asan_test.cc revision fe6d91684bcda766593800f6307233f1a33d31f6
1b0ddf227b25388ad836e560c00f0aec84026b0e5Alexey Samsonov//===-- asan_test.cc ------------------------------------------------------===//
21e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany//
31e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany//                     The LLVM Compiler Infrastructure
41e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany//
51e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany// This file is distributed under the University of Illinois Open Source
61e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany// License. See LICENSE.TXT for details.
71e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany//
81e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany//===----------------------------------------------------------------------===//
91e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany//
101e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany// This file is a part of AddressSanitizer, an address sanity checker.
111e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany//
121e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany//===----------------------------------------------------------------------===//
131e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany#include <stdio.h>
141e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany#include <signal.h>
151e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany#include <stdlib.h>
161e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany#include <string.h>
17af0f01d77c2a495f023ffbf6cce85b33bbd2306dKostya Serebryany#include <strings.h>
181e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany#include <pthread.h>
191e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany#include <stdint.h>
201e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany#include <setjmp.h>
211e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany#include <assert.h>
221e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
23716e2f25123bf9b20fbc6b582803a3929b78b96dKostya Serebryany#ifdef __linux__
24716e2f25123bf9b20fbc6b582803a3929b78b96dKostya Serebryany# include <sys/prctl.h>
258530e2b953f0b34ecd267a6aba5f155d5c08c5c8Kostya Serebryany# include <sys/types.h>
268530e2b953f0b34ecd267a6aba5f155d5c08c5c8Kostya Serebryany# include <sys/stat.h>
278530e2b953f0b34ecd267a6aba5f155d5c08c5c8Kostya Serebryany# include <fcntl.h>
28716e2f25123bf9b20fbc6b582803a3929b78b96dKostya Serebryany#endif
29716e2f25123bf9b20fbc6b582803a3929b78b96dKostya Serebryany
30f6607d097833cd53460735c1a5a2fd52b97613ebTimur Iskhodzhanov#if defined(__i386__) || defined(__x86_64__)
311e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany#include <emmintrin.h>
321e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany#endif
331e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
341e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany#include "asan_test_utils.h"
351e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
361e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany#ifndef __APPLE__
371e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany#include <malloc.h>
38fb506cb56c7f47a9f0aa515d6f5ca3ed6533422fAlexander Potapenko#else
39ca2cdd989076d091d8c4d4c277f8b47d9b5903adAlexander Potapenko#include <malloc/malloc.h>
400503ce8824393174c17acb26d62551f18a0fd82aAlexander Potapenko#include <AvailabilityMacros.h>  // For MAC_OS_X_VERSION_*
41fb506cb56c7f47a9f0aa515d6f5ca3ed6533422fAlexander Potapenko#include <CoreFoundation/CFString.h>
421e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany#endif  // __APPLE__
431e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
441e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany#if ASAN_HAS_EXCEPTIONS
451e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany# define ASAN_THROW(x) throw (x)
461e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany#else
471e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany# define ASAN_THROW(x)
481e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany#endif
491e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
501e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany#include <sys/mman.h>
511e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
521e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryanytypedef uint8_t   U1;
531e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryanytypedef uint16_t  U2;
541e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryanytypedef uint32_t  U4;
551e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryanytypedef uint64_t  U8;
561e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
571e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryanystatic const int kPageSize = 4096;
581e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
591e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany// Simple stand-alone pseudorandom number generator.
601e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany// Current algorithm is ANSI C linear congruential PRNG.
611e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryanystatic inline uint32_t my_rand(uint32_t* state) {
621e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  return (*state = *state * 1103515245 + 12345) >> 16;
631e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany}
641e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
651e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryanystatic uint32_t global_seed = 0;
661e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
671e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryanyconst size_t kLargeMalloc = 1 << 24;
681e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
692dcf44991a8ec1ca7c8051eb27c5ff158530bdc3Timur Iskhodzhanovtemplate<typename T>
70938106753364d96cedc11cbdc35a15030fb44d0cTimur IskhodzhanovNOINLINE void asan_write(T *a) {
711e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  *a = 0;
721e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany}
731e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
74938106753364d96cedc11cbdc35a15030fb44d0cTimur IskhodzhanovNOINLINE void asan_write_sized_aligned(uint8_t *p, size_t size) {
7576e842845c927e92c2c21c41ac51e364fa17528cAlexey Samsonov  EXPECT_EQ(0U, ((uintptr_t)p % size));
761e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  if      (size == 1) asan_write((uint8_t*)p);
771e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  else if (size == 2) asan_write((uint16_t*)p);
781e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  else if (size == 4) asan_write((uint32_t*)p);
791e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  else if (size == 8) asan_write((uint64_t*)p);
801e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany}
811e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
82938106753364d96cedc11cbdc35a15030fb44d0cTimur IskhodzhanovNOINLINE void *malloc_fff(size_t size) {
831e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  void *res = malloc/**/(size); break_optimization(0); return res;}
84938106753364d96cedc11cbdc35a15030fb44d0cTimur IskhodzhanovNOINLINE void *malloc_eee(size_t size) {
851e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  void *res = malloc_fff(size); break_optimization(0); return res;}
86938106753364d96cedc11cbdc35a15030fb44d0cTimur IskhodzhanovNOINLINE void *malloc_ddd(size_t size) {
871e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  void *res = malloc_eee(size); break_optimization(0); return res;}
88938106753364d96cedc11cbdc35a15030fb44d0cTimur IskhodzhanovNOINLINE void *malloc_ccc(size_t size) {
891e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  void *res = malloc_ddd(size); break_optimization(0); return res;}
90938106753364d96cedc11cbdc35a15030fb44d0cTimur IskhodzhanovNOINLINE void *malloc_bbb(size_t size) {
911e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  void *res = malloc_ccc(size); break_optimization(0); return res;}
92938106753364d96cedc11cbdc35a15030fb44d0cTimur IskhodzhanovNOINLINE void *malloc_aaa(size_t size) {
931e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  void *res = malloc_bbb(size); break_optimization(0); return res;}
941e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
951e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany#ifndef __APPLE__
96938106753364d96cedc11cbdc35a15030fb44d0cTimur IskhodzhanovNOINLINE void *memalign_fff(size_t alignment, size_t size) {
971e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  void *res = memalign/**/(alignment, size); break_optimization(0); return res;}
98938106753364d96cedc11cbdc35a15030fb44d0cTimur IskhodzhanovNOINLINE void *memalign_eee(size_t alignment, size_t size) {
991e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  void *res = memalign_fff(alignment, size); break_optimization(0); return res;}
100938106753364d96cedc11cbdc35a15030fb44d0cTimur IskhodzhanovNOINLINE void *memalign_ddd(size_t alignment, size_t size) {
1011e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  void *res = memalign_eee(alignment, size); break_optimization(0); return res;}
102938106753364d96cedc11cbdc35a15030fb44d0cTimur IskhodzhanovNOINLINE void *memalign_ccc(size_t alignment, size_t size) {
1031e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  void *res = memalign_ddd(alignment, size); break_optimization(0); return res;}
104938106753364d96cedc11cbdc35a15030fb44d0cTimur IskhodzhanovNOINLINE void *memalign_bbb(size_t alignment, size_t size) {
1051e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  void *res = memalign_ccc(alignment, size); break_optimization(0); return res;}
106938106753364d96cedc11cbdc35a15030fb44d0cTimur IskhodzhanovNOINLINE void *memalign_aaa(size_t alignment, size_t size) {
1071e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  void *res = memalign_bbb(alignment, size); break_optimization(0); return res;}
1081e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany#endif  // __APPLE__
1091e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
1101e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
111938106753364d96cedc11cbdc35a15030fb44d0cTimur IskhodzhanovNOINLINE void free_ccc(void *p) { free(p); break_optimization(0);}
112938106753364d96cedc11cbdc35a15030fb44d0cTimur IskhodzhanovNOINLINE void free_bbb(void *p) { free_ccc(p); break_optimization(0);}
113938106753364d96cedc11cbdc35a15030fb44d0cTimur IskhodzhanovNOINLINE void free_aaa(void *p) { free_bbb(p); break_optimization(0);}
1141e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
1152dcf44991a8ec1ca7c8051eb27c5ff158530bdc3Timur Iskhodzhanovtemplate<typename T>
116938106753364d96cedc11cbdc35a15030fb44d0cTimur IskhodzhanovNOINLINE void oob_test(int size, int off) {
1171e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  char *p = (char*)malloc_aaa(size);
1181e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  // fprintf(stderr, "writing %d byte(s) into [%p,%p) with offset %d\n",
1191e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  //        sizeof(T), p, p + size, off);
1201e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  asan_write((T*)(p + off));
1211e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  free_aaa(p);
1221e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany}
1231e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
1241e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
1252dcf44991a8ec1ca7c8051eb27c5ff158530bdc3Timur Iskhodzhanovtemplate<typename T>
126938106753364d96cedc11cbdc35a15030fb44d0cTimur IskhodzhanovNOINLINE void uaf_test(int size, int off) {
1271e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  char *p = (char *)malloc_aaa(size);
1281e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  free_aaa(p);
1291e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  for (int i = 1; i < 100; i++)
1301e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany    free_aaa(malloc_aaa(i));
1311e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  fprintf(stderr, "writing %ld byte(s) at %p with offset %d\n",
1321e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany          (long)sizeof(T), p, off);
1331e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  asan_write((T*)(p + off));
1341e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany}
1351e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
13613ebae606b526399771e9cca1d6a9d24458ad0f1Kostya SerebryanyTEST(AddressSanitizer, HasFeatureAddressSanitizerTest) {
13713ebae606b526399771e9cca1d6a9d24458ad0f1Kostya Serebryany#if defined(__has_feature) && __has_feature(address_sanitizer)
13813ebae606b526399771e9cca1d6a9d24458ad0f1Kostya Serebryany  bool asan = 1;
139badab16503e025326a46a45da8faa6fd20e5fc3dKostya Serebryany#elif defined(__SANITIZE_ADDRESS__)
140badab16503e025326a46a45da8faa6fd20e5fc3dKostya Serebryany  bool asan = 1;
14113ebae606b526399771e9cca1d6a9d24458ad0f1Kostya Serebryany#else
14213ebae606b526399771e9cca1d6a9d24458ad0f1Kostya Serebryany  bool asan = 0;
14313ebae606b526399771e9cca1d6a9d24458ad0f1Kostya Serebryany#endif
14413ebae606b526399771e9cca1d6a9d24458ad0f1Kostya Serebryany  EXPECT_EQ(true, asan);
1451e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany}
1461e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
1471e172b4bdec57329bf904f063a29f99cddf2d85fKostya SerebryanyTEST(AddressSanitizer, SimpleDeathTest) {
1481e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  EXPECT_DEATH(exit(1), "");
1491e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany}
1501e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
1511e172b4bdec57329bf904f063a29f99cddf2d85fKostya SerebryanyTEST(AddressSanitizer, VariousMallocsTest) {
1521e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  int *a = (int*)malloc(100 * sizeof(int));
1531e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  a[50] = 0;
1541e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  free(a);
1551e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
1561e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  int *r = (int*)malloc(10);
1571e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  r = (int*)realloc(r, 2000 * sizeof(int));
1581e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  r[1000] = 0;
1591e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  free(r);
1601e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
1611e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  int *b = new int[100];
1621e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  b[50] = 0;
1631e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  delete [] b;
1641e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
1651e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  int *c = new int;
1661e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  *c = 0;
1671e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  delete c;
1681e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
169e0e9eea99d7a81a15c4bb15ff2e5ebd92b50817bEvgeniy Stepanov#if !defined(__APPLE__) && !defined(ANDROID) && !defined(__ANDROID__)
1701e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  int *pm;
1711e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  int pm_res = posix_memalign((void**)&pm, kPageSize, kPageSize);
1721e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  EXPECT_EQ(0, pm_res);
1731e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  free(pm);
1747274eafceb832e1088f30b71652992787ba8c456Evgeniy Stepanov#endif
1751e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
1764dd8ba8238b1b698953628affe6e5b2edf3b3e3fAlexey Samsonov#if !defined(__APPLE__)
1771e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  int *ma = (int*)memalign(kPageSize, kPageSize);
17876e842845c927e92c2c21c41ac51e364fa17528cAlexey Samsonov  EXPECT_EQ(0U, (uintptr_t)ma % kPageSize);
1791e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  ma[123] = 0;
1801e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  free(ma);
1811e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany#endif  // __APPLE__
1821e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany}
1831e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
1841e172b4bdec57329bf904f063a29f99cddf2d85fKostya SerebryanyTEST(AddressSanitizer, CallocTest) {
1851e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  int *a = (int*)calloc(100, sizeof(int));
1861e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  EXPECT_EQ(0, a[10]);
1871e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  free(a);
1881e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany}
1891e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
1901e172b4bdec57329bf904f063a29f99cddf2d85fKostya SerebryanyTEST(AddressSanitizer, VallocTest) {
1911e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  void *a = valloc(100);
19276e842845c927e92c2c21c41ac51e364fa17528cAlexey Samsonov  EXPECT_EQ(0U, (uintptr_t)a % kPageSize);
1931e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  free(a);
1941e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany}
1951e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
1961e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany#ifndef __APPLE__
1971e172b4bdec57329bf904f063a29f99cddf2d85fKostya SerebryanyTEST(AddressSanitizer, PvallocTest) {
1981e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  char *a = (char*)pvalloc(kPageSize + 100);
19976e842845c927e92c2c21c41ac51e364fa17528cAlexey Samsonov  EXPECT_EQ(0U, (uintptr_t)a % kPageSize);
2001e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  a[kPageSize + 101] = 1;  // we should not report an error here.
2011e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  free(a);
2021e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
2031e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  a = (char*)pvalloc(0);  // pvalloc(0) should allocate at least one page.
20476e842845c927e92c2c21c41ac51e364fa17528cAlexey Samsonov  EXPECT_EQ(0U, (uintptr_t)a % kPageSize);
2051e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  a[101] = 1;  // we should not report an error here.
2061e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  free(a);
2071e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany}
2081e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany#endif  // __APPLE__
2091e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
2101e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryanyvoid *TSDWorker(void *test_key) {
2111e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  if (test_key) {
2121e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany    pthread_setspecific(*(pthread_key_t*)test_key, (void*)0xfeedface);
2131e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  }
2141e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  return NULL;
2151e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany}
2161e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
2171e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryanyvoid TSDDestructor(void *tsd) {
2181e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  // Spawning a thread will check that the current thread id is not -1.
2191e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  pthread_t th;
2202697687059e64a4f1319dc23a0a3ca59982d53f6Kostya Serebryany  PTHREAD_CREATE(&th, NULL, TSDWorker, NULL);
2212697687059e64a4f1319dc23a0a3ca59982d53f6Kostya Serebryany  PTHREAD_JOIN(th, NULL);
2221e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany}
2231e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
2241e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany// This tests triggers the thread-specific data destruction fiasco which occurs
2251e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany// if we don't manage the TSD destructors ourselves. We create a new pthread
2261e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany// key with a non-NULL destructor which is likely to be put after the destructor
2271e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany// of AsanThread in the list of destructors.
2281e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany// In this case the TSD for AsanThread will be destroyed before TSDDestructor
2291e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany// is called for the child thread, and a CHECK will fail when we call
2301e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany// pthread_create() to spawn the grandchild.
2311e172b4bdec57329bf904f063a29f99cddf2d85fKostya SerebryanyTEST(AddressSanitizer, DISABLED_TSDTest) {
2321e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  pthread_t th;
2331e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  pthread_key_t test_key;
2341e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  pthread_key_create(&test_key, TSDDestructor);
2352697687059e64a4f1319dc23a0a3ca59982d53f6Kostya Serebryany  PTHREAD_CREATE(&th, NULL, TSDWorker, &test_key);
2362697687059e64a4f1319dc23a0a3ca59982d53f6Kostya Serebryany  PTHREAD_JOIN(th, NULL);
2371e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  pthread_key_delete(test_key);
2381e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany}
2391e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
2402dcf44991a8ec1ca7c8051eb27c5ff158530bdc3Timur Iskhodzhanovtemplate<typename T>
2411e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryanyvoid OOBTest() {
2421e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  char expected_str[100];
2431e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  for (int size = sizeof(T); size < 20; size += 5) {
2441e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany    for (int i = -5; i < 0; i++) {
2451e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany      const char *str =
2461e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany          "is located.*%d byte.*to the left";
2471e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany      sprintf(expected_str, str, abs(i));
2481e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany      EXPECT_DEATH(oob_test<T>(size, i), expected_str);
2491e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany    }
2501e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
25176e842845c927e92c2c21c41ac51e364fa17528cAlexey Samsonov    for (int i = 0; i < (int)(size - sizeof(T) + 1); i++)
2521e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany      oob_test<T>(size, i);
2531e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
25476e842845c927e92c2c21c41ac51e364fa17528cAlexey Samsonov    for (int i = size - sizeof(T) + 1; i <= (int)(size + 3 * sizeof(T)); i++) {
2551e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany      const char *str =
2561e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany          "is located.*%d byte.*to the right";
2571e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany      int off = i >= size ? (i - size) : 0;
2581e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany      // we don't catch unaligned partially OOB accesses.
2591e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany      if (i % sizeof(T)) continue;
2601e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany      sprintf(expected_str, str, off);
2611e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany      EXPECT_DEATH(oob_test<T>(size, i), expected_str);
2621e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany    }
2631e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  }
2641e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
2651e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  EXPECT_DEATH(oob_test<T>(kLargeMalloc, -1),
2661e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany          "is located.*1 byte.*to the left");
2671e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  EXPECT_DEATH(oob_test<T>(kLargeMalloc, kLargeMalloc),
2681e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany          "is located.*0 byte.*to the right");
2691e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany}
2701e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
2711e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany// TODO(glider): the following tests are EXTREMELY slow on Darwin:
2721e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany//   AddressSanitizer.OOB_char (125503 ms)
2731e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany//   AddressSanitizer.OOB_int (126890 ms)
2741e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany//   AddressSanitizer.OOBRightTest (315605 ms)
2751e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany//   AddressSanitizer.SimpleStackTest (366559 ms)
2761e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
2771e172b4bdec57329bf904f063a29f99cddf2d85fKostya SerebryanyTEST(AddressSanitizer, OOB_char) {
2781e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  OOBTest<U1>();
2791e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany}
2801e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
2811e172b4bdec57329bf904f063a29f99cddf2d85fKostya SerebryanyTEST(AddressSanitizer, OOB_int) {
2821e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  OOBTest<U4>();
2831e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany}
2841e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
2851e172b4bdec57329bf904f063a29f99cddf2d85fKostya SerebryanyTEST(AddressSanitizer, OOBRightTest) {
2861e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  for (size_t access_size = 1; access_size <= 8; access_size *= 2) {
2871e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany    for (size_t alloc_size = 1; alloc_size <= 8; alloc_size++) {
2881e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany      for (size_t offset = 0; offset <= 8; offset += access_size) {
2891e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany        void *p = malloc(alloc_size);
2901e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany        // allocated: [p, p + alloc_size)
2911e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany        // accessed:  [p + offset, p + offset + access_size)
2921e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany        uint8_t *addr = (uint8_t*)p + offset;
2931e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany        if (offset + access_size <= alloc_size) {
2941e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany          asan_write_sized_aligned(addr, access_size);
2951e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany        } else {
2961e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany          int outside_bytes = offset > alloc_size ? (offset - alloc_size) : 0;
2971e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany          const char *str =
2981e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany              "is located.%d *byte.*to the right";
2991e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany          char expected_str[100];
3001e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany          sprintf(expected_str, str, outside_bytes);
3011e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany          EXPECT_DEATH(asan_write_sized_aligned(addr, access_size),
3021e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany                       expected_str);
3031e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany        }
3041e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany        free(p);
3051e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany      }
3061e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany    }
3071e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  }
3081e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany}
3091e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
3101e172b4bdec57329bf904f063a29f99cddf2d85fKostya SerebryanyTEST(AddressSanitizer, UAF_char) {
311ca9b5dd9922fb7f6e0ca06dbba7db7398b8997f1Kostya Serebryany  const char *uaf_string = "AddressSanitizer:.*heap-use-after-free";
3121e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  EXPECT_DEATH(uaf_test<U1>(1, 0), uaf_string);
3131e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  EXPECT_DEATH(uaf_test<U1>(10, 0), uaf_string);
3141e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  EXPECT_DEATH(uaf_test<U1>(10, 10), uaf_string);
3151e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  EXPECT_DEATH(uaf_test<U1>(kLargeMalloc, 0), uaf_string);
3161e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  EXPECT_DEATH(uaf_test<U1>(kLargeMalloc, kLargeMalloc / 2), uaf_string);
3171e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany}
3181e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
3191e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany#if ASAN_HAS_BLACKLIST
3201e172b4bdec57329bf904f063a29f99cddf2d85fKostya SerebryanyTEST(AddressSanitizer, IgnoreTest) {
3211e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  int *x = Ident(new int);
3221e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  delete Ident(x);
3231e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  *x = 0;
3241e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany}
3251e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany#endif  // ASAN_HAS_BLACKLIST
3261e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
3271e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryanystruct StructWithBitField {
3281e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  int bf1:1;
3291e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  int bf2:1;
3301e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  int bf3:1;
3311e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  int bf4:29;
3321e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany};
3331e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
3341e172b4bdec57329bf904f063a29f99cddf2d85fKostya SerebryanyTEST(AddressSanitizer, BitFieldPositiveTest) {
3351e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  StructWithBitField *x = new StructWithBitField;
3361e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  delete Ident(x);
3371e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  EXPECT_DEATH(x->bf1 = 0, "use-after-free");
3381e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  EXPECT_DEATH(x->bf2 = 0, "use-after-free");
3391e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  EXPECT_DEATH(x->bf3 = 0, "use-after-free");
3401e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  EXPECT_DEATH(x->bf4 = 0, "use-after-free");
34176e842845c927e92c2c21c41ac51e364fa17528cAlexey Samsonov}
3421e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
3431e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryanystruct StructWithBitFields_8_24 {
3441e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  int a:8;
3451e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  int b:24;
3461e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany};
3471e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
3481e172b4bdec57329bf904f063a29f99cddf2d85fKostya SerebryanyTEST(AddressSanitizer, BitFieldNegativeTest) {
3491e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  StructWithBitFields_8_24 *x = Ident(new StructWithBitFields_8_24);
3501e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  x->a = 0;
3511e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  x->b = 0;
3521e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  delete Ident(x);
3531e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany}
3541e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
3551e172b4bdec57329bf904f063a29f99cddf2d85fKostya SerebryanyTEST(AddressSanitizer, OutOfMemoryTest) {
3565af39e50366f1aacbebc284f572f08ad1ad07357Kostya Serebryany  size_t size = SANITIZER_WORDSIZE == 64 ? (size_t)(1ULL << 48) : (0xf0000000);
3571e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  EXPECT_EQ(0, realloc(0, size));
3581e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  EXPECT_EQ(0, realloc(0, ~Ident(0)));
3591e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  EXPECT_EQ(0, malloc(size));
3601e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  EXPECT_EQ(0, malloc(~Ident(0)));
3611e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  EXPECT_EQ(0, calloc(1, size));
3621e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  EXPECT_EQ(0, calloc(1, ~Ident(0)));
3631e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany}
3641e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
3651e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany#if ASAN_NEEDS_SEGV
36658b017bb286a8f4413a9348d2c87c52de38cff6dAlexander Potapenkonamespace {
36758b017bb286a8f4413a9348d2c87c52de38cff6dAlexander Potapenko
368ca9b5dd9922fb7f6e0ca06dbba7db7398b8997f1Kostya Serebryanyconst char kUnknownCrash[] = "AddressSanitizer: SEGV on unknown address";
36958b017bb286a8f4413a9348d2c87c52de38cff6dAlexander Potapenkoconst char kOverriddenHandler[] = "ASan signal handler has been overridden\n";
37058b017bb286a8f4413a9348d2c87c52de38cff6dAlexander Potapenko
3711e172b4bdec57329bf904f063a29f99cddf2d85fKostya SerebryanyTEST(AddressSanitizer, WildAddressTest) {
3721e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  char *c = (char*)0x123;
37358b017bb286a8f4413a9348d2c87c52de38cff6dAlexander Potapenko  EXPECT_DEATH(*c = 0, kUnknownCrash);
37458b017bb286a8f4413a9348d2c87c52de38cff6dAlexander Potapenko}
37558b017bb286a8f4413a9348d2c87c52de38cff6dAlexander Potapenko
37658b017bb286a8f4413a9348d2c87c52de38cff6dAlexander Potapenkovoid my_sigaction_sighandler(int, siginfo_t*, void*) {
37758b017bb286a8f4413a9348d2c87c52de38cff6dAlexander Potapenko  fprintf(stderr, kOverriddenHandler);
37858b017bb286a8f4413a9348d2c87c52de38cff6dAlexander Potapenko  exit(1);
37958b017bb286a8f4413a9348d2c87c52de38cff6dAlexander Potapenko}
38058b017bb286a8f4413a9348d2c87c52de38cff6dAlexander Potapenko
381b0ddf227b25388ad836e560c00f0aec84026b0e5Alexey Samsonovvoid my_signal_sighandler(int signum) {
38258b017bb286a8f4413a9348d2c87c52de38cff6dAlexander Potapenko  fprintf(stderr, kOverriddenHandler);
38358b017bb286a8f4413a9348d2c87c52de38cff6dAlexander Potapenko  exit(1);
38458b017bb286a8f4413a9348d2c87c52de38cff6dAlexander Potapenko}
38558b017bb286a8f4413a9348d2c87c52de38cff6dAlexander Potapenko
38658b017bb286a8f4413a9348d2c87c52de38cff6dAlexander PotapenkoTEST(AddressSanitizer, SignalTest) {
38758b017bb286a8f4413a9348d2c87c52de38cff6dAlexander Potapenko  struct sigaction sigact;
38858b017bb286a8f4413a9348d2c87c52de38cff6dAlexander Potapenko  memset(&sigact, 0, sizeof(sigact));
38958b017bb286a8f4413a9348d2c87c52de38cff6dAlexander Potapenko  sigact.sa_sigaction = my_sigaction_sighandler;
39058b017bb286a8f4413a9348d2c87c52de38cff6dAlexander Potapenko  sigact.sa_flags = SA_SIGINFO;
39158b017bb286a8f4413a9348d2c87c52de38cff6dAlexander Potapenko  // ASan should silently ignore sigaction()...
