| 1 | // Tests free_checks_tail_magic=1. |
|---|
| 2 | // RUN: %clang_hwasan %s -o %t |
|---|
| 3 | // RUN: %env_hwasan_opts=free_checks_tail_magic=0 %run %t |
|---|
| 4 | // RUN: %env_hwasan_opts=free_checks_tail_magic=1 not %run %t 2>&1 | \ |
|---|
| 5 | // RUN: FileCheck --check-prefixes=CHECK,CHECK-NONLASTGRANULE --strict-whitespace %s |
|---|
| 6 | // RUN: not %run %t 2>&1 | \ |
|---|
| 7 | // RUN: FileCheck --check-prefixes=CHECK,CHECK-NONLASTGRANULE --strict-whitespace %s |
|---|
| 8 | // RUN: %clang_hwasan -DLAST_GRANULE %s -o %t |
|---|
| 9 | // RUN: not %run %t 2>&1 | \ |
|---|
| 10 | // RUN: FileCheck --check-prefixes=CHECK,CHECK-LASTGRANULE --strict-whitespace %s |
|---|
| 11 | |
|---|
| 12 | #include <stdlib.h> |
|---|
| 13 | #include <stdio.h> |
|---|
| 14 | #include <sanitizer/hwasan_interface.h> |
|---|
| 15 | |
|---|
| 16 | static volatile char *sink; |
|---|
| 17 | |
|---|
| 18 | // Overwrite the tail in a non-hwasan function so that we don't detect the |
|---|
| 19 | // stores as OOB. |
|---|
| 20 | __attribute__((no_sanitize("hwaddress" ))) void overwrite_tail() { |
|---|
| 21 | #ifdef LAST_GRANULE |
|---|
| 22 | sink[31] = 0x71; |
|---|
| 23 | #else // LAST_GRANULE |
|---|
| 24 | sink[20] = 0x42; |
|---|
| 25 | sink[24] = 0x66; |
|---|
| 26 | #endif // LAST_GRANULE |
|---|
| 27 | } |
|---|
| 28 | |
|---|
| 29 | int main(int argc, char **argv) { |
|---|
| 30 | __hwasan_enable_allocator_tagging(); |
|---|
| 31 | |
|---|
| 32 | char *p = (char*)malloc(size: 20); |
|---|
| 33 | __hwasan_print_shadow(x: p, size: 1); |
|---|
| 34 | sink = p; |
|---|
| 35 | overwrite_tail(); |
|---|
| 36 | free(ptr: p); |
|---|
| 37 | // CHECK: HWASan shadow map for {{.*}} (pointer tag [[TAG:[a-f0-9]+]]) |
|---|
| 38 | // CHECK: ERROR: HWAddressSanitizer: allocation-tail-overwritten; heap object [{{.*}}) of size 20 |
|---|
| 39 | // CHECK: Stack of invalid access unknown. Issue detected at deallocation time. |
|---|
| 40 | // CHECK: deallocated here: |
|---|
| 41 | // CHECK: in main {{.*}}tail-magic.c:[[@LINE-5]] |
|---|
| 42 | // CHECK: allocated here: |
|---|
| 43 | // CHECK: in main {{.*}}tail-magic.c:[[@LINE-11]] |
|---|
| 44 | // CHECK-NONLASTGRANULE: Tail contains: .. .. .. .. 42 {{(([a-f0-9]{2} ){3})}}66 |
|---|
| 45 | // CHECK-LASTGRANULE: Tail contains: .. .. .. .. {{(([a-f0-9]{2} ?)+)}}71{{ *$}} |
|---|
| 46 | // CHECK-NEXT: Expected: {{ +}} .. .. .. .. {{([a-f0-9]{2} )+0?}}[[TAG]]{{ *$}} |
|---|
| 47 | // CHECK-NONLASTGRANULE-NEXT: {{ +}}^^{{ +}}^^{{ *$}} |
|---|
| 48 | // CHECK-LASTGRANULE-NEXT: {{ +}}^^{{ *$}} |
|---|
| 49 | return 0; |
|---|
| 50 | } |
|---|
| 51 | |
|---|
