diff mbox series

[v8,4/5] Use the .ACCESS_WITH_SIZE in bound sanitizer.

Message ID 20240329160703.4012941-5-qing.zhao@oracle.com
State Committed
Commit 3d94fee616d6132075f3292a6eafdcb7b1d3f5a5
Headers
Series New attribute "counted_by" to annotate bounds for C99 FAM(PR108896) |

Checks

Context Check Description
linaro-tcwg-bot/tcwg_gcc_build--master-arm success Testing passed
linaro-tcwg-bot/tcwg_gcc_build--master-aarch64 success Testing passed
linaro-tcwg-bot/tcwg_gcc_check--master-aarch64 success Testing passed
linaro-tcwg-bot/tcwg_gcc_check--master-arm success Testing passed

Commit Message

Qing Zhao March 29, 2024, 4:07 p.m. UTC 
  gcc/c-family/ChangeLog:

	* c-ubsan.cc (get_bound_from_access_with_size): New function.
	(ubsan_instrument_bounds): Handle call to .ACCESS_WITH_SIZE.

gcc/testsuite/ChangeLog:

	* gcc.dg/ubsan/flex-array-counted-by-bounds-2.c: New test.
	* gcc.dg/ubsan/flex-array-counted-by-bounds-3.c: New test.
	* gcc.dg/ubsan/flex-array-counted-by-bounds-4.c: New test.
	* gcc.dg/ubsan/flex-array-counted-by-bounds.c: New test.
---
 gcc/c-family/c-ubsan.cc                       | 42 +++++++++++++++++
 .../ubsan/flex-array-counted-by-bounds-2.c    | 45 ++++++++++++++++++
 .../ubsan/flex-array-counted-by-bounds-3.c    | 34 ++++++++++++++
 .../ubsan/flex-array-counted-by-bounds-4.c    | 34 ++++++++++++++
 .../ubsan/flex-array-counted-by-bounds.c      | 46 +++++++++++++++++++
 5 files changed, 201 insertions(+)
 create mode 100644 gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds-2.c
 create mode 100644 gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds-3.c
 create mode 100644 gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds-4.c
 create mode 100644 gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds.c

Comments

Joseph Myers April 10, 2024, 6:37 p.m. UTC | #1 
The C front-end changes in this patch are OK for GCC 15.
Siddhesh Poyarekar April 10, 2024, 9:46 p.m. UTC | #2 
On 2024-03-29 12:07, Qing Zhao wrote:
> gcc/c-family/ChangeLog:
> 
> 	* c-ubsan.cc (get_bound_from_access_with_size): New function.
> 	(ubsan_instrument_bounds): Handle call to .ACCESS_WITH_SIZE.
> 
> gcc/testsuite/ChangeLog:
> 
> 	* gcc.dg/ubsan/flex-array-counted-by-bounds-2.c: New test.
> 	* gcc.dg/ubsan/flex-array-counted-by-bounds-3.c: New test.
> 	* gcc.dg/ubsan/flex-array-counted-by-bounds-4.c: New test.
> 	* gcc.dg/ubsan/flex-array-counted-by-bounds.c: New test.
> ---

This version looks fine to me for stage 1, but I'm not a maintainer so 
you'll need an ack from one to commit.

