1//===-- asan_test.cpp -----------------------------------------------------===//
2//
3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4// See https://llvm.org/LICENSE.txt for license information.
5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6//
7//===----------------------------------------------------------------------===//
8//
9// This file is a part of AddressSanitizer, an address sanity checker.
10//
11//===----------------------------------------------------------------------===//
12#include "asan_test_utils.h"
13
14#include <errno.h>
15#include <stdarg.h>
16
17#ifdef _LIBCPP_GET_C_LOCALE
18#define SANITIZER_GET_C_LOCALE _LIBCPP_GET_C_LOCALE
19#else
20#if defined(__FreeBSD__)
21#define SANITIZER_GET_C_LOCALE 0
22#elif defined(__NetBSD__)
23#define SANITIZER_GET_C_LOCALE LC_C_LOCALE
24#endif
25#endif
26
27#if defined(__sun__) && defined(__svr4__)
28using std::_setjmp;
29using std::_longjmp;
30#endif
31
32NOINLINE void *malloc_fff(size_t size) {
33 void *res = malloc/**/(size: size); break_optimization(0); return res;}
34NOINLINE void *malloc_eee(size_t size) {
35 void *res = malloc_fff(size); break_optimization(0); return res;}
36NOINLINE void *malloc_ddd(size_t size) {
37 void *res = malloc_eee(size); break_optimization(0); return res;}
38NOINLINE void *malloc_ccc(size_t size) {
39 void *res = malloc_ddd(size); break_optimization(0); return res;}
40NOINLINE void *malloc_bbb(size_t size) {
41 void *res = malloc_ccc(size); break_optimization(0); return res;}
42NOINLINE void *malloc_aaa(size_t size) {
43 void *res = malloc_bbb(size); break_optimization(0); return res;}
44
45NOINLINE void free_ccc(void *p) { free(ptr: p); break_optimization(0);}
46NOINLINE void free_bbb(void *p) { free_ccc(p); break_optimization(0);}
47NOINLINE void free_aaa(void *p) { free_bbb(p); break_optimization(0);}
48
49template<typename T>
50NOINLINE void uaf_test(int size, int off) {
51 void *p = malloc_aaa(size);
52 free_aaa(p);
53 for (int i = 1; i < 100; i++)
54 free_aaa(p: malloc_aaa(size: i));
55 fprintf(stderr, format: "writing %ld byte(s) at %p with offset %d\n",
56 (long)sizeof(T), p, off);
57 asan_write((T *)((char *)p + off));
58}
59
60TEST(AddressSanitizer, HasFeatureAddressSanitizerTest) {
61#if defined(__has_feature) && __has_feature(address_sanitizer)
62 bool asan = 1;
63#elif defined(__SANITIZE_ADDRESS__)
64 bool asan = 1;
65#else
66 bool asan = 0;
67#endif
68 EXPECT_EQ(true, asan);
69}
70
71TEST(AddressSanitizer, SimpleDeathTest) {
72 EXPECT_DEATH(exit(status: 1), "");
73}
74
75TEST(AddressSanitizer, VariousMallocsTest) {
76 int *a = (int*)malloc(size: 100 * sizeof(int));
77 a[50] = 0;
78 free(ptr: a);
79
80 int *r = (int*)malloc(size: 10);
81 r = (int*)realloc(ptr: r, size: 2000 * sizeof(int));
82 r[1000] = 0;
83 free(ptr: r);
84
85 int *b = new int[100];
86 b[50] = 0;
87 delete [] b;
88
89 int *c = new int;
90 *c = 0;
91 delete c;
92
93#if SANITIZER_TEST_HAS_POSIX_MEMALIGN
94 void *pm = 0;
95 // Valid allocation.
96 int pm_res = posix_memalign(&pm, kPageSize, kPageSize);
97 EXPECT_EQ(0, pm_res);
98 EXPECT_NE(nullptr, pm);
99 free(pm);
100#endif // SANITIZER_TEST_HAS_POSIX_MEMALIGN
101
102#if SANITIZER_TEST_HAS_MEMALIGN
103 int *ma = (int*)memalign(kPageSize, kPageSize);
104 EXPECT_EQ(0U, (uintptr_t)ma % kPageSize);
105 ma[123] = 0;
106 free(ma);
107#endif // SANITIZER_TEST_HAS_MEMALIGN
108}
109
110TEST(AddressSanitizer, CallocTest) {
111 int *a = (int*)calloc(nmemb: 100, size: sizeof(int));
112 EXPECT_EQ(0, a[10]);
113 free(ptr: a);
114}
115
116TEST(AddressSanitizer, CallocReturnsZeroMem) {
117 size_t sizes[] = {16, 1000, 10000, 100000, 2100000};
118 for (size_t s = 0; s < sizeof(sizes)/sizeof(sizes[0]); s++) {
119 size_t size = sizes[s];
120 for (size_t iter = 0; iter < 5; iter++) {
121 char *x = Ident((char*)calloc(nmemb: 1, size: size));
122 EXPECT_EQ(x[0], 0);
123 EXPECT_EQ(x[size - 1], 0);
124 EXPECT_EQ(x[size / 2], 0);
125 EXPECT_EQ(x[size / 3], 0);
126 EXPECT_EQ(x[size / 4], 0);
127 memset(s: x, c: 0x42, n: size);
128 free(Ident(x));
129#if !defined(_WIN32)
130 // FIXME: OOM on Windows. We should just make this a lit test
131 // with quarantine size set to 1.
132 free(Ident(malloc(Ident(1 << 27)))); // Try to drain the quarantine.
133#endif
134 }
135 }
136}
137
138// No valloc on Windows or Android.
139#if !defined(_WIN32) && !defined(__ANDROID__)
140TEST(AddressSanitizer, VallocTest) {
141 void *a = valloc(size: 100);
142 EXPECT_EQ(0U, (uintptr_t)a % kPageSize);
143 free(ptr: a);
144}
145#endif
146
147#if SANITIZER_TEST_HAS_PVALLOC
148TEST(AddressSanitizer, PvallocTest) {
149 char *a = (char*)pvalloc(kPageSize + 100);
150 EXPECT_EQ(0U, (uintptr_t)a % kPageSize);
151 a[kPageSize + 101] = 1; // we should not report an error here.
152 free(a);
153
154 a = (char*)pvalloc(0); // pvalloc(0) should allocate at least one page.
155 EXPECT_EQ(0U, (uintptr_t)a % kPageSize);
156 a[101] = 1; // we should not report an error here.
157 free(a);
158}
159#endif // SANITIZER_TEST_HAS_PVALLOC
160
161#if !defined(_WIN32)
162// FIXME: Use an equivalent of pthread_setspecific on Windows.
163void *TSDWorker(void *test_key) {
164 if (test_key) {
165 pthread_setspecific(*(pthread_key_t*)test_key, (void*)0xfeedface);
166 }
167 return NULL;
168}
169
170void TSDDestructor(void *tsd) {
171 // Spawning a thread will check that the current thread id is not -1.
