msan_test.cc revision 4d7297daef90ad59446250617b72d184141436fc 
1//===-- msan_test.cc ------------------------------------------------------===//
2//
3//                     The LLVM Compiler Infrastructure
4//
5// This file is distributed under the University of Illinois Open Source
6// License. See LICENSE.TXT for details.
7//
8//===----------------------------------------------------------------------===//
9//
10// This file is a part of MemorySanitizer.
11//
12// MemorySanitizer unit tests.
13//===----------------------------------------------------------------------===//
14
15#ifndef MSAN_EXTERNAL_TEST_CONFIG
16#include "msan_test_config.h"
17#endif // MSAN_EXTERNAL_TEST_CONFIG
18
19#include "sanitizer/msan_interface.h"
20#include "msandr_test_so.h"
21
22#include <inttypes.h>
23#include <stdlib.h>
24#include <stdarg.h>
25#include <stdio.h>
26#include <assert.h>
27#include <wchar.h>
28#include <math.h>
29#include <malloc.h>
30
31#include <arpa/inet.h>
32#include <dlfcn.h>
33#include <grp.h>
34#include <unistd.h>
35#include <link.h>
36#include <limits.h>
37#include <sys/time.h>
38#include <poll.h>
39#include <sys/types.h>
40#include <sys/stat.h>
41#include <fcntl.h>
42#include <sys/resource.h>
43#include <sys/ioctl.h>
44#include <sys/sysinfo.h>
45#include <sys/utsname.h>
46#include <sys/mman.h>
47#include <sys/vfs.h>
48#include <dirent.h>
49#include <pwd.h>
50#include <sys/socket.h>
51#include <netdb.h>
52#include <wordexp.h>
53#include <mntent.h>
54
55#if defined(__i386__) || defined(__x86_64__)
56# include <emmintrin.h>
57# define MSAN_HAS_M128 1
58#else
59# define MSAN_HAS_M128 0
60#endif
61
62static const int kPageSize = 4096;
63
64typedef unsigned char      U1;
65typedef unsigned short     U2;  // NOLINT
66typedef unsigned int       U4;
67typedef unsigned long long U8;  // NOLINT
68typedef   signed char      S1;
69typedef   signed short     S2;  // NOLINT
70typedef   signed int       S4;
71typedef   signed long long S8;  // NOLINT
72#define NOINLINE      __attribute__((noinline))
73#define INLINE      __attribute__((always_inline))
74
75static bool TrackingOrigins() {
76  S8 x;
77  __msan_set_origin(&x, sizeof(x), 0x1234);
78  U4 origin = __msan_get_origin(&x);
79  __msan_set_origin(&x, sizeof(x), 0);
80  return origin == 0x1234;
81}
82
83#define EXPECT_UMR(action) \
84    do {                        \
85      __msan_set_expect_umr(1); \
86      action;                   \
87      __msan_set_expect_umr(0); \
88    } while (0)
89
90#define EXPECT_UMR_O(action, origin) \
91    do {                                            \
92      __msan_set_expect_umr(1);                     \
93      action;                                       \
94      __msan_set_expect_umr(0);                     \
95      if (TrackingOrigins())                        \
96        EXPECT_EQ(origin, __msan_get_umr_origin()); \
97    } while (0)
98
99#define EXPECT_UMR_S(action, stack_origin) \
100    do {                                            \
101      __msan_set_expect_umr(1);                     \
102      action;                                       \
103      __msan_set_expect_umr(0);                     \
104      U4 id = __msan_get_umr_origin();             \
105      const char *str = __msan_get_origin_descr_if_stack(id); \
106      if (!str || strcmp(str, stack_origin)) {      \
107        fprintf(stderr, "EXPECT_POISONED_S: id=%u %s, %s", \
108                id, stack_origin, str);  \
109        EXPECT_EQ(1, 0);                            \
110      }                                             \
111    } while (0)
112
113#define EXPECT_POISONED(x) ExpectPoisoned(x)
114
115template<typename T>
116void ExpectPoisoned(const T& t) {
117  EXPECT_NE(-1, __msan_test_shadow((void*)&t, sizeof(t)));
118}
119
120#define EXPECT_POISONED_O(x, origin) \
121  ExpectPoisonedWithOrigin(x, origin)
122
123template<typename T>
124void ExpectPoisonedWithOrigin(const T& t, unsigned origin) {
125  EXPECT_NE(-1, __msan_test_shadow((void*)&t, sizeof(t)));
126  if (TrackingOrigins())
127    EXPECT_EQ(origin, __msan_get_origin((void*)&t));
128}
129
130#define EXPECT_POISONED_S(x, stack_origin) \
131  ExpectPoisonedWithStackOrigin(x, stack_origin)
132
133template<typename T>
134void ExpectPoisonedWithStackOrigin(const T& t, const char *stack_origin) {
135  EXPECT_NE(-1, __msan_test_shadow((void*)&t, sizeof(t)));
136  U4 id = __msan_get_origin((void*)&t);
137  const char *str = __msan_get_origin_descr_if_stack(id);
138  if (!str || strcmp(str, stack_origin)) {
139    fprintf(stderr, "EXPECT_POISONED_S: id=%u %s, %s",
140        id, stack_origin, str);
141    EXPECT_EQ(1, 0);
142  }
143}
144
145#define EXPECT_NOT_POISONED(x) ExpectNotPoisoned(x)
146
147template<typename T>
148void ExpectNotPoisoned(const T& t) {
149  EXPECT_EQ(-1, __msan_test_shadow((void*)&t, sizeof(t)));
150}
151
152static U8 poisoned_array[100];
153template<class T>
154T *GetPoisoned(int i = 0, T val = 0) {
155  T *res = (T*)&poisoned_array[i];
156  *res = val;
157  __msan_poison(&poisoned_array[i], sizeof(T));
158  return res;
159}
160
161template<class T>
162T *GetPoisonedO(int i, U4 origin, T val = 0) {
163  T *res = (T*)&poisoned_array[i];
164  *res = val;
165  __msan_poison(&poisoned_array[i], sizeof(T));
166  __msan_set_origin(&poisoned_array[i], sizeof(T), origin);
167  return res;
168}
169
170// This function returns its parameter but in such a way that compiler
171// can not prove it.
172template<class T>
173NOINLINE
174static T Ident(T t) {
175  volatile T ret = t;
176  return ret;
177}
178
179template<class T> NOINLINE T ReturnPoisoned() { return *GetPoisoned<T>(); }
180
181static volatile int g_one = 1;
182static volatile int g_zero = 0;
183static volatile int g_0 = 0;
184static volatile int g_1 = 1;
185
186S4 a_s4[100];
187S8 a_s8[100];
188
189// Check that malloc poisons memory.
190// A lot of tests below depend on this.
191TEST(MemorySanitizerSanity, PoisonInMalloc) {
192  int *x = (int*)malloc(sizeof(int));
193  EXPECT_POISONED(*x);
194  free(x);
195}
196
197TEST(MemorySanitizer, NegativeTest1) {
198  S4 *x = GetPoisoned<S4>();
199  if (g_one)
200    *x = 0;
201  EXPECT_NOT_POISONED(*x);
202}
203
204TEST(MemorySanitizer, PositiveTest1) {
205  // Load to store.
206  EXPECT_POISONED(*GetPoisoned<S1>());
207  EXPECT_POISONED(*GetPoisoned<S2>());
208  EXPECT_POISONED(*GetPoisoned<S4>());
209  EXPECT_POISONED(*GetPoisoned<S8>());
210
211  // S->S conversions.