Thanks,
Sid

>   gcc/c-family/c-ubsan.cc                       | 42 +++++++++++++++++
>   .../ubsan/flex-array-counted-by-bounds-2.c    | 45 ++++++++++++++++++
>   .../ubsan/flex-array-counted-by-bounds-3.c    | 34 ++++++++++++++
>   .../ubsan/flex-array-counted-by-bounds-4.c    | 34 ++++++++++++++
>   .../ubsan/flex-array-counted-by-bounds.c      | 46 +++++++++++++++++++
>   5 files changed, 201 insertions(+)
>   create mode 100644 gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds-2.c
>   create mode 100644 gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds-3.c
>   create mode 100644 gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds-4.c
>   create mode 100644 gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds.c
> 
> diff --git a/gcc/c-family/c-ubsan.cc b/gcc/c-family/c-ubsan.cc
> index 940982819ddf..7cd3c6aa5b88 100644
> --- a/gcc/c-family/c-ubsan.cc
> +++ b/gcc/c-family/c-ubsan.cc
> @@ -376,6 +376,40 @@ ubsan_instrument_return (location_t loc)
>     return build_call_expr_loc (loc, t, 1, build_fold_addr_expr_loc (loc, data));
>   }
>   
> +/* Get the tree that represented the number of counted_by, i.e, the maximum
> +   number of the elements of the object that the call to .ACCESS_WITH_SIZE
> +   points to, this number will be the bound of the corresponding array.  */
> +static tree
> +get_bound_from_access_with_size (tree call)
> +{
> +  if (!is_access_with_size_p (call))
> +    return NULL_TREE;
> +
> +  tree ref_to_size = CALL_EXPR_ARG (call, 1);
> +  unsigned int class_of_size = TREE_INT_CST_LOW (CALL_EXPR_ARG (call, 2));
> +  tree type = TREE_TYPE (CALL_EXPR_ARG (call, 3));
> +  tree size = fold_build2 (MEM_REF, type, unshare_expr (ref_to_size),
> +			   build_int_cst (ptr_type_node, 0));
> +  /* If size is negative value, treat it as zero.  */
> +  if (!TYPE_UNSIGNED (type))
> +  {
> +    tree cond = fold_build2 (LT_EXPR, boolean_type_node,
> +			     unshare_expr (size), build_zero_cst (type));
> +    size = fold_build3 (COND_EXPR, type, cond,
> +			build_zero_cst (type), size);
> +  }
> +
> +  /* Only when class_of_size is 1, i.e, the number of the elements of
> +     the object type, return the size.  */
> +  if (class_of_size != 1)
> +    return NULL_TREE;
> +  else
> +    size = fold_convert (sizetype, size);
> +
> +  return size;
> +}
> +
> +
>   /* Instrument array bounds for ARRAY_REFs.  We create special builtin,
>      that gets expanded in the sanopt pass, and make an array dimension
>      of it.  ARRAY is the array, *INDEX is an index to the array.
> @@ -401,6 +435,14 @@ ubsan_instrument_bounds (location_t loc, tree array, tree *index,
>   	  && COMPLETE_TYPE_P (type)
>   	  && integer_zerop (TYPE_SIZE (type)))
>   	bound = build_int_cst (TREE_TYPE (TYPE_MIN_VALUE (domain)), -1);
> +      else if (INDIRECT_REF_P (array)
> +	       && is_access_with_size_p ((TREE_OPERAND (array, 0))))
> +	{
> +	  bound = get_bound_from_access_with_size ((TREE_OPERAND (array, 0)));
> +	  bound = fold_build2 (MINUS_EXPR, TREE_TYPE (bound),
> +			       bound,
> +			       build_int_cst (TREE_TYPE (bound), 1));
> +	}
>         else
>   	return NULL_TREE;
>       }
> diff --git a/gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds-2.c b/gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds-2.c
> new file mode 100644
> index 000000000000..b503320628d2
> --- /dev/null
> +++ b/gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds-2.c
> @@ -0,0 +1,45 @@
> +/* Test the attribute counted_by and its usage in
> +   bounds sanitizer combined with VLA.  */
> +/* { dg-do run } */
> +/* { dg-options "-fsanitize=bounds" } */
> +/* { dg-output "index 11 out of bounds for type 'int \\\[\\\*\\\]\\\[\\\*\\\]'\[^\n\r]*(\n|\r\n|\r)" } */
> +/* { dg-output "\[^\n\r]*index 20 out of bounds for type 'int \\\[\\\*\\\]\\\[\\\*\\\]\\\[\\\*\\\]'\[^\n\r]*(\n|\r\n|\r)" } */
> +/* { dg-output "\[^\n\r]*index 11 out of bounds for type 'int \\\[\\\*\\\]\\\[\\\*\\\]'\[^\n\r]*(\n|\r\n|\r)" } */
> +/* { dg-output "\[^\n\r]*index 10 out of bounds for type 'int \\\[\\\*\\\]'\[^\n\r]*(\n|\r\n|\r)" } */
> +
> +
> +#include <stdlib.h>
> +
> +void __attribute__((__noinline__)) setup_and_test_vla (int n, int m)
> +{
> +   struct foo {
> +       int n;
> +       int p[][n] __attribute__((counted_by(n)));
> +   } *f;
> +
> +   f = (struct foo *) malloc (sizeof(struct foo) + m*sizeof(int[n]));