172 pthread_t th;
173 PTHREAD_CREATE(&th, NULL, TSDWorker, NULL);
174 PTHREAD_JOIN(th, NULL);
175}
176
177// This tests triggers the thread-specific data destruction fiasco which occurs
178// if we don't manage the TSD destructors ourselves. We create a new pthread
179// key with a non-NULL destructor which is likely to be put after the destructor
180// of AsanThread in the list of destructors.
181// In this case the TSD for AsanThread will be destroyed before TSDDestructor
182// is called for the child thread, and a CHECK will fail when we call
183// pthread_create() to spawn the grandchild.
184TEST(AddressSanitizer, DISABLED_TSDTest) {
185 pthread_t th;
186 pthread_key_t test_key;
187 pthread_key_create(&test_key, TSDDestructor);
188 PTHREAD_CREATE(&th, NULL, TSDWorker, &test_key);
189 PTHREAD_JOIN(th, NULL);
190 pthread_key_delete(test_key);
191}
192#endif
193
194TEST(AddressSanitizer, UAF_char) {
195 const char *uaf_string = "AddressSanitizer:.*heap-use-after-free";
196 EXPECT_DEATH(uaf_test<U1>(1, 0), uaf_string);
197 EXPECT_DEATH(uaf_test<U1>(10, 0), uaf_string);
198 EXPECT_DEATH(uaf_test<U1>(10, 10), uaf_string);
199 EXPECT_DEATH(uaf_test<U1>(kLargeMalloc, 0), uaf_string);
200 EXPECT_DEATH(uaf_test<U1>(kLargeMalloc, kLargeMalloc / 2), uaf_string);
201}
202
203TEST(AddressSanitizer, UAF_long_double) {
204 if (sizeof(long double) == sizeof(double)) return;
205 long double *p = Ident(new long double[10]);
206#if defined(_WIN32)
207 // https://google.github.io/googletest/advanced.html#regular-expression-syntax
208 // GoogleTest's regular expression engine on Windows does not support `[]`
209 // brackets.
210 EXPECT_DEATH(Ident(p)[12] = 0, "WRITE of size 10");
211 EXPECT_DEATH(Ident(p)[0] = Ident(p)[12], "READ of size 10");
212#else
213 EXPECT_DEATH(Ident(p)[12] = 0, "WRITE of size 1[026]");
214 EXPECT_DEATH(Ident(p)[0] = Ident(p)[12], "READ of size 1[026]");
215#endif
216 delete [] Ident(p);
217}
218
219#if !defined(_WIN32)
220struct Packed5 {
221 int x;
222 char c;
223} __attribute__((packed));
224#else
225# pragma pack(push, 1)
226struct Packed5 {
227 int x;
228 char c;
229};
230# pragma pack(pop)
231#endif
232
233TEST(AddressSanitizer, UAF_Packed5) {
234 static_assert(sizeof(Packed5) == 5, "Please check the keywords used");
235 Packed5 *p = Ident(new Packed5[2]);
236 EXPECT_DEATH(p[0] = p[3], "READ of size 5");
237 EXPECT_DEATH(p[3] = p[0], "WRITE of size 5");
238 delete [] Ident(p);
239}
240
241#if ASAN_HAS_IGNORELIST
242TEST(AddressSanitizer, IgnoreTest) {
243 int *x = Ident(new int);
244 delete Ident(x);
245 *x = 0;
246}
247#endif // ASAN_HAS_IGNORELIST
248
249struct StructWithBitField {
250 int bf1:1;
251 int bf2:1;
252 int bf3:1;
253 int bf4:29;
254};
255
256TEST(AddressSanitizer, BitFieldPositiveTest) {
257 StructWithBitField *x = new StructWithBitField;
258 delete Ident(x);
259 EXPECT_DEATH(x->bf1 = 0, "use-after-free");
260 EXPECT_DEATH(x->bf2 = 0, "use-after-free");
261 EXPECT_DEATH(x->bf3 = 0, "use-after-free");
262 EXPECT_DEATH(x->bf4 = 0, "use-after-free");
263}
264
265struct StructWithBitFields_8_24 {
266 int a:8;
267 int b:24;
268};
269
270TEST(AddressSanitizer, BitFieldNegativeTest) {
271 StructWithBitFields_8_24 *x = Ident(new StructWithBitFields_8_24);
272 x->a = 0;
273 x->b = 0;
274 delete Ident(x);
275}
276
277#if ASAN_NEEDS_SEGV
278namespace {
279
280const char kSEGVCrash[] = "AddressSanitizer: SEGV on unknown address";
281const char kOverriddenSigactionHandler[] = "Test sigaction handler\n";
282const char kOverriddenSignalHandler[] = "Test signal handler\n";
283
284TEST(AddressSanitizer, WildAddressTest) {
285 char *c = (char*)0x123;
286 EXPECT_DEATH(*c = 0, kSEGVCrash);
287}
288
289void my_sigaction_sighandler(int, siginfo_t*, void*) {
290 fprintf(stderr, format: kOverriddenSigactionHandler);
291 exit(status: 1);
292}
293
294void my_signal_sighandler(int signum) {
295 fprintf(stderr, format: kOverriddenSignalHandler);
296 exit(status: 1);
297}
298
299TEST(AddressSanitizer, SignalTest) {
300 struct sigaction sigact;
301 memset(s: &sigact, c: 0, n: sizeof(sigact));
302 sigact.sa_sigaction = my_sigaction_sighandler;
303 sigact.sa_flags = SA_SIGINFO;
304 char *c = (char *)0x123;
305
306 EXPECT_DEATH(*c = 0, kSEGVCrash);
307
308 // ASan should allow to set sigaction()...
309 EXPECT_EQ(0, sigaction(SIGSEGV, act: &sigact, oact: 0));
310#ifdef __APPLE__
311 EXPECT_EQ(0, sigaction(SIGBUS, &sigact, 0));
312#endif
313 EXPECT_DEATH(*c = 0, kOverriddenSigactionHandler);
314
315 // ... and signal().
