src/libcompiler_builtins/compiler-rt/test/asan/TestCases/scariness_score_test.cc

   1 // Test how we produce the scariness score.
   2
   3 // RUN: %clangxx_asan -O0 %s -o %t
   4 // On OSX and Windows, alloc_dealloc_mismatch=1 isn't 100% reliable, so it's
   5 // off by default. It's safe for these tests, though, so we turn it on.
   6 // RUN: export %env_asan_opts=detect_stack_use_after_return=1:handle_abort=1:print_scariness=1:alloc_dealloc_mismatch=1
   7 // Make sure the stack is limited (may not be the default under GNU make)
   8 // RUN: ulimit -s 4096
   9 // RUN: not %run %t  1 2>&1 | FileCheck %s --check-prefix=CHECK1
  10 // RUN: not %run %t  2 2>&1 | FileCheck %s --check-prefix=CHECK2
  11 // RUN: not %run %t  3 2>&1 | FileCheck %s --check-prefix=CHECK3
  12 // RUN: not %run %t  4 2>&1 | FileCheck %s --check-prefix=CHECK4
  13 // RUN: not %run %t  5 2>&1 | FileCheck %s --check-prefix=CHECK5
  14 // RUN: not %run %t  6 2>&1 | FileCheck %s --check-prefix=CHECK6
  15 // RUN: not %run %t  7 2>&1 | FileCheck %s --check-prefix=CHECK7
  16 // RUN: not %run %t  8 2>&1 | FileCheck %s --check-prefix=CHECK8
  17 // RUN: not %run %t  9 2>&1 | FileCheck %s --check-prefix=CHECK9
  18 // RUN: not %run %t 10 2>&1 | FileCheck %s --check-prefix=CHECK10
  19 // RUN: not %run %t 11 2>&1 | FileCheck %s --check-prefix=CHECK11
  20 // RUN: not %run %t 12 2>&1 | FileCheck %s --check-prefix=CHECK12
  21 // RUN: not %run %t 13 2>&1 | FileCheck %s --check-prefix=CHECK13
  22 // RUN: not %run %t 14 2>&1 | FileCheck %s --check-prefix=CHECK14
  23 // RUN: not %run %t 15 2>&1 | FileCheck %s --check-prefix=CHECK15
  24 // RUN: not %run %t 16 2>&1 | FileCheck %s --check-prefix=CHECK16
  25 // RUN: not %run %t 17 2>&1 | FileCheck %s --check-prefix=CHECK17
  26 // RUN: not %run %t 18 2>&1 | FileCheck %s --check-prefix=CHECK18
  27 // RUN: not %run %t 19 2>&1 | FileCheck %s --check-prefix=CHECK19
  28 // RUN: not %run %t 20 2>&1 | FileCheck %s --check-prefix=CHECK20
  29 // RUN: not %run %t 21 2>&1 | FileCheck %s --check-prefix=CHECK21
  30 // RUN: not %run %t 22 2>&1 | FileCheck %s --check-prefix=CHECK22
  31 // RUN: not %run %t 23 2>&1 | FileCheck %s --check-prefix=CHECK23
  32 // RUN: not %run %t 24 2>&1 | FileCheck %s --check-prefix=CHECK24
  33 // RUN: not %run %t 25 2>&1 | FileCheck %s --check-prefix=CHECK25
  34 // RUN: not %run %t 26 2>&1 | FileCheck %s --check-prefix=CHECK26
  35 // RUN: not %run %t 27 2>&1 | FileCheck %s --check-prefix=CHECK27
  36 // Parts of the test are too platform-specific:
  37 // REQUIRES: x86_64-target-arch
  38 // REQUIRES: shell
  39 #include <stdlib.h>
  40 #include <stdio.h>
  41 #include <string.h>
  42
  43 #include <sanitizer/asan_interface.h>
  44
  45 enum ReadOrWrite { Read = 0, Write = 1 };
  46
  47 struct S32 {
  48   char x[32];
  49 };
  50
  51 template<class T>
  52 void HeapBuferOverflow(int Idx, ReadOrWrite w) {
  53   T *t = new T[100];
  54   static T sink;
  55   if (w)
  56     t[100 + Idx] = T();
  57   else
  58     sink = t[100 + Idx];
  59   delete [] t;
  60 }
  61
  62 template<class T>
  63 void HeapUseAfterFree(int Idx, ReadOrWrite w) {
  64   T *t = new T[100];
  65   static T sink;
  66   sink = t[0];
  67   delete [] t;
  68   if (w)
  69     t[Idx] = T();
  70   else
  71     sink = t[Idx];
  72 }
  73
  74 template<class T>
  75 void StackBufferOverflow(int Idx, ReadOrWrite w) {
  76   T t[100];
  77   static T sink;
  78   sink = t[Idx];
  79   if (w)
  80     t[100 + Idx] = T();
  81   else
  82     sink = t[100 + Idx];
  83 }
  84
  85 template<class T>
  86 T *LeakStack() {
  87   T t[100];
  88   static volatile T *x;
  89   x = &t[0];
  90   return (T*)x;
  91 }
  92
  93 template<class T>
  94 void StackUseAfterReturn(int Idx, ReadOrWrite w) {
  95   static T sink;
  96   T *t = LeakStack<T>();
  97   if (w)
  98     t[100 + Idx] = T();
  99   else
 100     sink = t[100 + Idx];
 101 }
 102
 103 char    g1[100];
 104 short   g2[100];
 105 int     g4[100];
 106 int64_t g8[100];
 107 S32     gm[100];
 108
 109 void DoubleFree() {
 110   int *x = new int;
 111   static volatile int two = 2;
 112   for (int i = 0; i < two; i++)
 113     delete x;
 114 }
 115
 116 void StackOverflow(int Idx) {
 117   int some_stack[10000];
 118   static volatile int *x;
 119   x = &some_stack[0];
 120   if (Idx > 0)
 121     StackOverflow(Idx - 1);
 122 }
 123
 124 void UseAfterPoison() {
 125   int buf[100];
 126   __asan_poison_memory_region(buf, sizeof(buf));
 127   static volatile int sink;
 128   sink = buf[42];
 129 }
 130
 131 int main(int argc, char **argv) {
 132   char arr[100];
 133   static volatile int zero = 0;
 134   static volatile int *zero_ptr = 0;
 135   static volatile int *wild_addr = (int*)0x10000000; // System-dependent.