> +   f->n = m;
> +   f->p[m][n-1]=1;
> +   return;
> +}
> +
> +void __attribute__((__noinline__)) setup_and_test_vla_1 (int n1, int n2, int m)
> +{
> +  struct foo {
> +    int n;
> +    int p[][n2][n1] __attribute__((counted_by(n)));
> +  } *f;
> +
> +  f = (struct foo *) malloc (sizeof(struct foo) + m*sizeof(int[n2][n1]));
> +  f->n = m;
> +  f->p[m][n2][n1]=1;
> +  return;
> +}
> +
> +int main(int argc, char *argv[])
> +{
> +  setup_and_test_vla (10, 11);
> +  setup_and_test_vla_1 (10, 11, 20);
> +  return 0;
> +}
> +
> diff --git a/gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds-3.c b/gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds-3.c
> new file mode 100644
> index 000000000000..9da25644af3e
> --- /dev/null
> +++ b/gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds-3.c
> @@ -0,0 +1,34 @@
> +/* Test the attribute counted_by and its usage in bounds
> +   sanitizer. when counted_by field is negative value.  */
> +/* { dg-do run } */
> +/* { dg-options "-fsanitize=bounds" } */
> +
> +#include <stdlib.h>
> +
> +struct annotated {
> +  int b;
> +  int c[] __attribute__ ((counted_by (b)));
> +} *array_annotated;
> +
> +void __attribute__((__noinline__)) setup (int annotated_count)
> +{
> +  array_annotated
> +    = (struct annotated *)malloc (sizeof (struct annotated));
> +  array_annotated->b = annotated_count;
> +
> +  return;
> +}
> +
> +void __attribute__((__noinline__)) test (int annotated_index)
> +{
> +  array_annotated->c[annotated_index] = 2;
> +}
> +
> +int main(int argc, char *argv[])
> +{
> +  setup (-3);
> +  test (2);
> +  return 0;
> +}
> +
> +/* { dg-output "24:21: runtime error: index 2 out of bounds for type" } */
> diff --git a/gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds-4.c b/gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds-4.c
> new file mode 100644
> index 000000000000..bd7e144274fc
> --- /dev/null
> +++ b/gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds-4.c
> @@ -0,0 +1,34 @@
> +/* Test the attribute counted_by and its usage in bounds
> +   sanitizer. when counted_by field is zero value.  */
> +/* { dg-do run } */
> +/* { dg-options "-fsanitize=bounds" } */
> +
> +#include <stdlib.h>
> +
> +struct annotated {
> +  int b;
> +  int c[] __attribute__ ((counted_by (b)));
> +} *array_annotated;
> +
> +void __attribute__((__noinline__)) setup (int annotated_count)
> +{
> +  array_annotated
> +    = (struct annotated *)malloc (sizeof (struct annotated));
> +  array_annotated->b = annotated_count;
> +
> +  return;
> +}
> +
> +void __attribute__((__noinline__)) test (int annotated_index)
> +{
> +  array_annotated->c[annotated_index] = 2;
> +}
> +
> +int main(int argc, char *argv[])
> +{
> +  setup (0);
> +  test (1);
> +  return 0;
> +}
> +
> +/* { dg-output "24:21: runtime error: index 1 out of bounds for type" } */
> diff --git a/gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds.c b/gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds.c
> new file mode 100644
> index 000000000000..e2b911dde626
> --- /dev/null
> +++ b/gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds.c
> @@ -0,0 +1,46 @@
> +/* Test the attribute counted_by and its usage in
> +   bounds sanitizer.  */
> +/* { dg-do run } */
> +/* { dg-options "-fsanitize=bounds" } */
> +
> +#include <stdlib.h>
> +
> +struct flex {
> +  int b;
> +  int c[];
> +} *array_flex;
> +
> +struct annotated {
> +  int b;
> +  int c[] __attribute__ ((counted_by (b)));
> +} *array_annotated;
> +
> +void __attribute__((__noinline__)) setup (int normal_count, int annotated_count)
> +{
> +  array_flex
> +    = (struct flex *)malloc (sizeof (struct flex)
> +			     + normal_count *  sizeof (int));
> +  array_flex->b = normal_count;
> +
> +  array_annotated
> +    = (struct annotated *)malloc (sizeof (struct annotated)
> +				  + annotated_count *  sizeof (int));
> +  array_annotated->b = annotated_count;
> +
> +  return;
> +}
> +
> +void __attribute__((__noinline__)) test (int normal_index, int annotated_index)
> +{
> +  array_flex->c[normal_index] = 1;
> +  array_annotated->c[annotated_index] = 2;
> +}
> +
> +int main(int argc, char *argv[])
> +{
> +  setup (10, 10);
> +  test (10, 10);
> +  return 0;
> +}
> +
> +/* { dg-output "36:21: runtime error: index 10 out of bounds for type" } */
Qing Zhao April 11, 2024, 1:22 p.m. UTC | #3 
Sid,