212  EXPECT_POISONED(*GetPoisoned<S1>());
213  EXPECT_POISONED(*GetPoisoned<S1>());
214  EXPECT_POISONED(*GetPoisoned<S1>());
215
216  EXPECT_POISONED(*GetPoisoned<S2>());
217  EXPECT_POISONED(*GetPoisoned<S2>());
218  EXPECT_POISONED(*GetPoisoned<S2>());
219
220  EXPECT_POISONED(*GetPoisoned<S4>());
221  EXPECT_POISONED(*GetPoisoned<S4>());
222  EXPECT_POISONED(*GetPoisoned<S4>());
223
224  EXPECT_POISONED(*GetPoisoned<S8>());
225  EXPECT_POISONED(*GetPoisoned<S8>());
226  EXPECT_POISONED(*GetPoisoned<S8>());
227
228  // ZExt
229  EXPECT_POISONED(*GetPoisoned<U1>());
230  EXPECT_POISONED(*GetPoisoned<U1>());
231  EXPECT_POISONED(*GetPoisoned<U1>());
232  EXPECT_POISONED(*GetPoisoned<U2>());
233  EXPECT_POISONED(*GetPoisoned<U2>());
234  EXPECT_POISONED(*GetPoisoned<U4>());
235
236  // Unary ops.
237  EXPECT_POISONED(- *GetPoisoned<S4>());
238
239  EXPECT_UMR(a_s4[g_zero] = 100 / *GetPoisoned<S4>(0, 1));
240
241
242  a_s4[g_zero] = 1 - *GetPoisoned<S4>();
243  a_s4[g_zero] = 1 + *GetPoisoned<S4>();
244}
245
246TEST(MemorySanitizer, Phi1) {
247  S4 c;
248  if (g_one) {
249    c = *GetPoisoned<S4>();
250  } else {
251    break_optimization(0);
252    c = 0;
253  }
254  EXPECT_POISONED(c);
255}
256
257TEST(MemorySanitizer, Phi2) {
258  S4 i = *GetPoisoned<S4>();
259  S4 n = g_one;
260  EXPECT_UMR(for (; i < g_one; i++););
261  EXPECT_POISONED(i);
262}
263
264NOINLINE void Arg1ExpectUMR(S4 a1) { EXPECT_POISONED(a1); }
265NOINLINE void Arg2ExpectUMR(S4 a1, S4 a2) { EXPECT_POISONED(a2); }
266NOINLINE void Arg3ExpectUMR(S1 a1, S4 a2, S8 a3) { EXPECT_POISONED(a3); }
267
268TEST(MemorySanitizer, ArgTest) {
269  Arg1ExpectUMR(*GetPoisoned<S4>());
270  Arg2ExpectUMR(0, *GetPoisoned<S4>());
271  Arg3ExpectUMR(0, 1, *GetPoisoned<S8>());
272}
273
274
275TEST(MemorySanitizer, CallAndRet) {
276  if (!__msan_has_dynamic_component()) return;
277  ReturnPoisoned<S1>();
278  ReturnPoisoned<S2>();
279  ReturnPoisoned<S4>();
280  ReturnPoisoned<S8>();
281
282  EXPECT_POISONED(ReturnPoisoned<S1>());
283  EXPECT_POISONED(ReturnPoisoned<S2>());
284  EXPECT_POISONED(ReturnPoisoned<S4>());
285  EXPECT_POISONED(ReturnPoisoned<S8>());
286}
287
288// malloc() in the following test may be optimized to produce a compile-time
289// undef value. Check that we trap on the volatile assignment anyway.
290TEST(MemorySanitizer, DISABLED_MallocNoIdent) {
291  S4 *x = (int*)malloc(sizeof(S4));
292  EXPECT_POISONED(*x);
293  free(x);
294}
295
296TEST(MemorySanitizer, Malloc) {
297  S4 *x = (int*)Ident(malloc(sizeof(S4)));
298  EXPECT_POISONED(*x);
299  free(x);
300}
301
302TEST(MemorySanitizer, Realloc) {
303  S4 *x = (int*)Ident(realloc(0, sizeof(S4)));
304  EXPECT_POISONED(x[0]);
305  x[0] = 1;
306  x = (int*)Ident(realloc(x, 2 * sizeof(S4)));
307  EXPECT_NOT_POISONED(x[0]);  // Ok, was inited before.
308  EXPECT_POISONED(x[1]);
309  x = (int*)Ident(realloc(x, 3 * sizeof(S4)));
310  EXPECT_NOT_POISONED(x[0]);  // Ok, was inited before.
311  EXPECT_POISONED(x[2]);
312  EXPECT_POISONED(x[1]);
313  x[2] = 1;  // Init this here. Check that after realloc it is poisoned again.
314  x = (int*)Ident(realloc(x, 2 * sizeof(S4)));
315  EXPECT_NOT_POISONED(x[0]);  // Ok, was inited before.
316  EXPECT_POISONED(x[1]);
317  x = (int*)Ident(realloc(x, 3 * sizeof(S4)));
318  EXPECT_POISONED(x[1]);
319  EXPECT_POISONED(x[2]);
320  free(x);
321}
322
323TEST(MemorySanitizer, Calloc) {
324  S4 *x = (int*)Ident(calloc(1, sizeof(S4)));
325  EXPECT_NOT_POISONED(*x);  // Should not be poisoned.
326  // EXPECT_EQ(0, *x);
327  free(x);
328}
329
330TEST(MemorySanitizer, AndOr) {
331  U4 *p = GetPoisoned<U4>();
332  // We poison two bytes in the midle of a 4-byte word to make the test
333  // correct regardless of endianness.
