1//===-- asan_test.cc ------------------------------------------------------===//
2//
3//                     The LLVM Compiler Infrastructure
4//
5// This file is distributed under the University of Illinois Open Source
6// License. See LICENSE.TXT for details.
7//
8//===----------------------------------------------------------------------===//
9//
10// This file is a part of AddressSanitizer, an address sanity checker.
11//
12//===----------------------------------------------------------------------===//
13#include "asan_test_utils.h"
14
15NOINLINE void *malloc_fff(size_t size) {
16  void *res = malloc/**/(size); break_optimization(0); return res;}
17NOINLINE void *malloc_eee(size_t size) {
18  void *res = malloc_fff(size); break_optimization(0); return res;}
19NOINLINE void *malloc_ddd(size_t size) {
20  void *res = malloc_eee(size); break_optimization(0); return res;}
21NOINLINE void *malloc_ccc(size_t size) {
22  void *res = malloc_ddd(size); break_optimization(0); return res;}
23NOINLINE void *malloc_bbb(size_t size) {
24  void *res = malloc_ccc(size); break_optimization(0); return res;}
25NOINLINE void *malloc_aaa(size_t size) {
26  void *res = malloc_bbb(size); break_optimization(0); return res;}
27
28NOINLINE void free_ccc(void *p) { free(p); break_optimization(0);}
29NOINLINE void free_bbb(void *p) { free_ccc(p); break_optimization(0);}
30NOINLINE void free_aaa(void *p) { free_bbb(p); break_optimization(0);}
31
32template<typename T>
33NOINLINE void uaf_test(int size, int off) {
34  char *p = (char *)malloc_aaa(size);
35  free_aaa(p);
36  for (int i = 1; i < 100; i++)
37    free_aaa(malloc_aaa(i));
38  fprintf(stderr, "writing %ld byte(s) at %p with offset %d\n",
39          (long)sizeof(T), p, off);
40  asan_write((T*)(p + off));
41}
42
43TEST(AddressSanitizer, HasFeatureAddressSanitizerTest) {
44#if defined(__has_feature) && __has_feature(address_sanitizer)
45  bool asan = 1;
46#elif defined(__SANITIZE_ADDRESS__)
47  bool asan = 1;
48#else
49  bool asan = 0;
50#endif
51  EXPECT_EQ(true, asan);
52}
53
54TEST(AddressSanitizer, SimpleDeathTest) {
55  EXPECT_DEATH(exit(1), "");
56}
57
58TEST(AddressSanitizer, VariousMallocsTest) {
59  int *a = (int*)malloc(100 * sizeof(int));
60  a[50] = 0;
61  free(a);
62
63  int *r = (int*)malloc(10);
64  r = (int*)realloc(r, 2000 * sizeof(int));
65  r[1000] = 0;
66  free(r);
67
68  int *b = new int[100];
69  b[50] = 0;
70  delete [] b;
71
72  int *c = new int;
73  *c = 0;
74  delete c;
75
76#if SANITIZER_TEST_HAS_POSIX_MEMALIGN
77  int *pm;
78  int pm_res = posix_memalign((void**)&pm, kPageSize, kPageSize);
79  EXPECT_EQ(0, pm_res);
80  free(pm);
81#endif  // SANITIZER_TEST_HAS_POSIX_MEMALIGN
82
83#if SANITIZER_TEST_HAS_MEMALIGN
84  int *ma = (int*)memalign(kPageSize, kPageSize);
85  EXPECT_EQ(0U, (uintptr_t)ma % kPageSize);
86  ma[123] = 0;
87  free(ma);
88#endif  // SANITIZER_TEST_HAS_MEMALIGN
89}
90
91TEST(AddressSanitizer, CallocTest) {
92  int *a = (int*)calloc(100, sizeof(int));
93  EXPECT_EQ(0, a[10]);
94  free(a);
95}
96
97TEST(AddressSanitizer, CallocReturnsZeroMem) {
98  size_t sizes[] = {16, 1000, 10000, 100000, 2100000};
99  for (size_t s = 0; s < sizeof(sizes)/sizeof(sizes[0]); s++) {
100    size_t size = sizes[s];
101    for (size_t iter = 0; iter < 5; iter++) {
102      char *x = Ident((char*)calloc(1, size));
103      EXPECT_EQ(x[0], 0);
104      EXPECT_EQ(x[size - 1], 0);
105      EXPECT_EQ(x[size / 2], 0);
106      EXPECT_EQ(x[size / 3], 0);
107      EXPECT_EQ(x[size / 4], 0);
108      memset(x, 0x42, size);
109      free(Ident(x));
110#if !defined(_WIN32)
111      // FIXME: OOM on Windows. We should just make this a lit test
112      // with quarantine size set to 1.
113      free(Ident(malloc(Ident(1 << 27))));  // Try to drain the quarantine.
114#endif
115    }
116  }
117}
118
119// No valloc on Windows or Android.
120#if !defined(_WIN32) && !defined(ANDROID) && !defined(__ANDROID__)
121TEST(AddressSanitizer, VallocTest) {
122  void *a = valloc(100);
123  EXPECT_EQ(0U, (uintptr_t)a % kPageSize);
124  free(a);
125}
126#endif
127
128#if SANITIZER_TEST_HAS_PVALLOC
129TEST(AddressSanitizer, PvallocTest) {
130  char *a = (char*)pvalloc(kPageSize + 100);
131  EXPECT_EQ(0U, (uintptr_t)a % kPageSize);
132  a[kPageSize + 101] = 1;  // we should not report an error here.
133  free(a);
134
135  a = (char*)pvalloc(0);  // pvalloc(0) should allocate at least one page.
136  EXPECT_EQ(0U, (uintptr_t)a % kPageSize);
137  a[101] = 1;  // we should not report an error here.
138  free(a);
139}
140#endif  // SANITIZER_TEST_HAS_PVALLOC
141
142#if !defined(_WIN32)
143// FIXME: Use an equivalent of pthread_setspecific on Windows.
144void *TSDWorker(void *test_key) {
145  if (test_key) {
146    pthread_setspecific(*(pthread_key_t*)test_key, (void*)0xfeedface);
147  }
148  return NULL;
149}
150
151void TSDDestructor(void *tsd) {
152  // Spawning a thread will check that the current thread id is not -1.