Thanks a lot for the review.


> On Apr 10, 2024, at 17:46, Siddhesh Poyarekar <siddhesh@gotplt.org> wrote:
> 
> On 2024-03-29 12:07, Qing Zhao wrote:
>> gcc/c-family/ChangeLog:
>> 	* c-ubsan.cc (get_bound_from_access_with_size): New function.
>> 	(ubsan_instrument_bounds): Handle call to .ACCESS_WITH_SIZE.
>> gcc/testsuite/ChangeLog:
>> 	* gcc.dg/ubsan/flex-array-counted-by-bounds-2.c: New test.
>> 	* gcc.dg/ubsan/flex-array-counted-by-bounds-3.c: New test.
>> 	* gcc.dg/ubsan/flex-array-counted-by-bounds-4.c: New test.
>> 	* gcc.dg/ubsan/flex-array-counted-by-bounds.c: New test.
>> ---
> 
> This version looks fine to me for stage 1, but I'm not a maintainer so you'll need an ack from one to commit.

This patch is purely C FE changes. Joseph already approved it.

thanks.

Qing
> 
> Thanks,
> Sid
> 
>>  gcc/c-family/c-ubsan.cc                       | 42 +++++++++++++++++
>>  .../ubsan/flex-array-counted-by-bounds-2.c    | 45 ++++++++++++++++++
>>  .../ubsan/flex-array-counted-by-bounds-3.c    | 34 ++++++++++++++
>>  .../ubsan/flex-array-counted-by-bounds-4.c    | 34 ++++++++++++++
>>  .../ubsan/flex-array-counted-by-bounds.c      | 46 +++++++++++++++++++
>>  5 files changed, 201 insertions(+)
>>  create mode 100644 gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds-2.c
>>  create mode 100644 gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds-3.c
>>  create mode 100644 gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds-4.c
>>  create mode 100644 gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds.c
>> diff --git a/gcc/c-family/c-ubsan.cc b/gcc/c-family/c-ubsan.cc
>> index 940982819ddf..7cd3c6aa5b88 100644
>> --- a/gcc/c-family/c-ubsan.cc
>> +++ b/gcc/c-family/c-ubsan.cc
>> @@ -376,6 +376,40 @@ ubsan_instrument_return (location_t loc)
>>    return build_call_expr_loc (loc, t, 1, build_fold_addr_expr_loc (loc, data));
>>  }
>>  +/* Get the tree that represented the number of counted_by, i.e, the maximum
>> +   number of the elements of the object that the call to .ACCESS_WITH_SIZE
>> +   points to, this number will be the bound of the corresponding array.  */
>> +static tree
>> +get_bound_from_access_with_size (tree call)
>> +{
>> +  if (!is_access_with_size_p (call))
>> +    return NULL_TREE;
>> +
>> +  tree ref_to_size = CALL_EXPR_ARG (call, 1);
>> +  unsigned int class_of_size = TREE_INT_CST_LOW (CALL_EXPR_ARG (call, 2));
>> +  tree type = TREE_TYPE (CALL_EXPR_ARG (call, 3));
>> +  tree size = fold_build2 (MEM_REF, type, unshare_expr (ref_to_size),
>> +			   build_int_cst (ptr_type_node, 0));
>> +  /* If size is negative value, treat it as zero.  */
>> +  if (!TYPE_UNSIGNED (type))
>> +  {
>> +    tree cond = fold_build2 (LT_EXPR, boolean_type_node,
>> +			     unshare_expr (size), build_zero_cst (type));
>> +    size = fold_build3 (COND_EXPR, type, cond,
>> +			build_zero_cst (type), size);
>> +  }
>> +
>> +  /* Only when class_of_size is 1, i.e, the number of the elements of
>> +     the object type, return the size.  */
>> +  if (class_of_size != 1)
>> +    return NULL_TREE;
>> +  else
>> +    size = fold_convert (sizetype, size);
>> +
>> +  return size;
>> +}
>> +
>> +
>>  /* Instrument array bounds for ARRAY_REFs.  We create special builtin,