334  ((U1*)p)[1] = 0;
335  ((U1*)p)[2] = 0xff;
336  EXPECT_NOT_POISONED(*p & 0x00ffff00);
337  EXPECT_NOT_POISONED(*p & 0x00ff0000);
338  EXPECT_NOT_POISONED(*p & 0x0000ff00);
339  EXPECT_POISONED(*p & 0xff000000);
340  EXPECT_POISONED(*p & 0x000000ff);
341  EXPECT_POISONED(*p & 0x0000ffff);
342  EXPECT_POISONED(*p & 0xffff0000);
343
344  EXPECT_NOT_POISONED(*p | 0xff0000ff);
345  EXPECT_NOT_POISONED(*p | 0xff00ffff);
346  EXPECT_NOT_POISONED(*p | 0xffff00ff);
347  EXPECT_POISONED(*p | 0xff000000);
348  EXPECT_POISONED(*p | 0x000000ff);
349  EXPECT_POISONED(*p | 0x0000ffff);
350  EXPECT_POISONED(*p | 0xffff0000);
351
352  EXPECT_POISONED(*GetPoisoned<bool>() & *GetPoisoned<bool>());
353}
354
355template<class T>
356static bool applyNot(T value, T shadow) {
357  __msan_partial_poison(&value, &shadow, sizeof(T));
358  return !value;
359}
360
361TEST(MemorySanitizer, Not) {
362  EXPECT_NOT_POISONED(applyNot<U4>(0x0, 0x0));
363  EXPECT_NOT_POISONED(applyNot<U4>(0xFFFFFFFF, 0x0));
364  EXPECT_POISONED(applyNot<U4>(0xFFFFFFFF, 0xFFFFFFFF));
365  EXPECT_NOT_POISONED(applyNot<U4>(0xFF000000, 0x0FFFFFFF));
366  EXPECT_NOT_POISONED(applyNot<U4>(0xFF000000, 0x00FFFFFF));
367  EXPECT_NOT_POISONED(applyNot<U4>(0xFF000000, 0x0000FFFF));
368  EXPECT_NOT_POISONED(applyNot<U4>(0xFF000000, 0x00000000));
369  EXPECT_POISONED(applyNot<U4>(0xFF000000, 0xFF000000));
370  EXPECT_NOT_POISONED(applyNot<U4>(0xFF800000, 0xFF000000));
371  EXPECT_POISONED(applyNot<U4>(0x00008000, 0x00008000));
372
373  EXPECT_NOT_POISONED(applyNot<U1>(0x0, 0x0));
374  EXPECT_NOT_POISONED(applyNot<U1>(0xFF, 0xFE));
375  EXPECT_NOT_POISONED(applyNot<U1>(0xFF, 0x0));
376  EXPECT_POISONED(applyNot<U1>(0xFF, 0xFF));
377
378  EXPECT_POISONED(applyNot<void*>((void*)0xFFFFFF, (void*)(-1)));
379  EXPECT_NOT_POISONED(applyNot<void*>((void*)0xFFFFFF, (void*)(-2)));
380}
381
382TEST(MemorySanitizer, Shift) {
383  U4 *up = GetPoisoned<U4>();
384  ((U1*)up)[0] = 0;
385  ((U1*)up)[3] = 0xff;
386  EXPECT_NOT_POISONED(*up >> 30);
387  EXPECT_NOT_POISONED(*up >> 24);
388  EXPECT_POISONED(*up >> 23);
389  EXPECT_POISONED(*up >> 10);
390
391  EXPECT_NOT_POISONED(*up << 30);
392  EXPECT_NOT_POISONED(*up << 24);
393  EXPECT_POISONED(*up << 23);
394  EXPECT_POISONED(*up << 10);
395
396  S4 *sp = (S4*)up;
397  EXPECT_NOT_POISONED(*sp >> 30);
398  EXPECT_NOT_POISONED(*sp >> 24);
399  EXPECT_POISONED(*sp >> 23);
400  EXPECT_POISONED(*sp >> 10);
401
402  sp = GetPoisoned<S4>();
403  ((S1*)sp)[1] = 0;
404  ((S1*)sp)[2] = 0;
405  EXPECT_POISONED(*sp >> 31);
406
407  EXPECT_POISONED(100 >> *GetPoisoned<S4>());
408  EXPECT_POISONED(100U >> *GetPoisoned<S4>());
409}
410
411NOINLINE static int GetPoisonedZero() {
412  int *zero = new int;
413  *zero = 0;
414  __msan_poison(zero, sizeof(*zero));
415  int res = *zero;
416  delete zero;
417  return res;
418}
419
420TEST(MemorySanitizer, LoadFromDirtyAddress) {
421  int *a = new int;
422  *a = 0;
423  EXPECT_UMR(break_optimization((void*)(U8)a[GetPoisonedZero()]));
424  delete a;
425}
426
427TEST(MemorySanitizer, StoreToDirtyAddress) {
428  int *a = new int;
429  EXPECT_UMR(a[GetPoisonedZero()] = 0);
430  break_optimization(a);
431  delete a;
432}
433
434
435NOINLINE void StackTestFunc() {
436  S4 p4;
437  S4 ok4 = 1;
438  S2 p2;
439  S2 ok2 = 1;
440  S1 p1;
441  S1 ok1 = 1;
442  break_optimization(&p4);
443  break_optimization(&ok4);
444  break_optimization(&p2);
445  break_optimization(&ok2);
446  break_optimization(&p1);
447  break_optimization(&ok1);
448
449  EXPECT_POISONED(p4);
450  EXPECT_POISONED(p2);
451  EXPECT_POISONED(p1);
452  EXPECT_NOT_POISONED(ok1);
453  EXPECT_NOT_POISONED(ok2);
454  EXPECT_NOT_POISONED(ok4);
455}
456
457TEST(MemorySanitizer, StackTest) {
458  StackTestFunc();
459}
460
461NOINLINE void StackStressFunc() {
462  int foo[10000];
463  break_optimization(foo);
464}
465
466TEST(MemorySanitizer, DISABLED_StackStressTest) {
467  for (int i = 0; i < 1000000; i++)
468    StackStressFunc();
469}
470
471template<class T>
472void TestFloatingPoint() {
473  static volatile T v;
474  static T g[100];
475  break_optimization(&g);
476  T *x = GetPoisoned<T>();
477  T *y = GetPoisoned<T>(1);
478  EXPECT_POISONED(*x);
479  EXPECT_POISONED((long long)*x);
480  EXPECT_POISONED((int)*x);
481  g[0] = *x;
482  g[1] = *x + *y;
483  g[2] = *x - *y;
484  g[3] = *x * *y;
485}
486
487TEST(MemorySanitizer, FloatingPointTest) {
488  TestFloatingPoint<float>();
489  TestFloatingPoint<double>();
490}
491
492TEST(MemorySanitizer, DynMem) {
493  S4 x = 0;
494  S4 *y = GetPoisoned<S4>();
495  memcpy(y, &x, g_one * sizeof(S4));
496  EXPECT_NOT_POISONED(*y);
497}
498
499static char *DynRetTestStr;
500
501TEST(MemorySanitizer, DynRet) {
502  if (!__msan_has_dynamic_component()) return;
503  ReturnPoisoned<S8>();
504  EXPECT_NOT_POISONED(clearenv());
505}
506
507
508TEST(MemorySanitizer, DynRet1) {
509  if (!__msan_has_dynamic_component()) return;
510  ReturnPoisoned<S8>();
511}
512
513struct LargeStruct {
514  S4 x[10];
515};
516
517NOINLINE
518LargeStruct LargeRetTest() {
519  LargeStruct res;
520  res.x[0] = *GetPoisoned<S4>();
521  res.x[1] = *GetPoisoned<S4>();
522  res.x[2] = *GetPoisoned<S4>();
523  res.x[3] = *GetPoisoned<S4>();
524  res.x[4] = *GetPoisoned<S4>();
525  res.x[5] = *GetPoisoned<S4>();
526  res.x[6] = *GetPoisoned<S4>();
527  res.x[7] = *GetPoisoned<S4>();
528  res.x[8] = *GetPoisoned<S4>();
529  res.x[9] = *GetPoisoned<S4>();
530  return res;
531}
532
533TEST(MemorySanitizer, strcmp) {
534  char s1[10];
535  char s2[10];
536  strncpy(s1, "foo", 10);
537  s2[0] = 'f';
538  s2[1] = 'n';
539  EXPECT_GT(strcmp(s1, s2), 0);
540  s2[1] = 'o';
541  int res;
542  EXPECT_UMR(res = strcmp(s1, s2));
543  EXPECT_NOT_POISONED(res);
544  EXPECT_EQ(strncmp(s1, s2, 1), 0);
545}
546
547TEST(MemorySanitizer, LargeRet) {
548  LargeStruct a = LargeRetTest();
549  EXPECT_POISONED(a.x[0]);
550  EXPECT_POISONED(a.x[9]);
551}
552
553TEST(MemorySanitizer, strerror) {
554  char *buf = strerror(EINVAL);
555  EXPECT_NOT_POISONED(strlen(buf));
556  buf = strerror(123456);
557  EXPECT_NOT_POISONED(strlen(buf));
558}
559
560TEST(MemorySanitizer, strerror_r) {
561  errno = 0;
562  char buf[1000];
563  char *res = strerror_r(EINVAL, buf, sizeof(buf));
564  ASSERT_EQ(0, errno);
565  if (!res) res = buf; // POSIX version success.
