-Message-Id: 55f192e9-99d2-483f-9008-08dc500a51c4 X-MS-Exchange-CrossTenant-AuthSource: CY8PR10MB6538.namprd10.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 29 Mar 2024 16:07:23.3052 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: pZk0tclcNJiP7hA2iZxR+0IGUG69MiT0x7yGDY026/fZJoaXwYY/GfMA4jOcsdOGDSDZkdm2ftm5xnWBTIEHGA== X-MS-Exchange-Transport-CrossTenantHeadersStamped: SJ0PR10MB4638 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.272,Aquarius:18.0.1011,Hydra:6.0.619,FMLib:17.11.176.26 definitions=2024-03-29_13,2024-03-28_01,2023-05-22_02 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 mlxlogscore=999 bulkscore=0 adultscore=0 mlxscore=0 phishscore=0 malwarescore=0 spamscore=0 suspectscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2403210000 definitions=main-2403290142 X-Proofpoint-ORIG-GUID: kiLDz98DmdW7Xqj9ZIUARREjA9OVtIN9 X-Proofpoint-GUID: kiLDz98DmdW7Xqj9ZIUARREjA9OVtIN9 X-Spam-Status: No, score=-11.6 required=5.0 tests=BAYES_00, DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, DKIM_VALID_EF, GIT_PATCH_0, RCVD_IN_DNSWL_LOW, RCVD_IN_MSPIKE_H4, RCVD_IN_MSPIKE_WL, SPF_HELO_NONE, SPF_NONE, TXREP autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on server2.sourceware.org X-BeenThere: gcc-patches@gcc.gnu.org X-Mailman-Version: 2.1.30 Precedence: list List-Id: Gcc-patches mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: gcc-patches-bounces+incoming=patchwork.ozlabs.org@gcc.gnu.org gcc/c-family/ChangeLog: * c-ubsan.cc (get_bound_from_access_with_size): New function. (ubsan_instrument_bounds): Handle call to .ACCESS_WITH_SIZE. gcc/testsuite/ChangeLog: * gcc.dg/ubsan/flex-array-counted-by-bounds-2.c: New test. * gcc.dg/ubsan/flex-array-counted-by-bounds-3.c: New test. * gcc.dg/ubsan/flex-array-counted-by-bounds-4.c: New test. * gcc.dg/ubsan/flex-array-counted-by-bounds.c: New test. --- gcc/c-family/c-ubsan.cc | 42 +++++++++++++++++ .../ubsan/flex-array-counted-by-bounds-2.c | 45 ++++++++++++++++++ .../ubsan/flex-array-counted-by-bounds-3.c | 34 ++++++++++++++ .../ubsan/flex-array-counted-by-bounds-4.c | 34 ++++++++++++++ .../ubsan/flex-array-counted-by-bounds.c | 46 +++++++++++++++++++ 5 files changed, 201 insertions(+) create mode 100644 gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds-2.c create mode 100644 gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds-3.c create mode 100644 gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds-4.c create mode 100644 gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds.c diff --git a/gcc/c-family/c-ubsan.cc b/gcc/c-family/c-ubsan.cc index 940982819ddf..7cd3c6aa5b88 100644 --- a/gcc/c-family/c-ubsan.cc +++ b/gcc/c-family/c-ubsan.cc @@ -376,6 +376,40 @@ ubsan_instrument_return (location_t loc) return build_call_expr_loc (loc, t, 1, build_fold_addr_expr_loc (loc, data)); } +/* Get the tree that represented the number of counted_by, i.e, the maximum + number of the elements of the object that the call to .ACCESS_WITH_SIZE + points to, this number will be the bound of the corresponding array. */ +static tree +get_bound_from_access_with_size (tree call) +{ + if (!is_access_with_size_p (call)) + return NULL_TREE; + + tree ref_to_size = CALL_EXPR_ARG (call, 1); + unsigned int class_of_size = TREE_INT_CST_LOW (CALL_EXPR_ARG (call, 2)); + tree type = TREE_TYPE (CALL_EXPR_ARG (call, 3)); + tree size = fold_build2 (MEM_REF, type, unshare_expr (ref_to_size), + build_int_cst (ptr_type_node, 0)); + /* If size is negative value, treat it as zero. */ + if (!TYPE_UNSIGNED (type)) + { + tree cond = fold_build2 (LT_EXPR, boolean_type_node, + unshare_expr (size), build_zero_cst (type)); + size = fold_build3 (COND_EXPR, type, cond, + build_zero_cst (type), size); + } + + /* Only when class_of_size is 1, i.e, the number of the elements of + the object type, return the size. */ + if (class_of_size != 1) + return NULL_TREE; + else + size = fold_convert (sizetype, size); + + return size; +} + + /* Instrument array bounds for ARRAY_REFs. We create special builtin, that gets expanded in the sanopt pass, and make an array dimension of it. ARRAY is the array, *INDEX is an index to the array. @@ -401,6 +435,14 @@ ubsan_instrument_bounds (location_t loc, tree array, tree *index, && COMPLETE_TYPE_P (type) && integer_zerop (TYPE_SIZE (type))) bound = build_int_cst (TREE_TYPE (TYPE_MIN_VALUE (domain)), -1); + else if (INDIRECT_REF_P (array) + && is_access_with_size_p ((TREE_OPERAND (array, 0)))) + { + bound = get_bound_from_access_with_size ((TREE_OPERAND (array, 0))); + bound = fold_build2 (MINUS_EXPR, TREE_TYPE (bound), + bound, + build_int_cst (TREE_TYPE (bound), 1)); + } else return NULL_TREE; } diff --git a/gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds-2.c b/gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds-2.c new file mode 100644 index 