| 1 | // RUN: %clang_hwasan -O0 -DISREAD=1 %s -o %t && not %run %t 2>&1 | FileCheck %s --check-prefixes=CHECK |
|---|
| 2 | // RUN: %clang_hwasan -O1 -DISREAD=1 %s -o %t && not %run %t 2>&1 | FileCheck %s --check-prefixes=CHECK |
|---|
| 3 | // RUN: %clang_hwasan -O2 -DISREAD=1 %s -o %t && not %run %t 2>&1 | FileCheck %s --check-prefixes=CHECK |
|---|
| 4 | // RUN: %clang_hwasan -O3 -DISREAD=1 %s -o %t && not %run %t 2>&1 | FileCheck %s --check-prefixes=CHECK |
|---|
| 5 | |
|---|
| 6 | // RUN: %clang_hwasan -O0 -DISREAD=0 %s -o %t && not %run %t 2>&1 | FileCheck %s --check-prefixes=CHECK |
|---|
| 7 | |
|---|
| 8 | #include <stdlib.h> |
|---|
| 9 | #include <stdio.h> |
|---|
| 10 | #include <sanitizer/hwasan_interface.h> |
|---|
| 11 | |
|---|
| 12 | int main() { |
|---|
| 13 | __hwasan_enable_allocator_tagging(); |
|---|
| 14 | char * volatile x = (char*)malloc(size: 10); |
|---|
| 15 | free(ptr: x); |
|---|
| 16 | __hwasan_disable_allocator_tagging(); |
|---|
| 17 | fprintf(stderr, ISREAD ? "Going to do a READ\n" : "Going to do a WRITE\n" ); |
|---|
| 18 | fflush(stderr); |
|---|
| 19 | // CHECK: Going to do a [[TYPE:[A-Z]*]] |
|---|
| 20 | int r = 0; |
|---|
| 21 | if (ISREAD) r = x[5]; else x[5] = 42; // should be on the same line. |
|---|
| 22 | // CHECK: ERROR: HWAddressSanitizer: tag-mismatch on address {{.*}} at pc {{[0x]+}}[[PC:.*]] |
|---|
| 23 | // CHECK: [[TYPE]] of size 1 at {{.*}} tags: [[PTR_TAG:[0-9a-f][0-9a-f]]]/[[MEM_TAG:[0-9a-f][0-9a-f]]] (ptr/mem) |
|---|
| 24 | // CHECK: #{{[0-9]}} {{[0-9]+}}{{.*}}[[PC]] |
|---|
| 25 | // If we instrument using calls (default on x86), main is not the top frame |
|---|
| 26 | // of the fault. |
|---|
| 27 | // CHECK: in main {{.*}}use-after-free.c:[[@LINE-6]] |
|---|
| 28 | // Offset is 5 or 11 depending on left/right alignment. |
|---|
| 29 | // CHECK: is a small unallocated heap chunk; size: {{16|32}} offset: {{5|11}} |
|---|
| 30 | // CHECK: Cause: use-after-free |
|---|
| 31 | // CHECK: is located 5 bytes inside a 10-byte region |
|---|
| 32 | // |
|---|
| 33 | // CHECK: freed by thread {{.*}} here: |
|---|
| 34 | // CHECK: #0 {{.*}} in {{.*}}free{{.*}} {{.*}}hwasan_allocation_functions.cpp |
|---|
| 35 | // CHECK: #1 {{.*}} in main {{.*}}use-after-free.c:[[@LINE-20]] |
|---|
| 36 | |
|---|
| 37 | // CHECK: previously allocated by thread {{.*}} here: |
|---|
| 38 | // CHECK: #0 {{.*}} in {{.*}}malloc{{.*}} {{.*}}hwasan_allocation_functions.cpp |
|---|
| 39 | // CHECK: #1 {{.*}} in main {{.*}}use-after-free.c:[[@LINE-25]] |
|---|
| 40 | // CHECK: Memory tags around the buggy address (one tag corresponds to 16 bytes): |
|---|
| 41 | // CHECK: =>{{.*}}[[MEM_TAG]] |
|---|
| 42 | // CHECK: SUMMARY: HWAddressSanitizer: tag-mismatch {{.*}} in main |
|---|
| 43 | return r; |
|---|
| 44 | } |
|---|
| 45 | |
|---|