566  EXPECT_NOT_POISONED(strlen(res));
567}
568
569TEST(MemorySanitizer, fread) {
570  char *x = new char[32];
571  FILE *f = fopen("/proc/self/stat", "r");
572  assert(f);
573  fread(x, 1, 32, f);
574  EXPECT_NOT_POISONED(x[0]);
575  EXPECT_NOT_POISONED(x[16]);
576  EXPECT_NOT_POISONED(x[31]);
577  fclose(f);
578  delete x;
579}
580
581TEST(MemorySanitizer, read) {
582  char *x = new char[32];
583  int fd = open("/proc/self/stat", O_RDONLY);
584  assert(fd > 0);
585  int sz = read(fd, x, 32);
586  assert(sz == 32);
587  EXPECT_NOT_POISONED(x[0]);
588  EXPECT_NOT_POISONED(x[16]);
589  EXPECT_NOT_POISONED(x[31]);
590  close(fd);
591  delete x;
592}
593
594TEST(MemorySanitizer, pread) {
595  char *x = new char[32];
596  int fd = open("/proc/self/stat", O_RDONLY);
597  assert(fd > 0);
598  int sz = pread(fd, x, 32, 0);
599  assert(sz == 32);
600  EXPECT_NOT_POISONED(x[0]);
601  EXPECT_NOT_POISONED(x[16]);
602  EXPECT_NOT_POISONED(x[31]);
603  close(fd);
604  delete x;
605}
606
607TEST(MemorySanitizer, readv) {
608  char buf[2011];
609  struct iovec iov[2];
610  iov[0].iov_base = buf + 1;
611  iov[0].iov_len = 5;
612  iov[1].iov_base = buf + 10;
613  iov[1].iov_len = 2000;
614  int fd = open("/proc/self/stat", O_RDONLY);
615  assert(fd > 0);
616  int sz = readv(fd, iov, 2);
617  ASSERT_LT(sz, 5 + 2000);
618  ASSERT_GT(sz, iov[0].iov_len);
619  EXPECT_POISONED(buf[0]);
620  EXPECT_NOT_POISONED(buf[1]);
621  EXPECT_NOT_POISONED(buf[5]);
622  EXPECT_POISONED(buf[6]);
623  EXPECT_POISONED(buf[9]);
624  EXPECT_NOT_POISONED(buf[10]);
625  EXPECT_NOT_POISONED(buf[10 + (sz - 1) - 5]);
626  EXPECT_POISONED(buf[11 + (sz - 1) - 5]);
627  close(fd);
628}
629
630TEST(MemorySanitizer, preadv) {
631  char buf[2011];
632  struct iovec iov[2];
633  iov[0].iov_base = buf + 1;
634  iov[0].iov_len = 5;
635  iov[1].iov_base = buf + 10;
636  iov[1].iov_len = 2000;
637  int fd = open("/proc/self/stat", O_RDONLY);
638  assert(fd > 0);
639  int sz = preadv(fd, iov, 2, 3);
640  ASSERT_LT(sz, 5 + 2000);
641  ASSERT_GT(sz, iov[0].iov_len);
642  EXPECT_POISONED(buf[0]);
643  EXPECT_NOT_POISONED(buf[1]);
644  EXPECT_NOT_POISONED(buf[5]);
645  EXPECT_POISONED(buf[6]);
646  EXPECT_POISONED(buf[9]);
647  EXPECT_NOT_POISONED(buf[10]);
648  EXPECT_NOT_POISONED(buf[10 + (sz - 1) - 5]);
649  EXPECT_POISONED(buf[11 + (sz - 1) - 5]);
650  close(fd);
651}
652
653// FIXME: fails now.
654TEST(MemorySanitizer, DISABLED_ioctl) {
655  struct winsize ws;
656  EXPECT_EQ(ioctl(2, TIOCGWINSZ, &ws), 0);
657  EXPECT_NOT_POISONED(ws.ws_col);
658}
659
660TEST(MemorySanitizer, readlink) {
661  char *x = new char[1000];
662  readlink("/proc/self/exe", x, 1000);
663  EXPECT_NOT_POISONED(x[0]);
664  delete [] x;
665}
666
667
668TEST(MemorySanitizer, stat) {
669  struct stat* st = new struct stat;
670  int res = stat("/proc/self/stat", st);
671  assert(!res);
672  EXPECT_NOT_POISONED(st->st_dev);
673  EXPECT_NOT_POISONED(st->st_mode);
674  EXPECT_NOT_POISONED(st->st_size);
675}
676
677TEST(MemorySanitizer, fstatat) {
678  struct stat* st = new struct stat;
679  int dirfd = open("/proc/self", O_RDONLY);
680  assert(dirfd > 0);
681  int res = fstatat(dirfd, "stat", st, 0);
682  assert(!res);
683  EXPECT_NOT_POISONED(st->st_dev);
684  EXPECT_NOT_POISONED(st->st_mode);
685  EXPECT_NOT_POISONED(st->st_size);
686  close(dirfd);
687}
688
689TEST(MemorySanitizer, statfs) {
690  struct statfs* st = new struct statfs;
691  int res = statfs("/", st);
692  assert(!res);
693  EXPECT_NOT_POISONED(st->f_type);
694  EXPECT_NOT_POISONED(st->f_bfree);
695  EXPECT_NOT_POISONED(st->f_namelen);
696}
697
698TEST(MemorySanitizer, pipe) {
699  int* pipefd = new int[2];
700  int res = pipe(pipefd);
701  assert(!res);
702  EXPECT_NOT_POISONED(pipefd[0]);
703  EXPECT_NOT_POISONED(pipefd[1]);
704  close(pipefd[0]);
705  close(pipefd[1]);
706}
707
708TEST(MemorySanitizer, pipe2) {
709  int* pipefd = new int[2];
710  int res = pipe2(pipefd, O_NONBLOCK);
711  assert(!res);
712  EXPECT_NOT_POISONED(pipefd[0]);
713  EXPECT_NOT_POISONED(pipefd[1]);
714  close(pipefd[0]);
715  close(pipefd[1]);
716}
717
718TEST(MemorySanitizer, socketpair) {
719  int sv[2];
720  int res = socketpair(AF_UNIX, SOCK_STREAM, 0, sv);
721  assert(!res);
722  EXPECT_NOT_POISONED(sv[0]);
723  EXPECT_NOT_POISONED(sv[1]);
724  close(sv[0]);
725  close(sv[1]);
726}
727
728TEST(MemorySanitizer, poll) {
729  int* pipefd = new int[2];
730  int res = pipe(pipefd);
731  ASSERT_EQ(0, res);
732
733  char data = 42;
734  res = write(pipefd[1], &data, 1);
735  ASSERT_EQ(1, res);
736
737  pollfd fds[2];
738  fds[0].fd = pipefd[0];
739  fds[0].events = POLLIN;
740  fds[1].fd = pipefd[1];
741  fds[1].events = POLLIN;
742  res = poll(fds, 2, 500);
743  ASSERT_EQ(1, res);
744  EXPECT_NOT_POISONED(fds[0].revents);
745  EXPECT_NOT_POISONED(fds[1].revents);
746
747  close(pipefd[0]);
748  close(pipefd[1]);
749}
750
751TEST(MemorySanitizer, ppoll) {
752  int* pipefd = new int[2];
753  int res = pipe(pipefd);
754  ASSERT_EQ(0, res);