39258b017bb286a8f4413a9348d2c87c52de38cff6dAlexander Potapenko  EXPECT_EQ(0, sigaction(SIGSEGV, &sigact, 0));
39358b017bb286a8f4413a9348d2c87c52de38cff6dAlexander Potapenko#ifdef __APPLE__
39458b017bb286a8f4413a9348d2c87c52de38cff6dAlexander Potapenko  EXPECT_EQ(0, sigaction(SIGBUS, &sigact, 0));
39558b017bb286a8f4413a9348d2c87c52de38cff6dAlexander Potapenko#endif
39658b017bb286a8f4413a9348d2c87c52de38cff6dAlexander Potapenko  char *c = (char*)0x123;
39758b017bb286a8f4413a9348d2c87c52de38cff6dAlexander Potapenko  EXPECT_DEATH(*c = 0, kUnknownCrash);
39858b017bb286a8f4413a9348d2c87c52de38cff6dAlexander Potapenko  // ... and signal().
39958b017bb286a8f4413a9348d2c87c52de38cff6dAlexander Potapenko  EXPECT_EQ(0, signal(SIGSEGV, my_signal_sighandler));
40058b017bb286a8f4413a9348d2c87c52de38cff6dAlexander Potapenko  EXPECT_DEATH(*c = 0, kUnknownCrash);
40158b017bb286a8f4413a9348d2c87c52de38cff6dAlexander Potapenko}
402b0ddf227b25388ad836e560c00f0aec84026b0e5Alexey Samsonov}  // namespace
4031e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany#endif
4041e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
4051e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryanystatic void MallocStress(size_t n) {
4061e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  uint32_t seed = my_rand(&global_seed);
4071e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  for (size_t iter = 0; iter < 10; iter++) {
4081e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany    vector<void *> vec;
4091e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany    for (size_t i = 0; i < n; i++) {
4101e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany      if ((i % 3) == 0) {
4111e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany        if (vec.empty()) continue;
4121e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany        size_t idx = my_rand(&seed) % vec.size();
4131e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany        void *ptr = vec[idx];
4141e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany        vec[idx] = vec.back();
4151e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany        vec.pop_back();
4161e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany        free_aaa(ptr);
4171e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany      } else {
4181e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany        size_t size = my_rand(&seed) % 1000 + 1;
4191e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany#ifndef __APPLE__
4201e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany        size_t alignment = 1 << (my_rand(&seed) % 7 + 3);
4211e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany        char *ptr = (char*)memalign_aaa(alignment, size);
4221e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany#else
4231e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany        char *ptr = (char*) malloc_aaa(size);
4241e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany#endif
4251e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany        vec.push_back(ptr);
4261e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany        ptr[0] = 0;
4271e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany        ptr[size-1] = 0;
4281e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany        ptr[size/2] = 0;
4291e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany      }
4301e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany    }
4311e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany    for (size_t i = 0; i < vec.size(); i++)
4321e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany      free_aaa(vec[i]);
4331e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  }
4341e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany}
4351e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
4361e172b4bdec57329bf904f063a29f99cddf2d85fKostya SerebryanyTEST(AddressSanitizer, MallocStressTest) {
4378ae44ac678644265ba82a1b5696a402c9301a85cEvgeniy Stepanov  MallocStress((ASAN_LOW_MEMORY) ? 20000 : 200000);
4381e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany}
4391e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
4401e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryanystatic void TestLargeMalloc(size_t size) {
4411e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  char buff[1024];
4421e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  sprintf(buff, "is located 1 bytes to the left of %lu-byte", (long)size);
4431e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  EXPECT_DEATH(Ident((char*)malloc(size))[-1] = 0, buff);
4441e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany}
4451e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
4461e172b4bdec57329bf904f063a29f99cddf2d85fKostya SerebryanyTEST(AddressSanitizer, LargeMallocTest) {
4471e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  for (int i = 113; i < (1 << 28); i = i * 2 + 13) {
4481e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany    TestLargeMalloc(i);
4491e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  }
4501e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany}
4511e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
452788e1d704436065beb514fdde86070f61d0394edEvgeniy Stepanov#if ASAN_LOW_MEMORY != 1
4531e172b4bdec57329bf904f063a29f99cddf2d85fKostya SerebryanyTEST(AddressSanitizer, HugeMallocTest) {
4541e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany#ifdef __APPLE__
4551e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  // It was empirically found out that 1215 megabytes is the maximum amount of
456e4d141dbbaf5185f332a185c22308340657d243eKostya Serebryany  // memory available to the process under AddressSanitizer on 32-bit Mac 10.6.
457e4d141dbbaf5185f332a185c22308340657d243eKostya Serebryany  // 32-bit Mac 10.7 gives even less (< 1G).
4581e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  // (the libSystem malloc() allows allocating up to 2300 megabytes without
4591e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  // ASan).
4605af39e50366f1aacbebc284f572f08ad1ad07357Kostya Serebryany  size_t n_megs = SANITIZER_WORDSIZE == 32 ? 500 : 4100;
4611e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany#else
4625af39e50366f1aacbebc284f572f08ad1ad07357Kostya Serebryany  size_t n_megs = SANITIZER_WORDSIZE == 32 ? 2600 : 4100;
4631e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany#endif
4641e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  TestLargeMalloc(n_megs << 20);
4651e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany}
466788e1d704436065beb514fdde86070f61d0394edEvgeniy Stepanov#endif
4671e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
468c311105fd64219bb96b6467c3707ebda355be87bKostya Serebryany#ifndef __APPLE__
469c311105fd64219bb96b6467c3707ebda355be87bKostya Serebryanyvoid MemalignRun(size_t align, size_t size, int idx) {
470c311105fd64219bb96b6467c3707ebda355be87bKostya Serebryany  fprintf(stderr, "align %ld\n", align);
471c311105fd64219bb96b6467c3707ebda355be87bKostya Serebryany  char *p = (char *)memalign(align, size);
472c311105fd64219bb96b6467c3707ebda355be87bKostya Serebryany  Ident(p)[idx] = 0;
473c311105fd64219bb96b6467c3707ebda355be87bKostya Serebryany  free(p);
474c311105fd64219bb96b6467c3707ebda355be87bKostya Serebryany}
475c311105fd64219bb96b6467c3707ebda355be87bKostya Serebryany
476c311105fd64219bb96b6467c3707ebda355be87bKostya SerebryanyTEST(AddressSanitizer, memalign) {
477c311105fd64219bb96b6467c3707ebda355be87bKostya Serebryany  for (int align = 16; align <= (1 << 23); align *= 2) {
478c311105fd64219bb96b6467c3707ebda355be87bKostya Serebryany    size_t size = align * 5;
479c311105fd64219bb96b6467c3707ebda355be87bKostya Serebryany    EXPECT_DEATH(MemalignRun(align, size, -1),
480c311105fd64219bb96b6467c3707ebda355be87bKostya Serebryany                 "is located 1 bytes to the left");
481c311105fd64219bb96b6467c3707ebda355be87bKostya Serebryany    EXPECT_DEATH(MemalignRun(align, size, size + 1),
482c311105fd64219bb96b6467c3707ebda355be87bKostya Serebryany                 "is located 1 bytes to the right");
483c311105fd64219bb96b6467c3707ebda355be87bKostya Serebryany  }
484c311105fd64219bb96b6467c3707ebda355be87bKostya Serebryany}
485c311105fd64219bb96b6467c3707ebda355be87bKostya Serebryany#endif
486c311105fd64219bb96b6467c3707ebda355be87bKostya Serebryany
4871e172b4bdec57329bf904f063a29f99cddf2d85fKostya SerebryanyTEST(AddressSanitizer, ThreadedMallocStressTest) {
4881e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  const int kNumThreads = 4;
4898ae44ac678644265ba82a1b5696a402c9301a85cEvgeniy Stepanov  const int kNumIterations = (ASAN_LOW_MEMORY) ? 10000 : 100000;
4901e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  pthread_t t[kNumThreads];
4911e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  for (int i = 0; i < kNumThreads; i++) {
4922697687059e64a4f1319dc23a0a3ca59982d53f6Kostya Serebryany    PTHREAD_CREATE(&t[i], 0, (void* (*)(void *x))MallocStress,
4938ae44ac678644265ba82a1b5696a402c9301a85cEvgeniy Stepanov        (void*)kNumIterations);
4941e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  }
4951e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  for (int i = 0; i < kNumThreads; i++) {
4962697687059e64a4f1319dc23a0a3ca59982d53f6Kostya Serebryany    PTHREAD_JOIN(t[i], 0);
4971e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  }
4981e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany}
4991e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
5001e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryanyvoid *ManyThreadsWorker(void *a) {
5011e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  for (int iter = 0; iter < 100; iter++) {
5021e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany    for (size_t size = 100; size < 2000; size *= 2) {
5031e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany      free(Ident(malloc(size)));
5041e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany    }
5051e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  }
5061e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  return 0;
5071e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany}
5081e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
5091e172b4bdec57329bf904f063a29f99cddf2d85fKostya SerebryanyTEST(AddressSanitizer, ManyThreadsTest) {
5102697687059e64a4f1319dc23a0a3ca59982d53f6Kostya Serebryany  const size_t kNumThreads =
5112697687059e64a4f1319dc23a0a3ca59982d53f6Kostya Serebryany      (SANITIZER_WORDSIZE == 32 || ASAN_AVOID_EXPENSIVE_TESTS) ? 30 : 1000;
5121e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  pthread_t t[kNumThreads];
5131e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  for (size_t i = 0; i < kNumThreads; i++) {
5142697687059e64a4f1319dc23a0a3ca59982d53f6Kostya Serebryany    PTHREAD_CREATE(&t[i], 0, ManyThreadsWorker, (void*)i);
5151e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  }
5161e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  for (size_t i = 0; i < kNumThreads; i++) {
5172697687059e64a4f1319dc23a0a3ca59982d53f6Kostya Serebryany    PTHREAD_JOIN(t[i], 0);
5181e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  }
5191e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany}
5201e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
5211e172b4bdec57329bf904f063a29f99cddf2d85fKostya SerebryanyTEST(AddressSanitizer, ReallocTest) {
5221e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  const int kMinElem = 5;
5231e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  int *ptr = (int*)malloc(sizeof(int) * kMinElem);
5241e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  ptr[3] = 3;
5251e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  for (int i = 0; i < 10000; i++) {
5261e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany    ptr = (int*)realloc(ptr,
5271e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany        (my_rand(&global_seed) % 1000 + kMinElem) * sizeof(int));
5281e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany    EXPECT_EQ(3, ptr[3]);
5291e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  }
5301e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany}
5311e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
5324fd95f141f78906570c15a8a3b4cf0a7b50a201dAlexey Samsonov#ifndef __APPLE__
5334fd95f141f78906570c15a8a3b4cf0a7b50a201dAlexey Samsonovstatic const char *kMallocUsableSizeErrorMsg =
534ca9b5dd9922fb7f6e0ca06dbba7db7398b8997f1Kostya Serebryany  "AddressSanitizer: attempting to call malloc_usable_size()";
5354fd95f141f78906570c15a8a3b4cf0a7b50a201dAlexey Samsonov
5364fd95f141f78906570c15a8a3b4cf0a7b50a201dAlexey SamsonovTEST(AddressSanitizer, MallocUsableSizeTest) {
5374fd95f141f78906570c15a8a3b4cf0a7b50a201dAlexey Samsonov  const size_t kArraySize = 100;
5384fd95f141f78906570c15a8a3b4cf0a7b50a201dAlexey Samsonov  char *array = Ident((char*)malloc(kArraySize));
5394fd95f141f78906570c15a8a3b4cf0a7b50a201dAlexey Samsonov  int *int_ptr = Ident(new int);
54076e842845c927e92c2c21c41ac51e364fa17528cAlexey Samsonov  EXPECT_EQ(0U, malloc_usable_size(NULL));
5414fd95f141f78906570c15a8a3b4cf0a7b50a201dAlexey Samsonov  EXPECT_EQ(kArraySize, malloc_usable_size(array));
5424fd95f141f78906570c15a8a3b4cf0a7b50a201dAlexey Samsonov  EXPECT_EQ(sizeof(int), malloc_usable_size(int_ptr));
5434fd95f141f78906570c15a8a3b4cf0a7b50a201dAlexey Samsonov  EXPECT_DEATH(malloc_usable_size((void*)0x123), kMallocUsableSizeErrorMsg);
5444fd95f141f78906570c15a8a3b4cf0a7b50a201dAlexey Samsonov  EXPECT_DEATH(malloc_usable_size(array + kArraySize / 2),
5454fd95f141f78906570c15a8a3b4cf0a7b50a201dAlexey Samsonov               kMallocUsableSizeErrorMsg);
5464fd95f141f78906570c15a8a3b4cf0a7b50a201dAlexey Samsonov  free(array);
5474fd95f141f78906570c15a8a3b4cf0a7b50a201dAlexey Samsonov  EXPECT_DEATH(malloc_usable_size(array), kMallocUsableSizeErrorMsg);
5484fd95f141f78906570c15a8a3b4cf0a7b50a201dAlexey Samsonov}
5494fd95f141f78906570c15a8a3b4cf0a7b50a201dAlexey Samsonov#endif
5504fd95f141f78906570c15a8a3b4cf0a7b50a201dAlexey Samsonov
5511e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryanyvoid WrongFree() {
5521e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  int *x = (int*)malloc(100 * sizeof(int));
5531e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  // Use the allocated memory, otherwise Clang will optimize it out.
5541e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  Ident(x);
5551e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  free(x + 1);
5561e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany}
5571e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
5581e172b4bdec57329bf904f063a29f99cddf2d85fKostya SerebryanyTEST(AddressSanitizer, WrongFreeTest) {
559c16201337a4bb974093ff75aa45682739a331d05Kostya Serebryany  EXPECT_DEATH(WrongFree(),
560ca9b5dd9922fb7f6e0ca06dbba7db7398b8997f1Kostya Serebryany               "ERROR: AddressSanitizer: attempting free.*not malloc");
5611e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany}
5621e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
5631e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryanyvoid DoubleFree() {
5641e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  int *x = (int*)malloc(100 * sizeof(int));
5651e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  fprintf(stderr, "DoubleFree: x=%p\n", x);
5661e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  free(x);
5671e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  free(x);
5681e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  fprintf(stderr, "should have failed in the second free(%p)\n", x);
5691e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  abort();
5701e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany}
5711e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
5721e172b4bdec57329bf904f063a29f99cddf2d85fKostya SerebryanyTEST(AddressSanitizer, DoubleFreeTest) {
57327f4932a8a0845303b33d69ddce096c445002e60Kostya Serebryany  EXPECT_DEATH(DoubleFree(), ASAN_PCRE_DOTALL
574ca9b5dd9922fb7f6e0ca06dbba7db7398b8997f1Kostya Serebryany               "ERROR: AddressSanitizer: attempting double-free"
57527f4932a8a0845303b33d69ddce096c445002e60Kostya Serebryany               ".*is located 0 bytes inside of 400-byte region"
57627f4932a8a0845303b33d69ddce096c445002e60Kostya Serebryany               ".*freed by thread T0 here"
57727f4932a8a0845303b33d69ddce096c445002e60Kostya Serebryany               ".*previously allocated by thread T0 here");
5781e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany}
5791e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
5801e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryanytemplate<int kSize>
581938106753364d96cedc11cbdc35a15030fb44d0cTimur IskhodzhanovNOINLINE void SizedStackTest() {
5821e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  char a[kSize];
5831e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  char  *A = Ident((char*)&a);
5841e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  for (size_t i = 0; i < kSize; i++)
5851e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany    A[i] = i;
5861e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  EXPECT_DEATH(A[-1] = 0, "");
5871e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  EXPECT_DEATH(A[-20] = 0, "");
5881e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  EXPECT_DEATH(A[-31] = 0, "");
5891e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  EXPECT_DEATH(A[kSize] = 0, "");
5901e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  EXPECT_DEATH(A[kSize + 1] = 0, "");
5911e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  EXPECT_DEATH(A[kSize + 10] = 0, "");
5921e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  EXPECT_DEATH(A[kSize + 31] = 0, "");
5931e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany}
5941e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
5951e172b4bdec57329bf904f063a29f99cddf2d85fKostya SerebryanyTEST(AddressSanitizer, SimpleStackTest) {
5961e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  SizedStackTest<1>();
5971e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  SizedStackTest<2>();
5981e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  SizedStackTest<3>();
5991e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  SizedStackTest<4>();
6001e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  SizedStackTest<5>();
6011e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  SizedStackTest<6>();
6021e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  SizedStackTest<7>();
6031e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  SizedStackTest<16>();
6041e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  SizedStackTest<25>();
6051e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  SizedStackTest<34>();
6061e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  SizedStackTest<43>();
6071e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  SizedStackTest<51>();
6081e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  SizedStackTest<62>();
6091e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  SizedStackTest<64>();
6101e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  SizedStackTest<128>();
6111e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany}
6121e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
6131e172b4bdec57329bf904f063a29f99cddf2d85fKostya SerebryanyTEST(AddressSanitizer, ManyStackObjectsTest) {
6141e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  char XXX[10];
6151e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  char YYY[20];
6161e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  char ZZZ[30];
6171e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  Ident(XXX);
6181e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  Ident(YYY);
6191e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  EXPECT_DEATH(Ident(ZZZ)[-1] = 0, ASAN_PCRE_DOTALL "XXX.*YYY.*ZZZ");
6201e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany}
6211e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
622938106753364d96cedc11cbdc35a15030fb44d0cTimur IskhodzhanovNOINLINE static void Frame0(int frame, char *a, char *b, char *c) {
6231e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  char d[4] = {0};
6241e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  char *D = Ident(d);
6251e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  switch (frame) {
6261e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany    case 3: a[5]++; break;
6271e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany    case 2: b[5]++; break;
6281e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany    case 1: c[5]++; break;
6291e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany    case 0: D[5]++; break;
6301e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  }
6311e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany}
632938106753364d96cedc11cbdc35a15030fb44d0cTimur IskhodzhanovNOINLINE static void Frame1(int frame, char *a, char *b) {
6331e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  char c[4] = {0}; Frame0(frame, a, b, c);
6341e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  break_optimization(0);
6351e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany}
636938106753364d96cedc11cbdc35a15030fb44d0cTimur IskhodzhanovNOINLINE static void Frame2(int frame, char *a) {
6371e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  char b[4] = {0}; Frame1(frame, a, b);
6381e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  break_optimization(0);
6391e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany}
640938106753364d96cedc11cbdc35a15030fb44d0cTimur IskhodzhanovNOINLINE static void Frame3(int frame) {
6411e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  char a[4] = {0}; Frame2(frame, a);
6421e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  break_optimization(0);
6431e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany}
6441e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
6451e172b4bdec57329bf904f063a29f99cddf2d85fKostya SerebryanyTEST(AddressSanitizer, GuiltyStackFrame0Test) {
6461e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  EXPECT_DEATH(Frame3(0), "located .*in frame <.*Frame0");
6471e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany}
6481e172b4bdec57329bf904f063a29f99cddf2d85fKostya SerebryanyTEST(AddressSanitizer, GuiltyStackFrame1Test) {
6491e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  EXPECT_DEATH(Frame3(1), "located .*in frame <.*Frame1");
6501e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany}
6511e172b4bdec57329bf904f063a29f99cddf2d85fKostya SerebryanyTEST(AddressSanitizer, GuiltyStackFrame2Test) {
6521e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  EXPECT_DEATH(Frame3(2), "located .*in frame <.*Frame2");
6531e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany}
6541e172b4bdec57329bf904f063a29f99cddf2d85fKostya SerebryanyTEST(AddressSanitizer, GuiltyStackFrame3Test) {
6551e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  EXPECT_DEATH(Frame3(3), "located .*in frame <.*Frame3");
6561e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany}
6571e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
658938106753364d96cedc11cbdc35a15030fb44d0cTimur IskhodzhanovNOINLINE void LongJmpFunc1(jmp_buf buf) {
6591e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  // create three red zones for these two stack objects.
6601e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  int a;
6611e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  int b;
6621e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
6631e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  int *A = Ident(&a);
6641e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  int *B = Ident(&b);
6651e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  *A = *B;
6661e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  longjmp(buf, 1);
6671e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany}
6681e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
669d3ca78fdb296d2a51fc224da673ebfff508acf44Kostya SerebryanyNOINLINE void BuiltinLongJmpFunc1(jmp_buf buf) {
670d3ca78fdb296d2a51fc224da673ebfff508acf44Kostya Serebryany  // create three red zones for these two stack objects.
671d3ca78fdb296d2a51fc224da673ebfff508acf44Kostya Serebryany  int a;
672d3ca78fdb296d2a51fc224da673ebfff508acf44Kostya Serebryany  int b;
673d3ca78fdb296d2a51fc224da673ebfff508acf44Kostya Serebryany
674d3ca78fdb296d2a51fc224da673ebfff508acf44Kostya Serebryany  int *A = Ident(&a);
675d3ca78fdb296d2a51fc224da673ebfff508acf44Kostya Serebryany  int *B = Ident(&b);
676d3ca78fdb296d2a51fc224da673ebfff508acf44Kostya Serebryany  *A = *B;
677d3ca78fdb296d2a51fc224da673ebfff508acf44Kostya Serebryany  __builtin_longjmp((void**)buf, 1);
678d3ca78fdb296d2a51fc224da673ebfff508acf44Kostya Serebryany}
679d3ca78fdb296d2a51fc224da673ebfff508acf44Kostya Serebryany
680938106753364d96cedc11cbdc35a15030fb44d0cTimur IskhodzhanovNOINLINE void UnderscopeLongJmpFunc1(jmp_buf buf) {
6811e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  // create three red zones for these two stack objects.
6821e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  int a;
6831e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  int b;
6841e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
6851e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  int *A = Ident(&a);
6861e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  int *B = Ident(&b);
6871e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  *A = *B;
6881e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  _longjmp(buf, 1);
6891e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany}
6901e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
691938106753364d96cedc11cbdc35a15030fb44d0cTimur IskhodzhanovNOINLINE void SigLongJmpFunc1(sigjmp_buf buf) {
6921e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  // create three red zones for these two stack objects.
6931e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  int a;
6941e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  int b;
6951e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
6961e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  int *A = Ident(&a);
6971e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  int *B = Ident(&b);
6981e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  *A = *B;
6991e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  siglongjmp(buf, 1);
7001e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany}
7011e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
7021e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
703938106753364d96cedc11cbdc35a15030fb44d0cTimur IskhodzhanovNOINLINE void TouchStackFunc() {
7041e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  int a[100];  // long array will intersect with redzones from LongJmpFunc1.