>>     that gets expanded in the sanopt pass, and make an array dimension
>>     of it.  ARRAY is the array, *INDEX is an index to the array.
>> @@ -401,6 +435,14 @@ ubsan_instrument_bounds (location_t loc, tree array, tree *index,
>>  	  && COMPLETE_TYPE_P (type)
>>  	  && integer_zerop (TYPE_SIZE (type)))
>>  	bound = build_int_cst (TREE_TYPE (TYPE_MIN_VALUE (domain)), -1);
>> +      else if (INDIRECT_REF_P (array)
>> +	       && is_access_with_size_p ((TREE_OPERAND (array, 0))))
>> +	{
>> +	  bound = get_bound_from_access_with_size ((TREE_OPERAND (array, 0)));
>> +	  bound = fold_build2 (MINUS_EXPR, TREE_TYPE (bound),
>> +			       bound,
>> +			       build_int_cst (TREE_TYPE (bound), 1));
>> +	}
>>        else
>>  	return NULL_TREE;
>>      }
>> diff --git a/gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds-2.c b/gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds-2.c
>> new file mode 100644
>> index 000000000000..b503320628d2
>> --- /dev/null
>> +++ b/gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds-2.c
>> @@ -0,0 +1,45 @@
>> +/* Test the attribute counted_by and its usage in
>> +   bounds sanitizer combined with VLA.  */
>> +/* { dg-do run } */
>> +/* { dg-options "-fsanitize=bounds" } */
>> +/* { dg-output "index 11 out of bounds for type 'int \\\[\\\*\\\]\\\[\\\*\\\]'\[^\n\r]*(\n|\r\n|\r)" } */
>> +/* { dg-output "\[^\n\r]*index 20 out of bounds for type 'int \\\[\\\*\\\]\\\[\\\*\\\]\\\[\\\*\\\]'\[^\n\r]*(\n|\r\n|\r)" } */
>> +/* { dg-output "\[^\n\r]*index 11 out of bounds for type 'int \\\[\\\*\\\]\\\[\\\*\\\]'\[^\n\r]*(\n|\r\n|\r)" } */
>> +/* { dg-output "\[^\n\r]*index 10 out of bounds for type 'int \\\[\\\*\\\]'\[^\n\r]*(\n|\r\n|\r)" } */
>> +
>> +
>> +#include <stdlib.h>
>> +
>> +void __attribute__((__noinline__)) setup_and_test_vla (int n, int m)
>> +{
>> +   struct foo {
>> +       int n;
>> +       int p[][n] __attribute__((counted_by(n)));
>> +   } *f;
>> +
>> +   f = (struct foo *) malloc (sizeof(struct foo) + m*sizeof(int[n]));
>> +   f->n = m;
>> +   f->p[m][n-1]=1;
>> +   return;
>> +}
>> +
>> +void __attribute__((__noinline__)) setup_and_test_vla_1 (int n1, int n2, int m)
>> +{
>> +  struct foo {
>> +    int n;
>> +    int p[][n2][n1] __attribute__((counted_by(n)));
>> +  } *f;
>> +
>> +  f = (struct foo *) malloc (sizeof(struct foo) + m*sizeof(int[n2][n1]));
>> +  f->n = m;
>> +  f->p[m][n2][n1]=1;
>> +  return;
>> +}
>> +
>> +int main(int argc, char *argv[])
>> +{
>> +  setup_and_test_vla (10, 11);
>> +  setup_and_test_vla_1 (10, 11, 20);
>> +  return 0;
>> +}
>> +
>> diff --git a/gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds-3.c b/gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds-3.c
>> new file mode 100644
>> index 000000000000..9da25644af3e
>> --- /dev/null
>> +++ b/gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds-3.c
>> @@ -0,0 +1,34 @@
>> +/* Test the attribute counted_by and its usage in bounds
>> +   sanitizer. when counted_by field is negative value.  */
>> +/* { dg-do run } */
>> +/* { dg-options "-fsanitize=bounds" } */
>> +
>> +#include <stdlib.h>
>> +
>> +struct annotated {
>> +  int b;
>> +  int c[] __attribute__ ((counted_by (b)));
>> +} *array_annotated;
>> +