 136   if (argc != 2) return 1;
 137   int kind = atoi(argv[1]);
 138   switch (kind) {
 139     case 1: HeapBuferOverflow<char>(0, Read); break;
 140     case 2: HeapBuferOverflow<int>(0, Read); break;
 141     case 3: HeapBuferOverflow<short>(0, Write); break;
 142     case 4: HeapBuferOverflow<int64_t>(2, Write); break;
 143     case 5: HeapBuferOverflow<S32>(4, Write); break;
 144     case 6: HeapUseAfterFree<char>(0, Read); break;
 145     case 7: HeapUseAfterFree<int>(0, Write); break;
 146     case 8: HeapUseAfterFree<int64_t>(0, Read); break;
 147     case 9: HeapUseAfterFree<S32>(0, Write); break;
 148     case 10: StackBufferOverflow<char>(0, Write); break;
 149     case 11: StackBufferOverflow<int64_t>(0, Read); break;
 150     case 12: StackBufferOverflow<int>(4, Write); break;
 151     case 13: StackUseAfterReturn<char>(0, Read); break;
 152     case 14: StackUseAfterReturn<S32>(0, Write); break;
 153     case 15: g1[zero + 100] = 0; break;
 154     case 16: gm[0] = gm[zero + 100 + 1]; break;
 155     case 17: DoubleFree(); break;
 156     case 18: StackOverflow(1000000); break;
 157     case 19: *zero_ptr = 0; break;
 158     case 20: *wild_addr = 0; break;
 159     case 21: zero = *wild_addr; break;
 160     case 22: ((void (*)(void))wild_addr)(); break;
 161     case 23: delete (new int[10]); break;
 162     case 24: free((char*)malloc(100) + 10); break;
 163     case 25: memcpy(arr, arr+10, 20);  break;
 164     case 26: UseAfterPoison(); break;
 165     case 27: abort();
 166     // CHECK1: SCARINESS: 12 (1-byte-read-heap-buffer-overflow)
 167     // CHECK2: SCARINESS: 17 (4-byte-read-heap-buffer-overflow)
 168     // CHECK3: SCARINESS: 33 (2-byte-write-heap-buffer-overflow)
 169     // CHECK4: SCARINESS: 52 (8-byte-write-heap-buffer-overflow-far-from-bounds)
 170     // CHECK5: SCARINESS: 55 (multi-byte-write-heap-buffer-overflow-far-from-bounds)
 171     // CHECK6: SCARINESS: 40 (1-byte-read-heap-use-after-free)
 172     // CHECK7: SCARINESS: 46 (4-byte-write-heap-use-after-free)
 173     // CHECK8: SCARINESS: 51 (8-byte-read-heap-use-after-free)
 174     // CHECK9: SCARINESS: 55 (multi-byte-write-heap-use-after-free)
 175     // CHECK10: SCARINESS: 46 (1-byte-write-stack-buffer-overflow)
 176     // CHECK11: SCARINESS: 38 (8-byte-read-stack-buffer-overflow)
 177     // CHECK12: SCARINESS: 61 (4-byte-write-stack-buffer-overflow-far-from-bounds)
 178     // CHECK13: SCARINESS: 50 (1-byte-read-stack-use-after-return)
 179     // CHECK14: SCARINESS: 65 (multi-byte-write-stack-use-after-return)
 180     // CHECK15: SCARINESS: 31 (1-byte-write-global-buffer-overflow)
 181     // CHECK16: SCARINESS: 36 (multi-byte-read-global-buffer-overflow-far-from-bounds)
 182     // CHECK17: SCARINESS: 42 (double-free)
 183     // CHECK18: SCARINESS: 10 (stack-overflow)
 184     // CHECK19: SCARINESS: 10 (null-deref)
 185     // CHECK20: SCARINESS: 30 (wild-addr-write)
 186     // CHECK21: SCARINESS: 20 (wild-addr-read)
 187     // CHECK22: SCARINESS: 60 (wild-jump)
 188     // CHECK23: SCARINESS: 10 (alloc-dealloc-mismatch)
 189     // CHECK24: SCARINESS: 40 (bad-free)
 190     // CHECK25: SCARINESS: 10 (memcpy-param-overlap)
 191     // CHECK26: SCARINESS: 27 (4-byte-read-use-after-poison)
 192     // CHECK27: SCARINESS: 10 (signal)
 193   }
 194 }