153  pthread_t th;
154  PTHREAD_CREATE(&th, NULL, TSDWorker, NULL);
155  PTHREAD_JOIN(th, NULL);
156}
157
158// This tests triggers the thread-specific data destruction fiasco which occurs
159// if we don't manage the TSD destructors ourselves. We create a new pthread
160// key with a non-NULL destructor which is likely to be put after the destructor
161// of AsanThread in the list of destructors.
162// In this case the TSD for AsanThread will be destroyed before TSDDestructor
163// is called for the child thread, and a CHECK will fail when we call
164// pthread_create() to spawn the grandchild.
165TEST(AddressSanitizer, DISABLED_TSDTest) {
166  pthread_t th;
167  pthread_key_t test_key;
168  pthread_key_create(&test_key, TSDDestructor);
169  PTHREAD_CREATE(&th, NULL, TSDWorker, &test_key);
170  PTHREAD_JOIN(th, NULL);
171  pthread_key_delete(test_key);
172}
173#endif
174
175TEST(AddressSanitizer, UAF_char) {
176  const char *uaf_string = "AddressSanitizer:.*heap-use-after-free";
177  EXPECT_DEATH(uaf_test<U1>(1, 0), uaf_string);
178  EXPECT_DEATH(uaf_test<U1>(10, 0), uaf_string);
179  EXPECT_DEATH(uaf_test<U1>(10, 10), uaf_string);
180  EXPECT_DEATH(uaf_test<U1>(kLargeMalloc, 0), uaf_string);
181  EXPECT_DEATH(uaf_test<U1>(kLargeMalloc, kLargeMalloc / 2), uaf_string);
182}
183
184TEST(AddressSanitizer, UAF_long_double) {
185  if (sizeof(long double) == sizeof(double)) return;
186  long double *p = Ident(new long double[10]);
187  EXPECT_DEATH(Ident(p)[12] = 0, "WRITE of size 1[026]");
188  EXPECT_DEATH(Ident(p)[0] = Ident(p)[12], "READ of size 1[026]");
189  delete [] Ident(p);
190}
191
192#if !defined(_WIN32)
193struct Packed5 {
194  int x;
195  char c;
196} __attribute__((packed));
197#else
198# pragma pack(push, 1)
199struct Packed5 {
200  int x;
201  char c;
202};
203# pragma pack(pop)
204#endif
205
206TEST(AddressSanitizer, UAF_Packed5) {
207  static_assert(sizeof(Packed5) == 5, "Please check the keywords used");
208  Packed5 *p = Ident(new Packed5[2]);
209  EXPECT_DEATH(p[0] = p[3], "READ of size 5");
210  EXPECT_DEATH(p[3] = p[0], "WRITE of size 5");
211  delete [] Ident(p);
212}
213
214#if ASAN_HAS_BLACKLIST
215TEST(AddressSanitizer, IgnoreTest) {
216  int *x = Ident(new int);
217  delete Ident(x);
218  *x = 0;
219}
220#endif  // ASAN_HAS_BLACKLIST
221
222struct StructWithBitField {
223  int bf1:1;
224  int bf2:1;
225  int bf3:1;
226  int bf4:29;
227};
228
229TEST(AddressSanitizer, BitFieldPositiveTest) {
230  StructWithBitField *x = new StructWithBitField;
231  delete Ident(x);
232  EXPECT_DEATH(x->bf1 = 0, "use-after-free");
233  EXPECT_DEATH(x->bf2 = 0, "use-after-free");
234  EXPECT_DEATH(x->bf3 = 0, "use-after-free");
235  EXPECT_DEATH(x->bf4 = 0, "use-after-free");
236}
237
238struct StructWithBitFields_8_24 {
239  int a:8;
240  int b:24;
241};
242
243TEST(AddressSanitizer, BitFieldNegativeTest) {
244  StructWithBitFields_8_24 *x = Ident(new StructWithBitFields_8_24);
245  x->a = 0;
246  x->b = 0;
247  delete Ident(x);
248}
249
250#if ASAN_NEEDS_SEGV
251namespace {
252
253const char kUnknownCrash[] = "AddressSanitizer: SEGV on unknown address";
254const char kOverriddenHandler[] = "ASan signal handler has been overridden\n";
255
256TEST(AddressSanitizer, WildAddressTest) {
257  char *c = (char*)0x123;
258  EXPECT_DEATH(*c = 0, kUnknownCrash);
259}
260
261void my_sigaction_sighandler(int, siginfo_t*, void*) {
262  fprintf(stderr, kOverriddenHandler);
263  exit(1);
264}
265
266void my_signal_sighandler(int signum) {
267  fprintf(stderr, kOverriddenHandler);
268  exit(1);
269}
270
271TEST(AddressSanitizer, SignalTest) {
272  struct sigaction sigact;
273  memset(&sigact, 0, sizeof(sigact));
274  sigact.sa_sigaction = my_sigaction_sighandler;
275  sigact.sa_flags = SA_SIGINFO;
276  // ASan should silently ignore sigaction()...
277  EXPECT_EQ(0, sigaction(SIGSEGV, &sigact, 0));
278#ifdef __APPLE__
279  EXPECT_EQ(0, sigaction(SIGBUS, &sigact, 0));
280#endif
281  char *c = (char*)0x123;
282  EXPECT_DEATH(*c = 0, kUnknownCrash);
283  // ... and signal().