>> +void __attribute__((__noinline__)) setup (int annotated_count)
>> +{
>> +  array_annotated
>> +    = (struct annotated *)malloc (sizeof (struct annotated));
>> +  array_annotated->b = annotated_count;
>> +
>> +  return;
>> +}
>> +
>> +void __attribute__((__noinline__)) test (int annotated_index)
>> +{
>> +  array_annotated->c[annotated_index] = 2;
>> +}
>> +
>> +int main(int argc, char *argv[])
>> +{
>> +  setup (-3);
>> +  test (2);
>> +  return 0;
>> +}
>> +
>> +/* { dg-output "24:21: runtime error: index 2 out of bounds for type" } */
>> diff --git a/gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds-4.c b/gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds-4.c
>> new file mode 100644
>> index 000000000000..bd7e144274fc
>> --- /dev/null
>> +++ b/gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds-4.c
>> @@ -0,0 +1,34 @@
>> +/* Test the attribute counted_by and its usage in bounds
>> +   sanitizer. when counted_by field is zero value.  */
>> +/* { dg-do run } */
>> +/* { dg-options "-fsanitize=bounds" } */
>> +
>> +#include <stdlib.h>
>> +
>> +struct annotated {
>> +  int b;
>> +  int c[] __attribute__ ((counted_by (b)));
>> +} *array_annotated;
>> +
>> +void __attribute__((__noinline__)) setup (int annotated_count)
>> +{
>> +  array_annotated
>> +    = (struct annotated *)malloc (sizeof (struct annotated));
>> +  array_annotated->b = annotated_count;
>> +
>> +  return;
>> +}
>> +
>> +void __attribute__((__noinline__)) test (int annotated_index)
>> +{
>> +  array_annotated->c[annotated_index] = 2;
>> +}
>> +
>> +int main(int argc, char *argv[])
>> +{
>> +  setup (0);
>> +  test (1);
>> +  return 0;
>> +}
>> +
>> +/* { dg-output "24:21: runtime error: index 1 out of bounds for type" } */
>> diff --git a/gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds.c b/gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds.c
>> new file mode 100644
>> index 000000000000..e2b911dde626
>> --- /dev/null
>> +++ b/gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds.c
>> @@ -0,0 +1,46 @@
>> +/* Test the attribute counted_by and its usage in
>> +   bounds sanitizer.  */
>> +/* { dg-do run } */
>> +/* { dg-options "-fsanitize=bounds" } */
>> +
>> +#include <stdlib.h>
>> +
>> +struct flex {
>> +  int b;
>> +  int c[];
>> +} *array_flex;
>> +
>> +struct annotated {
>> +  int b;
>> +  int c[] __attribute__ ((counted_by (b)));
>> +} *array_annotated;
>> +
>> +void __attribute__((__noinline__)) setup (int normal_count, int annotated_count)
>> +{
>> +  array_flex
>> +    = (struct flex *)malloc (sizeof (struct flex)
>> +			     + normal_count *  sizeof (int));
>> +  array_flex->b = normal_count;
>> +
>> +  array_annotated
>> +    = (struct annotated *)malloc (sizeof (struct annotated)
>> +				  + annotated_count *  sizeof (int));
>> +  array_annotated->b = annotated_count;
>> +
>> +  return;
>> +}
>> +
>> +void __attribute__((__noinline__)) test (int normal_index, int annotated_index)
>> +{
>> +  array_flex->c[normal_index] = 1;
>> +  array_annotated->c[annotated_index] = 2;
>> +}
>> +
>> +int main(int argc, char *argv[])
>> +{
>> +  setup (10, 10);
>> +  test (10, 10);
>> +  return 0;
>> +}
>> +
>> +/* { dg-output "36:21: runtime error: index 10 out of bounds for type" } */
diff mbox series