7051e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  int *A = Ident(a);
7061e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  for (int i = 0; i < 100; i++)
7071e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany    A[i] = i*i;
7081e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany}
7091e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
7101e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany// Test that we handle longjmp and do not report fals positives on stack.
7111e172b4bdec57329bf904f063a29f99cddf2d85fKostya SerebryanyTEST(AddressSanitizer, LongJmpTest) {
7121e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  static jmp_buf buf;
7131e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  if (!setjmp(buf)) {
7141e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany    LongJmpFunc1(buf);
7151e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  } else {
7161e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany    TouchStackFunc();
7171e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  }
7181e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany}
7191e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
720b989143d0be56496e8d5fcf75969af35a058792aKostya Serebryany#if not defined(__ANDROID__)
721c3a5c173f228cbb15e332e6bbc17c76ebd55d7a8Kostya SerebryanyTEST(AddressSanitizer, BuiltinLongJmpTest) {
722d3ca78fdb296d2a51fc224da673ebfff508acf44Kostya Serebryany  static jmp_buf buf;
723c3a5c173f228cbb15e332e6bbc17c76ebd55d7a8Kostya Serebryany  if (!__builtin_setjmp((void**)buf)) {
724d3ca78fdb296d2a51fc224da673ebfff508acf44Kostya Serebryany    BuiltinLongJmpFunc1(buf);
725d3ca78fdb296d2a51fc224da673ebfff508acf44Kostya Serebryany  } else {
726d3ca78fdb296d2a51fc224da673ebfff508acf44Kostya Serebryany    TouchStackFunc();
727d3ca78fdb296d2a51fc224da673ebfff508acf44Kostya Serebryany  }
728d3ca78fdb296d2a51fc224da673ebfff508acf44Kostya Serebryany}
729b989143d0be56496e8d5fcf75969af35a058792aKostya Serebryany#endif  // not defined(__ANDROID__)
730d3ca78fdb296d2a51fc224da673ebfff508acf44Kostya Serebryany
7311e172b4bdec57329bf904f063a29f99cddf2d85fKostya SerebryanyTEST(AddressSanitizer, UnderscopeLongJmpTest) {
7321e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  static jmp_buf buf;
7331e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  if (!_setjmp(buf)) {
7341e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany    UnderscopeLongJmpFunc1(buf);
7351e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  } else {
7361e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany    TouchStackFunc();
7371e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  }
7381e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany}
7391e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
7401e172b4bdec57329bf904f063a29f99cddf2d85fKostya SerebryanyTEST(AddressSanitizer, SigLongJmpTest) {
7411e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  static sigjmp_buf buf;
7421e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  if (!sigsetjmp(buf, 1)) {
7431e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany    SigLongJmpFunc1(buf);
7441e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  } else {
7451e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany    TouchStackFunc();
7461e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  }
7471e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany}
7481e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
7491e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany#ifdef __EXCEPTIONS
750938106753364d96cedc11cbdc35a15030fb44d0cTimur IskhodzhanovNOINLINE void ThrowFunc() {
7511e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  // create three red zones for these two stack objects.
7521e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  int a;
7531e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  int b;
7541e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
7551e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  int *A = Ident(&a);
7561e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  int *B = Ident(&b);
7571e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  *A = *B;
7581e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  ASAN_THROW(1);
7591e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany}
7601e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
7611e172b4bdec57329bf904f063a29f99cddf2d85fKostya SerebryanyTEST(AddressSanitizer, CxxExceptionTest) {
7621e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  if (ASAN_UAR) return;
7631e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  // TODO(kcc): this test crashes on 32-bit for some reason...
7645af39e50366f1aacbebc284f572f08ad1ad07357Kostya Serebryany  if (SANITIZER_WORDSIZE == 32) return;
7651e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  try {
7661e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany    ThrowFunc();
7671e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  } catch(...) {}
7681e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  TouchStackFunc();
7691e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany}
7701e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany#endif
7711e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
7721e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryanyvoid *ThreadStackReuseFunc1(void *unused) {
7731e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  // create three red zones for these two stack objects.
7741e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  int a;
7751e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  int b;
7761e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
7771e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  int *A = Ident(&a);
7781e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  int *B = Ident(&b);
7791e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  *A = *B;
7801e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  pthread_exit(0);
7811e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  return 0;
7821e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany}
7831e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
7841e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryanyvoid *ThreadStackReuseFunc2(void *unused) {
7851e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  TouchStackFunc();
7861e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  return 0;
7871e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany}
7881e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
7891e172b4bdec57329bf904f063a29f99cddf2d85fKostya SerebryanyTEST(AddressSanitizer, ThreadStackReuseTest) {
7901e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  pthread_t t;
7912697687059e64a4f1319dc23a0a3ca59982d53f6Kostya Serebryany  PTHREAD_CREATE(&t, 0, ThreadStackReuseFunc1, 0);
7922697687059e64a4f1319dc23a0a3ca59982d53f6Kostya Serebryany  PTHREAD_JOIN(t, 0);
7932697687059e64a4f1319dc23a0a3ca59982d53f6Kostya Serebryany  PTHREAD_CREATE(&t, 0, ThreadStackReuseFunc2, 0);
7942697687059e64a4f1319dc23a0a3ca59982d53f6Kostya Serebryany  PTHREAD_JOIN(t, 0);
7951e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany}
7961e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
797f6607d097833cd53460735c1a5a2fd52b97613ebTimur Iskhodzhanov#if defined(__i386__) || defined(__x86_64__)
7981e172b4bdec57329bf904f063a29f99cddf2d85fKostya SerebryanyTEST(AddressSanitizer, Store128Test) {
7991e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  char *a = Ident((char*)malloc(Ident(12)));
8001e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  char *p = a;
8011e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  if (((uintptr_t)a % 16) != 0)
8021e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany    p = a + 8;
8031e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  assert(((uintptr_t)p % 16) == 0);
8041e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  __m128i value_wide = _mm_set1_epi16(0x1234);
8051e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  EXPECT_DEATH(_mm_store_si128((__m128i*)p, value_wide),
806ca9b5dd9922fb7f6e0ca06dbba7db7398b8997f1Kostya Serebryany               "AddressSanitizer: heap-buffer-overflow");
807acd5c617b219e0f059620c2a3928d2cc821d4534Kostya Serebryany  EXPECT_DEATH(_mm_store_si128((__m128i*)p, value_wide),
8081e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany               "WRITE of size 16");
8091e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  EXPECT_DEATH(_mm_store_si128((__m128i*)p, value_wide),
8101e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany               "located 0 bytes to the right of 12-byte");
8111e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  free(a);
8121e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany}
8131e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany#endif
8141e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
815ef8dfd8dffbf4385baf24e5aaea6c2cc7c6c936aAlexander Potapenkostatic string RightOOBErrorMessage(int oob_distance, bool is_write) {
8161e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  assert(oob_distance >= 0);
8171e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  char expected_str[100];
8180b770b48e4ae053a7d0610e1c682405afba58fdaKostya Serebryany  sprintf(expected_str, ASAN_PCRE_DOTALL "%s.*located %d bytes to the right",
819ef8dfd8dffbf4385baf24e5aaea6c2cc7c6c936aAlexander Potapenko          is_write ? "WRITE" : "READ", oob_distance);
8201e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  return string(expected_str);
8211e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany}
8221e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
823ef8dfd8dffbf4385baf24e5aaea6c2cc7c6c936aAlexander Potapenkostatic string RightOOBWriteMessage(int oob_distance) {
824ef8dfd8dffbf4385baf24e5aaea6c2cc7c6c936aAlexander Potapenko  return RightOOBErrorMessage(oob_distance, /*is_write*/true);
825ef8dfd8dffbf4385baf24e5aaea6c2cc7c6c936aAlexander Potapenko}
826ef8dfd8dffbf4385baf24e5aaea6c2cc7c6c936aAlexander Potapenko
827ef8dfd8dffbf4385baf24e5aaea6c2cc7c6c936aAlexander Potapenkostatic string RightOOBReadMessage(int oob_distance) {
828ef8dfd8dffbf4385baf24e5aaea6c2cc7c6c936aAlexander Potapenko  return RightOOBErrorMessage(oob_distance, /*is_write*/false);
829ef8dfd8dffbf4385baf24e5aaea6c2cc7c6c936aAlexander Potapenko}
830ef8dfd8dffbf4385baf24e5aaea6c2cc7c6c936aAlexander Potapenko
831ef8dfd8dffbf4385baf24e5aaea6c2cc7c6c936aAlexander Potapenkostatic string LeftOOBErrorMessage(int oob_distance, bool is_write) {
8321e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  assert(oob_distance > 0);
8331e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  char expected_str[100];
8340b770b48e4ae053a7d0610e1c682405afba58fdaKostya Serebryany  sprintf(expected_str, ASAN_PCRE_DOTALL "%s.*located %d bytes to the left",
835ef8dfd8dffbf4385baf24e5aaea6c2cc7c6c936aAlexander Potapenko          is_write ? "WRITE" : "READ", oob_distance);
8361e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  return string(expected_str);
8371e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany}
8381e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
839ef8dfd8dffbf4385baf24e5aaea6c2cc7c6c936aAlexander Potapenkostatic string LeftOOBWriteMessage(int oob_distance) {
840ef8dfd8dffbf4385baf24e5aaea6c2cc7c6c936aAlexander Potapenko  return LeftOOBErrorMessage(oob_distance, /*is_write*/true);
841ef8dfd8dffbf4385baf24e5aaea6c2cc7c6c936aAlexander Potapenko}
842ef8dfd8dffbf4385baf24e5aaea6c2cc7c6c936aAlexander Potapenko
843ef8dfd8dffbf4385baf24e5aaea6c2cc7c6c936aAlexander Potapenkostatic string LeftOOBReadMessage(int oob_distance) {
844ef8dfd8dffbf4385baf24e5aaea6c2cc7c6c936aAlexander Potapenko  return LeftOOBErrorMessage(oob_distance, /*is_write*/false);
845ef8dfd8dffbf4385baf24e5aaea6c2cc7c6c936aAlexander Potapenko}
846ef8dfd8dffbf4385baf24e5aaea6c2cc7c6c936aAlexander Potapenko
847ada9ba14325df9e206f454c50bd1b55ea9ecdbb9Alexander Potapenkostatic string LeftOOBAccessMessage(int oob_distance) {
848ada9ba14325df9e206f454c50bd1b55ea9ecdbb9Alexander Potapenko  assert(oob_distance > 0);
849ada9ba14325df9e206f454c50bd1b55ea9ecdbb9Alexander Potapenko  char expected_str[100];
850ada9ba14325df9e206f454c50bd1b55ea9ecdbb9Alexander Potapenko  sprintf(expected_str, "located %d bytes to the left", oob_distance);
851ada9ba14325df9e206f454c50bd1b55ea9ecdbb9Alexander Potapenko  return string(expected_str);
852ada9ba14325df9e206f454c50bd1b55ea9ecdbb9Alexander Potapenko}
853ada9ba14325df9e206f454c50bd1b55ea9ecdbb9Alexander Potapenko
8542dcf44991a8ec1ca7c8051eb27c5ff158530bdc3Timur Iskhodzhanovtemplate<typename T>
8551e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryanyvoid MemSetOOBTestTemplate(size_t length) {
8561e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  if (length == 0) return;
8571e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  size_t size = Ident(sizeof(T) * length);
8581e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  T *array = Ident((T*)malloc(size));
8591e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  int element = Ident(42);
8601e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  int zero = Ident(0);
8611e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  // memset interval inside array
8621e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  memset(array, element, size);
8631e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  memset(array, element, size - 1);
8641e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  memset(array + length - 1, element, sizeof(T));
8651e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  memset(array, element, 1);
8661e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
8671e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  // memset 0 bytes
8681e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  memset(array - 10, element, zero);
8691e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  memset(array - 1, element, zero);
8701e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  memset(array, element, zero);
8711e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  memset(array + length, 0, zero);
8721e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  memset(array + length + 1, 0, zero);
8731e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
8741e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  // try to memset bytes to the right of array
8751e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  EXPECT_DEATH(memset(array, 0, size + 1),
876ef8dfd8dffbf4385baf24e5aaea6c2cc7c6c936aAlexander Potapenko               RightOOBWriteMessage(0));
8771e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  EXPECT_DEATH(memset((char*)(array + length) - 1, element, 6),
878ef8dfd8dffbf4385baf24e5aaea6c2cc7c6c936aAlexander Potapenko               RightOOBWriteMessage(4));
8791e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  EXPECT_DEATH(memset(array + 1, element, size + sizeof(T)),
880ef8dfd8dffbf4385baf24e5aaea6c2cc7c6c936aAlexander Potapenko               RightOOBWriteMessage(2 * sizeof(T) - 1));
8811e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  // whole interval is to the right
8821e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  EXPECT_DEATH(memset(array + length + 1, 0, 10),
883ef8dfd8dffbf4385baf24e5aaea6c2cc7c6c936aAlexander Potapenko               RightOOBWriteMessage(sizeof(T)));
8841e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
8851e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  // try to memset bytes to the left of array
8861e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  EXPECT_DEATH(memset((char*)array - 1, element, size),
887ef8dfd8dffbf4385baf24e5aaea6c2cc7c6c936aAlexander Potapenko               LeftOOBWriteMessage(1));
8881e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  EXPECT_DEATH(memset((char*)array - 5, 0, 6),
889ef8dfd8dffbf4385baf24e5aaea6c2cc7c6c936aAlexander Potapenko               LeftOOBWriteMessage(5));
8901e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  EXPECT_DEATH(memset(array - 5, element, size + 5 * sizeof(T)),
891ef8dfd8dffbf4385baf24e5aaea6c2cc7c6c936aAlexander Potapenko               LeftOOBWriteMessage(5 * sizeof(T)));
8921e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  // whole interval is to the left
8931e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  EXPECT_DEATH(memset(array - 2, 0, sizeof(T)),
894ef8dfd8dffbf4385baf24e5aaea6c2cc7c6c936aAlexander Potapenko               LeftOOBWriteMessage(2 * sizeof(T)));
8951e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
8961e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  // try to memset bytes both to the left & to the right
8971e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  EXPECT_DEATH(memset((char*)array - 2, element, size + 4),
898ef8dfd8dffbf4385baf24e5aaea6c2cc7c6c936aAlexander Potapenko               LeftOOBWriteMessage(2));
8991e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
9001e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  free(array);
9011e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany}
9021e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
9031e172b4bdec57329bf904f063a29f99cddf2d85fKostya SerebryanyTEST(AddressSanitizer, MemSetOOBTest) {
9041e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  MemSetOOBTestTemplate<char>(100);
9051e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  MemSetOOBTestTemplate<int>(5);
9061e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  MemSetOOBTestTemplate<double>(256);
9071e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  // We can test arrays of structres/classes here, but what for?
9081e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany}
9091e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
9101e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany// Same test for memcpy and memmove functions
9112dcf44991a8ec1ca7c8051eb27c5ff158530bdc3Timur Iskhodzhanovtemplate <typename T, class M>
9121e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryanyvoid MemTransferOOBTestTemplate(size_t length) {
9131e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  if (length == 0) return;
9141e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  size_t size = Ident(sizeof(T) * length);
9151e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  T *src = Ident((T*)malloc(size));
9161e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  T *dest = Ident((T*)malloc(size));
9171e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  int zero = Ident(0);
9181e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
9191e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  // valid transfer of bytes between arrays
9201e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  M::transfer(dest, src, size);
9211e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  M::transfer(dest + 1, src, size - sizeof(T));
9221e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  M::transfer(dest, src + length - 1, sizeof(T));
9231e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  M::transfer(dest, src, 1);
9241e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
9251e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  // transfer zero bytes
9261e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  M::transfer(dest - 1, src, 0);
9271e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  M::transfer(dest + length, src, zero);
9281e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  M::transfer(dest, src - 1, zero);
9291e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  M::transfer(dest, src, zero);
9301e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
9311e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  // try to change mem to the right of dest
9321e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  EXPECT_DEATH(M::transfer(dest + 1, src, size),
933ef8dfd8dffbf4385baf24e5aaea6c2cc7c6c936aAlexander Potapenko               RightOOBWriteMessage(sizeof(T) - 1));
9341e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  EXPECT_DEATH(M::transfer((char*)(dest + length) - 1, src, 5),
935ef8dfd8dffbf4385baf24e5aaea6c2cc7c6c936aAlexander Potapenko               RightOOBWriteMessage(3));
9361e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
9371e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  // try to change mem to the left of dest
9381e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  EXPECT_DEATH(M::transfer(dest - 2, src, size),
939ef8dfd8dffbf4385baf24e5aaea6c2cc7c6c936aAlexander Potapenko               LeftOOBWriteMessage(2 * sizeof(T)));
9401e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  EXPECT_DEATH(M::transfer((char*)dest - 3, src, 4),
941ef8dfd8dffbf4385baf24e5aaea6c2cc7c6c936aAlexander Potapenko               LeftOOBWriteMessage(3));
9421e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
9431e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  // try to access mem to the right of src
9441e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  EXPECT_DEATH(M::transfer(dest, src + 2, size),
945ef8dfd8dffbf4385baf24e5aaea6c2cc7c6c936aAlexander Potapenko               RightOOBReadMessage(2 * sizeof(T) - 1));
9461e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  EXPECT_DEATH(M::transfer(dest, (char*)(src + length) - 3, 6),
947ef8dfd8dffbf4385baf24e5aaea6c2cc7c6c936aAlexander Potapenko               RightOOBReadMessage(2));
9481e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
9491e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  // try to access mem to the left of src
9501e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  EXPECT_DEATH(M::transfer(dest, src - 1, size),
951ef8dfd8dffbf4385baf24e5aaea6c2cc7c6c936aAlexander Potapenko               LeftOOBReadMessage(sizeof(T)));
9521e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  EXPECT_DEATH(M::transfer(dest, (char*)src - 6, 7),
953ef8dfd8dffbf4385baf24e5aaea6c2cc7c6c936aAlexander Potapenko               LeftOOBReadMessage(6));
9541e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
9551e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  // Generally we don't need to test cases where both accessing src and writing
9561e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  // to dest address to poisoned memory.
9571e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
9581e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  T *big_src = Ident((T*)malloc(size * 2));
9591e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  T *big_dest = Ident((T*)malloc(size * 2));
9601e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  // try to change mem to both sides of dest
9611e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  EXPECT_DEATH(M::transfer(dest - 1, big_src, size * 2),
962ef8dfd8dffbf4385baf24e5aaea6c2cc7c6c936aAlexander Potapenko               LeftOOBWriteMessage(sizeof(T)));
9631e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  // try to access mem to both sides of src
9641e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  EXPECT_DEATH(M::transfer(big_dest, src - 2, size * 2),
965ef8dfd8dffbf4385baf24e5aaea6c2cc7c6c936aAlexander Potapenko               LeftOOBReadMessage(2 * sizeof(T)));
9661e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
9671e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  free(src);
9681e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  free(dest);
9691e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  free(big_src);
9701e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  free(big_dest);
9711e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany}
9721e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
9731e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryanyclass MemCpyWrapper {
9741e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany public:
9751e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  static void* transfer(void *to, const void *from, size_t size) {
9761e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany    return memcpy(to, from, size);
9771e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  }
9781e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany};
9791e172b4bdec57329bf904f063a29f99cddf2d85fKostya SerebryanyTEST(AddressSanitizer, MemCpyOOBTest) {
9801e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  MemTransferOOBTestTemplate<char, MemCpyWrapper>(100);
9811e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  MemTransferOOBTestTemplate<int, MemCpyWrapper>(1024);
9821e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany}
9831e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
9841e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryanyclass MemMoveWrapper {
9851e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany public:
9861e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  static void* transfer(void *to, const void *from, size_t size) {
9871e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany    return memmove(to, from, size);
9881e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  }
9891e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany};
9901e172b4bdec57329bf904f063a29f99cddf2d85fKostya SerebryanyTEST(AddressSanitizer, MemMoveOOBTest) {
9911e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  MemTransferOOBTestTemplate<char, MemMoveWrapper>(100);
9921e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  MemTransferOOBTestTemplate<int, MemMoveWrapper>(1024);
9931e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany}
9941e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
9951e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany// Tests for string functions
9961e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
9971e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany// Used for string functions tests
9981e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryanystatic char global_string[] = "global";
9991e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryanystatic size_t global_string_length = 6;
10001e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
10011e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany// Input to a test is a zero-terminated string str with given length
10021e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany// Accesses to the bytes to the left and to the right of str
10031e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany// are presumed to produce OOB errors
10041e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryanyvoid StrLenOOBTestTemplate(char *str, size_t length, bool is_global) {
10051e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  // Normal strlen calls
10061e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  EXPECT_EQ(strlen(str), length);
10071e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  if (length > 0) {
100876e842845c927e92c2c21c41ac51e364fa17528cAlexey Samsonov    EXPECT_EQ(length - 1, strlen(str + 1));
100976e842845c927e92c2c21c41ac51e364fa17528cAlexey Samsonov    EXPECT_EQ(0U, strlen(str + length));
10101e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  }
10111e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  // Arg of strlen is not malloced, OOB access
10121e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  if (!is_global) {
10131e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany    // We don't insert RedZones to the left of global variables
1014ef8dfd8dffbf4385baf24e5aaea6c2cc7c6c936aAlexander Potapenko    EXPECT_DEATH(Ident(strlen(str - 1)), LeftOOBReadMessage(1));
1015ef8dfd8dffbf4385baf24e5aaea6c2cc7c6c936aAlexander Potapenko    EXPECT_DEATH(Ident(strlen(str - 5)), LeftOOBReadMessage(5));
10161e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  }
1017ef8dfd8dffbf4385baf24e5aaea6c2cc7c6c936aAlexander Potapenko  EXPECT_DEATH(Ident(strlen(str + length + 1)), RightOOBReadMessage(0));
10181e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  // Overwrite terminator
10191e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  str[length] = 'a';
10201e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  // String is not zero-terminated, strlen will lead to OOB access
1021ef8dfd8dffbf4385baf24e5aaea6c2cc7c6c936aAlexander Potapenko  EXPECT_DEATH(Ident(strlen(str)), RightOOBReadMessage(0));
1022ef8dfd8dffbf4385baf24e5aaea6c2cc7c6c936aAlexander Potapenko  EXPECT_DEATH(Ident(strlen(str + length)), RightOOBReadMessage(0));
10231e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  // Restore terminator
10241e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  str[length] = 0;
10251e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany}
10261e172b4bdec57329bf904f063a29f99cddf2d85fKostya SerebryanyTEST(AddressSanitizer, StrLenOOBTest) {
10271e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  // Check heap-allocated string
10281e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  size_t length = Ident(10);
10291e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  char *heap_string = Ident((char*)malloc(length + 1));
10301e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  char stack_string[10 + 1];
1031badab16503e025326a46a45da8faa6fd20e5fc3dKostya Serebryany  break_optimization(&stack_string);
103276e842845c927e92c2c21c41ac51e364fa17528cAlexey Samsonov  for (size_t i = 0; i < length; i++) {
10331e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany    heap_string[i] = 'a';
10341e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany    stack_string[i] = 'b';
10351e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  }
10361e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  heap_string[length] = 0;
10371e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  stack_string[length] = 0;
10381e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  StrLenOOBTestTemplate(heap_string, length, false);
10391e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  // TODO(samsonov): Fix expected messages in StrLenOOBTestTemplate to
10401e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  //      make test for stack_string work. Or move it to output tests.
10411e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  // StrLenOOBTestTemplate(stack_string, length, false);
10421e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  StrLenOOBTestTemplate(global_string, global_string_length, true);
10431e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  free(heap_string);
10441e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany}
10451e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
1046847f932ab0405757946433b81d3b2952b306b0bcAlexey Samsonovstatic inline char* MallocAndMemsetString(size_t size, char ch) {
1047af0f01d77c2a495f023ffbf6cce85b33bbd2306dKostya Serebryany  char *s = Ident((char*)malloc(size));
1048847f932ab0405757946433b81d3b2952b306b0bcAlexey Samsonov  memset(s, ch, size);
1049af0f01d77c2a495f023ffbf6cce85b33bbd2306dKostya Serebryany  return s;
1050af0f01d77c2a495f023ffbf6cce85b33bbd2306dKostya Serebryany}
1051847f932ab0405757946433b81d3b2952b306b0bcAlexey Samsonovstatic inline char* MallocAndMemsetString(size_t size) {
1052847f932ab0405757946433b81d3b2952b306b0bcAlexey Samsonov  return MallocAndMemsetString(size, 'z');
1053847f932ab0405757946433b81d3b2952b306b0bcAlexey Samsonov}
1054af0f01d77c2a495f023ffbf6cce85b33bbd2306dKostya Serebryany
10551e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany#ifndef __APPLE__
10561e172b4bdec57329bf904f063a29f99cddf2d85fKostya SerebryanyTEST(AddressSanitizer, StrNLenOOBTest) {
10571e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  size_t size = Ident(123);
1058af0f01d77c2a495f023ffbf6cce85b33bbd2306dKostya Serebryany  char *str = MallocAndMemsetString(size);
10591e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  // Normal strnlen calls.