316 EXPECT_NE(SIG_ERR, signal(SIGSEGV, handler: my_signal_sighandler));
317 EXPECT_DEATH(*c = 0, kOverriddenSignalHandler);
318}
319} // namespace
320#endif
321
322static void TestLargeMalloc(size_t size) {
323 char buff[1024];
324 sprintf(s: buff, format: "is located 1 bytes before %lu-byte", (long)size);
325 EXPECT_DEATH(Ident((char*)malloc(size: size))[-1] = 0, buff);
326}
327
328TEST(AddressSanitizer, LargeMallocTest) {
329 const int max_size = (SANITIZER_WORDSIZE == 32) ? 1 << 26 : 1 << 28;
330 for (int i = 113; i < max_size; i = i * 2 + 13) {
331 TestLargeMalloc(size: i);
332 }
333}
334
335#if !GTEST_USES_SIMPLE_RE
336TEST(AddressSanitizer, HugeMallocTest) {
337 if (SANITIZER_WORDSIZE != 64 || ASAN_AVOID_EXPENSIVE_TESTS) return;
338 size_t n_megs = 4100;
339 EXPECT_DEATH(Ident((char*)malloc(size: n_megs << 20))[-1] = 0,
340 "is located 1 bytes before|"
341 "AddressSanitizer failed to allocate");
342}
343#endif
344
345#if SANITIZER_TEST_HAS_MEMALIGN
346void MemalignRun(size_t align, size_t size, int idx) {
347 char *p = (char *)memalign(align, size);
348 Ident(p)[idx] = 0;
349 free(p);
350}
351
352TEST(AddressSanitizer, memalign) {
353 for (int align = 16; align <= (1 << 23); align *= 2) {
354 size_t size = align * 5;
355 EXPECT_DEATH(MemalignRun(align, size, -1),
356 "is located 1 bytes before");
357 EXPECT_DEATH(MemalignRun(align, size, size + 1),
358 "is located 1 bytes after");
359 }
360}
361#endif // SANITIZER_TEST_HAS_MEMALIGN
362
363void *ManyThreadsWorker(void *a) {
364 for (int iter = 0; iter < 100; iter++) {
365 for (size_t size = 100; size < 2000; size *= 2) {
366 free(Ident(malloc(size: size)));
367 }
368 }
369 return 0;
370}
371
372#if !defined(__powerpc64__)
373// FIXME: Also occasional hang on powerpc. Maybe same problem as on AArch64?
374TEST(AddressSanitizer, ManyThreadsTest) {
375 const size_t kNumThreads =
376 (SANITIZER_WORDSIZE == 32 || ASAN_AVOID_EXPENSIVE_TESTS) ? 30 : 1000;
377 pthread_t t[kNumThreads];
378 for (size_t i = 0; i < kNumThreads; i++) {
379 PTHREAD_CREATE(&t[i], 0, ManyThreadsWorker, (void*)i);
380 }
381 for (size_t i = 0; i < kNumThreads; i++) {
382 PTHREAD_JOIN(t[i], 0);
383 }
384}
385#endif
386
387TEST(AddressSanitizer, ReallocTest) {
388 const int kMinElem = 5;
389 int *ptr = (int*)malloc(size: sizeof(int) * kMinElem);
390 ptr[3] = 3;
391 for (int i = 0; i < 10000; i++) {
392 ptr = (int*)realloc(ptr,
393 (my_rand() % 1000 + kMinElem) * sizeof(int));
394 EXPECT_EQ(3, ptr[3]);
395 }
396 free(ptr: ptr);
397 // Realloc pointer returned by malloc(0).
398 int *ptr2 = Ident((int*)malloc(size: 0));
399 ptr2 = Ident((int*)realloc(ptr: ptr2, size: sizeof(*ptr2)));
400 *ptr2 = 42;
401 EXPECT_EQ(42, *ptr2);
402 free(ptr: ptr2);
403}
404
405TEST(AddressSanitizer, ReallocFreedPointerTest) {
406 void *ptr = Ident(malloc(size: 42));
407 ASSERT_TRUE(NULL != ptr);
408 free(ptr: ptr);
409 EXPECT_DEATH(ptr = realloc(ptr: ptr, size: 77), "attempting double-free");
410}
411
412TEST(AddressSanitizer, ReallocInvalidPointerTest) {
413 void *ptr = Ident(malloc(size: 42));
414 EXPECT_DEATH(ptr = realloc(ptr: (int*)ptr + 1, size: 77), "attempting free.*not malloc");
415 free(ptr: ptr);
416}
417
418TEST(AddressSanitizer, ZeroSizeMallocTest) {
419 // Test that malloc(0) and similar functions don't return NULL.
420 void *ptr = Ident(malloc(size: 0));
421 EXPECT_TRUE(NULL != ptr);
422 free(ptr: ptr);
423#if SANITIZER_TEST_HAS_POSIX_MEMALIGN
424 int pm_res = posix_memalign(&ptr, 1<<20, 0);
425 EXPECT_EQ(0, pm_res);
426 EXPECT_TRUE(NULL != ptr);
427 free(ptr);
428#endif // SANITIZER_TEST_HAS_POSIX_MEMALIGN
429 int *int_ptr = new int[0];
430 int *int_ptr2 = new int[0];
431 EXPECT_TRUE(NULL != int_ptr);
432 EXPECT_TRUE(NULL != int_ptr2);
433 EXPECT_NE(int_ptr, int_ptr2);
434 delete[] int_ptr;
435 delete[] int_ptr2;
436}
437
438#if SANITIZER_TEST_HAS_MALLOC_USABLE_SIZE
439static const char *kMallocUsableSizeErrorMsg =
440 "AddressSanitizer: attempting to call malloc_usable_size()";
441
442TEST(AddressSanitizer, MallocUsableSizeTest) {
443 const size_t kArraySize = 100;
444 char *array = Ident((char*)malloc(kArraySize));
445 int *int_ptr = Ident(new int);
446 EXPECT_EQ(0U, malloc_usable_size(NULL));
447 EXPECT_EQ(kArraySize, malloc_usable_size(array));
448 EXPECT_EQ(sizeof(int), malloc_usable_size(int_ptr));
449 EXPECT_DEATH(malloc_usable_size((void*)0x123), kMallocUsableSizeErrorMsg);
450 EXPECT_DEATH(malloc_usable_size(array + kArraySize / 2),
451 kMallocUsableSizeErrorMsg);
452 free(array);
453 EXPECT_DEATH(malloc_usable_size(array), kMallocUsableSizeErrorMsg);
454 delete int_ptr;
455}
456#endif // SANITIZER_TEST_HAS_MALLOC_USABLE_SIZE
457
458void WrongFree() {
459 int *x = (int*)malloc(size: 100 * sizeof(int));
460 // Use the allocated memory, otherwise Clang will optimize it out.
461 Ident(x);
462 free(ptr: x + 1);
463}
464
465#if !defined(_WIN32) // FIXME: This should be a lit test.
466TEST(AddressSanitizer, WrongFreeTest) {
467 EXPECT_DEATH(WrongFree(), ASAN_PCRE_DOTALL
468 "ERROR: AddressSanitizer: attempting free.*not malloc"
469 ".*is located 4 bytes inside of 400-byte region"
470 ".*allocated by thread");
471}
472#endif
473
474void DoubleFree() {
475 int *x = (int*)malloc(size: 100 * sizeof(int));
476 fprintf(stderr, format: "DoubleFree: x=%p\n", (void *)x);
477 free(ptr: x);
478 free(ptr: x);
479 fprintf(stderr, format: "should have failed in the second free(%p)\n", (void *)x);
480 abort();
481}
482
483#if !defined(_WIN32) // FIXME: This should be a lit test.
