From patchwork Tue Feb 6 10:23:26 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jakub Jelinek X-Patchwork-Id: 197304 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a05:7301:168b:b0:106:860b:bbdd with SMTP id ma11csp1443654dyb; Tue, 6 Feb 2024 02:24:23 -0800 (PST) X-Google-Smtp-Source: AGHT+IHBZFsIrPV5U57PicTaqUHH75eTHD6vnskFkd25GTNylZHACDAGFvppOpck7UDAkJiBcQmz X-Received: by 2002:a05:6214:d0e:b0:68c:92d8:7df9 with SMTP id 14-20020a0562140d0e00b0068c92d87df9mr2201493qvh.7.1707215063772; Tue, 06 Feb 2024 02:24:23 -0800 (PST) ARC-Seal: i=2; a=rsa-sha256; t=1707215063; cv=pass; d=google.com; s=arc-20160816; b=his8dR5Qv31kNSGhR3fcf6dgD+FHH8Nlyi7DZcYNcTHaYbaj0OzSBMt6bKv1eFEYfS Nh3aFOmcqplDyJG76l/XAceC1hd9D/naNjBciYRtKks2pMQliScDZywnWRykmYMollhi 3erxpkwIc7XNyYfWLQ3PRFkLwo3QYvfjnNcOak8UWceyF+VGhGQdwMg1iKT773Z4RaPh 6hWRVsdeUkXww+Ga4WkrYdfCzEofWhLh21fi5WPcicP+8gPNoCPrO470qg6t9npuzvvw KOJLIwqVdHnDIqenMYkq9RjAf3Q5KvrnN3H9FILvedrHjswCd97VQvIHOtSDZxbCtaKf E4xg== ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=errors-to:reply-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-disposition :mime-version:message-id:subject:cc:to:from:date:dkim-signature :arc-filter:dmarc-filter:delivered-to; bh=KeVzyzgWAqtpW2mxehr22v0IZaL8FBqJWPwCcNowtyA=; fh=rHeLcCelJFC1+zVpXMhETXbT/RQ7fy7m3Qz0FWHel1M=; b=QvyN3gakKgpJAWZDU02eEZIdfY2tf7gF3+1PQrhdkkJCQE3BsXXBx7RZJgZXJgkEna YmBll9lBmQCIXv4M7heZ2b+x6Ucs3WBZCojdUVjUmBMyAUzqVT6XCPmfyTEzJI8V5VP8 e5w79wfXSYayBjwsmkvwtvbByix39wbxMMo7ugF4iBQh2FwZeMpCFQq0XzEVssu0e1mE NwxscspgSDIBVy5zBv3/ongLN43Twwq6aJFE0oJVYbZJM6FEDf0q2vwYk46P7f99vCEF jo3JlO9DBAWtehMA6FOWfvT9EA/QD/IEYn0r0sEEOgaphyqIR07t62vqimzPh157+C+R Qmtw==; dara=google.com ARC-Authentication-Results: i=2; mx.google.com; dkim=pass header.i=@redhat.com header.s=mimecast20190719 header.b="R/w8qn1/"; arc=pass (i=1); spf=pass (google.com: domain of gcc-patches-bounces+ouuuleilei=gmail.com@gcc.gnu.org designates 2620:52:3:1:0:246e:9693:128c as permitted sender) smtp.mailfrom="gcc-patches-bounces+ouuuleilei=gmail.com@gcc.gnu.org"; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=redhat.com X-Forwarded-Encrypted: i=1; AJvYcCVT+s10UbaAq63kNa5scHgnbZYS8VKsx+4Lrxz0Acb9VyTjYy/WH/zPUiYy8mbNKnY0wFhE419bdVp1gqBZlAigXIB6FQ== Received: from server2.sourceware.org (server2.sourceware.org. [2620:52:3:1:0:246e:9693:128c]) by mx.google.com with ESMTPS id g11-20020a0cf84b000000b0068c5d1c3aa8si2025905qvo.221.2024.02.06.02.24.23 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 06 Feb 2024 02:24:23 -0800 (PST) Received-SPF: pass (google.com: domain of gcc-patches-bounces+ouuuleilei=gmail.com@gcc.gnu.org designates 2620:52:3:1:0:246e:9693:128c as permitted sender) client-ip=2620:52:3:1:0:246e:9693:128c; Authentication-Results: mx.google.com; dkim=pass header.i=@redhat.com header.s=mimecast20190719 header.b="R/w8qn1/"; arc=pass (i=1); spf=pass (google.com: domain of gcc-patches-bounces+ouuuleilei=gmail.com@gcc.gnu.org