284  EXPECT_EQ(0, signal(SIGSEGV, my_signal_sighandler));
285  EXPECT_DEATH(*c = 0, kUnknownCrash);
286}
287}  // namespace
288#endif
289
290static void TestLargeMalloc(size_t size) {
291  char buff[1024];
292  sprintf(buff, "is located 1 bytes to the left of %lu-byte", (long)size);
293  EXPECT_DEATH(Ident((char*)malloc(size))[-1] = 0, buff);
294}
295
296TEST(AddressSanitizer, LargeMallocTest) {
297  const int max_size = (SANITIZER_WORDSIZE == 32) ? 1 << 26 : 1 << 28;
298  for (int i = 113; i < max_size; i = i * 2 + 13) {
299    TestLargeMalloc(i);
300  }
301}
302
303TEST(AddressSanitizer, HugeMallocTest) {
304  if (SANITIZER_WORDSIZE != 64 || ASAN_AVOID_EXPENSIVE_TESTS) return;
305  size_t n_megs = 4100;
306  EXPECT_DEATH(Ident((char*)malloc(n_megs << 20))[-1] = 0,
307               "is located 1 bytes to the left|"
308               "AddressSanitizer failed to allocate");
309}
310
311#if SANITIZER_TEST_HAS_MEMALIGN
312void MemalignRun(size_t align, size_t size, int idx) {
313  char *p = (char *)memalign(align, size);
314  Ident(p)[idx] = 0;
315  free(p);
316}
317
318TEST(AddressSanitizer, memalign) {
319  for (int align = 16; align <= (1 << 23); align *= 2) {
320    size_t size = align * 5;
321    EXPECT_DEATH(MemalignRun(align, size, -1),
322                 "is located 1 bytes to the left");
323    EXPECT_DEATH(MemalignRun(align, size, size + 1),
324                 "is located 1 bytes to the right");
325  }
326}
327#endif  // SANITIZER_TEST_HAS_MEMALIGN
328
329void *ManyThreadsWorker(void *a) {
330  for (int iter = 0; iter < 100; iter++) {
331    for (size_t size = 100; size < 2000; size *= 2) {
332      free(Ident(malloc(size)));
333    }
334  }
335  return 0;
336}
337
338TEST(AddressSanitizer, ManyThreadsTest) {
339  const size_t kNumThreads =
340      (SANITIZER_WORDSIZE == 32 || ASAN_AVOID_EXPENSIVE_TESTS) ? 30 : 1000;
341  pthread_t t[kNumThreads];
342  for (size_t i = 0; i < kNumThreads; i++) {
343    PTHREAD_CREATE(&t[i], 0, ManyThreadsWorker, (void*)i);
344  }
345  for (size_t i = 0; i < kNumThreads; i++) {
346    PTHREAD_JOIN(t[i], 0);
347  }
348}
349
350TEST(AddressSanitizer, ReallocTest) {
351  const int kMinElem = 5;
352  int *ptr = (int*)malloc(sizeof(int) * kMinElem);
353  ptr[3] = 3;
354  for (int i = 0; i < 10000; i++) {
355    ptr = (int*)realloc(ptr,
356        (my_rand() % 1000 + kMinElem) * sizeof(int));
357    EXPECT_EQ(3, ptr[3]);
358  }
359  free(ptr);
360  // Realloc pointer returned by malloc(0).
361  int *ptr2 = Ident((int*)malloc(0));
362  ptr2 = Ident((int*)realloc(ptr2, sizeof(*ptr2)));
363  *ptr2 = 42;
364  EXPECT_EQ(42, *ptr2);
365  free(ptr2);
366}
367
368TEST(AddressSanitizer, ReallocFreedPointerTest) {
369  void *ptr = Ident(malloc(42));
370  ASSERT_TRUE(NULL != ptr);
371  free(ptr);
372  EXPECT_DEATH(ptr = realloc(ptr, 77), "attempting double-free");
373}
374
375TEST(AddressSanitizer, ReallocInvalidPointerTest) {
376  void *ptr = Ident(malloc(42));
377  EXPECT_DEATH(ptr = realloc((int*)ptr + 1, 77), "attempting free.*not malloc");
378  free(ptr);
379}
380
381TEST(AddressSanitizer, ZeroSizeMallocTest) {
382  // Test that malloc(0) and similar functions don't return NULL.
383  void *ptr = Ident(malloc(0));
384  EXPECT_TRUE(NULL != ptr);
385  free(ptr);
386#if SANITIZER_TEST_HAS_POSIX_MEMALIGN
387  int pm_res = posix_memalign(&ptr, 1<<20, 0);
388  EXPECT_EQ(0, pm_res);
389  EXPECT_TRUE(NULL != ptr);
390  free(ptr);
391#endif  // SANITIZER_TEST_HAS_POSIX_MEMALIGN
392  int *int_ptr = new int[0];
393  int *int_ptr2 = new int[0];
394  EXPECT_TRUE(NULL != int_ptr);
395  EXPECT_TRUE(NULL != int_ptr2);
396  EXPECT_NE(int_ptr, int_ptr2);
397  delete[] int_ptr;
398  delete[] int_ptr2;
399}
400
401#if SANITIZER_TEST_HAS_MALLOC_USABLE_SIZE
402static const char *kMallocUsableSizeErrorMsg =
403  "AddressSanitizer: attempting to call malloc_usable_size()";
404
405TEST(AddressSanitizer, MallocUsableSizeTest) {
406  const size_t kArraySize = 100;
407  char *array = Ident((char*)malloc(kArraySize));
408  int *int_ptr = Ident(new int);
409  EXPECT_EQ(0U, malloc_usable_size(NULL));
410  EXPECT_EQ(kArraySize, malloc_usable_size(array));
411  EXPECT_EQ(sizeof(int), malloc_usable_size(int_ptr));
412  EXPECT_DEATH(malloc_usable_size((void*)0x123), kMallocUsableSizeErrorMsg);
413  EXPECT_DEATH(malloc_usable_size(array + kArraySize / 2),
414               kMallocUsableSizeErrorMsg);
415  free(array);
416  EXPECT_DEATH(malloc_usable_size(array), kMallocUsableSizeErrorMsg);
417  delete int_ptr;
418}
419#endif  // SANITIZER_TEST_HAS_MALLOC_USABLE_SIZE
420
421void WrongFree() {
422  int *x = (int*)malloc(100 * sizeof(int));
423  // Use the allocated memory, otherwise Clang will optimize it out.
424  Ident(x);
425  free(x + 1);
426}
427
428#if !defined(_WIN32)  // FIXME: This should be a lit test.
429TEST(AddressSanitizer, WrongFreeTest) {
430  EXPECT_DEATH(WrongFree(), ASAN_PCRE_DOTALL
431               "ERROR: AddressSanitizer: attempting free.*not malloc"
432               ".*is located 4 bytes inside of 400-byte region"
433               ".*allocated by thread");
434}
435#endif
436
437void DoubleFree() {
438  int *x = (int*)malloc(100 * sizeof(int));
439  fprintf(stderr, "DoubleFree: x=%p\n", x);
440  free(x);
441  free(x);
442  fprintf(stderr, "should have failed in the second free(%p)\n", x);
443  abort();
444}
445
446#if !defined(_WIN32)  // FIXME: This should be a lit test.