755
756  char data = 42;
757  res = write(pipefd[1], &data, 1);
758  ASSERT_EQ(1, res);
759
760  pollfd fds[2];
761  fds[0].fd = pipefd[0];
762  fds[0].events = POLLIN;
763  fds[1].fd = pipefd[1];
764  fds[1].events = POLLIN;
765  sigset_t ss;
766  sigemptyset(&ss);
767  res = ppoll(fds, 2, NULL, &ss);
768  ASSERT_EQ(1, res);
769  EXPECT_NOT_POISONED(fds[0].revents);
770  EXPECT_NOT_POISONED(fds[1].revents);
771
772  close(pipefd[0]);
773  close(pipefd[1]);
774}
775
776TEST(MemorySanitizer, poll_positive) {
777  int* pipefd = new int[2];
778  int res = pipe(pipefd);
779  ASSERT_EQ(0, res);
780
781  pollfd fds[2];
782  fds[0].fd = pipefd[0];
783  fds[0].events = POLLIN;
784  // fds[1].fd uninitialized
785  fds[1].events = POLLIN;
786  EXPECT_UMR(poll(fds, 2, 0));
787
788  close(pipefd[0]);
789  close(pipefd[1]);
790}
791
792TEST(MemorySanitizer, bind_getsockname) {
793  int sock = socket(AF_UNIX, SOCK_STREAM, 0);
794
795  struct sockaddr_in sai;
796  memset(&sai, 0, sizeof(sai));
797  sai.sin_family = AF_UNIX;
798  int res = bind(sock, (struct sockaddr *)&sai, sizeof(sai));
799
800  assert(!res);
801  char buf[200];
802  socklen_t addrlen;
803  EXPECT_UMR(getsockname(sock, (struct sockaddr *)&buf, &addrlen));
804
805  addrlen = sizeof(buf);
806  res = getsockname(sock, (struct sockaddr *)&buf, &addrlen);
807  EXPECT_NOT_POISONED(addrlen);
808  EXPECT_NOT_POISONED(buf[0]);
809  EXPECT_NOT_POISONED(buf[addrlen - 1]);
810  EXPECT_POISONED(buf[addrlen]);
811  close(sock);
812}
813
814TEST(MemorySanitizer, accept) {
815  int listen_socket = socket(AF_INET, SOCK_STREAM, 0);
816  ASSERT_LT(0, listen_socket);
817
818  struct sockaddr_in sai;
819  memset(&sai, 0, sizeof(sai));
820  sai.sin_family = AF_INET;
821  sai.sin_port = 0;
822  sai.sin_addr.s_addr = htonl(INADDR_LOOPBACK);
823  int res = bind(listen_socket, (struct sockaddr *)&sai, sizeof(sai));
824  ASSERT_EQ(0, res);
825
826  res = listen(listen_socket, 1);
827  ASSERT_EQ(0, res);
828
829  socklen_t sz = sizeof(sai);
830  res = getsockname(listen_socket, (struct sockaddr *)&sai, &sz);
831  ASSERT_EQ(0, res);
832  ASSERT_EQ(sizeof(sai), sz);
833
834  int connect_socket = socket(AF_INET, SOCK_STREAM, 0);
835  ASSERT_LT(0, connect_socket);
836  res = fcntl(connect_socket, F_SETFL, O_NONBLOCK);
837  ASSERT_EQ(0, res);
838  res = connect(connect_socket, (struct sockaddr *)&sai, sizeof(sai));
839  ASSERT_EQ(-1, res);
840  ASSERT_EQ(EINPROGRESS, errno);
841
842  __msan_poison(&sai, sizeof(sai));
843  int new_sock = accept(listen_socket, (struct sockaddr *)&sai, &sz);
844  ASSERT_LT(0, new_sock);
845  ASSERT_EQ(sizeof(sai), sz);
846  EXPECT_NOT_POISONED(sai);
847
848  __msan_poison(&sai, sizeof(sai));
849  res = getpeername(new_sock, (struct sockaddr *)&sai, &sz);
850  ASSERT_EQ(0, res);
851  ASSERT_EQ(sizeof(sai), sz);
852  EXPECT_NOT_POISONED(sai);
853
854  close(new_sock);
855  close(connect_socket);
856  close(listen_socket);
857}
858
859TEST(MemorySanitizer, getaddrinfo) {
860  struct addrinfo *ai;
861  struct addrinfo hints;
862  memset(&hints, 0, sizeof(hints));
863  hints.ai_family = AF_INET;
864  int res = getaddrinfo("localhost", NULL, &hints, &ai);
865  ASSERT_EQ(0, res);
866  EXPECT_NOT_POISONED(*ai);
867  ASSERT_EQ(sizeof(sockaddr_in), ai->ai_addrlen);
868  EXPECT_NOT_POISONED(*(sockaddr_in*)ai->ai_addr);
869}
870
871TEST(MemorySanitizer, getnameinfo) {
872  struct sockaddr_in sai;
873  memset(&sai, 0, sizeof(sai));
874  sai.sin_family = AF_INET;
875  sai.sin_port = 80;
876  sai.sin_addr.s_addr = htonl(INADDR_LOOPBACK);
877  char host[500];
878  char serv[500];
879  int res = getnameinfo((struct sockaddr *)&sai, sizeof(sai), host,
880                        sizeof(host), serv, sizeof(serv), 0);
881  ASSERT_EQ(0, res);
882  EXPECT_NOT_POISONED(host[0]);
883  EXPECT_POISONED(host[sizeof(host) - 1]);
884
885  ASSERT_NE(0, strlen(host));
886  EXPECT_NOT_POISONED(serv[0]);
887  EXPECT_POISONED(serv[sizeof(serv) - 1]);
888  ASSERT_NE(0, strlen(serv));
889}
890
891#define EXPECT_HOSTENT_NOT_POISONED(he)        \
892  do {                                         \
893    EXPECT_NOT_POISONED(*(he));                \
894    ASSERT_NE((void *) 0, (he)->h_name);       \
895    ASSERT_NE((void *) 0, (he)->h_aliases);    \
896    ASSERT_NE((void *) 0, (he)->h_addr_list);  \
897    EXPECT_NOT_POISONED(strlen((he)->h_name)); \
898    char **p = (he)->h_aliases;                \
899    while (*p) {                               \
900      EXPECT_NOT_POISONED(strlen(*p));         \
901      ++p;                                     \
902    }                                          \
903    char **q = (he)->h_addr_list;              \
904    while (*q) {                               \
905      EXPECT_NOT_POISONED(*q[0]);              \
906      ++q;                                     \
907    }                                          \
908    EXPECT_NOT_POISONED(*q);                   \
909  } while (0)
910
911TEST(MemorySanitizer, gethostent) {