Patch

diff --git a/gcc/c-family/c-ubsan.cc b/gcc/c-family/c-ubsan.cc
index 940982819ddf..7cd3c6aa5b88 100644
--- a/gcc/c-family/c-ubsan.cc
+++ b/gcc/c-family/c-ubsan.cc
@@ -376,6 +376,40 @@  ubsan_instrument_return (location_t loc)
   return build_call_expr_loc (loc, t, 1, build_fold_addr_expr_loc (loc, data));
 }
 
+/* Get the tree that represented the number of counted_by, i.e, the maximum
+   number of the elements of the object that the call to .ACCESS_WITH_SIZE
+   points to, this number will be the bound of the corresponding array.  */
+static tree
+get_bound_from_access_with_size (tree call)
+{
+  if (!is_access_with_size_p (call))
+    return NULL_TREE;
+
+  tree ref_to_size = CALL_EXPR_ARG (call, 1);
+  unsigned int class_of_size = TREE_INT_CST_LOW (CALL_EXPR_ARG (call, 2));
+  tree type = TREE_TYPE (CALL_EXPR_ARG (call, 3));
+  tree size = fold_build2 (MEM_REF, type, unshare_expr (ref_to_size),
+			   build_int_cst (ptr_type_node, 0));
+  /* If size is negative value, treat it as zero.  */
+  if (!TYPE_UNSIGNED (type))
+  {
+    tree cond = fold_build2 (LT_EXPR, boolean_type_node,
+			     unshare_expr (size), build_zero_cst (type));
+    size = fold_build3 (COND_EXPR, type, cond,
+			build_zero_cst (type), size);
+  }
+
+  /* Only when class_of_size is 1, i.e, the number of the elements of
+     the object type, return the size.  */
+  if (class_of_size != 1)
+    return NULL_TREE;
+  else
+    size = fold_convert (sizetype, size);
+
+  return size;
+}
+
+
 /* Instrument array bounds for ARRAY_REFs.  We create special builtin,
    that gets expanded in the sanopt pass, and make an array dimension
    of it.  ARRAY is the array, *INDEX is an index to the array.
@@ -401,6 +435,14 @@  ubsan_instrument_bounds (location_t loc, tree array, tree *index,
 	  && COMPLETE_TYPE_P (type)
 	  && integer_zerop (TYPE_SIZE (type)))
 	bound = build_int_cst (TREE_TYPE (TYPE_MIN_VALUE (domain)), -1);
+      else if (INDIRECT_REF_P (array)
+	       && is_access_with_size_p ((TREE_OPERAND (array, 0))))
+	{
+	  bound = get_bound_from_access_with_size ((TREE_OPERAND (array, 0)));
+	  bound = fold_build2 (MINUS_EXPR, TREE_TYPE (bound),
+			       bound,
+			       build_int_cst (TREE_TYPE (bound), 1));
+	}
       else
 	return NULL_TREE;
     }
diff --git a/gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds-2.c b/gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds-2.c
new file mode 100644
index 000000000000..b503320628d2
--- /dev/null
+++ b/gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds-2.c
@@ -0,0 +1,45 @@ 
+/* Test the attribute counted_by and its usage in
+   bounds sanitizer combined with VLA.  */
+/* { dg-do run } */
+/* { dg-options "-fsanitize=bounds" } */
+/* { dg-output "index 11 out of bounds for type 'int \\\[\\\*\\\]\\\[\\\*\\\]'\[^\n\r]*(\n|\r\n|\r)" } */
+/* { dg-output "\[^\n\r]*index 20 out of bounds for type 'int \\\[\\\*\\\]\\\[\\\*\\\]\\\[\\\*\\\]'\[^\n\r]*(\n|\r\n|\r)" } */
+/* { dg-output "\[^\n\r]*index 11 out of bounds for type 'int \\\[\\\*\\\]\\\[\\\*\\\]'\[^\n\r]*(\n|\r\n|\r)" } */
+/* { dg-output "\[^\n\r]*index 10 out of bounds for type 'int \\\[\\\*\\\]'\[^\n\r]*(\n|\r\n|\r)" } */
+
+
+#include <stdlib.h>
+
+void __attribute__((__noinline__)) setup_and_test_vla (int n, int m)
+{
+   struct foo {
+       int n;
+       int p[][n] __attribute__((counted_by(n)));
+   } *f;
+
+   f = (struct foo *) malloc (sizeof(struct foo) + m*sizeof(int[n]));
+   f->n = m;
+   f->p[m][n-1]=1;
+   return;
+}
+
+void __attribute__((__noinline__)) setup_and_test_vla_1 (int n1, int n2, int m)
+{
+  struct foo {
+    int n;
+    int p[][n2][n1] __attribute__((counted_by(n)));
+  } *f;
+
+  f = (struct foo *) malloc (sizeof(struct foo) + m*sizeof(int[n2][n1]));