000000000000..b503320628d2 --- /dev/null +++ b/gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds-2.c @@ -0,0 +1,45 @@ +/* Test the attribute counted_by and its usage in + bounds sanitizer combined with VLA. */ +/* { dg-do run } */ +/* { dg-options "-fsanitize=bounds" } */ +/* { dg-output "index 11 out of bounds for type 'int \\\[\\\*\\\]\\\[\\\*\\\]'\[^\n\r]*(\n|\r\n|\r)" } */ +/* { dg-output "\[^\n\r]*index 20 out of bounds for type 'int \\\[\\\*\\\]\\\[\\\*\\\]\\\[\\\*\\\]'\[^\n\r]*(\n|\r\n|\r)" } */ +/* { dg-output "\[^\n\r]*index 11 out of bounds for type 'int \\\[\\\*\\\]\\\[\\\*\\\]'\[^\n\r]*(\n|\r\n|\r)" } */ +/* { dg-output "\[^\n\r]*index 10 out of bounds for type 'int \\\[\\\*\\\]'\[^\n\r]*(\n|\r\n|\r)" } */ + + +#include + +void __attribute__((__noinline__)) setup_and_test_vla (int n, int m) +{ + struct foo { + int n; + int p[][n] __attribute__((counted_by(n))); + } *f; + + f = (struct foo *) malloc (sizeof(struct foo) + m*sizeof(int[n])); + f->n = m; + f->p[m][n-1]=1; + return; +} + +void __attribute__((__noinline__)) setup_and_test_vla_1 (int n1, int n2, int m) +{ + struct foo { + int n; + int p[][n2][n1] __attribute__((counted_by(n))); + } *f; + + f = (struct foo *) malloc (sizeof(struct foo) + m*sizeof(int[n2][n1])); + f->n = m; + f->p[m][n2][n1]=1; + return; +} + +int main(int argc, char *argv[]) +{ + setup_and_test_vla (10, 11); + setup_and_test_vla_1 (10, 11, 20); + return 0; +} + diff --git a/gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds-3.c b/gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds-3.c new file mode 100644 index 000000000000..9da25644af3e --- /dev/null +++ b/gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds-3.c @@ -0,0 +1,34 @@ +/* Test the attribute counted_by and its usage in bounds + sanitizer. when counted_by field is negative value. */ +/* { dg-do run } */ +/* { dg-options "-fsanitize=bounds" } */ + +#include + +struct annotated { + int b; + int c[] __attribute__ ((counted_by (b))); +} *array_annotated; + +void __attribute__((__noinline__)) setup (int annotated_count) +{ + array_annotated + = (struct annotated *)malloc (sizeof (struct annotated)); + array_annotated->b = annotated_count; + + return; +} + +void __attribute__((__noinline__)) test (int annotated_index) +{ + array_annotated->c[annotated_index] = 2; +} + +int main(int argc, char *argv[]) +{ + setup (-3); + test (2); + return 0; +} + +/* { dg-output "24:21: runtime error: index 2 out of bounds for type" } */ diff --git a/gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds-4.c b/gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds-4.c new file mode 100644 index 000000000000..bd7e144274fc --- /dev/null +++ b/gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds-4.c @@ -0,0 +1,34 @@ +/* Test the attribute counted_by and its usage in bounds + sanitizer. when counted_by field is zero value. */ +/* { dg-do run } */ +/* { dg-options "-fsanitize=bounds" } */ + +#include + +struct annotated { + int b; + int c[] __attribute__ ((counted_by (b))); +} *array_annotated; + +void __attribute__((__noinline__)) setup (int annotated_count) +{ + array_annotated + = (struct annotated *)malloc (sizeof (struct annotated)); + array_annotated->b = annotated_count; + + return; +} + +void __attribute__((__noinline__)) test (int annotated_index) +{ + array_annotated->c[annotated_index] = 2; +} + +int main(int argc, char *argv[]) +{ + setup (0); + test (1); + return 0; +} + +/* { dg-output "24:21: runtime error: index 1 out of bounds for type" } */ diff --git a/gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds.c b/gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds.c new file mode 100644 index 000000000000..e2b911dde626 --- /dev/null +++ b/gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds.c @@ -0,0 +1,46 @@ +/* Test the attribute counted_by and its usage in + bounds sanitizer. */ +/* { dg-do run } */ +/* { dg-options "-fsanitize=bounds" } */ + +#include + +struct flex { + int b; + int c[]; +} *array_flex; + +struct annotated { + int b; + int c[] __attribute__ ((counted_by (b))); +} *array_annotated; + +void __attribute__((__noinline__)) setup (int normal_count, int annotated_count) +{ + array_flex + = (struct flex *)malloc (sizeof (struct flex) + + normal_count * sizeof (int)); + array_flex->b = normal_count; + + array_annotated + = (struct annotated *)malloc (sizeof (struct annotated) + + annotated_count * sizeof (int)); + array_annotated->b = annotated_count; + + return; +} + +void __attribute__((__noinline__)) test (int normal_index, int annotated_index) +{ + array_flex->c[normal_index] = 1; + array_annotated->c[annotated_index] = 2; +} + +int main(int argc, char *argv[]) +{ + setup (10, 10); + test (10, 10); + return 0; +} + +/* { dg-output "36:21: runtime error: index 10 out of bounds for type" } */