912  struct hostent *he = gethostent();
913  ASSERT_NE((void *)NULL, he);
914  EXPECT_HOSTENT_NOT_POISONED(he);
915}
916
917#ifndef MSAN_TEST_DISABLE_GETHOSTBYNAME
918
919TEST(MemorySanitizer, gethostbyname) {
920  struct hostent *he = gethostbyname("localhost");
921  ASSERT_NE((void *)NULL, he);
922  EXPECT_HOSTENT_NOT_POISONED(he);
923}
924
925#endif // MSAN_TEST_DISABLE_GETHOSTBYNAME
926
927TEST(MemorySanitizer, recvmsg) {
928  int server_socket = socket(AF_INET, SOCK_DGRAM, 0);
929  ASSERT_LT(0, server_socket);
930
931  struct sockaddr_in sai;
932  memset(&sai, 0, sizeof(sai));
933  sai.sin_family = AF_INET;
934  sai.sin_port = 0;
935  sai.sin_addr.s_addr = htonl(INADDR_LOOPBACK);
936  int res = bind(server_socket, (struct sockaddr *)&sai, sizeof(sai));
937  ASSERT_EQ(0, res);
938
939  socklen_t sz = sizeof(sai);
940  res = getsockname(server_socket, (struct sockaddr *)&sai, &sz);
941  ASSERT_EQ(0, res);
942  ASSERT_EQ(sizeof(sai), sz);
943
944
945  int client_socket = socket(AF_INET, SOCK_DGRAM, 0);
946  ASSERT_LT(0, client_socket);
947
948  struct sockaddr_in client_sai;
949  memset(&client_sai, 0, sizeof(client_sai));
950  client_sai.sin_family = AF_INET;
951  client_sai.sin_port = 0;
952  client_sai.sin_addr.s_addr = htonl(INADDR_LOOPBACK);
953  res = bind(client_socket, (struct sockaddr *)&client_sai, sizeof(client_sai));
954  ASSERT_EQ(0, res);
955
956  sz = sizeof(client_sai);
957  res = getsockname(client_socket, (struct sockaddr *)&client_sai, &sz);
958  ASSERT_EQ(0, res);
959  ASSERT_EQ(sizeof(client_sai), sz);
960
961
962  const char *s = "message text";
963  struct iovec iov;
964  iov.iov_base = (void *)s;
965  iov.iov_len = strlen(s) + 1;
966  struct msghdr msg;
967  memset(&msg, 0, sizeof(msg));
968  msg.msg_name = &sai;
969  msg.msg_namelen = sizeof(sai);
970  msg.msg_iov = &iov;
971  msg.msg_iovlen = 1;
972  res = sendmsg(client_socket, &msg, 0);
973  ASSERT_LT(0, res);
974
975
976  char buf[1000];
977  struct iovec recv_iov;
978  recv_iov.iov_base = (void *)&buf;
979  recv_iov.iov_len = sizeof(buf);
980  struct sockaddr_in recv_sai;
981  struct msghdr recv_msg;
982  memset(&recv_msg, 0, sizeof(recv_msg));
983  recv_msg.msg_name = &recv_sai;
984  recv_msg.msg_namelen = sizeof(recv_sai);
985  recv_msg.msg_iov = &recv_iov;
986  recv_msg.msg_iovlen = 1;
987  res = recvmsg(server_socket, &recv_msg, 0);
988  ASSERT_LT(0, res);
989
990  ASSERT_EQ(sizeof(recv_sai), recv_msg.msg_namelen);
991  EXPECT_NOT_POISONED(*(struct sockaddr_in *)recv_msg.msg_name);
992  EXPECT_STREQ(s, buf);
993
994  close(server_socket);
995  close(client_socket);
996}
997
998TEST(MemorySanitizer, gethostbyname2) {
999  struct hostent *he = gethostbyname2("localhost", AF_INET);
1000  ASSERT_NE((void *)NULL, he);
1001  EXPECT_HOSTENT_NOT_POISONED(he);
1002}
1003
1004TEST(MemorySanitizer, gethostbyaddr) {
1005  in_addr_t addr = inet_addr("127.0.0.1");
1006  EXPECT_NOT_POISONED(addr);
1007  struct hostent *he = gethostbyaddr(&addr, sizeof(addr), AF_INET);
1008  ASSERT_NE((void *)NULL, he);
1009  EXPECT_HOSTENT_NOT_POISONED(he);
1010}
1011
1012TEST(MemorySanitizer, gethostent_r) {
1013  char buf[2000];
1014  struct hostent he;
1015  struct hostent *result;
1016  int err;
1017  int res = gethostent_r(&he, buf, sizeof(buf), &result, &err);
1018  ASSERT_EQ(0, res);
1019  EXPECT_NOT_POISONED(result);
1020  ASSERT_NE((void *)NULL, result);
1021  EXPECT_HOSTENT_NOT_POISONED(result);
1022  EXPECT_NOT_POISONED(err);
1023}
1024
1025TEST(MemorySanitizer, gethostbyname_r) {
1026  char buf[2000];
1027  struct hostent he;
1028  struct hostent *result;
1029  int err;
1030  int res = gethostbyname_r("localhost", &he, buf, sizeof(buf), &result, &err);
1031  ASSERT_EQ(0, res);
1032  EXPECT_NOT_POISONED(result);
1033  ASSERT_NE((void *)NULL, result);
1034  EXPECT_HOSTENT_NOT_POISONED(result);
1035  EXPECT_NOT_POISONED(err);
1036}
1037
1038TEST(MemorySanitizer, gethostbyname2_r) {
1039  char buf[2000];
1040  struct hostent he;
1041  struct hostent *result;
1042  int err;
1043  int res = gethostbyname2_r("localhost", AF_INET, &he, buf, sizeof(buf),
1044                             &result, &err);
1045  ASSERT_EQ(0, res);
1046  EXPECT_NOT_POISONED(result);
1047  ASSERT_NE((void *)NULL, result);
1048  EXPECT_HOSTENT_NOT_POISONED(result);
1049  EXPECT_NOT_POISONED(err);
1050}
1051
1052TEST(MemorySanitizer, gethostbyaddr_r) {
1053  char buf[2000];
1054  struct hostent he;
1055  struct hostent *result;
1056  int err;
1057  in_addr_t addr = inet_addr("127.0.0.1");
1058  EXPECT_NOT_POISONED(addr);
1059  int res = gethostbyaddr_r(&addr, sizeof(addr), AF_INET, &he, buf, sizeof(buf),
1060                            &result, &err);
1061  ASSERT_EQ(0, res);
1062  EXPECT_NOT_POISONED(result);
1063  ASSERT_NE((void *)NULL, result);
1064  EXPECT_HOSTENT_NOT_POISONED(result);
1065  EXPECT_NOT_POISONED(err);
1066}
1067
1068TEST(MemorySanitizer, getsockopt) {
1069  int sock = socket(AF_UNIX, SOCK_STREAM, 0);
1070  struct linger l[2];