484TEST(AddressSanitizer, DoubleFreeTest) {
485 EXPECT_DEATH(DoubleFree(), ASAN_PCRE_DOTALL
486 "ERROR: AddressSanitizer: attempting double-free"
487 ".*is located 0 bytes inside of 400-byte region"
488 ".*freed by thread T0 here"
489 ".*previously allocated by thread T0 here");
490}
491#endif
492
493template<int kSize>
494NOINLINE void SizedStackTest() {
495 char a[kSize];
496 char *A = Ident((char*)&a);
497 const char *expected_death = "AddressSanitizer: stack-buffer-";
498 for (size_t i = 0; i < kSize; i++)
499 A[i] = i;
500 EXPECT_DEATH(A[-1] = 0, expected_death);
501 EXPECT_DEATH(A[-5] = 0, expected_death);
502 EXPECT_DEATH(A[kSize] = 0, expected_death);
503 EXPECT_DEATH(A[kSize + 1] = 0, expected_death);
504 EXPECT_DEATH(A[kSize + 5] = 0, expected_death);
505 if (kSize > 16)
506 EXPECT_DEATH(A[kSize + 31] = 0, expected_death);
507}
508
509TEST(AddressSanitizer, SimpleStackTest) {
510 SizedStackTest<1>();
511 SizedStackTest<2>();
512 SizedStackTest<3>();
513 SizedStackTest<4>();
514 SizedStackTest<5>();
515 SizedStackTest<6>();
516 SizedStackTest<7>();
517 SizedStackTest<16>();
518 SizedStackTest<25>();
519 SizedStackTest<34>();
520 SizedStackTest<43>();
521 SizedStackTest<51>();
522 SizedStackTest<62>();
523 SizedStackTest<64>();
524 SizedStackTest<128>();
525}
526
527#if !defined(_WIN32)
528// FIXME: It's a bit hard to write multi-line death test expectations
529// in a portable way. Anyways, this should just be turned into a lit test.
530TEST(AddressSanitizer, ManyStackObjectsTest) {
531 char XXX[10];
532 char YYY[20];
533 char ZZZ[30];
534 Ident(XXX);
535 Ident(YYY);
536 EXPECT_DEATH(Ident(ZZZ)[-1] = 0, ASAN_PCRE_DOTALL "XXX.*YYY.*ZZZ");
537}
538#endif
539
540#if 0 // This test requires online symbolizer.
541// Moved to lit_tests/stack-oob-frames.cpp.
542// Reenable here once we have online symbolizer by default.
543NOINLINE static void Frame0(int frame, char *a, char *b, char *c) {
544 char d[4] = {0};
545 char *D = Ident(d);
546 switch (frame) {
547 case 3: a[5]++; break;
548 case 2: b[5]++; break;
549 case 1: c[5]++; break;
550 case 0: D[5]++; break;
551 }
552}
553NOINLINE static void Frame1(int frame, char *a, char *b) {
554 char c[4] = {0}; Frame0(frame, a, b, c);
555 break_optimization(0);
556}
557NOINLINE static void Frame2(int frame, char *a) {
558 char b[4] = {0}; Frame1(frame, a, b);
559 break_optimization(0);
560}
561NOINLINE static void Frame3(int frame) {
562 char a[4] = {0}; Frame2(frame, a);
563 break_optimization(0);
564}
565
566TEST(AddressSanitizer, GuiltyStackFrame0Test) {
567 EXPECT_DEATH(Frame3(0), "located .*in frame <.*Frame0");
568}
569TEST(AddressSanitizer, GuiltyStackFrame1Test) {
570 EXPECT_DEATH(Frame3(1), "located .*in frame <.*Frame1");
571}
572TEST(AddressSanitizer, GuiltyStackFrame2Test) {
573 EXPECT_DEATH(Frame3(2), "located .*in frame <.*Frame2");
574}
575TEST(AddressSanitizer, GuiltyStackFrame3Test) {
576 EXPECT_DEATH(Frame3(3), "located .*in frame <.*Frame3");
577}
578#endif
579
580NOINLINE void LongJmpFunc1(jmp_buf buf) {
581 // create three red zones for these two stack objects.
582 int a;
583 int b;
584
585 int *A = Ident(&a);
586 int *B = Ident(&b);
587 *A = *B;
588 longjmp(env: buf, val: 1);
589}
590
591NOINLINE void TouchStackFunc() {
592 int a[100]; // long array will intersect with redzones from LongJmpFunc1.
593 int *A = Ident(a);
594 for (int i = 0; i < 100; i++)
595 A[i] = i*i;
596}
597
598// Test that we handle longjmp and do not report false positives on stack.
599TEST(AddressSanitizer, LongJmpTest) {
600 static jmp_buf buf;
601 if (!setjmp(buf)) {
602 LongJmpFunc1(buf);
603 } else {
604 TouchStackFunc();
605 }
606}
607
608#if !defined(_WIN32) // Only basic longjmp is available on Windows.
609NOINLINE void UnderscopeLongJmpFunc1(jmp_buf buf) {
610 // create three red zones for these two stack objects.
611 int a;
612 int b;
613
614 int *A = Ident(&a);
615 int *B = Ident(&b);
616 *A = *B;
617 _longjmp(env: buf, val: 1);
618}
619
620NOINLINE void SigLongJmpFunc1(sigjmp_buf buf) {
621 // create three red zones for these two stack objects.
622 int a;
623 int b;
624
625 int *A = Ident(&a);
626 int *B = Ident(&b);
627 *A = *B;
628 siglongjmp(env: buf, val: 1);
629}
630
631#if !defined(__ANDROID__) && !defined(__arm__) && !defined(__aarch64__) && \
632 !defined(__mips__) && !defined(__mips64) && !defined(__s390__) && \
633 !defined(__riscv) && !defined(__loongarch__) && !defined(__sparc__)
634NOINLINE void BuiltinLongJmpFunc1(jmp_buf buf) {
635 // create three red zones for these two stack objects.
636 int a;
637 int b;
638
639 int *A = Ident(&a);
640 int *B = Ident(&b);
641 *A = *B;
642 __builtin_longjmp((void**)buf, 1);
643}
644
645// Does not work on ARM:
646// https://github.com/google/sanitizers/issues/185
647TEST(AddressSanitizer, BuiltinLongJmpTest) {
648 static jmp_buf buf;
649 if (!__builtin_setjmp((void**)buf)) {
650 BuiltinLongJmpFunc1(buf);
651 } else {
652 TouchStackFunc();
653 }
654}
655#endif // !defined(__ANDROID__) && !defined(__arm__) &&
656 // !defined(__aarch64__) && !defined(__mips__) &&
657 // !defined(__mips64) && !defined(__s390__) &&
658 // !defined(__riscv) && !defined(__loongarch__)
659
660TEST(AddressSanitizer, UnderscopeLongJmpTest) {
661 static jmp_buf buf;
662 if (!_setjmp(env: buf)) {
663 UnderscopeLongJmpFunc1(buf);
664 } else {
665 TouchStackFunc();
666 }
667}
668
669TEST(AddressSanitizer, SigLongJmpTest) {
670 static sigjmp_buf buf;
671 if (!sigsetjmp(buf, 1)) {
672 SigLongJmpFunc1(buf);
673 } else {
674 TouchStackFunc();
675 }
676}
677#endif
678
679// FIXME: Why does clang-cl define __EXCEPTIONS?
