compiler-rt/test/hwasan/TestCases/use-after-free.c

   1 // RUN: %clang_hwasan -O0 -DISREAD=1 %s -o %t && not %run %t 2>&1 | FileCheck %s --check-prefixes=CHECK
   2 // RUN: %clang_hwasan -O1 -DISREAD=1 %s -o %t && not %run %t 2>&1 | FileCheck %s --check-prefixes=CHECK
   3 // RUN: %clang_hwasan -O2 -DISREAD=1 %s -o %t && not %run %t 2>&1 | FileCheck %s --check-prefixes=CHECK
   4 // RUN: %clang_hwasan -O3 -DISREAD=1 %s -o %t && not %run %t 2>&1 | FileCheck %s --check-prefixes=CHECK
   5
   6 // RUN: %clang_hwasan -O0 -DISREAD=0 %s -o %t && not %run %t 2>&1 | FileCheck %s --check-prefixes=CHECK
   7
   8 #include <stdlib.h>
   9 #include <stdio.h>
  10 #include <sanitizer/hwasan_interface.h>
  11
  12 int main() {
  13   __hwasan_enable_allocator_tagging();
  14   char * volatile x = (char*)malloc(10);
  15   free(x);
  16   __hwasan_disable_allocator_tagging();
  17   fprintf(stderr, ISREAD ? "Going to do a READ\n" : "Going to do a WRITE\n");
  18   fflush(stderr);
  19   // CHECK: Going to do a [[TYPE:[A-Z]*]]
  20   int r = 0;
  21   if (ISREAD) r = x[5]; else x[5] = 42;  // should be on the same line.
  22   // CHECK: ERROR: HWAddressSanitizer: tag-mismatch on address {{.*}} at pc {{[0x]+}}[[PC:.*]]
  23   // CHECK: [[TYPE]] of size 1 at {{.*}} tags: [[PTR_TAG:[0-9a-f][0-9a-f]]]/[[MEM_TAG:[0-9a-f][0-9a-f]]] (ptr/mem)
  24   // CHECK: #{{[0-9]}} {{[0-9]+}}{{.*}}[[PC]]
  25   // If we instrument using calls (default on x86), main is not the top frame
  26   // of the fault.
  27   // CHECK: in main {{.*}}use-after-free.c:[[@LINE-6]]
  28   // Offset is 5 or 11 depending on left/right alignment.
  29   // CHECK: is a small unallocated heap chunk; size: {{16|32}} offset: {{5|11}}
  30   // CHECK: Cause: use-after-free
  31   // CHECK: is located 5 bytes inside a 10-byte region
  32   //
  33   // CHECK: freed by thread {{.*}} here:
  34   // CHECK: #0 {{.*}} in {{.*}}free{{.*}} {{.*}}hwasan_allocation_functions.cpp
  35   // CHECK: #1 {{.*}} in main {{.*}}use-after-free.c:[[@LINE-20]]
  36
  37   // CHECK: previously allocated by thread {{.*}} here:
  38   // CHECK: #0 {{.*}} in {{.*}}malloc{{.*}} {{.*}}hwasan_allocation_functions.cpp
  39   // CHECK: #1 {{.*}} in main {{.*}}use-after-free.c:[[@LINE-25]]
  40   // CHECK: Memory tags around the buggy address (one tag corresponds to 16 bytes):
  41   // CHECK: =>{{.*}}[[MEM_TAG]]
  42   // CHECK: SUMMARY: HWAddressSanitizer: tag-mismatch {{.*}} in main
  43   return r;
  44 }