10601e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  Ident(strnlen(str - 1, 0));
10611e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  Ident(strnlen(str, size));
10621e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  Ident(strnlen(str + size - 1, 1));
10631e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  str[size - 1] = '\0';
10641e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  Ident(strnlen(str, 2 * size));
10651e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  // Argument points to not allocated memory.
1066ef8dfd8dffbf4385baf24e5aaea6c2cc7c6c936aAlexander Potapenko  EXPECT_DEATH(Ident(strnlen(str - 1, 1)), LeftOOBReadMessage(1));
1067ef8dfd8dffbf4385baf24e5aaea6c2cc7c6c936aAlexander Potapenko  EXPECT_DEATH(Ident(strnlen(str + size, 1)), RightOOBReadMessage(0));
10681e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  // Overwrite the terminating '\0' and hit unallocated memory.
10691e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  str[size - 1] = 'z';
1070ef8dfd8dffbf4385baf24e5aaea6c2cc7c6c936aAlexander Potapenko  EXPECT_DEATH(Ident(strnlen(str, size + 1)), RightOOBReadMessage(0));
10711e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  free(str);
10721e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany}
10731e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany#endif
10741e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
10751e172b4bdec57329bf904f063a29f99cddf2d85fKostya SerebryanyTEST(AddressSanitizer, StrDupOOBTest) {
10761e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  size_t size = Ident(42);
1077af0f01d77c2a495f023ffbf6cce85b33bbd2306dKostya Serebryany  char *str = MallocAndMemsetString(size);
10781e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  char *new_str;
10791e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  // Normal strdup calls.
10801e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  str[size - 1] = '\0';
10811e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  new_str = strdup(str);
10821e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  free(new_str);
10831e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  new_str = strdup(str + size - 1);
10841e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  free(new_str);
10851e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  // Argument points to not allocated memory.
1086ef8dfd8dffbf4385baf24e5aaea6c2cc7c6c936aAlexander Potapenko  EXPECT_DEATH(Ident(strdup(str - 1)), LeftOOBReadMessage(1));
1087ef8dfd8dffbf4385baf24e5aaea6c2cc7c6c936aAlexander Potapenko  EXPECT_DEATH(Ident(strdup(str + size)), RightOOBReadMessage(0));
10881e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  // Overwrite the terminating '\0' and hit unallocated memory.
10891e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  str[size - 1] = 'z';
1090ef8dfd8dffbf4385baf24e5aaea6c2cc7c6c936aAlexander Potapenko  EXPECT_DEATH(Ident(strdup(str)), RightOOBReadMessage(0));
10911e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  free(str);
10921e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany}
10931e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
10941e172b4bdec57329bf904f063a29f99cddf2d85fKostya SerebryanyTEST(AddressSanitizer, StrCpyOOBTest) {
10951e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  size_t to_size = Ident(30);
10961e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  size_t from_size = Ident(6);  // less than to_size
10971e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  char *to = Ident((char*)malloc(to_size));
10981e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  char *from = Ident((char*)malloc(from_size));
10991e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  // Normal strcpy calls.
11001e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  strcpy(from, "hello");
11011e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  strcpy(to, from);
11021e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  strcpy(to + to_size - from_size, from);
11031e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  // Length of "from" is too small.
1104ef8dfd8dffbf4385baf24e5aaea6c2cc7c6c936aAlexander Potapenko  EXPECT_DEATH(Ident(strcpy(from, "hello2")), RightOOBWriteMessage(0));
11051e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  // "to" or "from" points to not allocated memory.
1106ef8dfd8dffbf4385baf24e5aaea6c2cc7c6c936aAlexander Potapenko  EXPECT_DEATH(Ident(strcpy(to - 1, from)), LeftOOBWriteMessage(1));
1107ef8dfd8dffbf4385baf24e5aaea6c2cc7c6c936aAlexander Potapenko  EXPECT_DEATH(Ident(strcpy(to, from - 1)), LeftOOBReadMessage(1));
1108ef8dfd8dffbf4385baf24e5aaea6c2cc7c6c936aAlexander Potapenko  EXPECT_DEATH(Ident(strcpy(to, from + from_size)), RightOOBReadMessage(0));
1109ef8dfd8dffbf4385baf24e5aaea6c2cc7c6c936aAlexander Potapenko  EXPECT_DEATH(Ident(strcpy(to + to_size, from)), RightOOBWriteMessage(0));
11101e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  // Overwrite the terminating '\0' character and hit unallocated memory.
11111e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  from[from_size - 1] = '!';
1112ef8dfd8dffbf4385baf24e5aaea6c2cc7c6c936aAlexander Potapenko  EXPECT_DEATH(Ident(strcpy(to, from)), RightOOBReadMessage(0));
11131e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  free(to);
11141e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  free(from);
11151e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany}
11161e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
11171e172b4bdec57329bf904f063a29f99cddf2d85fKostya SerebryanyTEST(AddressSanitizer, StrNCpyOOBTest) {
11181e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  size_t to_size = Ident(20);
11191e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  size_t from_size = Ident(6);  // less than to_size
11201e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  char *to = Ident((char*)malloc(to_size));
11211e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  // From is a zero-terminated string "hello\0" of length 6
11221e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  char *from = Ident((char*)malloc(from_size));
11231e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  strcpy(from, "hello");
11241e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  // copy 0 bytes
11251e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  strncpy(to, from, 0);
11261e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  strncpy(to - 1, from - 1, 0);
11271e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  // normal strncpy calls
11281e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  strncpy(to, from, from_size);
11291e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  strncpy(to, from, to_size);
11301e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  strncpy(to, from + from_size - 1, to_size);
11311e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  strncpy(to + to_size - 1, from, 1);
11321e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  // One of {to, from} points to not allocated memory
11331e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  EXPECT_DEATH(Ident(strncpy(to, from - 1, from_size)),
1134ef8dfd8dffbf4385baf24e5aaea6c2cc7c6c936aAlexander Potapenko               LeftOOBReadMessage(1));
11351e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  EXPECT_DEATH(Ident(strncpy(to - 1, from, from_size)),
1136ef8dfd8dffbf4385baf24e5aaea6c2cc7c6c936aAlexander Potapenko               LeftOOBWriteMessage(1));
11371e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  EXPECT_DEATH(Ident(strncpy(to, from + from_size, 1)),
1138ef8dfd8dffbf4385baf24e5aaea6c2cc7c6c936aAlexander Potapenko               RightOOBReadMessage(0));
11391e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  EXPECT_DEATH(Ident(strncpy(to + to_size, from, 1)),
1140ef8dfd8dffbf4385baf24e5aaea6c2cc7c6c936aAlexander Potapenko               RightOOBWriteMessage(0));
11411e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  // Length of "to" is too small
11421e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  EXPECT_DEATH(Ident(strncpy(to + to_size - from_size + 1, from, from_size)),
1143ef8dfd8dffbf4385baf24e5aaea6c2cc7c6c936aAlexander Potapenko               RightOOBWriteMessage(0));
11441e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  EXPECT_DEATH(Ident(strncpy(to + 1, from, to_size)),
1145ef8dfd8dffbf4385baf24e5aaea6c2cc7c6c936aAlexander Potapenko               RightOOBWriteMessage(0));
11461e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  // Overwrite terminator in from
11471e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  from[from_size - 1] = '!';
11481e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  // normal strncpy call
11491e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  strncpy(to, from, from_size);
11501e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  // Length of "from" is too small
11511e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  EXPECT_DEATH(Ident(strncpy(to, from, to_size)),
1152ef8dfd8dffbf4385baf24e5aaea6c2cc7c6c936aAlexander Potapenko               RightOOBReadMessage(0));
11531e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  free(to);
11541e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  free(from);
11551e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany}
11561e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
1157fa7e95da75c30b7111224e68cb4405357bdc0f4bAlexey Samsonov// Users may have different definitions of "strchr" and "index", so provide
1158fa7e95da75c30b7111224e68cb4405357bdc0f4bAlexey Samsonov// function pointer typedefs and overload RunStrChrTest implementation.
1159fa7e95da75c30b7111224e68cb4405357bdc0f4bAlexey Samsonov// We can't use macro for RunStrChrTest body here, as this macro would
1160fa7e95da75c30b7111224e68cb4405357bdc0f4bAlexey Samsonov// confuse EXPECT_DEATH gtest macro.
1161fa7e95da75c30b7111224e68cb4405357bdc0f4bAlexey Samsonovtypedef char*(*PointerToStrChr1)(const char*, int);
1162fa7e95da75c30b7111224e68cb4405357bdc0f4bAlexey Samsonovtypedef char*(*PointerToStrChr2)(char*, int);
1163fa7e95da75c30b7111224e68cb4405357bdc0f4bAlexey Samsonov
1164fa7e95da75c30b7111224e68cb4405357bdc0f4bAlexey SamsonovUSED static void RunStrChrTest(PointerToStrChr1 StrChr) {
11651e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  size_t size = Ident(100);
1166af0f01d77c2a495f023ffbf6cce85b33bbd2306dKostya Serebryany  char *str = MallocAndMemsetString(size);
11671e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  str[10] = 'q';
11681e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  str[11] = '\0';
11691e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  EXPECT_EQ(str, StrChr(str, 'z'));
11701e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  EXPECT_EQ(str + 10, StrChr(str, 'q'));
11711e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  EXPECT_EQ(NULL, StrChr(str, 'a'));
11721e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  // StrChr argument points to not allocated memory.
1173ef8dfd8dffbf4385baf24e5aaea6c2cc7c6c936aAlexander Potapenko  EXPECT_DEATH(Ident(StrChr(str - 1, 'z')), LeftOOBReadMessage(1));
1174ef8dfd8dffbf4385baf24e5aaea6c2cc7c6c936aAlexander Potapenko  EXPECT_DEATH(Ident(StrChr(str + size, 'z')), RightOOBReadMessage(0));
11751e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  // Overwrite the terminator and hit not allocated memory.
11761e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  str[11] = 'z';
1177ef8dfd8dffbf4385baf24e5aaea6c2cc7c6c936aAlexander Potapenko  EXPECT_DEATH(Ident(StrChr(str, 'a')), RightOOBReadMessage(0));
11781e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  free(str);
11791e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany}
1180fa7e95da75c30b7111224e68cb4405357bdc0f4bAlexey SamsonovUSED static void RunStrChrTest(PointerToStrChr2 StrChr) {
1181fa7e95da75c30b7111224e68cb4405357bdc0f4bAlexey Samsonov  size_t size = Ident(100);
1182fa7e95da75c30b7111224e68cb4405357bdc0f4bAlexey Samsonov  char *str = MallocAndMemsetString(size);
1183fa7e95da75c30b7111224e68cb4405357bdc0f4bAlexey Samsonov  str[10] = 'q';
1184fa7e95da75c30b7111224e68cb4405357bdc0f4bAlexey Samsonov  str[11] = '\0';
1185fa7e95da75c30b7111224e68cb4405357bdc0f4bAlexey Samsonov  EXPECT_EQ(str, StrChr(str, 'z'));
1186fa7e95da75c30b7111224e68cb4405357bdc0f4bAlexey Samsonov  EXPECT_EQ(str + 10, StrChr(str, 'q'));
1187fa7e95da75c30b7111224e68cb4405357bdc0f4bAlexey Samsonov  EXPECT_EQ(NULL, StrChr(str, 'a'));
1188fa7e95da75c30b7111224e68cb4405357bdc0f4bAlexey Samsonov  // StrChr argument points to not allocated memory.
1189ef8dfd8dffbf4385baf24e5aaea6c2cc7c6c936aAlexander Potapenko  EXPECT_DEATH(Ident(StrChr(str - 1, 'z')), LeftOOBReadMessage(1));
1190ef8dfd8dffbf4385baf24e5aaea6c2cc7c6c936aAlexander Potapenko  EXPECT_DEATH(Ident(StrChr(str + size, 'z')), RightOOBReadMessage(0));
1191fa7e95da75c30b7111224e68cb4405357bdc0f4bAlexey Samsonov  // Overwrite the terminator and hit not allocated memory.
1192fa7e95da75c30b7111224e68cb4405357bdc0f4bAlexey Samsonov  str[11] = 'z';
1193ef8dfd8dffbf4385baf24e5aaea6c2cc7c6c936aAlexander Potapenko  EXPECT_DEATH(Ident(StrChr(str, 'a')), RightOOBReadMessage(0));
1194fa7e95da75c30b7111224e68cb4405357bdc0f4bAlexey Samsonov  free(str);
1195fa7e95da75c30b7111224e68cb4405357bdc0f4bAlexey Samsonov}
1196fa7e95da75c30b7111224e68cb4405357bdc0f4bAlexey Samsonov
11971e172b4bdec57329bf904f063a29f99cddf2d85fKostya SerebryanyTEST(AddressSanitizer, StrChrAndIndexOOBTest) {
11981e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  RunStrChrTest(&strchr);
11991e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  RunStrChrTest(&index);
12001e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany}
12011e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
12021e172b4bdec57329bf904f063a29f99cddf2d85fKostya SerebryanyTEST(AddressSanitizer, StrCmpAndFriendsLogicTest) {
12031e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  // strcmp
12041e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  EXPECT_EQ(0, strcmp("", ""));
12051e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  EXPECT_EQ(0, strcmp("abcd", "abcd"));
1206af0f01d77c2a495f023ffbf6cce85b33bbd2306dKostya Serebryany  EXPECT_GT(0, strcmp("ab", "ac"));
1207af0f01d77c2a495f023ffbf6cce85b33bbd2306dKostya Serebryany  EXPECT_GT(0, strcmp("abc", "abcd"));
1208af0f01d77c2a495f023ffbf6cce85b33bbd2306dKostya Serebryany  EXPECT_LT(0, strcmp("acc", "abc"));
1209af0f01d77c2a495f023ffbf6cce85b33bbd2306dKostya Serebryany  EXPECT_LT(0, strcmp("abcd", "abc"));
12101e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
12111e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  // strncmp
12121e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  EXPECT_EQ(0, strncmp("a", "b", 0));
12131e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  EXPECT_EQ(0, strncmp("abcd", "abcd", 10));
12141e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  EXPECT_EQ(0, strncmp("abcd", "abcef", 3));
1215af0f01d77c2a495f023ffbf6cce85b33bbd2306dKostya Serebryany  EXPECT_GT(0, strncmp("abcde", "abcfa", 4));
1216af0f01d77c2a495f023ffbf6cce85b33bbd2306dKostya Serebryany  EXPECT_GT(0, strncmp("a", "b", 5));
1217af0f01d77c2a495f023ffbf6cce85b33bbd2306dKostya Serebryany  EXPECT_GT(0, strncmp("bc", "bcde", 4));
1218af0f01d77c2a495f023ffbf6cce85b33bbd2306dKostya Serebryany  EXPECT_LT(0, strncmp("xyz", "xyy", 10));
1219af0f01d77c2a495f023ffbf6cce85b33bbd2306dKostya Serebryany  EXPECT_LT(0, strncmp("baa", "aaa", 1));
1220af0f01d77c2a495f023ffbf6cce85b33bbd2306dKostya Serebryany  EXPECT_LT(0, strncmp("zyx", "", 2));
1221af0f01d77c2a495f023ffbf6cce85b33bbd2306dKostya Serebryany
1222af0f01d77c2a495f023ffbf6cce85b33bbd2306dKostya Serebryany  // strcasecmp
1223af0f01d77c2a495f023ffbf6cce85b33bbd2306dKostya Serebryany  EXPECT_EQ(0, strcasecmp("", ""));
1224af0f01d77c2a495f023ffbf6cce85b33bbd2306dKostya Serebryany  EXPECT_EQ(0, strcasecmp("zzz", "zzz"));
1225af0f01d77c2a495f023ffbf6cce85b33bbd2306dKostya Serebryany  EXPECT_EQ(0, strcasecmp("abCD", "ABcd"));
1226af0f01d77c2a495f023ffbf6cce85b33bbd2306dKostya Serebryany  EXPECT_GT(0, strcasecmp("aB", "Ac"));
1227af0f01d77c2a495f023ffbf6cce85b33bbd2306dKostya Serebryany  EXPECT_GT(0, strcasecmp("ABC", "ABCd"));
1228af0f01d77c2a495f023ffbf6cce85b33bbd2306dKostya Serebryany  EXPECT_LT(0, strcasecmp("acc", "abc"));
1229af0f01d77c2a495f023ffbf6cce85b33bbd2306dKostya Serebryany  EXPECT_LT(0, strcasecmp("ABCd", "abc"));
1230af0f01d77c2a495f023ffbf6cce85b33bbd2306dKostya Serebryany
1231af0f01d77c2a495f023ffbf6cce85b33bbd2306dKostya Serebryany  // strncasecmp
1232af0f01d77c2a495f023ffbf6cce85b33bbd2306dKostya Serebryany  EXPECT_EQ(0, strncasecmp("a", "b", 0));
1233af0f01d77c2a495f023ffbf6cce85b33bbd2306dKostya Serebryany  EXPECT_EQ(0, strncasecmp("abCD", "ABcd", 10));
1234af0f01d77c2a495f023ffbf6cce85b33bbd2306dKostya Serebryany  EXPECT_EQ(0, strncasecmp("abCd", "ABcef", 3));
1235af0f01d77c2a495f023ffbf6cce85b33bbd2306dKostya Serebryany  EXPECT_GT(0, strncasecmp("abcde", "ABCfa", 4));
1236af0f01d77c2a495f023ffbf6cce85b33bbd2306dKostya Serebryany  EXPECT_GT(0, strncasecmp("a", "B", 5));
1237af0f01d77c2a495f023ffbf6cce85b33bbd2306dKostya Serebryany  EXPECT_GT(0, strncasecmp("bc", "BCde", 4));
1238af0f01d77c2a495f023ffbf6cce85b33bbd2306dKostya Serebryany  EXPECT_LT(0, strncasecmp("xyz", "xyy", 10));
1239af0f01d77c2a495f023ffbf6cce85b33bbd2306dKostya Serebryany  EXPECT_LT(0, strncasecmp("Baa", "aaa", 1));
1240af0f01d77c2a495f023ffbf6cce85b33bbd2306dKostya Serebryany  EXPECT_LT(0, strncasecmp("zyx", "", 2));
124152fb238ccc45781e4e1d097ae1ee748c898b5825Kostya Serebryany
124252fb238ccc45781e4e1d097ae1ee748c898b5825Kostya Serebryany  // memcmp
124352fb238ccc45781e4e1d097ae1ee748c898b5825Kostya Serebryany  EXPECT_EQ(0, memcmp("a", "b", 0));
124452fb238ccc45781e4e1d097ae1ee748c898b5825Kostya Serebryany  EXPECT_EQ(0, memcmp("ab\0c", "ab\0c", 4));
124552fb238ccc45781e4e1d097ae1ee748c898b5825Kostya Serebryany  EXPECT_GT(0, memcmp("\0ab", "\0ac", 3));
124652fb238ccc45781e4e1d097ae1ee748c898b5825Kostya Serebryany  EXPECT_GT(0, memcmp("abb\0", "abba", 4));
124752fb238ccc45781e4e1d097ae1ee748c898b5825Kostya Serebryany  EXPECT_LT(0, memcmp("ab\0cd", "ab\0c\0", 5));
124852fb238ccc45781e4e1d097ae1ee748c898b5825Kostya Serebryany  EXPECT_LT(0, memcmp("zza", "zyx", 3));
1249af0f01d77c2a495f023ffbf6cce85b33bbd2306dKostya Serebryany}
1250af0f01d77c2a495f023ffbf6cce85b33bbd2306dKostya Serebryany
1251af0f01d77c2a495f023ffbf6cce85b33bbd2306dKostya Serebryanytypedef int(*PointerToStrCmp)(const char*, const char*);
1252af0f01d77c2a495f023ffbf6cce85b33bbd2306dKostya Serebryanyvoid RunStrCmpTest(PointerToStrCmp StrCmp) {
12531e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  size_t size = Ident(100);
12541e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  char *s1 = MallocAndMemsetString(size);
12551e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  char *s2 = MallocAndMemsetString(size);
12561e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  s1[size - 1] = '\0';
12571e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  s2[size - 1] = '\0';
1258af0f01d77c2a495f023ffbf6cce85b33bbd2306dKostya Serebryany  // Normal StrCmp calls
1259af0f01d77c2a495f023ffbf6cce85b33bbd2306dKostya Serebryany  Ident(StrCmp(s1, s2));
1260af0f01d77c2a495f023ffbf6cce85b33bbd2306dKostya Serebryany  Ident(StrCmp(s1, s2 + size - 1));
1261af0f01d77c2a495f023ffbf6cce85b33bbd2306dKostya Serebryany  Ident(StrCmp(s1 + size - 1, s2 + size - 1));
12621e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  s1[size - 1] = 'z';
12631e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  s2[size - 1] = 'x';
1264af0f01d77c2a495f023ffbf6cce85b33bbd2306dKostya Serebryany  Ident(StrCmp(s1, s2));
12651e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  // One of arguments points to not allocated memory.
1266ef8dfd8dffbf4385baf24e5aaea6c2cc7c6c936aAlexander Potapenko  EXPECT_DEATH(Ident(StrCmp)(s1 - 1, s2), LeftOOBReadMessage(1));
1267ef8dfd8dffbf4385baf24e5aaea6c2cc7c6c936aAlexander Potapenko  EXPECT_DEATH(Ident(StrCmp)(s1, s2 - 1), LeftOOBReadMessage(1));
1268ef8dfd8dffbf4385baf24e5aaea6c2cc7c6c936aAlexander Potapenko  EXPECT_DEATH(Ident(StrCmp)(s1 + size, s2), RightOOBReadMessage(0));
1269ef8dfd8dffbf4385baf24e5aaea6c2cc7c6c936aAlexander Potapenko  EXPECT_DEATH(Ident(StrCmp)(s1, s2 + size), RightOOBReadMessage(0));
12701e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  // Hit unallocated memory and die.
12711e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  s2[size - 1] = 'z';
1272ef8dfd8dffbf4385baf24e5aaea6c2cc7c6c936aAlexander Potapenko  EXPECT_DEATH(Ident(StrCmp)(s1, s1), RightOOBReadMessage(0));
1273ef8dfd8dffbf4385baf24e5aaea6c2cc7c6c936aAlexander Potapenko  EXPECT_DEATH(Ident(StrCmp)(s1 + size - 1, s2), RightOOBReadMessage(0));
12741e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  free(s1);
12751e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  free(s2);
12761e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany}
12771e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
1278af0f01d77c2a495f023ffbf6cce85b33bbd2306dKostya SerebryanyTEST(AddressSanitizer, StrCmpOOBTest) {
1279af0f01d77c2a495f023ffbf6cce85b33bbd2306dKostya Serebryany  RunStrCmpTest(&strcmp);
1280af0f01d77c2a495f023ffbf6cce85b33bbd2306dKostya Serebryany}
1281af0f01d77c2a495f023ffbf6cce85b33bbd2306dKostya Serebryany
1282af0f01d77c2a495f023ffbf6cce85b33bbd2306dKostya SerebryanyTEST(AddressSanitizer, StrCaseCmpOOBTest) {
1283af0f01d77c2a495f023ffbf6cce85b33bbd2306dKostya Serebryany  RunStrCmpTest(&strcasecmp);
1284af0f01d77c2a495f023ffbf6cce85b33bbd2306dKostya Serebryany}
1285af0f01d77c2a495f023ffbf6cce85b33bbd2306dKostya Serebryany
1286af0f01d77c2a495f023ffbf6cce85b33bbd2306dKostya Serebryanytypedef int(*PointerToStrNCmp)(const char*, const char*, size_t);
1287af0f01d77c2a495f023ffbf6cce85b33bbd2306dKostya Serebryanyvoid RunStrNCmpTest(PointerToStrNCmp StrNCmp) {
12881e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  size_t size = Ident(100);
12891e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  char *s1 = MallocAndMemsetString(size);
12901e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  char *s2 = MallocAndMemsetString(size);
12911e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  s1[size - 1] = '\0';
12921e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  s2[size - 1] = '\0';
1293af0f01d77c2a495f023ffbf6cce85b33bbd2306dKostya Serebryany  // Normal StrNCmp calls
1294af0f01d77c2a495f023ffbf6cce85b33bbd2306dKostya Serebryany  Ident(StrNCmp(s1, s2, size + 2));
12951e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  s1[size - 1] = 'z';
12961e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  s2[size - 1] = 'x';
1297af0f01d77c2a495f023ffbf6cce85b33bbd2306dKostya Serebryany  Ident(StrNCmp(s1 + size - 2, s2 + size - 2, size));
12981e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  s2[size - 1] = 'z';
1299af0f01d77c2a495f023ffbf6cce85b33bbd2306dKostya Serebryany  Ident(StrNCmp(s1 - 1, s2 - 1, 0));
1300af0f01d77c2a495f023ffbf6cce85b33bbd2306dKostya Serebryany  Ident(StrNCmp(s1 + size - 1, s2 + size - 1, 1));
13011e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  // One of arguments points to not allocated memory.