1071  socklen_t sz = sizeof(l[0]);
1072  int res = getsockopt(sock, SOL_SOCKET, SO_LINGER, &l[0], &sz);
1073  ASSERT_EQ(0, res);
1074  ASSERT_EQ(sizeof(l[0]), sz);
1075  EXPECT_NOT_POISONED(l[0]);
1076  EXPECT_POISONED(*(char *)(l + 1));
1077}
1078
1079TEST(MemorySanitizer, getcwd) {
1080  char path[PATH_MAX + 1];
1081  char* res = getcwd(path, sizeof(path));
1082  assert(res);
1083  EXPECT_NOT_POISONED(path[0]);
1084}
1085
1086TEST(MemorySanitizer, getcwd_gnu) {
1087  char* res = getcwd(NULL, 0);
1088  assert(res);
1089  EXPECT_NOT_POISONED(res[0]);
1090  free(res);
1091}
1092
1093TEST(MemorySanitizer, get_current_dir_name) {
1094  char* res = get_current_dir_name();
1095  assert(res);
1096  EXPECT_NOT_POISONED(res[0]);
1097  free(res);
1098}
1099
1100TEST(MemorySanitizer, confstr) {
1101  char buf[3];
1102  size_t res = confstr(_CS_PATH, buf, sizeof(buf));
1103  ASSERT_GT(res, sizeof(buf));
1104  EXPECT_NOT_POISONED(buf[0]);
1105  EXPECT_NOT_POISONED(buf[sizeof(buf) - 1]);
1106
1107  char buf2[1000];
1108  res = confstr(_CS_PATH, buf2, sizeof(buf2));
1109  ASSERT_LT(res, sizeof(buf2));
1110  EXPECT_NOT_POISONED(buf2[0]);
1111  EXPECT_NOT_POISONED(buf2[res - 1]);
1112  EXPECT_POISONED(buf2[res]);
1113  ASSERT_EQ(res, strlen(buf2) + 1);
1114}
1115
1116TEST(MemorySanitizer, readdir) {
1117  DIR *dir = opendir(".");
1118  struct dirent *d = readdir(dir);
1119  assert(d);
1120  EXPECT_NOT_POISONED(d->d_name[0]);
1121  closedir(dir);
1122}
1123
1124TEST(MemorySanitizer, readdir_r) {
1125  DIR *dir = opendir(".");
1126  struct dirent d;
1127  struct dirent *pd;
1128  int res = readdir_r(dir, &d, &pd);
1129  assert(!res);
1130  EXPECT_NOT_POISONED(pd);
1131  EXPECT_NOT_POISONED(d.d_name[0]);
1132  closedir(dir);
1133}
1134
1135TEST(MemorySanitizer, realpath) {
1136  const char* relpath = ".";
1137  char path[PATH_MAX + 1];
1138  char* res = realpath(relpath, path);
1139  assert(res);
1140  EXPECT_NOT_POISONED(path[0]);
1141}
1142
1143TEST(MemorySanitizer, realpath_null) {
1144  const char* relpath = ".";
1145  char* res = realpath(relpath, NULL);
1146  printf("%d, %s\n", errno, strerror(errno));
1147  assert(res);
1148  EXPECT_NOT_POISONED(res[0]);
1149  free(res);
1150}
1151
1152TEST(MemorySanitizer, canonicalize_file_name) {
1153  const char* relpath = ".";
1154  char* res = canonicalize_file_name(relpath);
1155  assert(res);
1156  EXPECT_NOT_POISONED(res[0]);
1157  free(res);
1158}
1159
1160extern char **environ;
1161
1162TEST(MemorySanitizer, setenv) {
1163  setenv("AAA", "BBB", 1);
1164  for (char **envp = environ; *envp; ++envp) {
1165    EXPECT_NOT_POISONED(*envp);
1166    EXPECT_NOT_POISONED(*envp[0]);
1167  }
1168}
1169
1170TEST(MemorySanitizer, putenv) {
1171  char s[] = "AAA=BBB";
1172  putenv(s);
1173  for (char **envp = environ; *envp; ++envp) {
1174    EXPECT_NOT_POISONED(*envp);
1175    EXPECT_NOT_POISONED(*envp[0]);
1176  }
1177}
1178
1179TEST(MemorySanitizer, memcpy) {
1180  char* x = new char[2];
1181  char* y = new char[2];
1182  x[0] = 1;
1183  x[1] = *GetPoisoned<char>();
1184  memcpy(y, x, 2);
1185  EXPECT_NOT_POISONED(y[0]);
1186  EXPECT_POISONED(y[1]);
1187}
1188
1189TEST(MemorySanitizer, memmove) {
1190  char* x = new char[2];
1191  char* y = new char[2];
1192  x[0] = 1;
1193  x[1] = *GetPoisoned<char>();
1194  memmove(y, x, 2);
1195  EXPECT_NOT_POISONED(y[0]);
1196  EXPECT_POISONED(y[1]);
1197}
1198
1199TEST(MemorySanitizer, bcopy) {
1200  char* x = new char[2];
1201  char* y = new char[2];
1202  x[0] = 1;
1203  x[1] = *GetPoisoned<char>();
1204  bcopy(x, y, 2);
1205  EXPECT_NOT_POISONED(y[0]);
1206  EXPECT_POISONED(y[1]);
1207}
1208
1209TEST(MemorySanitizer, strdup) {
1210  char buf[4] = "abc";
1211  __msan_poison(buf + 2, sizeof(*buf));
1212  char *x = strdup(buf);
1213  EXPECT_NOT_POISONED(x[0]);
1214  EXPECT_NOT_POISONED(x[1]);
1215  EXPECT_POISONED(x[2]);
1216  EXPECT_NOT_POISONED(x[3]);
1217  free(x);
1218}
1219
1220TEST(MemorySanitizer, strndup) {
1221  char buf[4] = "abc";
1222  __msan_poison(buf + 2, sizeof(*buf));
1223  char *x = strndup(buf, 3);
1224  EXPECT_NOT_POISONED(x[0]);
1225  EXPECT_NOT_POISONED(x[1]);
1226  EXPECT_POISONED(x[2]);
1227  EXPECT_NOT_POISONED(x[3]);
1228  free(x);
1229}
1230
1231TEST(MemorySanitizer, strndup_short) {
1232  char buf[4] = "abc";
1233  __msan_poison(buf + 1, sizeof(*buf));
1234  __msan_poison(buf + 2, sizeof(*buf));
1235  char *x = strndup(buf, 2);
1236  EXPECT_NOT_POISONED(x[0]);
1237  EXPECT_POISONED(x[1]);
1238  EXPECT_NOT_POISONED(x[2]);
1239  free(x);
1240}
1241
1242
1243template<class T, int size>
1244void TestOverlapMemmove() {
1245  T *x = new T[size];
1246  assert(size >= 3);
1247  x[2] = 0;
1248  memmove(x, x + 1, (size - 1) * sizeof(T));
1249  EXPECT_NOT_POISONED(x[1]);
1250  if (!__msan_has_dynamic_component()) {
1251    // FIXME: under DR we will lose this information
1252    // because accesses in memmove will unpoisin the shadow.
1253    // We need to use our own memove implementation instead of libc's.