680#if defined(__EXCEPTIONS) && !defined(_WIN32)
681NOINLINE void ThrowFunc() {
682 // create three red zones for these two stack objects.
683 int a;
684 int b;
685
686 int *A = Ident(&a);
687 int *B = Ident(&b);
688 *A = *B;
689 ASAN_THROW(1);
690}
691
692TEST(AddressSanitizer, CxxExceptionTest) {
693 if (ASAN_UAR) return;
694 // TODO(kcc): this test crashes on 32-bit for some reason...
695 if (SANITIZER_WORDSIZE == 32) return;
696 try {
697 ThrowFunc();
698 } catch(...) {}
699 TouchStackFunc();
700}
701#endif
702
703void *ThreadStackReuseFunc1(void *unused) {
704 // create three red zones for these two stack objects.
705 int a;
706 int b;
707
708 int *A = Ident(&a);
709 int *B = Ident(&b);
710 *A = *B;
711 pthread_exit(0);
712 return 0;
713}
714
715void *ThreadStackReuseFunc2(void *unused) {
716 TouchStackFunc();
717 return 0;
718}
719
720#if !defined(__thumb__)
721TEST(AddressSanitizer, ThreadStackReuseTest) {
722 pthread_t t;
723 PTHREAD_CREATE(&t, 0, ThreadStackReuseFunc1, 0);
724 PTHREAD_JOIN(t, 0);
725 PTHREAD_CREATE(&t, 0, ThreadStackReuseFunc2, 0);
726 PTHREAD_JOIN(t, 0);
727}
728#endif
729
730#if defined(__SSE2__)
731#include <emmintrin.h>
732TEST(AddressSanitizer, Store128Test) {
733 char *a = Ident((char*)malloc(Ident(12)));
734 char *p = a;
735 if (((uintptr_t)a % 16) != 0)
736 p = a + 8;
737 assert(((uintptr_t)p % 16) == 0);
738 __m128i value_wide = _mm_set1_epi16(w: 0x1234);
739 EXPECT_DEATH(_mm_store_si128(p: (__m128i*)p, b: value_wide),
740 "AddressSanitizer: heap-buffer-overflow");
741 EXPECT_DEATH(_mm_store_si128(p: (__m128i*)p, b: value_wide),
742 "WRITE of size 16");
743 EXPECT_DEATH(_mm_store_si128(p: (__m128i*)p, b: value_wide),
744 "located 0 bytes after 12-byte");
745 free(ptr: a);
746}
747#endif
748
749// FIXME: All tests that use this function should be turned into lit tests.
750std::string RightOOBErrorMessage(int oob_distance, bool is_write) {
751 assert(oob_distance >= 0);
752 char expected_str[100];
753 sprintf(s: expected_str, ASAN_PCRE_DOTALL
754#if !GTEST_USES_SIMPLE_RE
755 "buffer-overflow.*%s.*"
756#endif
757 "located %d bytes after",
758#if !GTEST_USES_SIMPLE_RE
759 is_write ? "WRITE" : "READ",
760#endif
761 oob_distance);
762 return std::string(expected_str);
763}
764
765std::string RightOOBWriteMessage(int oob_distance) {
766 return RightOOBErrorMessage(oob_distance, /*is_write*/true);
767}
768
769std::string RightOOBReadMessage(int oob_distance) {
770 return RightOOBErrorMessage(oob_distance, /*is_write*/false);
771}
772
773// FIXME: All tests that use this function should be turned into lit tests.
774std::string LeftOOBErrorMessage(int oob_distance, bool is_write) {
775 assert(oob_distance > 0);
776 char expected_str[100];
777 sprintf(s: expected_str,
778#if !GTEST_USES_SIMPLE_RE
779 ASAN_PCRE_DOTALL "%s.*"
780#endif
781 "located %d bytes before",
782#if !GTEST_USES_SIMPLE_RE
783 is_write ? "WRITE" : "READ",
784#endif
785 oob_distance);
786 return std::string(expected_str);
787}
788
789std::string LeftOOBWriteMessage(int oob_distance) {
790 return LeftOOBErrorMessage(oob_distance, /*is_write*/true);
791}
792
793std::string LeftOOBReadMessage(int oob_distance) {
794 return LeftOOBErrorMessage(oob_distance, /*is_write*/false);
795}
796
797std::string LeftOOBAccessMessage(int oob_distance) {
798 assert(oob_distance > 0);
799 char expected_str[100];
800 sprintf(s: expected_str, format: "located %d bytes before", oob_distance);
801 return std::string(expected_str);
802}
803
804char* MallocAndMemsetString(size_t size, char ch) {
805 char *s = Ident((char*)malloc(size: size));
806 memset(s: s, c: ch, n: size);
807 return s;
808}
809
810char* MallocAndMemsetString(size_t size) {
811 return MallocAndMemsetString(size, ch: 'z');
812}
813
814#if SANITIZER_GLIBC
815#define READ_TEST(READ_N_BYTES) \
816 char *x = new char[10]; \
817 int fd = open("/proc/self/stat", O_RDONLY); \
818 ASSERT_GT(fd, 0); \
819 EXPECT_DEATH(READ_N_BYTES, \
820 ASAN_PCRE_DOTALL \
821 "AddressSanitizer: heap-buffer-overflow" \
822 ".* is located 0 bytes after 10-byte region"); \
823 close(fd); \
824 delete [] x; \
825
826TEST(AddressSanitizer, pread) {
827 READ_TEST(pread(fd, x, 15, 0));
828}
829
830TEST(AddressSanitizer, pread64) {
831 READ_TEST(pread64(fd, x, 15, 0));
832}
833
834TEST(AddressSanitizer, read) {
835 READ_TEST(read(fd, x, 15));
836}
837#endif // SANITIZER_GLIBC
838
839// This test case fails
840// Clang optimizes memcpy/memset calls which lead to unaligned access
841TEST(AddressSanitizer, DISABLED_MemIntrinsicUnalignedAccessTest) {
842 int size = Ident(4096);
843 char *s = Ident((char*)malloc(size: size));
844 EXPECT_DEATH(memset(s + size - 1, 0, 2), RightOOBWriteMessage(0));
845 free(ptr: s);
846}
847
848NOINLINE static int LargeFunction(bool do_bad_access) {
849 int *x = new int[100];
850 x[0]++;
851 x[1]++;
852 x[2]++;
853 x[3]++;
854 x[4]++;
855 x[5]++;
856 x[6]++;
857 x[7]++;
858 x[8]++;
859 x[9]++;
860
861 x[do_bad_access ? 100 : 0]++; int res = __LINE__;
862
863 x[10]++;
864 x[11]++;
865 x[12]++;
866 x[13]++;
867 x[14]++;
868 x[15]++;
869 x[16]++;
870 x[17]++;
871 x[18]++;
872 x[19]++;
873
874 delete[] x;
875 return res;
876}
877
878// Test the we have correct debug info for the failing instruction.