447TEST(AddressSanitizer, DoubleFreeTest) {
448  EXPECT_DEATH(DoubleFree(), ASAN_PCRE_DOTALL
449               "ERROR: AddressSanitizer: attempting double-free"
450               ".*is located 0 bytes inside of 400-byte region"
451               ".*freed by thread T0 here"
452               ".*previously allocated by thread T0 here");
453}
454#endif
455
456template<int kSize>
457NOINLINE void SizedStackTest() {
458  char a[kSize];
459  char  *A = Ident((char*)&a);
460  const char *expected_death = "AddressSanitizer: stack-buffer-";
461  for (size_t i = 0; i < kSize; i++)
462    A[i] = i;
463  EXPECT_DEATH(A[-1] = 0, expected_death);
464  EXPECT_DEATH(A[-5] = 0, expected_death);
465  EXPECT_DEATH(A[kSize] = 0, expected_death);
466  EXPECT_DEATH(A[kSize + 1] = 0, expected_death);
467  EXPECT_DEATH(A[kSize + 5] = 0, expected_death);
468  if (kSize > 16)
469    EXPECT_DEATH(A[kSize + 31] = 0, expected_death);
470}
471
472TEST(AddressSanitizer, SimpleStackTest) {
473  SizedStackTest<1>();
474  SizedStackTest<2>();
475  SizedStackTest<3>();
476  SizedStackTest<4>();
477  SizedStackTest<5>();
478  SizedStackTest<6>();
479  SizedStackTest<7>();
480  SizedStackTest<16>();
481  SizedStackTest<25>();
482  SizedStackTest<34>();
483  SizedStackTest<43>();
484  SizedStackTest<51>();
485  SizedStackTest<62>();
486  SizedStackTest<64>();
487  SizedStackTest<128>();
488}
489
490#if !defined(_WIN32)
491// FIXME: It's a bit hard to write multi-line death test expectations
492// in a portable way.  Anyways, this should just be turned into a lit test.
493TEST(AddressSanitizer, ManyStackObjectsTest) {
494  char XXX[10];
495  char YYY[20];
496  char ZZZ[30];
497  Ident(XXX);
498  Ident(YYY);
499  EXPECT_DEATH(Ident(ZZZ)[-1] = 0, ASAN_PCRE_DOTALL "XXX.*YYY.*ZZZ");
500}
501#endif
502
503#if 0  // This test requires online symbolizer.
504// Moved to lit_tests/stack-oob-frames.cc.
505// Reenable here once we have online symbolizer by default.
506NOINLINE static void Frame0(int frame, char *a, char *b, char *c) {
507  char d[4] = {0};
508  char *D = Ident(d);
509  switch (frame) {
510    case 3: a[5]++; break;
511    case 2: b[5]++; break;
512    case 1: c[5]++; break;
513    case 0: D[5]++; break;
514  }
515}
516NOINLINE static void Frame1(int frame, char *a, char *b) {
517  char c[4] = {0}; Frame0(frame, a, b, c);
518  break_optimization(0);
519}
520NOINLINE static void Frame2(int frame, char *a) {
521  char b[4] = {0}; Frame1(frame, a, b);
522  break_optimization(0);
523}
524NOINLINE static void Frame3(int frame) {
525  char a[4] = {0}; Frame2(frame, a);
526  break_optimization(0);
527}
528
529TEST(AddressSanitizer, GuiltyStackFrame0Test) {
530  EXPECT_DEATH(Frame3(0), "located .*in frame <.*Frame0");
531}
532TEST(AddressSanitizer, GuiltyStackFrame1Test) {
533  EXPECT_DEATH(Frame3(1), "located .*in frame <.*Frame1");
534}
535TEST(AddressSanitizer, GuiltyStackFrame2Test) {
536  EXPECT_DEATH(Frame3(2), "located .*in frame <.*Frame2");
537}
538TEST(AddressSanitizer, GuiltyStackFrame3Test) {
539  EXPECT_DEATH(Frame3(3), "located .*in frame <.*Frame3");
540}
541#endif
542
543NOINLINE void LongJmpFunc1(jmp_buf buf) {
544  // create three red zones for these two stack objects.
545  int a;
546  int b;
547
548  int *A = Ident(&a);
549  int *B = Ident(&b);
550  *A = *B;
551  longjmp(buf, 1);
552}
553
554NOINLINE void TouchStackFunc() {
555  int a[100];  // long array will intersect with redzones from LongJmpFunc1.
556  int *A = Ident(a);
557  for (int i = 0; i < 100; i++)
558    A[i] = i*i;
559}
560
561// Test that we handle longjmp and do not report false positives on stack.
562TEST(AddressSanitizer, LongJmpTest) {
563  static jmp_buf buf;
564  if (!setjmp(buf)) {
565    LongJmpFunc1(buf);
566  } else {
567    TouchStackFunc();
568  }
569}
570
571#if !defined(_WIN32)  // Only basic longjmp is available on Windows.
572NOINLINE void BuiltinLongJmpFunc1(jmp_buf buf) {
573  // create three red zones for these two stack objects.
574  int a;
575  int b;
576
577  int *A = Ident(&a);
578  int *B = Ident(&b);
579  *A = *B;
580  __builtin_longjmp((void**)buf, 1);
581}
582
583NOINLINE void UnderscopeLongJmpFunc1(jmp_buf buf) {
584  // create three red zones for these two stack objects.
585  int a;
586  int b;
587
588  int *A = Ident(&a);
589  int *B = Ident(&b);
590  *A = *B;
591  _longjmp(buf, 1);
592}
593
594NOINLINE void SigLongJmpFunc1(sigjmp_buf buf) {
595  // create three red zones for these two stack objects.
596  int a;
597  int b;
598
599  int *A = Ident(&a);
600  int *B = Ident(&b);
601  *A = *B;
602  siglongjmp(buf, 1);
603}
604
605#if !defined(__ANDROID__) && \
606    !defined(__powerpc64__) && !defined(__powerpc__)
607// Does not work on Power:
608// https://code.google.com/p/address-sanitizer/issues/detail?id=185
609TEST(AddressSanitizer, BuiltinLongJmpTest) {
610  static jmp_buf buf;
611  if (!__builtin_setjmp((void**)buf)) {
612    BuiltinLongJmpFunc1(buf);
613  } else {
614    TouchStackFunc();
615  }
616}
617#endif  // !defined(__ANDROID__) && !defined(__powerpc64__) &&
618        // !defined(__powerpc__)
619
620TEST(AddressSanitizer, UnderscopeLongJmpTest) {
621  static jmp_buf buf;
622  if (!_setjmp(buf)) {
623    UnderscopeLongJmpFunc1(buf);
624  } else {
625    TouchStackFunc();
626  }
627}
628
629TEST(AddressSanitizer, SigLongJmpTest) {
630  static sigjmp_buf buf;
631  if (!sigsetjmp(buf, 1)) {
632    SigLongJmpFunc1(buf);
633  } else {
634    TouchStackFunc();
635  }
636}
637#endif
638
639// FIXME: Why does clang-cl define __EXCEPTIONS?