1302ef8dfd8dffbf4385baf24e5aaea6c2cc7c6c936aAlexander Potapenko  EXPECT_DEATH(Ident(StrNCmp)(s1 - 1, s2, 1), LeftOOBReadMessage(1));
1303ef8dfd8dffbf4385baf24e5aaea6c2cc7c6c936aAlexander Potapenko  EXPECT_DEATH(Ident(StrNCmp)(s1, s2 - 1, 1), LeftOOBReadMessage(1));
1304ef8dfd8dffbf4385baf24e5aaea6c2cc7c6c936aAlexander Potapenko  EXPECT_DEATH(Ident(StrNCmp)(s1 + size, s2, 1), RightOOBReadMessage(0));
1305ef8dfd8dffbf4385baf24e5aaea6c2cc7c6c936aAlexander Potapenko  EXPECT_DEATH(Ident(StrNCmp)(s1, s2 + size, 1), RightOOBReadMessage(0));
13061e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  // Hit unallocated memory and die.
1307ef8dfd8dffbf4385baf24e5aaea6c2cc7c6c936aAlexander Potapenko  EXPECT_DEATH(Ident(StrNCmp)(s1 + 1, s2 + 1, size), RightOOBReadMessage(0));
1308ef8dfd8dffbf4385baf24e5aaea6c2cc7c6c936aAlexander Potapenko  EXPECT_DEATH(Ident(StrNCmp)(s1 + size - 1, s2, 2), RightOOBReadMessage(0));
13091e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  free(s1);
13101e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  free(s2);
13111e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany}
13121e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
1313af0f01d77c2a495f023ffbf6cce85b33bbd2306dKostya SerebryanyTEST(AddressSanitizer, StrNCmpOOBTest) {
1314af0f01d77c2a495f023ffbf6cce85b33bbd2306dKostya Serebryany  RunStrNCmpTest(&strncmp);
1315af0f01d77c2a495f023ffbf6cce85b33bbd2306dKostya Serebryany}
1316af0f01d77c2a495f023ffbf6cce85b33bbd2306dKostya Serebryany
1317af0f01d77c2a495f023ffbf6cce85b33bbd2306dKostya SerebryanyTEST(AddressSanitizer, StrNCaseCmpOOBTest) {
1318af0f01d77c2a495f023ffbf6cce85b33bbd2306dKostya Serebryany  RunStrNCmpTest(&strncasecmp);
1319af0f01d77c2a495f023ffbf6cce85b33bbd2306dKostya Serebryany}
1320af0f01d77c2a495f023ffbf6cce85b33bbd2306dKostya Serebryany
132152fb238ccc45781e4e1d097ae1ee748c898b5825Kostya SerebryanyTEST(AddressSanitizer, MemCmpOOBTest) {
132252fb238ccc45781e4e1d097ae1ee748c898b5825Kostya Serebryany  size_t size = Ident(100);
132352fb238ccc45781e4e1d097ae1ee748c898b5825Kostya Serebryany  char *s1 = MallocAndMemsetString(size);
132452fb238ccc45781e4e1d097ae1ee748c898b5825Kostya Serebryany  char *s2 = MallocAndMemsetString(size);
132552fb238ccc45781e4e1d097ae1ee748c898b5825Kostya Serebryany  // Normal memcmp calls.
132652fb238ccc45781e4e1d097ae1ee748c898b5825Kostya Serebryany  Ident(memcmp(s1, s2, size));
132752fb238ccc45781e4e1d097ae1ee748c898b5825Kostya Serebryany  Ident(memcmp(s1 + size - 1, s2 + size - 1, 1));
132852fb238ccc45781e4e1d097ae1ee748c898b5825Kostya Serebryany  Ident(memcmp(s1 - 1, s2 - 1, 0));
132952fb238ccc45781e4e1d097ae1ee748c898b5825Kostya Serebryany  // One of arguments points to not allocated memory.
1330ef8dfd8dffbf4385baf24e5aaea6c2cc7c6c936aAlexander Potapenko  EXPECT_DEATH(Ident(memcmp)(s1 - 1, s2, 1), LeftOOBReadMessage(1));
1331ef8dfd8dffbf4385baf24e5aaea6c2cc7c6c936aAlexander Potapenko  EXPECT_DEATH(Ident(memcmp)(s1, s2 - 1, 1), LeftOOBReadMessage(1));
1332ef8dfd8dffbf4385baf24e5aaea6c2cc7c6c936aAlexander Potapenko  EXPECT_DEATH(Ident(memcmp)(s1 + size, s2, 1), RightOOBReadMessage(0));
1333ef8dfd8dffbf4385baf24e5aaea6c2cc7c6c936aAlexander Potapenko  EXPECT_DEATH(Ident(memcmp)(s1, s2 + size, 1), RightOOBReadMessage(0));
133452fb238ccc45781e4e1d097ae1ee748c898b5825Kostya Serebryany  // Hit unallocated memory and die.
1335ef8dfd8dffbf4385baf24e5aaea6c2cc7c6c936aAlexander Potapenko  EXPECT_DEATH(Ident(memcmp)(s1 + 1, s2 + 1, size), RightOOBReadMessage(0));
1336ef8dfd8dffbf4385baf24e5aaea6c2cc7c6c936aAlexander Potapenko  EXPECT_DEATH(Ident(memcmp)(s1 + size - 1, s2, 2), RightOOBReadMessage(0));
133752fb238ccc45781e4e1d097ae1ee748c898b5825Kostya Serebryany  // Zero bytes are not terminators and don't prevent from OOB.
133852fb238ccc45781e4e1d097ae1ee748c898b5825Kostya Serebryany  s1[size - 1] = '\0';
133952fb238ccc45781e4e1d097ae1ee748c898b5825Kostya Serebryany  s2[size - 1] = '\0';
1340ef8dfd8dffbf4385baf24e5aaea6c2cc7c6c936aAlexander Potapenko  EXPECT_DEATH(Ident(memcmp)(s1, s2, size + 1), RightOOBReadMessage(0));
134152fb238ccc45781e4e1d097ae1ee748c898b5825Kostya Serebryany  free(s1);
134252fb238ccc45781e4e1d097ae1ee748c898b5825Kostya Serebryany  free(s2);
134352fb238ccc45781e4e1d097ae1ee748c898b5825Kostya Serebryany}
134452fb238ccc45781e4e1d097ae1ee748c898b5825Kostya Serebryany
13450985ca240812ac5519168a6aecbccf4c513ae243Kostya SerebryanyTEST(AddressSanitizer, StrCatOOBTest) {
1346ada9ba14325df9e206f454c50bd1b55ea9ecdbb9Alexander Potapenko  // strcat() reads strlen(to) bytes from |to| before concatenating.
13470985ca240812ac5519168a6aecbccf4c513ae243Kostya Serebryany  size_t to_size = Ident(100);
13480985ca240812ac5519168a6aecbccf4c513ae243Kostya Serebryany  char *to = MallocAndMemsetString(to_size);
13490985ca240812ac5519168a6aecbccf4c513ae243Kostya Serebryany  to[0] = '\0';
13500985ca240812ac5519168a6aecbccf4c513ae243Kostya Serebryany  size_t from_size = Ident(20);
13510985ca240812ac5519168a6aecbccf4c513ae243Kostya Serebryany  char *from = MallocAndMemsetString(from_size);
13520985ca240812ac5519168a6aecbccf4c513ae243Kostya Serebryany  from[from_size - 1] = '\0';
13530985ca240812ac5519168a6aecbccf4c513ae243Kostya Serebryany  // Normal strcat calls.
13540985ca240812ac5519168a6aecbccf4c513ae243Kostya Serebryany  strcat(to, from);
13550985ca240812ac5519168a6aecbccf4c513ae243Kostya Serebryany  strcat(to, from);
13560985ca240812ac5519168a6aecbccf4c513ae243Kostya Serebryany  strcat(to + from_size, from + from_size - 2);
135737b3fcd6fdec5740fe51fc1315c5d4d54313de98Alexander Potapenko  // Passing an invalid pointer is an error even when concatenating an empty
135837b3fcd6fdec5740fe51fc1315c5d4d54313de98Alexander Potapenko  // string.
1359ada9ba14325df9e206f454c50bd1b55ea9ecdbb9Alexander Potapenko  EXPECT_DEATH(strcat(to - 1, from + from_size - 1), LeftOOBAccessMessage(1));
13600985ca240812ac5519168a6aecbccf4c513ae243Kostya Serebryany  // One of arguments points to not allocated memory.
1361ada9ba14325df9e206f454c50bd1b55ea9ecdbb9Alexander Potapenko  EXPECT_DEATH(strcat(to - 1, from), LeftOOBAccessMessage(1));
1362ef8dfd8dffbf4385baf24e5aaea6c2cc7c6c936aAlexander Potapenko  EXPECT_DEATH(strcat(to, from - 1), LeftOOBReadMessage(1));
1363ef8dfd8dffbf4385baf24e5aaea6c2cc7c6c936aAlexander Potapenko  EXPECT_DEATH(strcat(to + to_size, from), RightOOBWriteMessage(0));
1364ef8dfd8dffbf4385baf24e5aaea6c2cc7c6c936aAlexander Potapenko  EXPECT_DEATH(strcat(to, from + from_size), RightOOBReadMessage(0));
13650985ca240812ac5519168a6aecbccf4c513ae243Kostya Serebryany
13660985ca240812ac5519168a6aecbccf4c513ae243Kostya Serebryany  // "from" is not zero-terminated.
13670985ca240812ac5519168a6aecbccf4c513ae243Kostya Serebryany  from[from_size - 1] = 'z';
1368ef8dfd8dffbf4385baf24e5aaea6c2cc7c6c936aAlexander Potapenko  EXPECT_DEATH(strcat(to, from), RightOOBReadMessage(0));
13690985ca240812ac5519168a6aecbccf4c513ae243Kostya Serebryany  from[from_size - 1] = '\0';
13700985ca240812ac5519168a6aecbccf4c513ae243Kostya Serebryany  // "to" is not zero-terminated.
13710985ca240812ac5519168a6aecbccf4c513ae243Kostya Serebryany  memset(to, 'z', to_size);
1372ef8dfd8dffbf4385baf24e5aaea6c2cc7c6c936aAlexander Potapenko  EXPECT_DEATH(strcat(to, from), RightOOBWriteMessage(0));
13730985ca240812ac5519168a6aecbccf4c513ae243Kostya Serebryany  // "to" is too short to fit "from".
13740985ca240812ac5519168a6aecbccf4c513ae243Kostya Serebryany  to[to_size - from_size + 1] = '\0';
1375ef8dfd8dffbf4385baf24e5aaea6c2cc7c6c936aAlexander Potapenko  EXPECT_DEATH(strcat(to, from), RightOOBWriteMessage(0));
13760985ca240812ac5519168a6aecbccf4c513ae243Kostya Serebryany  // length of "to" is just enough.
13770985ca240812ac5519168a6aecbccf4c513ae243Kostya Serebryany  strcat(to, from + 1);
1378c1bdd5adca453f2fae238a4c53ade35ae60b85daAlexey Samsonov
1379c1bdd5adca453f2fae238a4c53ade35ae60b85daAlexey Samsonov  free(to);
1380c1bdd5adca453f2fae238a4c53ade35ae60b85daAlexey Samsonov  free(from);
1381c1bdd5adca453f2fae238a4c53ade35ae60b85daAlexey Samsonov}
1382c1bdd5adca453f2fae238a4c53ade35ae60b85daAlexey Samsonov
1383c1bdd5adca453f2fae238a4c53ade35ae60b85daAlexey SamsonovTEST(AddressSanitizer, StrNCatOOBTest) {
1384ada9ba14325df9e206f454c50bd1b55ea9ecdbb9Alexander Potapenko  // strncat() reads strlen(to) bytes from |to| before concatenating.
1385c1bdd5adca453f2fae238a4c53ade35ae60b85daAlexey Samsonov  size_t to_size = Ident(100);
1386c1bdd5adca453f2fae238a4c53ade35ae60b85daAlexey Samsonov  char *to = MallocAndMemsetString(to_size);
1387c1bdd5adca453f2fae238a4c53ade35ae60b85daAlexey Samsonov  to[0] = '\0';
1388c1bdd5adca453f2fae238a4c53ade35ae60b85daAlexey Samsonov  size_t from_size = Ident(20);
1389c1bdd5adca453f2fae238a4c53ade35ae60b85daAlexey Samsonov  char *from = MallocAndMemsetString(from_size);
1390c1bdd5adca453f2fae238a4c53ade35ae60b85daAlexey Samsonov  // Normal strncat calls.
1391c1bdd5adca453f2fae238a4c53ade35ae60b85daAlexey Samsonov  strncat(to, from, 0);
1392c1bdd5adca453f2fae238a4c53ade35ae60b85daAlexey Samsonov  strncat(to, from, from_size);
1393c1bdd5adca453f2fae238a4c53ade35ae60b85daAlexey Samsonov  from[from_size - 1] = '\0';
1394c1bdd5adca453f2fae238a4c53ade35ae60b85daAlexey Samsonov  strncat(to, from, 2 * from_size);
139537b3fcd6fdec5740fe51fc1315c5d4d54313de98Alexander Potapenko  // Catenating empty string with an invalid string is still an error.
1396ada9ba14325df9e206f454c50bd1b55ea9ecdbb9Alexander Potapenko  EXPECT_DEATH(strncat(to - 1, from, 0), LeftOOBAccessMessage(1));
1397c1bdd5adca453f2fae238a4c53ade35ae60b85daAlexey Samsonov  strncat(to, from + from_size - 1, 10);
1398c1bdd5adca453f2fae238a4c53ade35ae60b85daAlexey Samsonov  // One of arguments points to not allocated memory.
1399ada9ba14325df9e206f454c50bd1b55ea9ecdbb9Alexander Potapenko  EXPECT_DEATH(strncat(to - 1, from, 2), LeftOOBAccessMessage(1));
1400ef8dfd8dffbf4385baf24e5aaea6c2cc7c6c936aAlexander Potapenko  EXPECT_DEATH(strncat(to, from - 1, 2), LeftOOBReadMessage(1));
1401ef8dfd8dffbf4385baf24e5aaea6c2cc7c6c936aAlexander Potapenko  EXPECT_DEATH(strncat(to + to_size, from, 2), RightOOBWriteMessage(0));
1402ef8dfd8dffbf4385baf24e5aaea6c2cc7c6c936aAlexander Potapenko  EXPECT_DEATH(strncat(to, from + from_size, 2), RightOOBReadMessage(0));
1403c1bdd5adca453f2fae238a4c53ade35ae60b85daAlexey Samsonov
1404c1bdd5adca453f2fae238a4c53ade35ae60b85daAlexey Samsonov  memset(from, 'z', from_size);
1405c1bdd5adca453f2fae238a4c53ade35ae60b85daAlexey Samsonov  memset(to, 'z', to_size);
1406c1bdd5adca453f2fae238a4c53ade35ae60b85daAlexey Samsonov  to[0] = '\0';
1407c1bdd5adca453f2fae238a4c53ade35ae60b85daAlexey Samsonov  // "from" is too short.
1408ef8dfd8dffbf4385baf24e5aaea6c2cc7c6c936aAlexander Potapenko  EXPECT_DEATH(strncat(to, from, from_size + 1), RightOOBReadMessage(0));
1409c1bdd5adca453f2fae238a4c53ade35ae60b85daAlexey Samsonov  // "to" is not zero-terminated.
1410ef8dfd8dffbf4385baf24e5aaea6c2cc7c6c936aAlexander Potapenko  EXPECT_DEATH(strncat(to + 1, from, 1), RightOOBWriteMessage(0));
1411c1bdd5adca453f2fae238a4c53ade35ae60b85daAlexey Samsonov  // "to" is too short to fit "from".
1412c1bdd5adca453f2fae238a4c53ade35ae60b85daAlexey Samsonov  to[0] = 'z';
1413c1bdd5adca453f2fae238a4c53ade35ae60b85daAlexey Samsonov  to[to_size - from_size + 1] = '\0';
1414ef8dfd8dffbf4385baf24e5aaea6c2cc7c6c936aAlexander Potapenko  EXPECT_DEATH(strncat(to, from, from_size - 1), RightOOBWriteMessage(0));
1415c1bdd5adca453f2fae238a4c53ade35ae60b85daAlexey Samsonov  // "to" is just enough.
1416c1bdd5adca453f2fae238a4c53ade35ae60b85daAlexey Samsonov  strncat(to, from, from_size - 2);
1417c1bdd5adca453f2fae238a4c53ade35ae60b85daAlexey Samsonov
1418c1bdd5adca453f2fae238a4c53ade35ae60b85daAlexey Samsonov  free(to);
1419c1bdd5adca453f2fae238a4c53ade35ae60b85daAlexey Samsonov  free(from);
14200985ca240812ac5519168a6aecbccf4c513ae243Kostya Serebryany}
14210985ca240812ac5519168a6aecbccf4c513ae243Kostya Serebryany
1422c5e72a3b7c60f1b2d9d9be3a07d397d5b5f872beKostya Serebryanystatic string OverlapErrorMessage(const string &func) {
1423c5e72a3b7c60f1b2d9d9be3a07d397d5b5f872beKostya Serebryany  return func + "-param-overlap";
1424c5e72a3b7c60f1b2d9d9be3a07d397d5b5f872beKostya Serebryany}
14251e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
14261e172b4bdec57329bf904f063a29f99cddf2d85fKostya SerebryanyTEST(AddressSanitizer, StrArgsOverlapTest) {
14271e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  size_t size = Ident(100);
14281e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  char *str = Ident((char*)malloc(size));
14291e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
14300503ce8824393174c17acb26d62551f18a0fd82aAlexander Potapenko// Do not check memcpy() on OS X 10.7 and later, where it actually aliases
14310503ce8824393174c17acb26d62551f18a0fd82aAlexander Potapenko// memmove().
14320503ce8824393174c17acb26d62551f18a0fd82aAlexander Potapenko#if !defined(__APPLE__) || !defined(MAC_OS_X_VERSION_10_7) || \
14330503ce8824393174c17acb26d62551f18a0fd82aAlexander Potapenko    (MAC_OS_X_VERSION_MAX_ALLOWED < MAC_OS_X_VERSION_10_7)
14341e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  // Check "memcpy". Use Ident() to avoid inlining.
14351e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  memset(str, 'z', size);
14361e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  Ident(memcpy)(str + 1, str + 11, 10);
14371e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  Ident(memcpy)(str, str, 0);
1438c5e72a3b7c60f1b2d9d9be3a07d397d5b5f872beKostya Serebryany  EXPECT_DEATH(Ident(memcpy)(str, str + 14, 15), OverlapErrorMessage("memcpy"));
1439c5e72a3b7c60f1b2d9d9be3a07d397d5b5f872beKostya Serebryany  EXPECT_DEATH(Ident(memcpy)(str + 14, str, 15), OverlapErrorMessage("memcpy"));
14400503ce8824393174c17acb26d62551f18a0fd82aAlexander Potapenko#endif
1441c655cfa8dc0fdf5b521e565f6cbdbf7981fba1b2Kostya Serebryany
1442c655cfa8dc0fdf5b521e565f6cbdbf7981fba1b2Kostya Serebryany  // We do not treat memcpy with to==from as a bug.
1443c655cfa8dc0fdf5b521e565f6cbdbf7981fba1b2Kostya Serebryany  // See http://llvm.org/bugs/show_bug.cgi?id=11763.
1444c655cfa8dc0fdf5b521e565f6cbdbf7981fba1b2Kostya Serebryany  // EXPECT_DEATH(Ident(memcpy)(str + 20, str + 20, 1),
1445c655cfa8dc0fdf5b521e565f6cbdbf7981fba1b2Kostya Serebryany  //              OverlapErrorMessage("memcpy"));
14461e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
14471e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  // Check "strcpy".
14481e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  memset(str, 'z', size);
14491e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  str[9] = '\0';
14501e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  strcpy(str + 10, str);
1451c5e72a3b7c60f1b2d9d9be3a07d397d5b5f872beKostya Serebryany  EXPECT_DEATH(strcpy(str + 9, str), OverlapErrorMessage("strcpy"));
1452c5e72a3b7c60f1b2d9d9be3a07d397d5b5f872beKostya Serebryany  EXPECT_DEATH(strcpy(str, str + 4), OverlapErrorMessage("strcpy"));
14531e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  strcpy(str, str + 5);
14541e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
14551e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  // Check "strncpy".
14561e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  memset(str, 'z', size);
14571e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  strncpy(str, str + 10, 10);
1458c5e72a3b7c60f1b2d9d9be3a07d397d5b5f872beKostya Serebryany  EXPECT_DEATH(strncpy(str, str + 9, 10), OverlapErrorMessage("strncpy"));
1459c5e72a3b7c60f1b2d9d9be3a07d397d5b5f872beKostya Serebryany  EXPECT_DEATH(strncpy(str + 9, str, 10), OverlapErrorMessage("strncpy"));
14601e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  str[10] = '\0';
14611e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  strncpy(str + 11, str, 20);
1462c5e72a3b7c60f1b2d9d9be3a07d397d5b5f872beKostya Serebryany  EXPECT_DEATH(strncpy(str + 10, str, 20), OverlapErrorMessage("strncpy"));
14631e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
14640985ca240812ac5519168a6aecbccf4c513ae243Kostya Serebryany  // Check "strcat".
14650985ca240812ac5519168a6aecbccf4c513ae243Kostya Serebryany  memset(str, 'z', size);
14660985ca240812ac5519168a6aecbccf4c513ae243Kostya Serebryany  str[10] = '\0';
14670985ca240812ac5519168a6aecbccf4c513ae243Kostya Serebryany  str[20] = '\0';
14680985ca240812ac5519168a6aecbccf4c513ae243Kostya Serebryany  strcat(str, str + 10);
146937b3fcd6fdec5740fe51fc1315c5d4d54313de98Alexander Potapenko  EXPECT_DEATH(strcat(str, str + 11), OverlapErrorMessage("strcat"));
14700985ca240812ac5519168a6aecbccf4c513ae243Kostya Serebryany  str[10] = '\0';
14710985ca240812ac5519168a6aecbccf4c513ae243Kostya Serebryany  strcat(str + 11, str);
1472c5e72a3b7c60f1b2d9d9be3a07d397d5b5f872beKostya Serebryany  EXPECT_DEATH(strcat(str, str + 9), OverlapErrorMessage("strcat"));
1473c5e72a3b7c60f1b2d9d9be3a07d397d5b5f872beKostya Serebryany  EXPECT_DEATH(strcat(str + 9, str), OverlapErrorMessage("strcat"));
1474c5e72a3b7c60f1b2d9d9be3a07d397d5b5f872beKostya Serebryany  EXPECT_DEATH(strcat(str + 10, str), OverlapErrorMessage("strcat"));
14750985ca240812ac5519168a6aecbccf4c513ae243Kostya Serebryany
1476c1bdd5adca453f2fae238a4c53ade35ae60b85daAlexey Samsonov  // Check "strncat".