879// This test requires the in-process symbolizer to be enabled by default.
880TEST(AddressSanitizer, DISABLED_LargeFunctionSymbolizeTest) {
881 int failing_line = LargeFunction(false);
882 char expected_warning[128];
883 sprintf(s: expected_warning, format: "LargeFunction.*asan_test.*:%d", failing_line);
884 EXPECT_DEATH(LargeFunction(true), expected_warning);
885}
886
887// Check that we unwind and symbolize correctly.
888TEST(AddressSanitizer, DISABLED_MallocFreeUnwindAndSymbolizeTest) {
889 int *a = (int*)malloc_aaa(size: sizeof(int));
890 *a = 1;
891 free_aaa(p: a);
892 EXPECT_DEATH(*a = 1, "free_ccc.*free_bbb.*free_aaa.*"
893 "malloc_fff.*malloc_eee.*malloc_ddd");
894}
895
896static bool TryToSetThreadName(const char *name) {
897#if defined(__linux__) && defined(PR_SET_NAME)
898 return 0 == prctl(PR_SET_NAME, (unsigned long)name, 0, 0, 0);
899#else
900 return false;
901#endif
902}
903
904void *ThreadedTestAlloc(void *a) {
905 EXPECT_EQ(true, TryToSetThreadName(name: "AllocThr"));
906 int **p = (int**)a;
907 *p = new int;
908 return 0;
909}
910
911void *ThreadedTestFree(void *a) {
912 EXPECT_EQ(true, TryToSetThreadName(name: "FreeThr"));
913 int **p = (int**)a;
914 delete *p;
915 return 0;
916}
917
918void *ThreadedTestUse(void *a) {
919 EXPECT_EQ(true, TryToSetThreadName(name: "UseThr"));
920 int **p = (int**)a;
921 **p = 1;
922 return 0;
923}
924
925void ThreadedTestSpawn() {
926 pthread_t t;
927 int *x;
928 PTHREAD_CREATE(&t, 0, ThreadedTestAlloc, &x);
929 PTHREAD_JOIN(t, 0);
930 PTHREAD_CREATE(&t, 0, ThreadedTestFree, &x);
931 PTHREAD_JOIN(t, 0);
932 PTHREAD_CREATE(&t, 0, ThreadedTestUse, &x);
933 PTHREAD_JOIN(t, 0);
934}
935
936#if !defined(_WIN32) // FIXME: This should be a lit test.
937TEST(AddressSanitizer, ThreadedTest) {
938 EXPECT_DEATH(ThreadedTestSpawn(),
939 ASAN_PCRE_DOTALL
940 "Thread T.*created"
941 ".*Thread T.*created"
942 ".*Thread T.*created");
943}
944#endif
945
946void *ThreadedTestFunc(void *unused) {
947 // Check if prctl(PR_SET_NAME) is supported. Return if not.
948 if (!TryToSetThreadName(name: "TestFunc"))
949 return 0;
950 EXPECT_DEATH(ThreadedTestSpawn(),
951 ASAN_PCRE_DOTALL
952 "WRITE .*thread T. .UseThr."
953 ".*freed by thread T. .FreeThr. here:"
954 ".*previously allocated by thread T. .AllocThr. here:"
955 ".*Thread T. .UseThr. created by T.*TestFunc"
956 ".*Thread T. .FreeThr. created by T"
957 ".*Thread T. .AllocThr. created by T"
958 "");
959 return 0;
960}
961
962TEST(AddressSanitizer, ThreadNamesTest) {
963 // Run ThreadedTestFunc in a separate thread because it tries to set a
964 // thread name and we don't want to change the main thread's name.
965 pthread_t t;
966 PTHREAD_CREATE(&t, 0, ThreadedTestFunc, 0);
967 PTHREAD_JOIN(t, 0);
968}
969
970#if ASAN_NEEDS_SEGV
971TEST(AddressSanitizer, ShadowGapTest) {
972#if SANITIZER_WORDSIZE == 32
973 char *addr = (char*)0x23000000;
974#else
975# if defined(__powerpc64__)
976 char *addr = (char*)0x024000800000;
977# elif defined(__s390x__)
978 char *addr = (char*)0x11000000000000;
979# else
980 char *addr = (char*)0x0000100000080000;
981# endif
982#endif
983 EXPECT_DEATH(*addr = 1, "AddressSanitizer: (SEGV|BUS) on unknown");
984}
985#endif // ASAN_NEEDS_SEGV
986
987extern "C" {
988NOINLINE static void UseThenFreeThenUse() {
989 char *x = Ident((char*)malloc(size: 8));
990 *x = 1;
991 free_aaa(p: x);
992 *x = 2;
993}
994}
995
996TEST(AddressSanitizer, UseThenFreeThenUseTest) {
997 EXPECT_DEATH(UseThenFreeThenUse(), "freed by thread");
998}
999
1000TEST(AddressSanitizer, StrDupTest) {
1001 free(strdup(Ident("123")));
1002}
1003
1004// Currently we create and poison redzone at right of global variables.
1005static char static110[110];
1006const char ConstGlob[7] = {1, 2, 3, 4, 5, 6, 7};
1007static const char StaticConstGlob[3] = {9, 8, 7};
1008
1009TEST(AddressSanitizer, GlobalTest) {
1010 static char func_static15[15];
1011
1012 static char fs1[10];
1013 static char fs2[10];
1014 static char fs3[10];
1015
1016 glob5[Ident(0)] = 0;
1017 glob5[Ident(1)] = 0;
1018 glob5[Ident(2)] = 0;
1019 glob5[Ident(3)] = 0;
1020 glob5[Ident(4)] = 0;
1021
1022 EXPECT_DEATH(glob5[Ident(5)] = 0,
1023 "0 bytes after global variable.*glob5.* size 5");
1024 EXPECT_DEATH(glob5[Ident(5+6)] = 0,
1025 "6 bytes after global variable.*glob5.* size 5");
1026 Ident(static110); // avoid optimizations
1027 static110[Ident(0)] = 0;
1028 static110[Ident(109)] = 0;
1029 EXPECT_DEATH(static110[Ident(110)] = 0,
1030 "0 bytes after global variable");
1031 EXPECT_DEATH(static110[Ident(110+7)] = 0,
1032 "7 bytes after global variable");
1033
1034 Ident(func_static15); // avoid optimizations
1035 func_static15[Ident(0)] = 0;
1036 EXPECT_DEATH(func_static15[Ident(15)] = 0,
1037 "0 bytes after global variable");
1038 EXPECT_DEATH(func_static15[Ident(15 + 9)] = 0,
1039 "9 bytes after global variable");
1040
1041 Ident(fs1);
1042 Ident(fs2);
1043 Ident(fs3);
1044
1045 // We don't create left redzones, so this is not 100% guaranteed to fail.
1046 // But most likely will.