designates 2620:52:3:1:0:246e:9693:128c as permitted sender) smtp.mailfrom="gcc-patches-bounces+ouuuleilei=gmail.com@gcc.gnu.org"; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=redhat.com Received: from server2.sourceware.org (localhost [IPv6:::1]) by sourceware.org (Postfix) with ESMTP id 77F363858C66 for ; Tue, 6 Feb 2024 10:24:23 +0000 (GMT) X-Original-To: gcc-patches@gcc.gnu.org Delivered-To: gcc-patches@gcc.gnu.org Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) by sourceware.org (Postfix) with ESMTPS id 8427E3858D33 for ; Tue, 6 Feb 2024 10:23:34 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org 8427E3858D33 Authentication-Results: sourceware.org; dmarc=pass (p=none dis=none) header.from=redhat.com Authentication-Results: sourceware.org; spf=pass smtp.mailfrom=redhat.com ARC-Filter: OpenARC Filter v1.0.0 sourceware.org 8427E3858D33 Authentication-Results: server2.sourceware.org; arc=none smtp.remote-ip=170.10.133.124 ARC-Seal: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1707215015; cv=none; b=eAiZ7d2SB8IttyfMWBHkMiDkeXxEVZuo9BjSy2FVLlrW1j5rNXtgwwcxcX9CjYkohuK3Zo0jhXQvw8dnLDdhljBbA3MlLuomuJUEeDtA8z76J/EKb669Nl0OlBOh8BoaZOtwMxzxqK5V1Tj8UGKrq3b7a98ZequA2zGD0HaEtCk= ARC-Message-Signature: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1707215015; c=relaxed/simple; bh=z53/fclf1joE8tujw5fxTxF1XQmJQ0R0MuePaJRGJqE=; h=DKIM-Signature:Date:From:To:Subject:Message-ID:MIME-Version; b=dh4bf8Tb3tCQgjqlq0klO9uxjZ5gkLfnnkIeolu2BsSqYuHXfPUwGAHbE9y8M2jouNXnUWkpWu3s3DzgFILw4gJym/3pc5fzPBHl0cAemeCRQxxdYQM23FD1fOUIJ8a+iIUICAjLixRIBh4/GY3L6X0utsn1ZJ9PFOTDzEdbSeg= ARC-Authentication-Results: i=1; server2.sourceware.org DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1707215014; h=from:from:reply-to:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type; bh=KeVzyzgWAqtpW2mxehr22v0IZaL8FBqJWPwCcNowtyA=; b=R/w8qn1/xBRB8pIQxB3Q71sSRwrv8kkYryB4JtUjOovOYniqwh3yjbvBiV4cd8NQtbPM4d Z/xnBd61BcfMyK3PNq1gKTybWMehLfr3vWmR+OtoB6JnI+SWrtJiXaHlnkBXszmK65S9IX sN+aK73RPFAira+P6DU0hhL0MS6dX6o= Received: from mimecast-mx02.redhat.com (mx-ext.redhat.com [66.187.233.73]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-18-O-F6JtbaO0a-WXSBN_0a_w-1; Tue, 06 Feb 2024 05:23:30 -0500 X-MC-Unique: O-F6JtbaO0a-WXSBN_0a_w-1 Received: from smtp.corp.redhat.com (int-mx08.intmail.prod.int.rdu2.redhat.com [10.11.54.8]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id 6AB6E38562C3; Tue, 6 Feb 2024 10:23:30 +0000 (UTC) Received: from tucnak.zalov.cz (unknown [10.39.192.70]) by smtp.corp.redhat.com (Postfix) with ESMTPS id 2E1AFC1690E; Tue, 6 Feb 2024 10:23:30 +0000 (UTC) Received: from tucnak.zalov.cz (localhost [127.0.0.1]) by tucnak.zalov.cz (8.17.1/8.17.1) with ESMTPS id 416ANRfc3214903 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT); Tue, 6 Feb 2024 11:23:28 +0100 Received: (from jakub@localhost) by tucnak.zalov.cz (8.17.1/8.17.1/Submit) id 416ANQ6R3214901; Tue, 6 Feb 2024 11:23:26 +0100 Date: Tue, 6 Feb 2024 11:23:26 +0100 From: Jakub Jelinek To: Richard Biener Cc: gcc-patches@gcc.gnu.org Subject: [PATCH] asan: Don't fold some strlens with -fsanitize=address [PR110676] Message-ID: MIME-Version: 1.0 X-Scanned-By: MIMEDefang 3.4.1 on 10.11.54.8 X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Content-Disposition: inline X-Spam-Status: No, score=-3.8 required=5.0 tests=BAYES_00, DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, DKIM_VALID_EF, RCVD_IN_DNSWL_NONE, RCVD_IN_MSPIKE_H5, RCVD_IN_MSPIKE_WL, SPF_HELO_NONE, SPF_NONE, TXREP, T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on server2.sourceware.org X-BeenThere: gcc-patches@gcc.gnu.org X-Mailman-Version: 2.1.30 Precedence: list List-Id: Gcc-patches mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: Jakub Jelinek Errors-To: gcc-patches-bounces+ouuuleilei=gmail.com@gcc.gnu.org X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-THRID: 1790144742637559268 X-GMAIL-MSGID: 1790144742637559268 Hi! The UB on the following testcase isn't diagnosed by -fsanitize=address, because we see that the array has a single element and optimize the strlen to 0. I think it is fine to assume e.g. for range purposes the lower bound for the strlen as long as we don't try to optimize strlen (str) where we know that it returns [26, 42] to 26 + strlen (str + 26), but for the upper bound we really want to punt on optimizing that for -fsanitize=address to read all the bytes of the string and diagnose if we run to object end etc. Bootstrapped/regtested on x86_64-linux and i686-linux, ok for trunk? 2024-02-06 Jakub Jelinek PR sanitizer/110676 * gimple-fold.cc (gimple_fold_builtin_strlen): For -fsanitize=address reset maxlen to sizetype maximum. * gcc.dg/asan/pr110676.c: New test. Jakub --- gcc/gimple-fold.cc.jj 2024-01-31 12:24:51.714239628 +0100 +++ gcc/gimple-fold.cc 2024-02-05 21:38:03.829964904 +0100 @@ -4019,6 +4019,11 @@ gimple_fold_builtin_strlen (gimple_stmt_ maxlen = wi::to_wide (max_object_size (), prec) - 2; } + /* For -fsanitize=address, don't optimize the upper bound of the + length to be able to diagnose UB on non-zero terminated arrays. */ + if (sanitize_flags_p (SANITIZE_ADDRESS)) + maxlen = wi::max_value (TYPE_PRECISION (sizetype), UNSIGNED); + if (minlen == maxlen) { /* Fold the strlen call to a constant. */ --- gcc/testsuite/gcc.dg/asan/pr110676.c.jj 2024-02-05 21:42:43.657104536 +0100 +++ gcc/testsuite/gcc.dg/asan/pr110676.c 2024-02-05 21:42:39.091167524 +0100 @@ -0,0 +1,14 @@ +/* PR sanitizer/110676 */ +/* { dg-do run } */ +/* { dg-skip-if "" { *-*-* } { "*" } { "-O0" } } */ +/* { dg-shouldfail "asan" } */ + +int +main () +{ + char s[1] = "A"; + return __builtin_strlen (s); +} + +/* { dg-output "ERROR: AddressSanitizer: stack-buffer-overflow on address.*(\n|\r\n|\r)" } */ +/* { dg-output "READ of size.*" } */