1477c1bdd5adca453f2fae238a4c53ade35ae60b85daAlexey Samsonov  memset(str, 'z', size);
1478c1bdd5adca453f2fae238a4c53ade35ae60b85daAlexey Samsonov  str[10] = '\0';
1479c1bdd5adca453f2fae238a4c53ade35ae60b85daAlexey Samsonov  strncat(str, str + 10, 10);  // from is empty
148037b3fcd6fdec5740fe51fc1315c5d4d54313de98Alexander Potapenko  EXPECT_DEATH(strncat(str, str + 11, 10), OverlapErrorMessage("strncat"));
1481c1bdd5adca453f2fae238a4c53ade35ae60b85daAlexey Samsonov  str[10] = '\0';
1482c1bdd5adca453f2fae238a4c53ade35ae60b85daAlexey Samsonov  str[20] = '\0';
1483c1bdd5adca453f2fae238a4c53ade35ae60b85daAlexey Samsonov  strncat(str + 5, str, 5);
1484c1bdd5adca453f2fae238a4c53ade35ae60b85daAlexey Samsonov  str[10] = '\0';
1485c1bdd5adca453f2fae238a4c53ade35ae60b85daAlexey Samsonov  EXPECT_DEATH(strncat(str + 5, str, 6), OverlapErrorMessage("strncat"));
1486c1bdd5adca453f2fae238a4c53ade35ae60b85daAlexey Samsonov  EXPECT_DEATH(strncat(str, str + 9, 10), OverlapErrorMessage("strncat"));
1487c1bdd5adca453f2fae238a4c53ade35ae60b85daAlexey Samsonov
14881e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  free(str);
14891e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany}
14901e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
1491847f932ab0405757946433b81d3b2952b306b0bcAlexey Samsonovvoid CallAtoi(const char *nptr) {
1492847f932ab0405757946433b81d3b2952b306b0bcAlexey Samsonov  Ident(atoi(nptr));
1493847f932ab0405757946433b81d3b2952b306b0bcAlexey Samsonov}
1494847f932ab0405757946433b81d3b2952b306b0bcAlexey Samsonovvoid CallAtol(const char *nptr) {
1495847f932ab0405757946433b81d3b2952b306b0bcAlexey Samsonov  Ident(atol(nptr));
1496847f932ab0405757946433b81d3b2952b306b0bcAlexey Samsonov}
1497847f932ab0405757946433b81d3b2952b306b0bcAlexey Samsonovvoid CallAtoll(const char *nptr) {
1498847f932ab0405757946433b81d3b2952b306b0bcAlexey Samsonov  Ident(atoll(nptr));
1499847f932ab0405757946433b81d3b2952b306b0bcAlexey Samsonov}
1500847f932ab0405757946433b81d3b2952b306b0bcAlexey Samsonovtypedef void(*PointerToCallAtoi)(const char*);
1501847f932ab0405757946433b81d3b2952b306b0bcAlexey Samsonov
1502847f932ab0405757946433b81d3b2952b306b0bcAlexey Samsonovvoid RunAtoiOOBTest(PointerToCallAtoi Atoi) {
1503847f932ab0405757946433b81d3b2952b306b0bcAlexey Samsonov  char *array = MallocAndMemsetString(10, '1');
1504847f932ab0405757946433b81d3b2952b306b0bcAlexey Samsonov  // Invalid pointer to the string.
1505ef8dfd8dffbf4385baf24e5aaea6c2cc7c6c936aAlexander Potapenko  EXPECT_DEATH(Atoi(array + 11), RightOOBReadMessage(1));
1506ef8dfd8dffbf4385baf24e5aaea6c2cc7c6c936aAlexander Potapenko  EXPECT_DEATH(Atoi(array - 1), LeftOOBReadMessage(1));
1507847f932ab0405757946433b81d3b2952b306b0bcAlexey Samsonov  // Die if a buffer doesn't have terminating NULL.
1508ef8dfd8dffbf4385baf24e5aaea6c2cc7c6c936aAlexander Potapenko  EXPECT_DEATH(Atoi(array), RightOOBReadMessage(0));
1509847f932ab0405757946433b81d3b2952b306b0bcAlexey Samsonov  // Make last symbol a terminating NULL or other non-digit.
1510847f932ab0405757946433b81d3b2952b306b0bcAlexey Samsonov  array[9] = '\0';
1511847f932ab0405757946433b81d3b2952b306b0bcAlexey Samsonov  Atoi(array);
1512847f932ab0405757946433b81d3b2952b306b0bcAlexey Samsonov  array[9] = 'a';
1513847f932ab0405757946433b81d3b2952b306b0bcAlexey Samsonov  Atoi(array);
1514847f932ab0405757946433b81d3b2952b306b0bcAlexey Samsonov  Atoi(array + 9);
1515847f932ab0405757946433b81d3b2952b306b0bcAlexey Samsonov  // Sometimes we need to detect overflow if no digits are found.
1516847f932ab0405757946433b81d3b2952b306b0bcAlexey Samsonov  memset(array, ' ', 10);
1517ef8dfd8dffbf4385baf24e5aaea6c2cc7c6c936aAlexander Potapenko  EXPECT_DEATH(Atoi(array), RightOOBReadMessage(0));
1518847f932ab0405757946433b81d3b2952b306b0bcAlexey Samsonov  array[9] = '-';
1519ef8dfd8dffbf4385baf24e5aaea6c2cc7c6c936aAlexander Potapenko  EXPECT_DEATH(Atoi(array), RightOOBReadMessage(0));
1520ef8dfd8dffbf4385baf24e5aaea6c2cc7c6c936aAlexander Potapenko  EXPECT_DEATH(Atoi(array + 9), RightOOBReadMessage(0));
1521847f932ab0405757946433b81d3b2952b306b0bcAlexey Samsonov  array[8] = '-';
1522847f932ab0405757946433b81d3b2952b306b0bcAlexey Samsonov  Atoi(array);
1523fe6d91684bcda766593800f6307233f1a33d31f6Kostya Serebryany  free(array);
1524847f932ab0405757946433b81d3b2952b306b0bcAlexey Samsonov}
1525847f932ab0405757946433b81d3b2952b306b0bcAlexey Samsonov
1526847f932ab0405757946433b81d3b2952b306b0bcAlexey SamsonovTEST(AddressSanitizer, AtoiAndFriendsOOBTest) {
1527847f932ab0405757946433b81d3b2952b306b0bcAlexey Samsonov  RunAtoiOOBTest(&CallAtoi);
1528847f932ab0405757946433b81d3b2952b306b0bcAlexey Samsonov  RunAtoiOOBTest(&CallAtol);
1529847f932ab0405757946433b81d3b2952b306b0bcAlexey Samsonov  RunAtoiOOBTest(&CallAtoll);
1530847f932ab0405757946433b81d3b2952b306b0bcAlexey Samsonov}
1531847f932ab0405757946433b81d3b2952b306b0bcAlexey Samsonov
15328f6a77f3f59ebc5f40f235e51836f468f30b9110Alexey Samsonovvoid CallStrtol(const char *nptr, char **endptr, int base) {
15338f6a77f3f59ebc5f40f235e51836f468f30b9110Alexey Samsonov  Ident(strtol(nptr, endptr, base));
15348f6a77f3f59ebc5f40f235e51836f468f30b9110Alexey Samsonov}
15358f6a77f3f59ebc5f40f235e51836f468f30b9110Alexey Samsonovvoid CallStrtoll(const char *nptr, char **endptr, int base) {
15368f6a77f3f59ebc5f40f235e51836f468f30b9110Alexey Samsonov  Ident(strtoll(nptr, endptr, base));
15378f6a77f3f59ebc5f40f235e51836f468f30b9110Alexey Samsonov}
15388f6a77f3f59ebc5f40f235e51836f468f30b9110Alexey Samsonovtypedef void(*PointerToCallStrtol)(const char*, char**, int);
15398f6a77f3f59ebc5f40f235e51836f468f30b9110Alexey Samsonov
15408f6a77f3f59ebc5f40f235e51836f468f30b9110Alexey Samsonovvoid RunStrtolOOBTest(PointerToCallStrtol Strtol) {
154184ba324b94d22a69acc823e845f9718fd2984e44Alexey Samsonov  char *array = MallocAndMemsetString(3);
154284ba324b94d22a69acc823e845f9718fd2984e44Alexey Samsonov  char *endptr = NULL;
154384ba324b94d22a69acc823e845f9718fd2984e44Alexey Samsonov  array[0] = '1';
154484ba324b94d22a69acc823e845f9718fd2984e44Alexey Samsonov  array[1] = '2';
154584ba324b94d22a69acc823e845f9718fd2984e44Alexey Samsonov  array[2] = '3';
154684ba324b94d22a69acc823e845f9718fd2984e44Alexey Samsonov  // Invalid pointer to the string.
1547ef8dfd8dffbf4385baf24e5aaea6c2cc7c6c936aAlexander Potapenko  EXPECT_DEATH(Strtol(array + 3, NULL, 0), RightOOBReadMessage(0));
1548ef8dfd8dffbf4385baf24e5aaea6c2cc7c6c936aAlexander Potapenko  EXPECT_DEATH(Strtol(array - 1, NULL, 0), LeftOOBReadMessage(1));
154984ba324b94d22a69acc823e845f9718fd2984e44Alexey Samsonov  // Buffer overflow if there is no terminating null (depends on base).
15508f6a77f3f59ebc5f40f235e51836f468f30b9110Alexey Samsonov  Strtol(array, &endptr, 3);
155184ba324b94d22a69acc823e845f9718fd2984e44Alexey Samsonov  EXPECT_EQ(array + 2, endptr);
1552ef8dfd8dffbf4385baf24e5aaea6c2cc7c6c936aAlexander Potapenko  EXPECT_DEATH(Strtol(array, NULL, 0), RightOOBReadMessage(0));
155384ba324b94d22a69acc823e845f9718fd2984e44Alexey Samsonov  array[2] = 'z';
15548f6a77f3f59ebc5f40f235e51836f468f30b9110Alexey Samsonov  Strtol(array, &endptr, 35);
155584ba324b94d22a69acc823e845f9718fd2984e44Alexey Samsonov  EXPECT_EQ(array + 2, endptr);
1556ef8dfd8dffbf4385baf24e5aaea6c2cc7c6c936aAlexander Potapenko  EXPECT_DEATH(Strtol(array, NULL, 36), RightOOBReadMessage(0));
155784ba324b94d22a69acc823e845f9718fd2984e44Alexey Samsonov  // Add terminating zero to get rid of overflow.
155884ba324b94d22a69acc823e845f9718fd2984e44Alexey Samsonov  array[2] = '\0';
15598f6a77f3f59ebc5f40f235e51836f468f30b9110Alexey Samsonov  Strtol(array, NULL, 36);
156084ba324b94d22a69acc823e845f9718fd2984e44Alexey Samsonov  // Don't check for overflow if base is invalid.
15618f6a77f3f59ebc5f40f235e51836f468f30b9110Alexey Samsonov  Strtol(array - 1, NULL, -1);
15628f6a77f3f59ebc5f40f235e51836f468f30b9110Alexey Samsonov  Strtol(array + 3, NULL, 1);
156384ba324b94d22a69acc823e845f9718fd2984e44Alexey Samsonov  // Sometimes we need to detect overflow if no digits are found.
156484ba324b94d22a69acc823e845f9718fd2984e44Alexey Samsonov  array[0] = array[1] = array[2] = ' ';
1565ef8dfd8dffbf4385baf24e5aaea6c2cc7c6c936aAlexander Potapenko  EXPECT_DEATH(Strtol(array, NULL, 0), RightOOBReadMessage(0));
156684ba324b94d22a69acc823e845f9718fd2984e44Alexey Samsonov  array[2] = '+';
1567ef8dfd8dffbf4385baf24e5aaea6c2cc7c6c936aAlexander Potapenko  EXPECT_DEATH(Strtol(array, NULL, 0), RightOOBReadMessage(0));
156884ba324b94d22a69acc823e845f9718fd2984e44Alexey Samsonov  array[2] = '-';
1569ef8dfd8dffbf4385baf24e5aaea6c2cc7c6c936aAlexander Potapenko  EXPECT_DEATH(Strtol(array, NULL, 0), RightOOBReadMessage(0));
157084ba324b94d22a69acc823e845f9718fd2984e44Alexey Samsonov  array[1] = '+';
15718f6a77f3f59ebc5f40f235e51836f468f30b9110Alexey Samsonov  Strtol(array, NULL, 0);
157284ba324b94d22a69acc823e845f9718fd2984e44Alexey Samsonov  array[1] = array[2] = 'z';
15738f6a77f3f59ebc5f40f235e51836f468f30b9110Alexey Samsonov  Strtol(array, &endptr, 0);
157484ba324b94d22a69acc823e845f9718fd2984e44Alexey Samsonov  EXPECT_EQ(array, endptr);
15758f6a77f3f59ebc5f40f235e51836f468f30b9110Alexey Samsonov  Strtol(array + 2, NULL, 0);
157684ba324b94d22a69acc823e845f9718fd2984e44Alexey Samsonov  EXPECT_EQ(array, endptr);
1577fe6d91684bcda766593800f6307233f1a33d31f6Kostya Serebryany  free(array);
157884ba324b94d22a69acc823e845f9718fd2984e44Alexey Samsonov}
157984ba324b94d22a69acc823e845f9718fd2984e44Alexey Samsonov
15808f6a77f3f59ebc5f40f235e51836f468f30b9110Alexey SamsonovTEST(AddressSanitizer, StrtollOOBTest) {
15818f6a77f3f59ebc5f40f235e51836f468f30b9110Alexey Samsonov  RunStrtolOOBTest(&CallStrtoll);
15828f6a77f3f59ebc5f40f235e51836f468f30b9110Alexey Samsonov}
15838f6a77f3f59ebc5f40f235e51836f468f30b9110Alexey SamsonovTEST(AddressSanitizer, StrtolOOBTest) {
15848f6a77f3f59ebc5f40f235e51836f468f30b9110Alexey Samsonov  RunStrtolOOBTest(&CallStrtol);
15858f6a77f3f59ebc5f40f235e51836f468f30b9110Alexey Samsonov}
15868f6a77f3f59ebc5f40f235e51836f468f30b9110Alexey Samsonov
15871e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany// At the moment we instrument memcpy/memove/memset calls at compile time so we
15881e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany// can't handle OOB error if these functions are called by pointer, see disabled
15891e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany// MemIntrinsicCallByPointerTest below
15901e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryanytypedef void*(*PointerToMemTransfer)(void*, const void*, size_t);
15911e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryanytypedef void*(*PointerToMemSet)(void*, int, size_t);
15921e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
15931e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryanyvoid CallMemSetByPointer(PointerToMemSet MemSet) {
15941e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  size_t size = Ident(100);
15951e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  char *array = Ident((char*)malloc(size));
1596ef8dfd8dffbf4385baf24e5aaea6c2cc7c6c936aAlexander Potapenko  EXPECT_DEATH(MemSet(array, 0, 101), RightOOBWriteMessage(0));
15971e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  free(array);
15981e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany}
15991e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
16001e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryanyvoid CallMemTransferByPointer(PointerToMemTransfer MemTransfer) {
16011e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  size_t size = Ident(100);
16021e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  char *src = Ident((char*)malloc(size));
16031e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  char *dst = Ident((char*)malloc(size));
1604ef8dfd8dffbf4385baf24e5aaea6c2cc7c6c936aAlexander Potapenko  EXPECT_DEATH(MemTransfer(dst, src, 101), RightOOBWriteMessage(0));
16051e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  free(src);
16061e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  free(dst);
16071e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany}
16081e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
16091e172b4bdec57329bf904f063a29f99cddf2d85fKostya SerebryanyTEST(AddressSanitizer, DISABLED_MemIntrinsicCallByPointerTest) {
16101e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  CallMemSetByPointer(&memset);
16111e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  CallMemTransferByPointer(&memcpy);
16121e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  CallMemTransferByPointer(&memmove);
16131e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany}
16141e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
1615c311105fd64219bb96b6467c3707ebda355be87bKostya Serebryany#if defined(__linux__) && !defined(ANDROID) && !defined(__ANDROID__)
16168530e2b953f0b34ecd267a6aba5f155d5c08c5c8Kostya SerebryanyTEST(AddressSanitizer, pread) {
16176e6a7cfe0aac66eeefdf36dec78d7c536bff3c90Kostya Serebryany  char *x = new char[10];
16188530e2b953f0b34ecd267a6aba5f155d5c08c5c8Kostya Serebryany  int fd = open("/proc/self/stat", O_RDONLY);
16198530e2b953f0b34ecd267a6aba5f155d5c08c5c8Kostya Serebryany  ASSERT_GT(fd, 0);
16208530e2b953f0b34ecd267a6aba5f155d5c08c5c8Kostya Serebryany  EXPECT_DEATH(pread(fd, x, 15, 0),
16218530e2b953f0b34ecd267a6aba5f155d5c08c5c8Kostya Serebryany               ASAN_PCRE_DOTALL
16228530e2b953f0b34ecd267a6aba5f155d5c08c5c8Kostya Serebryany               "AddressSanitizer: heap-buffer-overflow"
16238530e2b953f0b34ecd267a6aba5f155d5c08c5c8Kostya Serebryany               ".* is located 4 bytes to the right of 10-byte region");
16248530e2b953f0b34ecd267a6aba5f155d5c08c5c8Kostya Serebryany  close(fd);
1625fe6d91684bcda766593800f6307233f1a33d31f6Kostya Serebryany  delete [] x;
16268530e2b953f0b34ecd267a6aba5f155d5c08c5c8Kostya Serebryany}
16278530e2b953f0b34ecd267a6aba5f155d5c08c5c8Kostya Serebryany
16288530e2b953f0b34ecd267a6aba5f155d5c08c5c8Kostya SerebryanyTEST(AddressSanitizer, pread64) {
16296e6a7cfe0aac66eeefdf36dec78d7c536bff3c90Kostya Serebryany  char *x = new char[10];
16308530e2b953f0b34ecd267a6aba5f155d5c08c5c8Kostya Serebryany  int fd = open("/proc/self/stat", O_RDONLY);
16318530e2b953f0b34ecd267a6aba5f155d5c08c5c8Kostya Serebryany  ASSERT_GT(fd, 0);
16328530e2b953f0b34ecd267a6aba5f155d5c08c5c8Kostya Serebryany  EXPECT_DEATH(pread64(fd, x, 15, 0),
16338530e2b953f0b34ecd267a6aba5f155d5c08c5c8Kostya Serebryany               ASAN_PCRE_DOTALL
16348530e2b953f0b34ecd267a6aba5f155d5c08c5c8Kostya Serebryany               "AddressSanitizer: heap-buffer-overflow"
16358530e2b953f0b34ecd267a6aba5f155d5c08c5c8Kostya Serebryany               ".* is located 4 bytes to the right of 10-byte region");
16368530e2b953f0b34ecd267a6aba5f155d5c08c5c8Kostya Serebryany  close(fd);
1637fe6d91684bcda766593800f6307233f1a33d31f6Kostya Serebryany  delete [] x;
16388530e2b953f0b34ecd267a6aba5f155d5c08c5c8Kostya Serebryany}
16398530e2b953f0b34ecd267a6aba5f155d5c08c5c8Kostya Serebryany
16408530e2b953f0b34ecd267a6aba5f155d5c08c5c8Kostya SerebryanyTEST(AddressSanitizer, read) {
16416e6a7cfe0aac66eeefdf36dec78d7c536bff3c90Kostya Serebryany  char *x = new char[10];
16428530e2b953f0b34ecd267a6aba5f155d5c08c5c8Kostya Serebryany  int fd = open("/proc/self/stat", O_RDONLY);
16438530e2b953f0b34ecd267a6aba5f155d5c08c5c8Kostya Serebryany  ASSERT_GT(fd, 0);
16448530e2b953f0b34ecd267a6aba5f155d5c08c5c8Kostya Serebryany  EXPECT_DEATH(read(fd, x, 15),
16458530e2b953f0b34ecd267a6aba5f155d5c08c5c8Kostya Serebryany               ASAN_PCRE_DOTALL
16468530e2b953f0b34ecd267a6aba5f155d5c08c5c8Kostya Serebryany               "AddressSanitizer: heap-buffer-overflow"
16478530e2b953f0b34ecd267a6aba5f155d5c08c5c8Kostya Serebryany               ".* is located 4 bytes to the right of 10-byte region");
16488530e2b953f0b34ecd267a6aba5f155d5c08c5c8Kostya Serebryany  close(fd);
1649fe6d91684bcda766593800f6307233f1a33d31f6Kostya Serebryany  delete [] x;
16508530e2b953f0b34ecd267a6aba5f155d5c08c5c8Kostya Serebryany}
16518530e2b953f0b34ecd267a6aba5f155d5c08c5c8Kostya Serebryany
1652c311105fd64219bb96b6467c3707ebda355be87bKostya Serebryany#endif  // defined(__linux__) && !defined(ANDROID) && !defined(__ANDROID__)
16538530e2b953f0b34ecd267a6aba5f155d5c08c5c8Kostya Serebryany
16541e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany// This test case fails
16551e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany// Clang optimizes memcpy/memset calls which lead to unaligned access
16561e172b4bdec57329bf904f063a29f99cddf2d85fKostya SerebryanyTEST(AddressSanitizer, DISABLED_MemIntrinsicUnalignedAccessTest) {
16571e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  int size = Ident(4096);
16581e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  char *s = Ident((char*)malloc(size));
1659ef8dfd8dffbf4385baf24e5aaea6c2cc7c6c936aAlexander Potapenko  EXPECT_DEATH(memset(s + size - 1, 0, 2), RightOOBWriteMessage(0));
16601e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  free(s);
16611e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany}
16621e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
16631e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany// TODO(samsonov): Add a test with malloc(0)
16641e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany// TODO(samsonov): Add tests for str* and mem* functions.
16651e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
1666938106753364d96cedc11cbdc35a15030fb44d0cTimur IskhodzhanovNOINLINE static int LargeFunction(bool do_bad_access) {
16671e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  int *x = new int[100];
16681e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  x[0]++;
16691e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  x[1]++;
16701e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  x[2]++;
16711e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  x[3]++;
16721e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  x[4]++;
16731e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  x[5]++;
16741e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  x[6]++;
16751e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  x[7]++;
16761e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  x[8]++;
16771e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  x[9]++;
16781e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
16791e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  x[do_bad_access ? 100 : 0]++; int res = __LINE__;
16801e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
16811e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  x[10]++;
16821e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  x[11]++;
16831e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  x[12]++;
16841e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  x[13]++;
16851e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  x[14]++;
16861e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  x[15]++;
16871e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  x[16]++;
16881e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  x[17]++;
16891e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  x[18]++;
16901e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  x[19]++;
16911e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
16921e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  delete x;
16931e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  return res;
16941e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany}
16951e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
16961e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany// Test the we have correct debug info for the failing instruction.
16971e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany// This test requires the in-process symbolizer to be enabled by default.
16981e172b4bdec57329bf904f063a29f99cddf2d85fKostya SerebryanyTEST(AddressSanitizer, DISABLED_LargeFunctionSymbolizeTest) {
16991e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  int failing_line = LargeFunction(false);
17001e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  char expected_warning[128];
17015a15541fc2bbe46a5ce0cd802b5c1055f2ffb14eKostya Serebryany  sprintf(expected_warning, "LargeFunction.*asan_test.*:%d", failing_line);
17021e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  EXPECT_DEATH(LargeFunction(true), expected_warning);
17031e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany}
17041e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
17051e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany// Check that we unwind and symbolize correctly.