1047 EXPECT_DEATH(fs2[Ident(-1)] = 0, "is located.* global variable");
1048
1049 EXPECT_DEATH(Ident(Ident(ConstGlob)[8]),
1050 "is located 1 bytes after .*ConstGlob");
1051 EXPECT_DEATH(Ident(Ident(StaticConstGlob)[5]),
1052 "is located 2 bytes after .*StaticConstGlob");
1053
1054 // call stuff from another file.
1055 GlobalsTest(x: 0);
1056}
1057
1058TEST(AddressSanitizer, GlobalStringConstTest) {
1059 static const char *zoo = "FOOBAR123";
1060 const char *p = Ident(zoo);
1061 EXPECT_DEATH(Ident(p[15]), "is ascii string 'FOOBAR123'");
1062}
1063
1064TEST(AddressSanitizer, FileNameInGlobalReportTest) {
1065 static char zoo[10];
1066 const char *p = Ident(zoo);
1067 // The file name should be present in the report.
1068 EXPECT_DEATH(Ident(p[15]), "zoo.*asan_test.");
1069}
1070
1071int *ReturnsPointerToALocalObject() {
1072 int a = 0;
1073 return Ident(&a);
1074}
1075
1076#if ASAN_UAR == 1
1077TEST(AddressSanitizer, LocalReferenceReturnTest) {
1078 int *(*f)() = Ident(ReturnsPointerToALocalObject);
1079 int *p = f();
1080 // Call 'f' a few more times, 'p' should still be poisoned.
1081 for (int i = 0; i < 32; i++)
1082 f();
1083 EXPECT_DEATH(*p = 1, "AddressSanitizer: stack-use-after-return");
1084 EXPECT_DEATH(*p = 1, "is located.*in frame .*ReturnsPointerToALocal");
1085}
1086#endif
1087
1088template <int kSize>
1089NOINLINE static void FuncWithStack() {
1090 char x[kSize];
1091 Ident(x)[0] = 0;
1092 Ident(x)[kSize-1] = 0;
1093}
1094
1095static void LotsOfStackReuse() {
1096 int LargeStack[10000];
1097 Ident(LargeStack)[0] = 0;
1098 for (int i = 0; i < 10000; i++) {
1099 FuncWithStack<128 * 1>();
1100 FuncWithStack<128 * 2>();
1101 FuncWithStack<128 * 4>();
1102 FuncWithStack<128 * 8>();
1103 FuncWithStack<128 * 16>();
1104 FuncWithStack<128 * 32>();
1105 FuncWithStack<128 * 64>();
1106 FuncWithStack<128 * 128>();
1107 FuncWithStack<128 * 256>();
1108 FuncWithStack<128 * 512>();
1109 Ident(LargeStack)[0] = 0;
1110 }
1111}
1112
1113TEST(AddressSanitizer, StressStackReuseTest) {
1114 LotsOfStackReuse();
1115}
1116
1117TEST(AddressSanitizer, ThreadedStressStackReuseTest) {
1118 const int kNumThreads = 20;
1119 pthread_t t[kNumThreads];
1120 for (int i = 0; i < kNumThreads; i++) {
1121 PTHREAD_CREATE(&t[i], 0, (void* (*)(void *x))LotsOfStackReuse, 0);
1122 }
1123 for (int i = 0; i < kNumThreads; i++) {
1124 PTHREAD_JOIN(t[i], 0);
1125 }
1126}
1127
1128// pthread_exit tries to perform unwinding stuff that leads to dlopen'ing
1129// libgcc_s.so. dlopen in its turn calls malloc to store "libgcc_s.so" string
1130// that confuses LSan on Thumb because it fails to understand that this
1131// allocation happens in dynamic linker and should be ignored.
1132#if !defined(__thumb__)
1133static void *PthreadExit(void *a) {
1134 pthread_exit(0);
1135 return 0;
1136}
1137
1138TEST(AddressSanitizer, PthreadExitTest) {
1139 pthread_t t;
1140 for (int i = 0; i < 1000; i++) {
1141 PTHREAD_CREATE(&t, 0, PthreadExit, 0);
1142 PTHREAD_JOIN(t, 0);
1143 }
1144}
1145#endif
1146
1147// FIXME: Why does clang-cl define __EXCEPTIONS?
1148#if defined(__EXCEPTIONS) && !defined(_WIN32)
1149NOINLINE static void StackReuseAndException() {
1150 int large_stack[1000];
1151 Ident(large_stack);
1152 ASAN_THROW(1);
1153}
1154
1155// TODO(kcc): support exceptions with use-after-return.
1156TEST(AddressSanitizer, DISABLED_StressStackReuseAndExceptionsTest) {
1157 for (int i = 0; i < 10000; i++) {
1158 try {
1159 StackReuseAndException();
1160 } catch(...) {
1161 }
1162 }
1163}
1164#endif
1165
1166#if !defined(_WIN32) && !defined(__HAIKU__)
1167TEST(AddressSanitizer, MlockTest) {
1168 EXPECT_EQ(0, mlockall(MCL_CURRENT));
1169 EXPECT_EQ(0, mlock(addr: (void *)0x12345, len: 0x5678));
1170 EXPECT_EQ(0, munlockall());
1171 EXPECT_EQ(0, munlock(addr: (void*)0x987, len: 0x654));
1172}
1173#endif
1174
1175struct LargeStruct {
1176 int foo[100];
1177};
1178
1179// Test for bug http://llvm.org/bugs/show_bug.cgi?id=11763.
1180// Struct copy should not cause asan warning even if lhs == rhs.
1181TEST(AddressSanitizer, LargeStructCopyTest) {
1182 LargeStruct a;
1183 *Ident(&a) = *Ident(&a);
1184}
1185
1186ATTRIBUTE_NO_SANITIZE_ADDRESS
1187static void NoSanitizeAddress() {
1188 char *foo = new char[10];
1189 Ident(foo)[10] = 0;
1190 delete [] foo;
1191}
1192
1193TEST(AddressSanitizer, AttributeNoSanitizeAddressTest) {
1194 Ident(NoSanitizeAddress)();
1195}
1196
1197// The new/delete/etc mismatch checks don't work on Android,
1198// as calls to new/delete go through malloc/free.