640#if defined(__EXCEPTIONS) && !defined(_WIN32)
641NOINLINE void ThrowFunc() {
642  // create three red zones for these two stack objects.
643  int a;
644  int b;
645
646  int *A = Ident(&a);
647  int *B = Ident(&b);
648  *A = *B;
649  ASAN_THROW(1);
650}
651
652TEST(AddressSanitizer, CxxExceptionTest) {
653  if (ASAN_UAR) return;
654  // TODO(kcc): this test crashes on 32-bit for some reason...
655  if (SANITIZER_WORDSIZE == 32) return;
656  try {
657    ThrowFunc();
658  } catch(...) {}
659  TouchStackFunc();
660}
661#endif
662
663void *ThreadStackReuseFunc1(void *unused) {
664  // create three red zones for these two stack objects.
665  int a;
666  int b;
667
668  int *A = Ident(&a);
669  int *B = Ident(&b);
670  *A = *B;
671  pthread_exit(0);
672  return 0;
673}
674
675void *ThreadStackReuseFunc2(void *unused) {
676  TouchStackFunc();
677  return 0;
678}
679
680TEST(AddressSanitizer, ThreadStackReuseTest) {
681  pthread_t t;
682  PTHREAD_CREATE(&t, 0, ThreadStackReuseFunc1, 0);
683  PTHREAD_JOIN(t, 0);
684  PTHREAD_CREATE(&t, 0, ThreadStackReuseFunc2, 0);
685  PTHREAD_JOIN(t, 0);
686}
687
688#if defined(__i686__) || defined(__x86_64__)
689#include <emmintrin.h>
690TEST(AddressSanitizer, Store128Test) {
691  char *a = Ident((char*)malloc(Ident(12)));
692  char *p = a;
693  if (((uintptr_t)a % 16) != 0)
694    p = a + 8;
695  assert(((uintptr_t)p % 16) == 0);
696  __m128i value_wide = _mm_set1_epi16(0x1234);
697  EXPECT_DEATH(_mm_store_si128((__m128i*)p, value_wide),
698               "AddressSanitizer: heap-buffer-overflow");
699  EXPECT_DEATH(_mm_store_si128((__m128i*)p, value_wide),
700               "WRITE of size 16");
701  EXPECT_DEATH(_mm_store_si128((__m128i*)p, value_wide),
702               "located 0 bytes to the right of 12-byte");
703  free(a);
704}
705#endif
706
707// FIXME: All tests that use this function should be turned into lit tests.
708string RightOOBErrorMessage(int oob_distance, bool is_write) {
709  assert(oob_distance >= 0);
710  char expected_str[100];
711  sprintf(expected_str, ASAN_PCRE_DOTALL
712#if !GTEST_USES_SIMPLE_RE
713          "buffer-overflow.*%s.*"
714#endif
715          "located %d bytes to the right",
716#if !GTEST_USES_SIMPLE_RE
717          is_write ? "WRITE" : "READ",
718#endif
719          oob_distance);
720  return string(expected_str);
721}
722
723string RightOOBWriteMessage(int oob_distance) {
724  return RightOOBErrorMessage(oob_distance, /*is_write*/true);
725}
726
727string RightOOBReadMessage(int oob_distance) {
728  return RightOOBErrorMessage(oob_distance, /*is_write*/false);
729}
730
731// FIXME: All tests that use this function should be turned into lit tests.
732string LeftOOBErrorMessage(int oob_distance, bool is_write) {
733  assert(oob_distance > 0);
734  char expected_str[100];
735  sprintf(expected_str,
736#if !GTEST_USES_SIMPLE_RE
737          ASAN_PCRE_DOTALL "%s.*"
738#endif
739          "located %d bytes to the left",
740#if !GTEST_USES_SIMPLE_RE
741          is_write ? "WRITE" : "READ",
742#endif
743          oob_distance);
744  return string(expected_str);
745}
746
747string LeftOOBWriteMessage(int oob_distance) {
748  return LeftOOBErrorMessage(oob_distance, /*is_write*/true);
749}
750
751string LeftOOBReadMessage(int oob_distance) {
752  return LeftOOBErrorMessage(oob_distance, /*is_write*/false);
753}
754
755string LeftOOBAccessMessage(int oob_distance) {
756  assert(oob_distance > 0);
757  char expected_str[100];
758  sprintf(expected_str, "located %d bytes to the left", oob_distance);
759  return string(expected_str);
760}
761
762char* MallocAndMemsetString(size_t size, char ch) {
763  char *s = Ident((char*)malloc(size));
764  memset(s, ch, size);
765  return s;
766}
767
768char* MallocAndMemsetString(size_t size) {
769  return MallocAndMemsetString(size, 'z');
770}
771
772#if defined(__linux__) && !defined(ANDROID) && !defined(__ANDROID__)
773#define READ_TEST(READ_N_BYTES)                                          \
774  char *x = new char[10];                                                \
775  int fd = open("/proc/self/stat", O_RDONLY);                            \
776  ASSERT_GT(fd, 0);                                                      \
777  EXPECT_DEATH(READ_N_BYTES,                                             \
778               ASAN_PCRE_DOTALL                                          \
779               "AddressSanitizer: heap-buffer-overflow"                  \
780               ".* is located 0 bytes to the right of 10-byte region");  \
781  close(fd);                                                             \
782  delete [] x;                                                           \
783
784TEST(AddressSanitizer, pread) {
785  READ_TEST(pread(fd, x, 15, 0));
786}
787
788TEST(AddressSanitizer, pread64) {
789  READ_TEST(pread64(fd, x, 15, 0));
790}
791
792TEST(AddressSanitizer, read) {
793  READ_TEST(read(fd, x, 15));
794}
795#endif  // defined(__linux__) && !defined(ANDROID) && !defined(__ANDROID__)
796
797// This test case fails
798// Clang optimizes memcpy/memset calls which lead to unaligned access
799TEST(AddressSanitizer, DISABLED_MemIntrinsicUnalignedAccessTest) {
800  int size = Ident(4096);
801  char *s = Ident((char*)malloc(size));
802  EXPECT_DEATH(memset(s + size - 1, 0, 2), RightOOBWriteMessage(0));
803  free(s);
804}
805
806// TODO(samsonov): Add a test with malloc(0)
807// TODO(samsonov): Add tests for str* and mem* functions.