+  f->n = m;
+  f->p[m][n2][n1]=1;
+  return;
+}
+
+int main(int argc, char *argv[])
+{
+  setup_and_test_vla (10, 11);
+  setup_and_test_vla_1 (10, 11, 20);
+  return 0;
+}
+
diff --git a/gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds-3.c b/gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds-3.c
new file mode 100644
index 000000000000..9da25644af3e
--- /dev/null
+++ b/gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds-3.c
@@ -0,0 +1,34 @@ 
+/* Test the attribute counted_by and its usage in bounds
+   sanitizer. when counted_by field is negative value.  */
+/* { dg-do run } */
+/* { dg-options "-fsanitize=bounds" } */
+
+#include <stdlib.h>
+
+struct annotated {
+  int b;
+  int c[] __attribute__ ((counted_by (b)));
+} *array_annotated;
+
+void __attribute__((__noinline__)) setup (int annotated_count)
+{
+  array_annotated
+    = (struct annotated *)malloc (sizeof (struct annotated));
+  array_annotated->b = annotated_count;
+
+  return;
+}
+
+void __attribute__((__noinline__)) test (int annotated_index)
+{
+  array_annotated->c[annotated_index] = 2;
+}
+
+int main(int argc, char *argv[])
+{
+  setup (-3);   
+  test (2);
+  return 0;
+}
+
+/* { dg-output "24:21: runtime error: index 2 out of bounds for type" } */
diff --git a/gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds-4.c b/gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds-4.c
new file mode 100644
index 000000000000..bd7e144274fc
--- /dev/null
+++ b/gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds-4.c
@@ -0,0 +1,34 @@ 
+/* Test the attribute counted_by and its usage in bounds
+   sanitizer. when counted_by field is zero value.  */
+/* { dg-do run } */
+/* { dg-options "-fsanitize=bounds" } */
+
+#include <stdlib.h>
+
+struct annotated {
+  int b;
+  int c[] __attribute__ ((counted_by (b)));
+} *array_annotated;
+
+void __attribute__((__noinline__)) setup (int annotated_count)
+{
+  array_annotated
+    = (struct annotated *)malloc (sizeof (struct annotated));
+  array_annotated->b = annotated_count;
+
+  return;
+}
+
+void __attribute__((__noinline__)) test (int annotated_index)
+{
+  array_annotated->c[annotated_index] = 2;
+}
+
+int main(int argc, char *argv[])
+{
+  setup (0);   
+  test (1);
+  return 0;
+}
+
+/* { dg-output "24:21: runtime error: index 1 out of bounds for type" } */
diff --git a/gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds.c b/gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds.c
new file mode 100644
index 000000000000..e2b911dde626
--- /dev/null
+++ b/gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds.c
@@ -0,0 +1,46 @@ 
+/* Test the attribute counted_by and its usage in
+   bounds sanitizer.  */
+/* { dg-do run } */
+/* { dg-options "-fsanitize=bounds" } */
+
+#include <stdlib.h>
+
+struct flex {
+  int b;
+  int c[];
+} *array_flex;
+
+struct annotated {
+  int b;
+  int c[] __attribute__ ((counted_by (b)));
+} *array_annotated;
+
+void __attribute__((__noinline__)) setup (int normal_count, int annotated_count)
+{
+  array_flex
+    = (struct flex *)malloc (sizeof (struct flex)
+			     + normal_count *  sizeof (int));
+  array_flex->b = normal_count;
+
+  array_annotated
+    = (struct annotated *)malloc (sizeof (struct annotated)
+				  + annotated_count *  sizeof (int));
+  array_annotated->b = annotated_count;
+
+  return;
+}
+
+void __attribute__((__noinline__)) test (int normal_index, int annotated_index)
+{
+  array_flex->c[normal_index] = 1;
+  array_annotated->c[annotated_index] = 2;
+}
+
+int main(int argc, char *argv[])
+{
+  setup (10, 10);   
+  test (10, 10);
+  return 0;
+}
+
+/* { dg-output "36:21: runtime error: index 10 out of bounds for type" } */