1199// OS X support is tracked here:
1200// https://github.com/google/sanitizers/issues/131
1201// Windows support is tracked here:
1202// https://github.com/google/sanitizers/issues/309
1203#if !defined(__ANDROID__) && \
1204 !defined(__APPLE__) && \
1205 !defined(_WIN32)
1206static std::string MismatchStr(const std::string &str) {
1207 return std::string("AddressSanitizer: alloc-dealloc-mismatch \\(") + str;
1208}
1209
1210static std::string MismatchOrNewDeleteTypeStr(const std::string &mismatch_str) {
1211 return "(" + MismatchStr(mismatch_str) +
1212 ")|(AddressSanitizer: new-delete-type-mismatch)";
1213}
1214
1215TEST(AddressSanitizer, AllocDeallocMismatch) {
1216 EXPECT_DEATH(free(Ident(new int)),
1217 MismatchStr("operator new vs free"));
1218 EXPECT_DEATH(free(Ident(new int[2])),
1219 MismatchStr("operator new \\[\\] vs free"));
1220 EXPECT_DEATH(
1221 delete (Ident(new int[2])),
1222 MismatchOrNewDeleteTypeStr("operator new \\[\\] vs operator delete"));
1223 EXPECT_DEATH(delete (Ident((int *)malloc(2 * sizeof(int)))),
1224 MismatchOrNewDeleteTypeStr("malloc vs operator delete"));
1225 EXPECT_DEATH(delete [] (Ident(new int)),
1226 MismatchStr("operator new vs operator delete \\[\\]"));
1227 EXPECT_DEATH(delete [] (Ident((int*)malloc(2 * sizeof(int)))),
1228 MismatchStr("malloc vs operator delete \\[\\]"));
1229}
1230#endif
1231
1232// ------------------ demo tests; run each one-by-one -------------
1233// e.g. --gtest_filter=*DemoOOBLeftHigh --gtest_also_run_disabled_tests
1234TEST(AddressSanitizer, DISABLED_DemoThreadedTest) {
1235 ThreadedTestSpawn();
1236}
1237
1238void *SimpleBugOnSTack(void *x = 0) {
1239 char a[20];
1240 Ident(a)[20] = 0;
1241 return 0;
1242}
1243
1244TEST(AddressSanitizer, DISABLED_DemoStackTest) {
1245 SimpleBugOnSTack();
1246}
1247
1248TEST(AddressSanitizer, DISABLED_DemoThreadStackTest) {
1249 pthread_t t;
1250 PTHREAD_CREATE(&t, 0, SimpleBugOnSTack, 0);
1251 PTHREAD_JOIN(t, 0);
1252}
1253
1254TEST(AddressSanitizer, DISABLED_DemoUAFLowIn) {
1255 uaf_test<U1>(10, 0);
1256}
1257TEST(AddressSanitizer, DISABLED_DemoUAFLowLeft) {
1258 uaf_test<U1>(10, -2);
1259}
1260TEST(AddressSanitizer, DISABLED_DemoUAFLowRight) {
1261 uaf_test<U1>(10, 10);
1262}
1263
1264TEST(AddressSanitizer, DISABLED_DemoUAFHigh) {
1265 uaf_test<U1>(kLargeMalloc, 0);
1266}
1267
1268TEST(AddressSanitizer, DISABLED_DemoOOM) {
1269 size_t size = SANITIZER_WORDSIZE == 64 ? (size_t)(1ULL << 40) : (0xf0000000);
1270 printf(format: "%p\n", malloc(size: size));
1271}
1272
1273TEST(AddressSanitizer, DISABLED_DemoDoubleFreeTest) {
1274 DoubleFree();
1275}
1276
1277TEST(AddressSanitizer, DISABLED_DemoNullDerefTest) {
1278 int *a = 0;
1279 Ident(a)[10] = 0;
1280}
1281
1282TEST(AddressSanitizer, DISABLED_DemoFunctionStaticTest) {
1283 static char a[100];
1284 static char b[100];
1285 static char c[100];
1286 Ident(a);
1287 Ident(b);
1288 Ident(c);
1289 Ident(a)[5] = 0;
1290 Ident(b)[105] = 0;
1291 Ident(a)[5] = 0;
1292}
1293
1294TEST(AddressSanitizer, DISABLED_DemoTooMuchMemoryTest) {
1295 const size_t kAllocSize = (1 << 28) - 1024;
1296 size_t total_size = 0;
1297 while (true) {
1298 void *x = malloc(size: kAllocSize);
1299 memset(s: x, c: 0, n: kAllocSize);
1300 total_size += kAllocSize;
1301 fprintf(stderr, format: "total: %ldM %p\n", (long)total_size >> 20, x);
1302 }
1303}
1304
1305#if !defined(__NetBSD__) && !defined(__i386__)
1306// https://github.com/google/sanitizers/issues/66
1307TEST(AddressSanitizer, BufferOverflowAfterManyFrees) {
1308 for (int i = 0; i < 1000000; i++) {
1309 delete [] (Ident(new char [8644]));
1310 }
1311 char *x = new char[8192];
1312 EXPECT_DEATH(x[Ident(8192)] = 0, "AddressSanitizer: heap-buffer-overflow");
1313 delete [] Ident(x);
1314}
1315#endif
1316
1317
1318// Test that instrumentation of stack allocations takes into account
1319// AllocSize of a type, and not its StoreSize (16 vs 10 bytes for long double).
1320// See http://llvm.org/bugs/show_bug.cgi?id=12047 for more details.
1321TEST(AddressSanitizer, LongDoubleNegativeTest) {
1322 long double a, b;
1323 static long double c;
1324 memcpy(Ident(&a), Ident(&b), sizeof(long double));
1325 memcpy(Ident(&c), Ident(&b), sizeof(long double));
1326}
1327
1328#if !defined(_WIN32)
1329TEST(AddressSanitizer, pthread_getschedparam) {
1330 int policy;
1331 struct sched_param param;
1332 EXPECT_DEATH(
1333 pthread_getschedparam(pthread_self(), &policy, Ident(&param) + 2),
1334 "AddressSanitizer: stack-buffer-.*flow");
1335 EXPECT_DEATH(
1336 pthread_getschedparam(pthread_self(), Ident(&policy) - 1, &param),
1337 "AddressSanitizer: stack-buffer-.*flow");
1338 int res = pthread_getschedparam(pthread_self(), &policy, &param);
1339 ASSERT_EQ(0, res);
1340}
1341#endif
1342
1343#if SANITIZER_TEST_HAS_PRINTF_L
1344static int vsnprintf_l_wrapper(char *s, size_t n,
1345 locale_t l, const char *format, ...) {
1346 va_list va;
1347 va_start(va, format);
1348 int res = vsnprintf_l(s, n , l, format, va);
1349 va_end(va);
1350 return res;
1351}
1352
1353TEST(AddressSanitizer, snprintf_l) {
1354 char buff[5];
1355 // Check that snprintf_l() works fine with Asan.
1356 int res = snprintf_l(buff, 5, SANITIZER_GET_C_LOCALE, "%s", "snprintf_l()");
1357 EXPECT_EQ(12, res);
1358 // Check that vsnprintf_l() works fine with Asan.
1359 res = vsnprintf_l_wrapper(buff, 5, SANITIZER_GET_C_LOCALE, "%s",
1360 "vsnprintf_l()");
1361 EXPECT_EQ(13, res);
1362
1363 EXPECT_DEATH(
1364 snprintf_l(buff, 10, SANITIZER_GET_C_LOCALE, "%s", "snprintf_l()"),
1365 "AddressSanitizer: stack-buffer-overflow");
1366 EXPECT_DEATH(vsnprintf_l_wrapper(buff, 10, SANITIZER_GET_C_LOCALE, "%s",
1367 "vsnprintf_l()"),
1368 "AddressSanitizer: stack-buffer-overflow");
1369}
1370#endif
1371

source code of compiler-rt/lib/asan/tests/asan_test.cpp