808
809NOINLINE static int LargeFunction(bool do_bad_access) {
810  int *x = new int[100];
811  x[0]++;
812  x[1]++;
813  x[2]++;
814  x[3]++;
815  x[4]++;
816  x[5]++;
817  x[6]++;
818  x[7]++;
819  x[8]++;
820  x[9]++;
821
822  x[do_bad_access ? 100 : 0]++; int res = __LINE__;
823
824  x[10]++;
825  x[11]++;
826  x[12]++;
827  x[13]++;
828  x[14]++;
829  x[15]++;
830  x[16]++;
831  x[17]++;
832  x[18]++;
833  x[19]++;
834
835  delete x;
836  return res;
837}
838
839// Test the we have correct debug info for the failing instruction.
840// This test requires the in-process symbolizer to be enabled by default.
841TEST(AddressSanitizer, DISABLED_LargeFunctionSymbolizeTest) {
842  int failing_line = LargeFunction(false);
843  char expected_warning[128];
844  sprintf(expected_warning, "LargeFunction.*asan_test.*:%d", failing_line);
845  EXPECT_DEATH(LargeFunction(true), expected_warning);
846}
847
848// Check that we unwind and symbolize correctly.
849TEST(AddressSanitizer, DISABLED_MallocFreeUnwindAndSymbolizeTest) {
850  int *a = (int*)malloc_aaa(sizeof(int));
851  *a = 1;
852  free_aaa(a);
853  EXPECT_DEATH(*a = 1, "free_ccc.*free_bbb.*free_aaa.*"
854               "malloc_fff.*malloc_eee.*malloc_ddd");
855}
856
857static bool TryToSetThreadName(const char *name) {
858#if defined(__linux__) && defined(PR_SET_NAME)
859  return 0 == prctl(PR_SET_NAME, (unsigned long)name, 0, 0, 0);
860#else
861  return false;
862#endif
863}
864
865void *ThreadedTestAlloc(void *a) {
866  EXPECT_EQ(true, TryToSetThreadName("AllocThr"));
867  int **p = (int**)a;
868  *p = new int;
869  return 0;
870}
871
872void *ThreadedTestFree(void *a) {
873  EXPECT_EQ(true, TryToSetThreadName("FreeThr"));
874  int **p = (int**)a;
875  delete *p;
876  return 0;
877}
878
879void *ThreadedTestUse(void *a) {
880  EXPECT_EQ(true, TryToSetThreadName("UseThr"));
881  int **p = (int**)a;
882  **p = 1;
883  return 0;
884}
885
886void ThreadedTestSpawn() {
887  pthread_t t;
888  int *x;
889  PTHREAD_CREATE(&t, 0, ThreadedTestAlloc, &x);
890  PTHREAD_JOIN(t, 0);
891  PTHREAD_CREATE(&t, 0, ThreadedTestFree, &x);
892  PTHREAD_JOIN(t, 0);
893  PTHREAD_CREATE(&t, 0, ThreadedTestUse, &x);
894  PTHREAD_JOIN(t, 0);
895}
896
897#if !defined(_WIN32)  // FIXME: This should be a lit test.
898TEST(AddressSanitizer, ThreadedTest) {
899  EXPECT_DEATH(ThreadedTestSpawn(),
900               ASAN_PCRE_DOTALL
901               "Thread T.*created"
902               ".*Thread T.*created"
903               ".*Thread T.*created");
904}
905#endif
906
907void *ThreadedTestFunc(void *unused) {
908  // Check if prctl(PR_SET_NAME) is supported. Return if not.
909  if (!TryToSetThreadName("TestFunc"))
910    return 0;
911  EXPECT_DEATH(ThreadedTestSpawn(),
912               ASAN_PCRE_DOTALL
913               "WRITE .*thread T. .UseThr."
914               ".*freed by thread T. .FreeThr. here:"
915               ".*previously allocated by thread T. .AllocThr. here:"
916               ".*Thread T. .UseThr. created by T.*TestFunc"
917               ".*Thread T. .FreeThr. created by T"
918               ".*Thread T. .AllocThr. created by T"
919               "");
920  return 0;
921}
922
923TEST(AddressSanitizer, ThreadNamesTest) {
924  // Run ThreadedTestFunc in a separate thread because it tries to set a
925  // thread name and we don't want to change the main thread's name.
926  pthread_t t;
927  PTHREAD_CREATE(&t, 0, ThreadedTestFunc, 0);
928  PTHREAD_JOIN(t, 0);
929}
930
931#if ASAN_NEEDS_SEGV
932TEST(AddressSanitizer, ShadowGapTest) {
933#if SANITIZER_WORDSIZE == 32
934  char *addr = (char*)0x22000000;
935#else
936# if defined(__powerpc64__)
937  char *addr = (char*)0x024000800000;
938# else
939  char *addr = (char*)0x0000100000080000;
940# endif
941#endif
942  EXPECT_DEATH(*addr = 1, "AddressSanitizer: SEGV on unknown");
943}
944#endif  // ASAN_NEEDS_SEGV
945
946extern "C" {
947NOINLINE static void UseThenFreeThenUse() {
948  char *x = Ident((char*)malloc(8));
949  *x = 1;
950  free_aaa(x);
951  *x = 2;
952}
953}
954
955TEST(AddressSanitizer, UseThenFreeThenUseTest) {
956  EXPECT_DEATH(UseThenFreeThenUse(), "freed by thread");
957}
958
959TEST(AddressSanitizer, StrDupTest) {
960  free(strdup(Ident("123")));
961}
962
963// Currently we create and poison redzone at right of global variables.