17061e172b4bdec57329bf904f063a29f99cddf2d85fKostya SerebryanyTEST(AddressSanitizer, DISABLED_MallocFreeUnwindAndSymbolizeTest) {
17071e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  int *a = (int*)malloc_aaa(sizeof(int));
17081e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  *a = 1;
17091e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  free_aaa(a);
17101e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  EXPECT_DEATH(*a = 1, "free_ccc.*free_bbb.*free_aaa.*"
17111e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany               "malloc_fff.*malloc_eee.*malloc_ddd");
17121e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany}
17131e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
1714716e2f25123bf9b20fbc6b582803a3929b78b96dKostya Serebryanystatic void TryToSetThreadName(const char *name) {
1715716e2f25123bf9b20fbc6b582803a3929b78b96dKostya Serebryany#ifdef __linux__
1716716e2f25123bf9b20fbc6b582803a3929b78b96dKostya Serebryany  prctl(PR_SET_NAME, (unsigned long)name, 0, 0, 0);
1717716e2f25123bf9b20fbc6b582803a3929b78b96dKostya Serebryany#endif
1718716e2f25123bf9b20fbc6b582803a3929b78b96dKostya Serebryany}
1719716e2f25123bf9b20fbc6b582803a3929b78b96dKostya Serebryany
17201e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryanyvoid *ThreadedTestAlloc(void *a) {
1721716e2f25123bf9b20fbc6b582803a3929b78b96dKostya Serebryany  TryToSetThreadName("AllocThr");
17221e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  int **p = (int**)a;
17231e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  *p = new int;
17241e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  return 0;
17251e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany}
17261e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
17271e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryanyvoid *ThreadedTestFree(void *a) {
1728716e2f25123bf9b20fbc6b582803a3929b78b96dKostya Serebryany  TryToSetThreadName("FreeThr");
17291e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  int **p = (int**)a;
17301e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  delete *p;
17311e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  return 0;
17321e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany}
17331e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
17341e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryanyvoid *ThreadedTestUse(void *a) {
1735716e2f25123bf9b20fbc6b582803a3929b78b96dKostya Serebryany  TryToSetThreadName("UseThr");
17361e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  int **p = (int**)a;
17371e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  **p = 1;
17381e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  return 0;
17391e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany}
17401e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
17411e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryanyvoid ThreadedTestSpawn() {
17421e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  pthread_t t;
17431e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  int *x;
17442697687059e64a4f1319dc23a0a3ca59982d53f6Kostya Serebryany  PTHREAD_CREATE(&t, 0, ThreadedTestAlloc, &x);
17452697687059e64a4f1319dc23a0a3ca59982d53f6Kostya Serebryany  PTHREAD_JOIN(t, 0);
17462697687059e64a4f1319dc23a0a3ca59982d53f6Kostya Serebryany  PTHREAD_CREATE(&t, 0, ThreadedTestFree, &x);
17472697687059e64a4f1319dc23a0a3ca59982d53f6Kostya Serebryany  PTHREAD_JOIN(t, 0);
17482697687059e64a4f1319dc23a0a3ca59982d53f6Kostya Serebryany  PTHREAD_CREATE(&t, 0, ThreadedTestUse, &x);
17492697687059e64a4f1319dc23a0a3ca59982d53f6Kostya Serebryany  PTHREAD_JOIN(t, 0);
17501e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany}
17511e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
17521e172b4bdec57329bf904f063a29f99cddf2d85fKostya SerebryanyTEST(AddressSanitizer, ThreadedTest) {
17531e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  EXPECT_DEATH(ThreadedTestSpawn(),
17541e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany               ASAN_PCRE_DOTALL
17551e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany               "Thread T.*created"
17561e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany               ".*Thread T.*created"
17571e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany               ".*Thread T.*created");
17581e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany}
17591e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
1760716e2f25123bf9b20fbc6b582803a3929b78b96dKostya Serebryany#ifdef __linux__
1761716e2f25123bf9b20fbc6b582803a3929b78b96dKostya SerebryanyTEST(AddressSanitizer, ThreadNamesTest) {
1762716e2f25123bf9b20fbc6b582803a3929b78b96dKostya Serebryany  // ThreadedTestSpawn();
1763716e2f25123bf9b20fbc6b582803a3929b78b96dKostya Serebryany  EXPECT_DEATH(ThreadedTestSpawn(),
1764716e2f25123bf9b20fbc6b582803a3929b78b96dKostya Serebryany               ASAN_PCRE_DOTALL
1765a390ece58317a25ef26866cef6753df4b06a3e65Kostya Serebryany               "WRITE .*thread T. .UseThr."
1766a390ece58317a25ef26866cef6753df4b06a3e65Kostya Serebryany               ".*freed by thread T. .FreeThr. here:"
1767a390ece58317a25ef26866cef6753df4b06a3e65Kostya Serebryany               ".*previously allocated by thread T. .AllocThr. here:"
1768a390ece58317a25ef26866cef6753df4b06a3e65Kostya Serebryany               ".*Thread T. .UseThr. created by T. here:"
1769a390ece58317a25ef26866cef6753df4b06a3e65Kostya Serebryany               ".*Thread T. .FreeThr. created by T. here:"
1770a390ece58317a25ef26866cef6753df4b06a3e65Kostya Serebryany               ".*Thread T. .AllocThr. created by T. here:"
1771716e2f25123bf9b20fbc6b582803a3929b78b96dKostya Serebryany               "");
1772716e2f25123bf9b20fbc6b582803a3929b78b96dKostya Serebryany}
1773716e2f25123bf9b20fbc6b582803a3929b78b96dKostya Serebryany#endif
1774716e2f25123bf9b20fbc6b582803a3929b78b96dKostya Serebryany
17751e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany#if ASAN_NEEDS_SEGV
17761e172b4bdec57329bf904f063a29f99cddf2d85fKostya SerebryanyTEST(AddressSanitizer, ShadowGapTest) {
17775af39e50366f1aacbebc284f572f08ad1ad07357Kostya Serebryany#if SANITIZER_WORDSIZE == 32
17781e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  char *addr = (char*)0x22000000;
17791e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany#else
17801e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  char *addr = (char*)0x0000100000080000;
17811e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany#endif
1782ca9b5dd9922fb7f6e0ca06dbba7db7398b8997f1Kostya Serebryany  EXPECT_DEATH(*addr = 1, "AddressSanitizer: SEGV on unknown");
17831e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany}
17841e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany#endif  // ASAN_NEEDS_SEGV
17851e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
17861e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryanyextern "C" {
1787938106753364d96cedc11cbdc35a15030fb44d0cTimur IskhodzhanovNOINLINE static void UseThenFreeThenUse() {
17881e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  char *x = Ident((char*)malloc(8));
17891e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  *x = 1;
17901e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  free_aaa(x);
17911e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  *x = 2;
17921e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany}
17931e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany}
17941e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
17951e172b4bdec57329bf904f063a29f99cddf2d85fKostya SerebryanyTEST(AddressSanitizer, UseThenFreeThenUseTest) {
17961e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  EXPECT_DEATH(UseThenFreeThenUse(), "freed by thread");
17971e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany}
17981e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
17991e172b4bdec57329bf904f063a29f99cddf2d85fKostya SerebryanyTEST(AddressSanitizer, StrDupTest) {
18001e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  free(strdup(Ident("123")));
18011e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany}
18021e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
18031e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany// Currently we create and poison redzone at right of global variables.
18041e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryanychar glob5[5];
18051e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryanystatic char static110[110];
18061e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryanyconst char ConstGlob[7] = {1, 2, 3, 4, 5, 6, 7};
18071e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryanystatic const char StaticConstGlob[3] = {9, 8, 7};
18081e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryanyextern int GlobalsTest(int x);
18091e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
18101e172b4bdec57329bf904f063a29f99cddf2d85fKostya SerebryanyTEST(AddressSanitizer, GlobalTest) {
18111e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  static char func_static15[15];
18121e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
18131e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  static char fs1[10];
18141e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  static char fs2[10];
18151e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  static char fs3[10];
18161e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
18171e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  glob5[Ident(0)] = 0;
18181e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  glob5[Ident(1)] = 0;
18191e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  glob5[Ident(2)] = 0;
18201e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  glob5[Ident(3)] = 0;
18211e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  glob5[Ident(4)] = 0;
18221e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
18231e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  EXPECT_DEATH(glob5[Ident(5)] = 0,
18241e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany               "0 bytes to the right of global variable.*glob5.* size 5");
18251e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  EXPECT_DEATH(glob5[Ident(5+6)] = 0,
18261e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany               "6 bytes to the right of global variable.*glob5.* size 5");
18271e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  Ident(static110);  // avoid optimizations
18281e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  static110[Ident(0)] = 0;
18291e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  static110[Ident(109)] = 0;
18301e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  EXPECT_DEATH(static110[Ident(110)] = 0,
18311e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany               "0 bytes to the right of global variable");
18321e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  EXPECT_DEATH(static110[Ident(110+7)] = 0,
18331e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany               "7 bytes to the right of global variable");
18341e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
18351e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  Ident(func_static15);  // avoid optimizations
18361e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  func_static15[Ident(0)] = 0;
18371e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  EXPECT_DEATH(func_static15[Ident(15)] = 0,
18381e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany               "0 bytes to the right of global variable");
18391e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  EXPECT_DEATH(func_static15[Ident(15 + 9)] = 0,
18401e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany               "9 bytes to the right of global variable");
18411e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
18421e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  Ident(fs1);
18431e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  Ident(fs2);
18441e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  Ident(fs3);
18451e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
18461e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  // We don't create left redzones, so this is not 100% guaranteed to fail.
18471e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  // But most likely will.
18481e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  EXPECT_DEATH(fs2[Ident(-1)] = 0, "is located.*of global variable");
18491e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
18501e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  EXPECT_DEATH(Ident(Ident(ConstGlob)[8]),
18511e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany               "is located 1 bytes to the right of .*ConstGlob");
18521e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  EXPECT_DEATH(Ident(Ident(StaticConstGlob)[5]),
18531e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany               "is located 2 bytes to the right of .*StaticConstGlob");
18541e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
18551e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  // call stuff from another file.
18561e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  GlobalsTest(0);
18571e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany}
18581e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
18591e172b4bdec57329bf904f063a29f99cddf2d85fKostya SerebryanyTEST(AddressSanitizer, GlobalStringConstTest) {
18601e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  static const char *zoo = "FOOBAR123";
18611e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  const char *p = Ident(zoo);
18621e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  EXPECT_DEATH(Ident(p[15]), "is ascii string 'FOOBAR123'");
18631e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany}
18641e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
1865c37ca572876a585b6a910f14a85cc7ba7fc22f20Kostya SerebryanyTEST(AddressSanitizer, FileNameInGlobalReportTest) {
1866c37ca572876a585b6a910f14a85cc7ba7fc22f20Kostya Serebryany  static char zoo[10];
1867c37ca572876a585b6a910f14a85cc7ba7fc22f20Kostya Serebryany  const char *p = Ident(zoo);
1868c37ca572876a585b6a910f14a85cc7ba7fc22f20Kostya Serebryany  // The file name should be present in the report.
18695a15541fc2bbe46a5ce0cd802b5c1055f2ffb14eKostya Serebryany  EXPECT_DEATH(Ident(p[15]), "zoo.*asan_test.");
1870c37ca572876a585b6a910f14a85cc7ba7fc22f20Kostya Serebryany}
1871c37ca572876a585b6a910f14a85cc7ba7fc22f20Kostya Serebryany
18721e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryanyint *ReturnsPointerToALocalObject() {
18731e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  int a = 0;
18741e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  return Ident(&a);
18751e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany}
18761e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
1877918b18a849cea679bff31a4e0dfb3745302c240aKostya Serebryany#if ASAN_UAR == 1
18781e172b4bdec57329bf904f063a29f99cddf2d85fKostya SerebryanyTEST(AddressSanitizer, LocalReferenceReturnTest) {
18791e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  int *(*f)() = Ident(ReturnsPointerToALocalObject);
1880918b18a849cea679bff31a4e0dfb3745302c240aKostya Serebryany  int *p = f();
1881918b18a849cea679bff31a4e0dfb3745302c240aKostya Serebryany  // Call 'f' a few more times, 'p' should still be poisoned.
1882918b18a849cea679bff31a4e0dfb3745302c240aKostya Serebryany  for (int i = 0; i < 32; i++)
1883918b18a849cea679bff31a4e0dfb3745302c240aKostya Serebryany    f();
1884ca9b5dd9922fb7f6e0ca06dbba7db7398b8997f1Kostya Serebryany  EXPECT_DEATH(*p = 1, "AddressSanitizer: stack-use-after-return");
1885918b18a849cea679bff31a4e0dfb3745302c240aKostya Serebryany  EXPECT_DEATH(*p = 1, "is located.*in frame .*ReturnsPointerToALocal");
18861e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany}
1887918b18a849cea679bff31a4e0dfb3745302c240aKostya Serebryany#endif
18881e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
18891e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryanytemplate <int kSize>
1890938106753364d96cedc11cbdc35a15030fb44d0cTimur IskhodzhanovNOINLINE static void FuncWithStack() {
18911e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  char x[kSize];
18921e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  Ident(x)[0] = 0;
18931e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  Ident(x)[kSize-1] = 0;
18941e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany}
18951e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
18961e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryanystatic void LotsOfStackReuse() {
18971e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  int LargeStack[10000];
18981e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  Ident(LargeStack)[0] = 0;
18991e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  for (int i = 0; i < 10000; i++) {
19001e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany    FuncWithStack<128 * 1>();
19011e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany    FuncWithStack<128 * 2>();
19021e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany    FuncWithStack<128 * 4>();
19031e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany    FuncWithStack<128 * 8>();
19041e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany    FuncWithStack<128 * 16>();
19051e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany    FuncWithStack<128 * 32>();
19061e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany    FuncWithStack<128 * 64>();
19071e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany    FuncWithStack<128 * 128>();
19081e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany    FuncWithStack<128 * 256>();
19091e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany    FuncWithStack<128 * 512>();
19101e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany    Ident(LargeStack)[0] = 0;
19111e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  }
19121e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany}
19131e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
19141e172b4bdec57329bf904f063a29f99cddf2d85fKostya SerebryanyTEST(AddressSanitizer, StressStackReuseTest) {
19151e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  LotsOfStackReuse();
19161e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany}
19171e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
19181e172b4bdec57329bf904f063a29f99cddf2d85fKostya SerebryanyTEST(AddressSanitizer, ThreadedStressStackReuseTest) {
19191e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  const int kNumThreads = 20;
19201e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  pthread_t t[kNumThreads];
19211e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  for (int i = 0; i < kNumThreads; i++) {
19222697687059e64a4f1319dc23a0a3ca59982d53f6Kostya Serebryany    PTHREAD_CREATE(&t[i], 0, (void* (*)(void *x))LotsOfStackReuse, 0);
19231e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  }
19241e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  for (int i = 0; i < kNumThreads; i++) {
19252697687059e64a4f1319dc23a0a3ca59982d53f6Kostya Serebryany    PTHREAD_JOIN(t[i], 0);
19261e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  }
19271e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany}
19281e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
1929f58f998066db0231e521169d2f50af439ceecb49Kostya Serebryanystatic void *PthreadExit(void *a) {
1930f58f998066db0231e521169d2f50af439ceecb49Kostya Serebryany  pthread_exit(0);
19317b7b55e99166511ce1e66bf6b79c46ae4aa60d17Evgeniy Stepanov  return 0;
1932f58f998066db0231e521169d2f50af439ceecb49Kostya Serebryany}
1933f58f998066db0231e521169d2f50af439ceecb49Kostya Serebryany
1934f58f998066db0231e521169d2f50af439ceecb49Kostya SerebryanyTEST(AddressSanitizer, PthreadExitTest) {
1935f58f998066db0231e521169d2f50af439ceecb49Kostya Serebryany  pthread_t t;
1936f58f998066db0231e521169d2f50af439ceecb49Kostya Serebryany  for (int i = 0; i < 1000; i++) {
19372697687059e64a4f1319dc23a0a3ca59982d53f6Kostya Serebryany    PTHREAD_CREATE(&t, 0, PthreadExit, 0);
19382697687059e64a4f1319dc23a0a3ca59982d53f6Kostya Serebryany    PTHREAD_JOIN(t, 0);
1939f58f998066db0231e521169d2f50af439ceecb49Kostya Serebryany  }
1940f58f998066db0231e521169d2f50af439ceecb49Kostya Serebryany}
1941f58f998066db0231e521169d2f50af439ceecb49Kostya Serebryany
19421e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany#ifdef __EXCEPTIONS
1943938106753364d96cedc11cbdc35a15030fb44d0cTimur IskhodzhanovNOINLINE static void StackReuseAndException() {
19441e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  int large_stack[1000];
19451e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  Ident(large_stack);
19461e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  ASAN_THROW(1);
19471e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany}
19481e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
19491e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany// TODO(kcc): support exceptions with use-after-return.
19501e172b4bdec57329bf904f063a29f99cddf2d85fKostya SerebryanyTEST(AddressSanitizer, DISABLED_StressStackReuseAndExceptionsTest) {
19511e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  for (int i = 0; i < 10000; i++) {
19521e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany    try {
19531e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany    StackReuseAndException();
19541e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany    } catch(...) {
19551e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany    }
19561e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  }
19571e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany}
19581e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany#endif
19591e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
19601e172b4bdec57329bf904f063a29f99cddf2d85fKostya SerebryanyTEST(AddressSanitizer, MlockTest) {
19611e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  EXPECT_EQ(0, mlockall(MCL_CURRENT));
19621e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  EXPECT_EQ(0, mlock((void*)0x12345, 0x5678));
19631e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  EXPECT_EQ(0, munlockall());
19641e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  EXPECT_EQ(0, munlock((void*)0x987, 0x654));
19651e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany}
19661e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
1967c655cfa8dc0fdf5b521e565f6cbdbf7981fba1b2Kostya Serebryanystruct LargeStruct {
1968c655cfa8dc0fdf5b521e565f6cbdbf7981fba1b2Kostya Serebryany  int foo[100];
1969c655cfa8dc0fdf5b521e565f6cbdbf7981fba1b2Kostya Serebryany};
1970c655cfa8dc0fdf5b521e565f6cbdbf7981fba1b2Kostya Serebryany
1971c655cfa8dc0fdf5b521e565f6cbdbf7981fba1b2Kostya Serebryany// Test for bug http://llvm.org/bugs/show_bug.cgi?id=11763.
1972c655cfa8dc0fdf5b521e565f6cbdbf7981fba1b2Kostya Serebryany// Struct copy should not cause asan warning even if lhs == rhs.
1973c655cfa8dc0fdf5b521e565f6cbdbf7981fba1b2Kostya SerebryanyTEST(AddressSanitizer, LargeStructCopyTest) {
1974c655cfa8dc0fdf5b521e565f6cbdbf7981fba1b2Kostya Serebryany  LargeStruct a;
1975c655cfa8dc0fdf5b521e565f6cbdbf7981fba1b2Kostya Serebryany  *Ident(&a) = *Ident(&a);
1976c655cfa8dc0fdf5b521e565f6cbdbf7981fba1b2Kostya Serebryany}
1977c655cfa8dc0fdf5b521e565f6cbdbf7981fba1b2Kostya Serebryany
19781cffef3e39cad4eb33606afbebac78d6637361acAlexey SamsonovATTRIBUTE_NO_ADDRESS_SAFETY_ANALYSIS
19793be19f4fa3519e358fd41a5feda82c39a22ef107Kostya Serebryanystatic void NoAddressSafety() {
19803be19f4fa3519e358fd41a5feda82c39a22ef107Kostya Serebryany  char *foo = new char[10];
19813be19f4fa3519e358fd41a5feda82c39a22ef107Kostya Serebryany  Ident(foo)[10] = 0;
19823be19f4fa3519e358fd41a5feda82c39a22ef107Kostya Serebryany  delete [] foo;
19833be19f4fa3519e358fd41a5feda82c39a22ef107Kostya Serebryany}
19843be19f4fa3519e358fd41a5feda82c39a22ef107Kostya Serebryany
19853be19f4fa3519e358fd41a5feda82c39a22ef107Kostya SerebryanyTEST(AddressSanitizer, AttributeNoAddressSafetyTest) {
19863be19f4fa3519e358fd41a5feda82c39a22ef107Kostya Serebryany  Ident(NoAddressSafety)();
19873be19f4fa3519e358fd41a5feda82c39a22ef107Kostya Serebryany}
19883be19f4fa3519e358fd41a5feda82c39a22ef107Kostya Serebryany
1989fe6d91684bcda766593800f6307233f1a33d31f6Kostya Serebryanystatic string MismatchStr(const string &str) {
1990fe6d91684bcda766593800f6307233f1a33d31f6Kostya Serebryany  return string("AddressSanitizer: alloc-dealloc-mismatch \\(") + str;
1991fe6d91684bcda766593800f6307233f1a33d31f6Kostya Serebryany}
1992fe6d91684bcda766593800f6307233f1a33d31f6Kostya Serebryany
1993fe6d91684bcda766593800f6307233f1a33d31f6Kostya Serebryany// This test is disabled until we enable alloc_dealloc_mismatch by default.
1994fe6d91684bcda766593800f6307233f1a33d31f6Kostya Serebryany// The feature is also tested by lit tests.
1995fe6d91684bcda766593800f6307233f1a33d31f6Kostya SerebryanyTEST(AddressSanitizer, DISABLED_AllocDeallocMismatch) {
1996fe6d91684bcda766593800f6307233f1a33d31f6Kostya Serebryany  EXPECT_DEATH(free(Ident(new int)),
1997fe6d91684bcda766593800f6307233f1a33d31f6Kostya Serebryany               MismatchStr("operator new vs free"));
1998fe6d91684bcda766593800f6307233f1a33d31f6Kostya Serebryany  EXPECT_DEATH(free(Ident(new int[2])),
1999fe6d91684bcda766593800f6307233f1a33d31f6Kostya Serebryany               MismatchStr("operator new \\[\\] vs free"));
2000fe6d91684bcda766593800f6307233f1a33d31f6Kostya Serebryany  EXPECT_DEATH(delete (Ident(new int[2])),
2001fe6d91684bcda766593800f6307233f1a33d31f6Kostya Serebryany               MismatchStr("operator new \\[\\] vs operator delete"));
2002fe6d91684bcda766593800f6307233f1a33d31f6Kostya Serebryany  EXPECT_DEATH(delete (Ident((int*)malloc(2 * sizeof(int)))),
2003fe6d91684bcda766593800f6307233f1a33d31f6Kostya Serebryany               MismatchStr("malloc vs operator delete"));
2004fe6d91684bcda766593800f6307233f1a33d31f6Kostya Serebryany  EXPECT_DEATH(delete [] (Ident(new int)),
2005fe6d91684bcda766593800f6307233f1a33d31f6Kostya Serebryany               MismatchStr("operator new vs operator delete \\[\\]"));
2006fe6d91684bcda766593800f6307233f1a33d31f6Kostya Serebryany  EXPECT_DEATH(delete [] (Ident((int*)malloc(2 * sizeof(int)))),
2007fe6d91684bcda766593800f6307233f1a33d31f6Kostya Serebryany               MismatchStr("malloc vs operator delete \\[\\]"));
2008fe6d91684bcda766593800f6307233f1a33d31f6Kostya Serebryany}
2009fe6d91684bcda766593800f6307233f1a33d31f6Kostya Serebryany
20101e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany// ------------------ demo tests; run each one-by-one -------------
20111e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany// e.g. --gtest_filter=*DemoOOBLeftHigh --gtest_also_run_disabled_tests
20121e172b4bdec57329bf904f063a29f99cddf2d85fKostya SerebryanyTEST(AddressSanitizer, DISABLED_DemoThreadedTest) {
20131e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  ThreadedTestSpawn();
20141e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany}
20151e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
20161e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryanyvoid *SimpleBugOnSTack(void *x = 0) {
20171e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  char a[20];
20181e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  Ident(a)[20] = 0;
20191e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  return 0;
20201e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany}
20211e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
20221e172b4bdec57329bf904f063a29f99cddf2d85fKostya SerebryanyTEST(AddressSanitizer, DISABLED_DemoStackTest) {
20231e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  SimpleBugOnSTack();
20241e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany}
20251e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
20261e172b4bdec57329bf904f063a29f99cddf2d85fKostya SerebryanyTEST(AddressSanitizer, DISABLED_DemoThreadStackTest) {
20271e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  pthread_t t;
20282697687059e64a4f1319dc23a0a3ca59982d53f6Kostya Serebryany  PTHREAD_CREATE(&t, 0, SimpleBugOnSTack, 0);
20292697687059e64a4f1319dc23a0a3ca59982d53f6Kostya Serebryany  PTHREAD_JOIN(t, 0);
20301e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany}
20311e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
20321e172b4bdec57329bf904f063a29f99cddf2d85fKostya SerebryanyTEST(AddressSanitizer, DISABLED_DemoUAFLowIn) {
20331e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  uaf_test<U1>(10, 0);
20341e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany}
20351e172b4bdec57329bf904f063a29f99cddf2d85fKostya SerebryanyTEST(AddressSanitizer, DISABLED_DemoUAFLowLeft) {
20361e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  uaf_test<U1>(10, -2);
20371e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany}
20381e172b4bdec57329bf904f063a29f99cddf2d85fKostya SerebryanyTEST(AddressSanitizer, DISABLED_DemoUAFLowRight) {
20391e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  uaf_test<U1>(10, 10);
20401e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany}
20411e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
20421e172b4bdec57329bf904f063a29f99cddf2d85fKostya SerebryanyTEST(AddressSanitizer, DISABLED_DemoUAFHigh) {
20431e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  uaf_test<U1>(kLargeMalloc, 0);
20441e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany}
20451e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
20461e172b4bdec57329bf904f063a29f99cddf2d85fKostya SerebryanyTEST(AddressSanitizer, DISABLED_DemoOOBLeftLow) {
20471e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  oob_test<U1>(10, -1);
20481e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany}
20491e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
20501e172b4bdec57329bf904f063a29f99cddf2d85fKostya SerebryanyTEST(AddressSanitizer, DISABLED_DemoOOBLeftHigh) {
20511e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  oob_test<U1>(kLargeMalloc, -1);
20521e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany}
20531e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
20541e172b4bdec57329bf904f063a29f99cddf2d85fKostya SerebryanyTEST(AddressSanitizer, DISABLED_DemoOOBRightLow) {
20551e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  oob_test<U1>(10, 10);
20561e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany}
20571e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
20581e172b4bdec57329bf904f063a29f99cddf2d85fKostya SerebryanyTEST(AddressSanitizer, DISABLED_DemoOOBRightHigh) {
20591e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  oob_test<U1>(kLargeMalloc, kLargeMalloc);
20601e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany}
20611e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
20621e172b4bdec57329bf904f063a29f99cddf2d85fKostya SerebryanyTEST(AddressSanitizer, DISABLED_DemoOOM) {
20635af39e50366f1aacbebc284f572f08ad1ad07357Kostya Serebryany  size_t size = SANITIZER_WORDSIZE == 64 ? (size_t)(1ULL << 40) : (0xf0000000);
20641e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  printf("%p\n", malloc(size));
20651e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany}
20661e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
20671e172b4bdec57329bf904f063a29f99cddf2d85fKostya SerebryanyTEST(AddressSanitizer, DISABLED_DemoDoubleFreeTest) {
20681e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  DoubleFree();
20691e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany}
20701e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
20711e172b4bdec57329bf904f063a29f99cddf2d85fKostya SerebryanyTEST(AddressSanitizer, DISABLED_DemoNullDerefTest) {
20721e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  int *a = 0;
20731e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  Ident(a)[10] = 0;
20741e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany}
20751e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
20761e172b4bdec57329bf904f063a29f99cddf2d85fKostya SerebryanyTEST(AddressSanitizer, DISABLED_DemoFunctionStaticTest) {
20771e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  static char a[100];
20781e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  static char b[100];
20791e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  static char c[100];
20801e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  Ident(a);
20811e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  Ident(b);
20821e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  Ident(c);
20831e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  Ident(a)[5] = 0;
20841e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  Ident(b)[105] = 0;
20851e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  Ident(a)[5] = 0;
20861e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany}
20871e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
20881e172b4bdec57329bf904f063a29f99cddf2d85fKostya SerebryanyTEST(AddressSanitizer, DISABLED_DemoTooMuchMemoryTest) {
20891e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  const size_t kAllocSize = (1 << 28) - 1024;
20901e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  size_t total_size = 0;
20911e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  while (true) {
20921e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany    char *x = (char*)malloc(kAllocSize);
20931e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany    memset(x, 0, kAllocSize);
20941e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany    total_size += kAllocSize;
20950aa04b3f432bc55e7c116d5280685ee3f243be8eKostya Serebryany    fprintf(stderr, "total: %ldM %p\n", (long)total_size >> 20, x);
20961e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  }
20971e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany}
20981e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
20994eaa17848ed02cae465f10aa5fe095e42dbf0d61Kostya Serebryany// http://code.google.com/p/address-sanitizer/issues/detail?id=66
21000796393f2088e3b75c4110934451160eeb037fabKostya SerebryanyTEST(AddressSanitizer, BufferOverflowAfterManyFrees) {
21014eaa17848ed02cae465f10aa5fe095e42dbf0d61Kostya Serebryany  for (int i = 0; i < 1000000; i++) {
21024eaa17848ed02cae465f10aa5fe095e42dbf0d61Kostya Serebryany    delete [] (Ident(new char [8644]));
21034eaa17848ed02cae465f10aa5fe095e42dbf0d61Kostya Serebryany  }
21044eaa17848ed02cae465f10aa5fe095e42dbf0d61Kostya Serebryany  char *x = new char[8192];
2105ca9b5dd9922fb7f6e0ca06dbba7db7398b8997f1Kostya Serebryany  EXPECT_DEATH(x[Ident(8192)] = 0, "AddressSanitizer: heap-buffer-overflow");
21064eaa17848ed02cae465f10aa5fe095e42dbf0d61Kostya Serebryany  delete [] Ident(x);
21074eaa17848ed02cae465f10aa5fe095e42dbf0d61Kostya Serebryany}
21084eaa17848ed02cae465f10aa5fe095e42dbf0d61Kostya Serebryany
21091e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany#ifdef __APPLE__
21101e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany#include "asan_mac_test.h"
2111effd6bf516b7109460647253aa1a62046ca9bb7aAlexander PotapenkoTEST(AddressSanitizerMac, CFAllocatorDefaultDoubleFree) {
21121e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  EXPECT_DEATH(
211343d03f3775677ca8e4727d49d1256de014351b95Alexander Potapenko      CFAllocatorDefaultDoubleFree(NULL),
21141e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany      "attempting double-free");
21151e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany}
21161e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
211743d03f3775677ca8e4727d49d1256de014351b95Alexander Potapenkovoid CFAllocator_DoubleFreeOnPthread() {
211843d03f3775677ca8e4727d49d1256de014351b95Alexander Potapenko  pthread_t child;
21192697687059e64a4f1319dc23a0a3ca59982d53f6Kostya Serebryany  PTHREAD_CREATE(&child, NULL, CFAllocatorDefaultDoubleFree, NULL);
21202697687059e64a4f1319dc23a0a3ca59982d53f6Kostya Serebryany  PTHREAD_JOIN(child, NULL);  // Shouldn't be reached.
