compiler-rt/test/hwasan/TestCases/use-after-free-and-overflow.c

   1 // Checks that we do not print a faraway buffer overrun if we find a
   2 // use-after-free.
   3 // RUN: %clang_hwasan -O0 %s -o %t
   4 // RUN: not %run %t 2>&1 | FileCheck %s --check-prefix=CHECK
   5 // REQUIRES: stable-runtime
   6
   7 #include <sanitizer/hwasan_interface.h>
   8 #include <stdio.h>
   9 #include <stdlib.h>
  10
  11 #define ALLOC_ATTEMPTS 256
  12
  13 char *Untag(void *x) {
  14   return (char *)__hwasan_tag_pointer(x, 0);
  15 }
  16
  17 void *FindMatch(void *ptrs[ALLOC_ATTEMPTS], void *value) {
  18   for (int i = 0; i < ALLOC_ATTEMPTS; ++i) {
  19     if (!ptrs[i])
  20       return NULL;
  21     int distance = Untag(value) - Untag(ptrs[i]);
  22     // Leave at least one granule of gap to the allocation.
  23     if (abs(distance) < 1000 && abs(distance) > 32)
  24       return ptrs[i];
  25   }
  26   return NULL;
  27 }
  28
  29 int main(int argc, char **argv) {
  30   __hwasan_enable_allocator_tagging();
  31   void *ptrs[ALLOC_ATTEMPTS] = {};
  32   // Find two allocations that are close enough so that they would be
  33   // candidates as buffer overflows for each other.
  34   void *one;
  35   void *other;
  36   for (int i = 0; i < ALLOC_ATTEMPTS; ++i) {
  37     one = malloc(16);
  38     other = FindMatch(ptrs, one);
  39     ptrs[i] = one;
  40     if (other)
  41       break;
  42   }
  43   if (!other) {
  44     fprintf(stderr, "Could not find closeby allocations.\n");
  45     abort();
  46   }
  47   __hwasan_tag_memory(Untag(one), 3, 16);
  48   __hwasan_tag_memory(Untag(other), 3, 16);
  49   // Tag potential adjaceant allocations with a mismatching tag, otherwise this
  50   // test would flake.
  51   __hwasan_tag_memory(Untag(one) + 16, 4, 16);
  52   __hwasan_tag_memory(Untag(one) - 16, 4, 16);
  53   void *retagged_one = __hwasan_tag_pointer(one, 3);
  54   free(retagged_one);
  55   volatile char *ptr = (char *)retagged_one;
  56   *ptr = 1;
  57 }
  58
  59 // CHECK-NOT: Cause: heap-buffer-overflow
  60 // CHECK: Cause: use-after-free
  61 // CHECK-NOT: Cause: heap-buffer-overflow