964static char static110[110];
965const char ConstGlob[7] = {1, 2, 3, 4, 5, 6, 7};
966static const char StaticConstGlob[3] = {9, 8, 7};
967
968TEST(AddressSanitizer, GlobalTest) {
969  static char func_static15[15];
970
971  static char fs1[10];
972  static char fs2[10];
973  static char fs3[10];
974
975  glob5[Ident(0)] = 0;
976  glob5[Ident(1)] = 0;
977  glob5[Ident(2)] = 0;
978  glob5[Ident(3)] = 0;
979  glob5[Ident(4)] = 0;
980
981  EXPECT_DEATH(glob5[Ident(5)] = 0,
982               "0 bytes to the right of global variable.*glob5.* size 5");
983  EXPECT_DEATH(glob5[Ident(5+6)] = 0,
984               "6 bytes to the right of global variable.*glob5.* size 5");
985  Ident(static110);  // avoid optimizations
986  static110[Ident(0)] = 0;
987  static110[Ident(109)] = 0;
988  EXPECT_DEATH(static110[Ident(110)] = 0,
989               "0 bytes to the right of global variable");
990  EXPECT_DEATH(static110[Ident(110+7)] = 0,
991               "7 bytes to the right of global variable");
992
993  Ident(func_static15);  // avoid optimizations
994  func_static15[Ident(0)] = 0;
995  EXPECT_DEATH(func_static15[Ident(15)] = 0,
996               "0 bytes to the right of global variable");
997  EXPECT_DEATH(func_static15[Ident(15 + 9)] = 0,
998               "9 bytes to the right of global variable");
999
1000  Ident(fs1);
1001  Ident(fs2);
1002  Ident(fs3);
1003
1004  // We don't create left redzones, so this is not 100% guaranteed to fail.
1005  // But most likely will.
1006  EXPECT_DEATH(fs2[Ident(-1)] = 0, "is located.*of global variable");
1007
1008  EXPECT_DEATH(Ident(Ident(ConstGlob)[8]),
1009               "is located 1 bytes to the right of .*ConstGlob");
1010  EXPECT_DEATH(Ident(Ident(StaticConstGlob)[5]),
1011               "is located 2 bytes to the right of .*StaticConstGlob");
1012
1013  // call stuff from another file.
1014  GlobalsTest(0);
1015}
1016
1017TEST(AddressSanitizer, GlobalStringConstTest) {
1018  static const char *zoo = "FOOBAR123";
1019  const char *p = Ident(zoo);
1020  EXPECT_DEATH(Ident(p[15]), "is ascii string 'FOOBAR123'");
1021}
1022
1023TEST(AddressSanitizer, FileNameInGlobalReportTest) {
1024  static char zoo[10];
1025  const char *p = Ident(zoo);
1026  // The file name should be present in the report.
1027  EXPECT_DEATH(Ident(p[15]), "zoo.*asan_test.");
1028}
1029
1030int *ReturnsPointerToALocalObject() {
1031  int a = 0;
1032  return Ident(&a);
1033}
1034
1035#if ASAN_UAR == 1
1036TEST(AddressSanitizer, LocalReferenceReturnTest) {
1037  int *(*f)() = Ident(ReturnsPointerToALocalObject);
1038  int *p = f();
1039  // Call 'f' a few more times, 'p' should still be poisoned.
1040  for (int i = 0; i < 32; i++)
1041    f();
1042  EXPECT_DEATH(*p = 1, "AddressSanitizer: stack-use-after-return");
1043  EXPECT_DEATH(*p = 1, "is located.*in frame .*ReturnsPointerToALocal");
1044}
1045#endif
1046
1047template <int kSize>
1048NOINLINE static void FuncWithStack() {
1049  char x[kSize];
1050  Ident(x)[0] = 0;
1051  Ident(x)[kSize-1] = 0;
1052}
1053
1054static void LotsOfStackReuse() {
1055  int LargeStack[10000];
1056  Ident(LargeStack)[0] = 0;
1057  for (int i = 0; i < 10000; i++) {
1058    FuncWithStack<128 * 1>();
1059    FuncWithStack<128 * 2>();
1060    FuncWithStack<128 * 4>();
1061    FuncWithStack<128 * 8>();
1062    FuncWithStack<128 * 16>();
1063    FuncWithStack<128 * 32>();
1064    FuncWithStack<128 * 64>();
1065    FuncWithStack<128 * 128>();
1066    FuncWithStack<128 * 256>();
1067    FuncWithStack<128 * 512>();
1068    Ident(LargeStack)[0] = 0;
1069  }
1070}
1071
1072TEST(AddressSanitizer, StressStackReuseTest) {
1073  LotsOfStackReuse();
1074}
1075
1076TEST(AddressSanitizer, ThreadedStressStackReuseTest) {
1077  const int kNumThreads = 20;
1078  pthread_t t[kNumThreads];
1079  for (int i = 0; i < kNumThreads; i++) {
1080    PTHREAD_CREATE(&t[i], 0, (void* (*)(void *x))LotsOfStackReuse, 0);
1081  }
1082  for (int i = 0; i < kNumThreads; i++) {
1083    PTHREAD_JOIN(t[i], 0);
1084  }
1085}
1086
1087static void *PthreadExit(void *a) {
1088  pthread_exit(0);
1089  return 0;
1090}
1091
1092TEST(AddressSanitizer, PthreadExitTest) {
1093  pthread_t t;
1094  for (int i = 0; i < 1000; i++) {
1095    PTHREAD_CREATE(&t, 0, PthreadExit, 0);
1096    PTHREAD_JOIN(t, 0);
1097  }
1098}
1099
1100// FIXME: Why does clang-cl define __EXCEPTIONS?
1101#if defined(__EXCEPTIONS) && !defined(_WIN32)
1102NOINLINE static void StackReuseAndException() {
1103  int large_stack[1000];
1104  Ident(large_stack);
1105  ASAN_THROW(1);
1106}
1107
1108// TODO(kcc): support exceptions with use-after-return.
1109TEST(AddressSanitizer, DISABLED_StressStackReuseAndExceptionsTest) {
1110  for (int i = 0; i < 10000; i++) {
1111    try {
1112    StackReuseAndException();
1113    } catch(...) {
1114    }
1115  }
1116}
1117#endif
1118
1119#if !defined(_WIN32)
1120TEST(AddressSanitizer, MlockTest) {
1121  EXPECT_EQ(0, mlockall(MCL_CURRENT));
1122  EXPECT_EQ(0, mlock((void*)0x12345, 0x5678));
1123  EXPECT_EQ(0, munlockall());
1124  EXPECT_EQ(0, munlock((void*)0x987, 0x654));
1125}
1126#endif
1127
1128struct LargeStruct {
1129  int foo[100];
1130};
1131
1132// Test for bug http://llvm.org/bugs/show_bug.cgi?id=11763.
1133// Struct copy should not cause asan warning even if lhs == rhs.
1134TEST(AddressSanitizer, LargeStructCopyTest) {
1135  LargeStruct a;
1136  *Ident(&a) = *Ident(&a);
1137}
1138
1139ATTRIBUTE_NO_SANITIZE_ADDRESS
1140static void NoSanitizeAddress() {
1141  char *foo = new char[10];
1142  Ident(foo)[10] = 0;
1143  delete [] foo;
1144}
1145
1146TEST(AddressSanitizer, AttributeNoSanitizeAddressTest) {
1147  Ident(NoSanitizeAddress)();
1148}
1149
1150// The new/delete/etc mismatch checks don't work on Android,
1151//   as calls to new/delete go through malloc/free.