212143d03f3775677ca8e4727d49d1256de014351b95Alexander Potapenko}
212243d03f3775677ca8e4727d49d1256de014351b95Alexander Potapenko
212375b19ebf25af204cf209d108997272822241d6daAlexander PotapenkoTEST(AddressSanitizerMac, CFAllocatorDefaultDoubleFree_ChildPhread) {
212443d03f3775677ca8e4727d49d1256de014351b95Alexander Potapenko  EXPECT_DEATH(CFAllocator_DoubleFreeOnPthread(), "attempting double-free");
2125f4e8fc675ab52d0b3022847764a70ed7f03817bdAlexander Potapenko}
212643d03f3775677ca8e4727d49d1256de014351b95Alexander Potapenko
212775b19ebf25af204cf209d108997272822241d6daAlexander Potapenkonamespace {
212875b19ebf25af204cf209d108997272822241d6daAlexander Potapenko
212975b19ebf25af204cf209d108997272822241d6daAlexander Potapenkovoid *GLOB;
213075b19ebf25af204cf209d108997272822241d6daAlexander Potapenko
213175b19ebf25af204cf209d108997272822241d6daAlexander Potapenkovoid *CFAllocatorAllocateToGlob(void *unused) {
213275b19ebf25af204cf209d108997272822241d6daAlexander Potapenko  GLOB = CFAllocatorAllocate(NULL, 100, /*hint*/0);
213375b19ebf25af204cf209d108997272822241d6daAlexander Potapenko  return NULL;
213475b19ebf25af204cf209d108997272822241d6daAlexander Potapenko}
213575b19ebf25af204cf209d108997272822241d6daAlexander Potapenko
213675b19ebf25af204cf209d108997272822241d6daAlexander Potapenkovoid *CFAllocatorDeallocateFromGlob(void *unused) {
213775b19ebf25af204cf209d108997272822241d6daAlexander Potapenko  char *p = (char*)GLOB;
213875b19ebf25af204cf209d108997272822241d6daAlexander Potapenko  p[100] = 'A';  // ASan should report an error here.
213975b19ebf25af204cf209d108997272822241d6daAlexander Potapenko  CFAllocatorDeallocate(NULL, GLOB);
214075b19ebf25af204cf209d108997272822241d6daAlexander Potapenko  return NULL;
214175b19ebf25af204cf209d108997272822241d6daAlexander Potapenko}
214275b19ebf25af204cf209d108997272822241d6daAlexander Potapenko
214375b19ebf25af204cf209d108997272822241d6daAlexander Potapenkovoid CFAllocator_PassMemoryToAnotherThread() {
214475b19ebf25af204cf209d108997272822241d6daAlexander Potapenko  pthread_t th1, th2;
21452697687059e64a4f1319dc23a0a3ca59982d53f6Kostya Serebryany  PTHREAD_CREATE(&th1, NULL, CFAllocatorAllocateToGlob, NULL);
21462697687059e64a4f1319dc23a0a3ca59982d53f6Kostya Serebryany  PTHREAD_JOIN(th1, NULL);
21472697687059e64a4f1319dc23a0a3ca59982d53f6Kostya Serebryany  PTHREAD_CREATE(&th2, NULL, CFAllocatorDeallocateFromGlob, NULL);
21482697687059e64a4f1319dc23a0a3ca59982d53f6Kostya Serebryany  PTHREAD_JOIN(th2, NULL);
214975b19ebf25af204cf209d108997272822241d6daAlexander Potapenko}
215075b19ebf25af204cf209d108997272822241d6daAlexander Potapenko
215175b19ebf25af204cf209d108997272822241d6daAlexander PotapenkoTEST(AddressSanitizerMac, CFAllocator_PassMemoryToAnotherThread) {
215275b19ebf25af204cf209d108997272822241d6daAlexander Potapenko  EXPECT_DEATH(CFAllocator_PassMemoryToAnotherThread(),
215375b19ebf25af204cf209d108997272822241d6daAlexander Potapenko               "heap-buffer-overflow");
215475b19ebf25af204cf209d108997272822241d6daAlexander Potapenko}
215575b19ebf25af204cf209d108997272822241d6daAlexander Potapenko
215675b19ebf25af204cf209d108997272822241d6daAlexander Potapenko}  // namespace
215775b19ebf25af204cf209d108997272822241d6daAlexander Potapenko
2158effd6bf516b7109460647253aa1a62046ca9bb7aAlexander Potapenko// TODO(glider): figure out whether we still need these tests. Is it correct
2159effd6bf516b7109460647253aa1a62046ca9bb7aAlexander Potapenko// to intercept the non-default CFAllocators?
21601e172b4bdec57329bf904f063a29f99cddf2d85fKostya SerebryanyTEST(AddressSanitizerMac, DISABLED_CFAllocatorSystemDefaultDoubleFree) {
21611e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  EXPECT_DEATH(
21621e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany      CFAllocatorSystemDefaultDoubleFree(),
21631e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany      "attempting double-free");
21641e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany}
21651e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
216643d03f3775677ca8e4727d49d1256de014351b95Alexander Potapenko// We're intercepting malloc, so kCFAllocatorMalloc is routed to ASan.
2167effd6bf516b7109460647253aa1a62046ca9bb7aAlexander PotapenkoTEST(AddressSanitizerMac, CFAllocatorMallocDoubleFree) {
21681e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  EXPECT_DEATH(CFAllocatorMallocDoubleFree(), "attempting double-free");
21691e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany}
21701e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
21711e172b4bdec57329bf904f063a29f99cddf2d85fKostya SerebryanyTEST(AddressSanitizerMac, DISABLED_CFAllocatorMallocZoneDoubleFree) {
21721e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  EXPECT_DEATH(CFAllocatorMallocZoneDoubleFree(), "attempting double-free");
21731e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany}
21741e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
217537a14418e494d3dfb27cd6bddcd9855df2c80ff5Alexander Potapenko// For libdispatch tests below we check that ASan got to the shadow byte
217637a14418e494d3dfb27cd6bddcd9855df2c80ff5Alexander Potapenko// legend, i.e. managed to print the thread stacks (this almost certainly
217737a14418e494d3dfb27cd6bddcd9855df2c80ff5Alexander Potapenko// means that the libdispatch task creation has been intercepted correctly).
217896bdefaabcd9ed4cb3401f5fbfb51fd964e03f5aKostya SerebryanyTEST(AddressSanitizerMac, GCDDispatchAsync) {
21791e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  // Make sure the whole ASan report is printed, i.e. that we don't die
21801e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  // on a CHECK.
218137a14418e494d3dfb27cd6bddcd9855df2c80ff5Alexander Potapenko  EXPECT_DEATH(TestGCDDispatchAsync(), "Shadow byte legend");
21821e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany}
21831e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
218496bdefaabcd9ed4cb3401f5fbfb51fd964e03f5aKostya SerebryanyTEST(AddressSanitizerMac, GCDDispatchSync) {
21851e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  // Make sure the whole ASan report is printed, i.e. that we don't die
21861e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  // on a CHECK.
218737a14418e494d3dfb27cd6bddcd9855df2c80ff5Alexander Potapenko  EXPECT_DEATH(TestGCDDispatchSync(), "Shadow byte legend");
21881e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany}
21891e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
21901e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
219196bdefaabcd9ed4cb3401f5fbfb51fd964e03f5aKostya SerebryanyTEST(AddressSanitizerMac, GCDReuseWqthreadsAsync) {
21921e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  // Make sure the whole ASan report is printed, i.e. that we don't die
21931e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  // on a CHECK.
219437a14418e494d3dfb27cd6bddcd9855df2c80ff5Alexander Potapenko  EXPECT_DEATH(TestGCDReuseWqthreadsAsync(), "Shadow byte legend");
21951e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany}
21961e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
219796bdefaabcd9ed4cb3401f5fbfb51fd964e03f5aKostya SerebryanyTEST(AddressSanitizerMac, GCDReuseWqthreadsSync) {
21981e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  // Make sure the whole ASan report is printed, i.e. that we don't die
21991e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  // on a CHECK.
220037a14418e494d3dfb27cd6bddcd9855df2c80ff5Alexander Potapenko  EXPECT_DEATH(TestGCDReuseWqthreadsSync(), "Shadow byte legend");
22011e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany}
22021e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
220396bdefaabcd9ed4cb3401f5fbfb51fd964e03f5aKostya SerebryanyTEST(AddressSanitizerMac, GCDDispatchAfter) {
22041e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  // Make sure the whole ASan report is printed, i.e. that we don't die
22051e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  // on a CHECK.
220637a14418e494d3dfb27cd6bddcd9855df2c80ff5Alexander Potapenko  EXPECT_DEATH(TestGCDDispatchAfter(), "Shadow byte legend");
22071e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany}
22081e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
220996bdefaabcd9ed4cb3401f5fbfb51fd964e03f5aKostya SerebryanyTEST(AddressSanitizerMac, GCDSourceEvent) {
22101e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  // Make sure the whole ASan report is printed, i.e. that we don't die
22111e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  // on a CHECK.
221237a14418e494d3dfb27cd6bddcd9855df2c80ff5Alexander Potapenko  EXPECT_DEATH(TestGCDSourceEvent(), "Shadow byte legend");
22131e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany}
22141e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
221596bdefaabcd9ed4cb3401f5fbfb51fd964e03f5aKostya SerebryanyTEST(AddressSanitizerMac, GCDSourceCancel) {
22161e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  // Make sure the whole ASan report is printed, i.e. that we don't die
22171e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  // on a CHECK.
221837a14418e494d3dfb27cd6bddcd9855df2c80ff5Alexander Potapenko  EXPECT_DEATH(TestGCDSourceCancel(), "Shadow byte legend");
22191e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany}
22201e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
222196bdefaabcd9ed4cb3401f5fbfb51fd964e03f5aKostya SerebryanyTEST(AddressSanitizerMac, GCDGroupAsync) {
22221e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  // Make sure the whole ASan report is printed, i.e. that we don't die
22231e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  // on a CHECK.
222437a14418e494d3dfb27cd6bddcd9855df2c80ff5Alexander Potapenko  EXPECT_DEATH(TestGCDGroupAsync(), "Shadow byte legend");
22251e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany}
22261e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
22271e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryanyvoid *MallocIntrospectionLockWorker(void *_) {
22281e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  const int kNumPointers = 100;
22291e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  int i;
22301e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  void *pointers[kNumPointers];
22311e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  for (i = 0; i < kNumPointers; i++) {
22321e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany    pointers[i] = malloc(i + 1);
22331e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  }
22341e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  for (i = 0; i < kNumPointers; i++) {
22351e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany    free(pointers[i]);
22361e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  }
22371e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
22381e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  return NULL;
22391e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany}
22401e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
22411e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryanyvoid *MallocIntrospectionLockForker(void *_) {
22421e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  pid_t result = fork();
22431e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  if (result == -1) {
22441e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany    perror("fork");
22451e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  }
22461e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  assert(result != -1);
22471e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  if (result == 0) {
22481e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany    // Call malloc in the child process to make sure we won't deadlock.
22491e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany    void *ptr = malloc(42);
22501e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany    free(ptr);
22511e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany    exit(0);
22521e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  } else {
22531e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany    // Return in the parent process.
22541e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany    return NULL;
22551e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  }
22561e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany}
22571e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
22581e172b4bdec57329bf904f063a29f99cddf2d85fKostya SerebryanyTEST(AddressSanitizerMac, MallocIntrospectionLock) {
22591e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  // Incorrect implementation of force_lock and force_unlock in our malloc zone
22601e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  // will cause forked processes to deadlock.
22611e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  // TODO(glider): need to detect that none of the child processes deadlocked.
22621e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  const int kNumWorkers = 5, kNumIterations = 100;
22631e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  int i, iter;
22641e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  for (iter = 0; iter < kNumIterations; iter++) {
22651e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany    pthread_t workers[kNumWorkers], forker;
22661e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany    for (i = 0; i < kNumWorkers; i++) {
22672697687059e64a4f1319dc23a0a3ca59982d53f6Kostya Serebryany      PTHREAD_CREATE(&workers[i], 0, MallocIntrospectionLockWorker, 0);
22681e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany    }
22692697687059e64a4f1319dc23a0a3ca59982d53f6Kostya Serebryany    PTHREAD_CREATE(&forker, 0, MallocIntrospectionLockForker, 0);
22701e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany    for (i = 0; i < kNumWorkers; i++) {
22712697687059e64a4f1319dc23a0a3ca59982d53f6Kostya Serebryany      PTHREAD_JOIN(workers[i], 0);
22721e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany    }
22732697687059e64a4f1319dc23a0a3ca59982d53f6Kostya Serebryany    PTHREAD_JOIN(forker, 0);
22741e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  }
22751e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany}
22761e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
22771e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryanyvoid *TSDAllocWorker(void *test_key) {
22781e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  if (test_key) {
22791e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany    void *mem = malloc(10);
22801e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany    pthread_setspecific(*(pthread_key_t*)test_key, mem);
22811e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  }
22821e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  return NULL;
22831e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany}
22841e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
22851e172b4bdec57329bf904f063a29f99cddf2d85fKostya SerebryanyTEST(AddressSanitizerMac, DISABLED_TSDWorkqueueTest) {
22861e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  pthread_t th;
22871e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  pthread_key_t test_key;
22881e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  pthread_key_create(&test_key, CallFreeOnWorkqueue);
22892697687059e64a4f1319dc23a0a3ca59982d53f6Kostya Serebryany  PTHREAD_CREATE(&th, NULL, TSDAllocWorker, &test_key);
22902697687059e64a4f1319dc23a0a3ca59982d53f6Kostya Serebryany  PTHREAD_JOIN(th, NULL);
22911e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany  pthread_key_delete(test_key);
22921e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany}
2293fb506cb56c7f47a9f0aa515d6f5ca3ed6533422fAlexander Potapenko
2294fb506cb56c7f47a9f0aa515d6f5ca3ed6533422fAlexander Potapenko// Test that CFStringCreateCopy does not copy constant strings.
2295431e51782d62d1257348e41e24da6b544fe70507Alexander PotapenkoTEST(AddressSanitizerMac, CFStringCreateCopy) {
2296fb506cb56c7f47a9f0aa515d6f5ca3ed6533422fAlexander Potapenko  CFStringRef str = CFSTR("Hello world!\n");
2297fb506cb56c7f47a9f0aa515d6f5ca3ed6533422fAlexander Potapenko  CFStringRef str2 = CFStringCreateCopy(0, str);
2298fb506cb56c7f47a9f0aa515d6f5ca3ed6533422fAlexander Potapenko  EXPECT_EQ(str, str2);
2299fb506cb56c7f47a9f0aa515d6f5ca3ed6533422fAlexander Potapenko}
2300fb506cb56c7f47a9f0aa515d6f5ca3ed6533422fAlexander Potapenko
23018c9ccc655405dd8a41264fe7eb5f902700077d1aAlexander PotapenkoTEST(AddressSanitizerMac, NSObjectOOB) {
23028c9ccc655405dd8a41264fe7eb5f902700077d1aAlexander Potapenko  // Make sure that our allocators are used for NSObjects.
23038c9ccc655405dd8a41264fe7eb5f902700077d1aAlexander Potapenko  EXPECT_DEATH(TestOOBNSObjects(), "heap-buffer-overflow");
23048c9ccc655405dd8a41264fe7eb5f902700077d1aAlexander Potapenko}
2305df42b619de6f7cbf23a68d91a924cfb44b9fd201Alexander Potapenko
2306df42b619de6f7cbf23a68d91a924cfb44b9fd201Alexander Potapenko// Make sure that correct pointer is passed to free() when deallocating a
2307df42b619de6f7cbf23a68d91a924cfb44b9fd201Alexander Potapenko// NSURL object.
2308df42b619de6f7cbf23a68d91a924cfb44b9fd201Alexander Potapenko// See http://code.google.com/p/address-sanitizer/issues/detail?id=70.
2309e205a9daec9ec4afed956cf5455889725b9192fbAlexander PotapenkoTEST(AddressSanitizerMac, NSURLDeallocation) {
2310df42b619de6f7cbf23a68d91a924cfb44b9fd201Alexander Potapenko  TestNSURLDeallocation();
2311df42b619de6f7cbf23a68d91a924cfb44b9fd201Alexander Potapenko}
2312ca2cdd989076d091d8c4d4c277f8b47d9b5903adAlexander Potapenko
2313ca2cdd989076d091d8c4d4c277f8b47d9b5903adAlexander Potapenko// See http://code.google.com/p/address-sanitizer/issues/detail?id=109.
2314ca2cdd989076d091d8c4d4c277f8b47d9b5903adAlexander PotapenkoTEST(AddressSanitizerMac, Mstats) {
2315ca2cdd989076d091d8c4d4c277f8b47d9b5903adAlexander Potapenko  malloc_statistics_t stats1, stats2;
2316ca2cdd989076d091d8c4d4c277f8b47d9b5903adAlexander Potapenko  malloc_zone_statistics(/*all zones*/NULL, &stats1);
2317be9796d7148b89f20ca04ffdf3fa98ac84bd1141Richard Relph  const size_t kMallocSize = 100000;
2318ca2cdd989076d091d8c4d4c277f8b47d9b5903adAlexander Potapenko  void *alloc = Ident(malloc(kMallocSize));
2319ca2cdd989076d091d8c4d4c277f8b47d9b5903adAlexander Potapenko  malloc_zone_statistics(/*all zones*/NULL, &stats2);
2320ca2cdd989076d091d8c4d4c277f8b47d9b5903adAlexander Potapenko  EXPECT_GT(stats2.blocks_in_use, stats1.blocks_in_use);
2321ca2cdd989076d091d8c4d4c277f8b47d9b5903adAlexander Potapenko  EXPECT_GE(stats2.size_in_use - stats1.size_in_use, kMallocSize);
2322ca2cdd989076d091d8c4d4c277f8b47d9b5903adAlexander Potapenko  free(alloc);
2323ca2cdd989076d091d8c4d4c277f8b47d9b5903adAlexander Potapenko  // Even the default OSX allocator may not change the stats after free().
2324ca2cdd989076d091d8c4d4c277f8b47d9b5903adAlexander Potapenko}
23251e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany#endif  // __APPLE__
23261e172b4bdec57329bf904f063a29f99cddf2d85fKostya Serebryany
23275b6eab9dc5572a66e3af54ab087255ffa4dd5185Evgeniy Stepanov// Test that instrumentation of stack allocations takes into account
23285b6eab9dc5572a66e3af54ab087255ffa4dd5185Evgeniy Stepanov// AllocSize of a type, and not its StoreSize (16 vs 10 bytes for long double).
23295b6eab9dc5572a66e3af54ab087255ffa4dd5185Evgeniy Stepanov// See http://llvm.org/bugs/show_bug.cgi?id=12047 for more details.
23305b6eab9dc5572a66e3af54ab087255ffa4dd5185Evgeniy StepanovTEST(AddressSanitizer, LongDoubleNegativeTest) {
23315b6eab9dc5572a66e3af54ab087255ffa4dd5185Evgeniy Stepanov  long double a, b;
23329b90e95d4dc59c6d97ed73b2470f5e21e7b346d5Kostya Serebryany  static long double c;
23335b6eab9dc5572a66e3af54ab087255ffa4dd5185Evgeniy Stepanov  memcpy(Ident(&a), Ident(&b), sizeof(long double));
23349b90e95d4dc59c6d97ed73b2470f5e21e7b346d5Kostya Serebryany  memcpy(Ident(&c), Ident(&b), sizeof(long double));
233576e842845c927e92c2c21c41ac51e364fa17528cAlexey Samsonov}
2336