1152// OS X support is tracked here:
1153//   https://code.google.com/p/address-sanitizer/issues/detail?id=131
1154// Windows support is tracked here:
1155//   https://code.google.com/p/address-sanitizer/issues/detail?id=309
1156#if !defined(ANDROID) && !defined(__ANDROID__) && \
1157    !defined(__APPLE__) && \
1158    !defined(_WIN32)
1159static string MismatchStr(const string &str) {
1160  return string("AddressSanitizer: alloc-dealloc-mismatch \\(") + str;
1161}
1162
1163TEST(AddressSanitizer, AllocDeallocMismatch) {
1164  EXPECT_DEATH(free(Ident(new int)),
1165               MismatchStr("operator new vs free"));
1166  EXPECT_DEATH(free(Ident(new int[2])),
1167               MismatchStr("operator new \\[\\] vs free"));
1168  EXPECT_DEATH(delete (Ident(new int[2])),
1169               MismatchStr("operator new \\[\\] vs operator delete"));
1170  EXPECT_DEATH(delete (Ident((int*)malloc(2 * sizeof(int)))),
1171               MismatchStr("malloc vs operator delete"));
1172  EXPECT_DEATH(delete [] (Ident(new int)),
1173               MismatchStr("operator new vs operator delete \\[\\]"));
1174  EXPECT_DEATH(delete [] (Ident((int*)malloc(2 * sizeof(int)))),
1175               MismatchStr("malloc vs operator delete \\[\\]"));
1176}
1177#endif
1178
1179// ------------------ demo tests; run each one-by-one -------------
1180// e.g. --gtest_filter=*DemoOOBLeftHigh --gtest_also_run_disabled_tests
1181TEST(AddressSanitizer, DISABLED_DemoThreadedTest) {
1182  ThreadedTestSpawn();
1183}
1184
1185void *SimpleBugOnSTack(void *x = 0) {
1186  char a[20];
1187  Ident(a)[20] = 0;
1188  return 0;
1189}
1190
1191TEST(AddressSanitizer, DISABLED_DemoStackTest) {
1192  SimpleBugOnSTack();
1193}
1194
1195TEST(AddressSanitizer, DISABLED_DemoThreadStackTest) {
1196  pthread_t t;
1197  PTHREAD_CREATE(&t, 0, SimpleBugOnSTack, 0);
1198  PTHREAD_JOIN(t, 0);
1199}
1200
1201TEST(AddressSanitizer, DISABLED_DemoUAFLowIn) {
1202  uaf_test<U1>(10, 0);
1203}
1204TEST(AddressSanitizer, DISABLED_DemoUAFLowLeft) {
1205  uaf_test<U1>(10, -2);
1206}
1207TEST(AddressSanitizer, DISABLED_DemoUAFLowRight) {
1208  uaf_test<U1>(10, 10);
1209}
1210
1211TEST(AddressSanitizer, DISABLED_DemoUAFHigh) {
1212  uaf_test<U1>(kLargeMalloc, 0);
1213}
1214
1215TEST(AddressSanitizer, DISABLED_DemoOOM) {
1216  size_t size = SANITIZER_WORDSIZE == 64 ? (size_t)(1ULL << 40) : (0xf0000000);
1217  printf("%p\n", malloc(size));
1218}
1219
1220TEST(AddressSanitizer, DISABLED_DemoDoubleFreeTest) {
1221  DoubleFree();
1222}
1223
1224TEST(AddressSanitizer, DISABLED_DemoNullDerefTest) {
1225  int *a = 0;
1226  Ident(a)[10] = 0;
1227}
1228
1229TEST(AddressSanitizer, DISABLED_DemoFunctionStaticTest) {
1230  static char a[100];
1231  static char b[100];
1232  static char c[100];
1233  Ident(a);
1234  Ident(b);
1235  Ident(c);
1236  Ident(a)[5] = 0;
1237  Ident(b)[105] = 0;
1238  Ident(a)[5] = 0;
1239}
1240
1241TEST(AddressSanitizer, DISABLED_DemoTooMuchMemoryTest) {
1242  const size_t kAllocSize = (1 << 28) - 1024;
1243  size_t total_size = 0;
1244  while (true) {
1245    char *x = (char*)malloc(kAllocSize);
1246    memset(x, 0, kAllocSize);
1247    total_size += kAllocSize;
1248    fprintf(stderr, "total: %ldM %p\n", (long)total_size >> 20, x);
1249  }
1250}
1251
1252// http://code.google.com/p/address-sanitizer/issues/detail?id=66
1253TEST(AddressSanitizer, BufferOverflowAfterManyFrees) {
1254  for (int i = 0; i < 1000000; i++) {
1255    delete [] (Ident(new char [8644]));
1256  }
1257  char *x = new char[8192];
1258  EXPECT_DEATH(x[Ident(8192)] = 0, "AddressSanitizer: heap-buffer-overflow");
1259  delete [] Ident(x);
1260}
1261
1262
1263// Test that instrumentation of stack allocations takes into account
1264// AllocSize of a type, and not its StoreSize (16 vs 10 bytes for long double).
1265// See http://llvm.org/bugs/show_bug.cgi?id=12047 for more details.
1266TEST(AddressSanitizer, LongDoubleNegativeTest) {
1267  long double a, b;
1268  static long double c;
1269  memcpy(Ident(&a), Ident(&b), sizeof(long double));
1270  memcpy(Ident(&c), Ident(&b), sizeof(long double));
1271}
1272
1273#if !defined(_WIN32)
1274TEST(AddressSanitizer, pthread_getschedparam) {
1275  int policy;
1276  struct sched_param param;
1277  EXPECT_DEATH(
1278      pthread_getschedparam(pthread_self(), &policy, Ident(&param) + 2),
1279      "AddressSanitizer: stack-buffer-.*flow");
1280  EXPECT_DEATH(
1281      pthread_getschedparam(pthread_self(), Ident(&policy) - 1, &param),
1282      "AddressSanitizer: stack-buffer-.*flow");
1283  int res = pthread_getschedparam(pthread_self(), &policy, &param);
1284  ASSERT_EQ(0, res);
1285}
1286#endif
1287