1254    EXPECT_POISONED(x[0]);
1255    EXPECT_POISONED(x[2]);
1256  }
1257  delete [] x;
1258}
1259
1260TEST(MemorySanitizer, overlap_memmove) {
1261  TestOverlapMemmove<U1, 10>();
1262  TestOverlapMemmove<U1, 1000>();
1263  TestOverlapMemmove<U8, 4>();
1264  TestOverlapMemmove<U8, 1000>();
1265}
1266
1267TEST(MemorySanitizer, strcpy) {  // NOLINT
1268  char* x = new char[3];
1269  char* y = new char[3];
1270  x[0] = 'a';
1271  x[1] = *GetPoisoned<char>(1, 1);
1272  x[2] = 0;
1273  strcpy(y, x);  // NOLINT
1274  EXPECT_NOT_POISONED(y[0]);
1275  EXPECT_POISONED(y[1]);
1276  EXPECT_NOT_POISONED(y[2]);
1277}
1278
1279TEST(MemorySanitizer, strncpy) {  // NOLINT
1280  char* x = new char[3];
1281  char* y = new char[3];
1282  x[0] = 'a';
1283  x[1] = *GetPoisoned<char>(1, 1);
1284  x[2] = 0;
1285  strncpy(y, x, 2);  // NOLINT
1286  EXPECT_NOT_POISONED(y[0]);
1287  EXPECT_POISONED(y[1]);
1288  EXPECT_POISONED(y[2]);
1289}
1290
1291TEST(MemorySanitizer, stpcpy) {  // NOLINT
1292  char* x = new char[3];
1293  char* y = new char[3];
1294  x[0] = 'a';
1295  x[1] = *GetPoisoned<char>(1, 1);
1296  x[2] = 0;
1297  char *res = stpcpy(y, x);  // NOLINT
1298  ASSERT_EQ(res, y + 2);
1299  EXPECT_NOT_POISONED(y[0]);
1300  EXPECT_POISONED(y[1]);
1301  EXPECT_NOT_POISONED(y[2]);
1302}
1303
1304TEST(MemorySanitizer, strtol) {
1305  char *e;
1306  assert(1 == strtol("1", &e, 10));
1307  EXPECT_NOT_POISONED((S8) e);
1308}
1309
1310TEST(MemorySanitizer, strtoll) {
1311  char *e;
1312  assert(1 == strtoll("1", &e, 10));
1313  EXPECT_NOT_POISONED((S8) e);
1314}
1315
1316TEST(MemorySanitizer, strtoul) {
1317  char *e;
1318  assert(1 == strtoul("1", &e, 10));
1319  EXPECT_NOT_POISONED((S8) e);
1320}
1321
1322TEST(MemorySanitizer, strtoull) {
1323  char *e;
1324  assert(1 == strtoull("1", &e, 10));
1325  EXPECT_NOT_POISONED((S8) e);
1326}
1327
1328TEST(MemorySanitizer, strtoimax) {
1329  char *e;
1330  assert(1 == strtoimax("1", &e, 10));
1331  EXPECT_NOT_POISONED((S8) e);
1332}
1333
1334TEST(MemorySanitizer, strtoumax) {
1335  char *e;
1336  assert(1 == strtoumax("1", &e, 10));
1337  EXPECT_NOT_POISONED((S8) e);
1338}
1339
1340TEST(MemorySanitizer, strtod) {
1341  char *e;
1342  assert(0 != strtod("1.5", &e));
1343  EXPECT_NOT_POISONED((S8) e);
1344}
1345
1346#ifdef __GLIBC__
1347extern "C" double __strtod_l(const char *nptr, char **endptr, locale_t loc);
1348TEST(MemorySanitizer, __strtod_l) {
1349  locale_t loc = newlocale(LC_NUMERIC_MASK, "C", (locale_t)0);
1350  char *e;
1351  assert(0 != __strtod_l("1.5", &e, loc));
1352  EXPECT_NOT_POISONED((S8) e);
1353  freelocale(loc);
1354}
1355#endif  // __GLIBC__
1356
1357TEST(MemorySanitizer, strtof) {
1358  char *e;
1359  assert(0 != strtof("1.5", &e));
1360  EXPECT_NOT_POISONED((S8) e);
1361}
1362
1363TEST(MemorySanitizer, strtold) {
1364  char *e;
1365  assert(0 != strtold("1.5", &e));
1366  EXPECT_NOT_POISONED((S8) e);
1367}
1368
1369TEST(MemorySanitizer, modf) {
1370  double x, y;
1371  x = modf(2.1, &y);
1372  EXPECT_NOT_POISONED(y);
1373}
1374
1375TEST(MemorySanitizer, modff) {
1376  float x, y;
1377  x = modff(2.1, &y);
1378  EXPECT_NOT_POISONED(y);
1379}
1380
1381TEST(MemorySanitizer, modfl) {
1382  long double x, y;
1383  x = modfl(2.1, &y);
1384  EXPECT_NOT_POISONED(y);
1385}
1386
1387TEST(MemorySanitizer, sprintf) {  // NOLINT
1388  char buff[10];
1389  break_optimization(buff);
1390  EXPECT_POISONED(buff[0]);
1391  int res = sprintf(buff, "%d", 1234567);  // NOLINT
1392  assert(res == 7);
1393  assert(buff[0] == '1');
1394  assert(buff[1] == '2');
1395  assert(buff[2] == '3');
1396  assert(buff[6] == '7');
1397  assert(buff[7] == 0);
1398  EXPECT_POISONED(buff[8]);
1399}
1400
1401TEST(MemorySanitizer, snprintf) {
1402  char buff[10];
1403  break_optimization(buff);
1404  EXPECT_POISONED(buff[0]);
1405  int res = snprintf(buff, sizeof(buff), "%d", 1234567);
1406  assert(res == 7);
1407  assert(buff[0] == '1');
1408  assert(buff[1] == '2');
1409  assert(buff[2] == '3');
1410  assert(buff[6] == '7');
1411  assert(buff[7] == 0);
1412  EXPECT_POISONED(buff[8]);
1413}
1414
1415TEST(MemorySanitizer, swprintf) {
1416  wchar_t buff[10];
1417  assert(sizeof(wchar_t) == 4);
1418  break_optimization(buff);
1419  EXPECT_POISONED(buff[0]);
1420  int res = swprintf(buff, 9, L"%d", 1234567);
1421  assert(res == 7);
1422  assert(buff[0] == '1');
1423  assert(buff[1] == '2');
1424  assert(buff[2] == '3');
1425  assert(buff[6] == '7');
1426  assert(buff[7] == 0);
1427  EXPECT_POISONED(buff[8]);
1428}
1429
1430TEST(MemorySanitizer, asprintf) {  // NOLINT
1431  char *pbuf;
1432  EXPECT_POISONED(pbuf);
1433  int res = asprintf(&pbuf, "%d", 1234567);  // NOLINT
1434  assert(res == 7);
1435  EXPECT_NOT_POISONED(pbuf);
1436  assert(pbuf[0] == '1');
1437  assert(pbuf[1] == '2');
1438  assert(pbuf[2] == '3');
1439  assert(pbuf[6] == '7');
1440  assert(pbuf[7] == 0);
1441  free(pbuf);
1442}
1443
1444TEST(MemorySanitizer, mbstowcs) {
1445  const char *x = "abc";
1446  wchar_t buff[10];
1447  int res = mbstowcs(buff, x, 2);
1448  EXPECT_EQ(2, res);
1449  EXPECT_EQ(L'a', buff[0]);
1450  EXPECT_EQ(L'b', buff[1]);
1451  EXPECT_POISONED(buff[2]);
1452  res = mbstowcs(buff, x, 10);
1453  EXPECT_EQ(3, res);
1454  EXPECT_NOT_POISONED(buff[3]);
1455}
1456
1457TEST(MemorySanitizer, wcstombs) {
1458  const wchar_t *x = L"abc";
1459  char buff[10];
1460  int res = wcstombs(buff, x, 4);
1461  EXPECT_EQ(res, 3);
1462  EXPECT_EQ(buff[0], 'a');
1463  EXPECT_EQ(buff[1], 'b');
1464  EXPECT_EQ(buff[2], 'c');
1465}
1466
1467TEST(MemorySanitizer, wcsrtombs) {
1468  const wchar_t *x = L"abc";
1469  const wchar_t *p = x;
1470  char buff[10];
1471  mbstate_t mbs;
1472  memset(&mbs, 0, sizeof(mbs));
1473  int res = wcsrtombs(buff, &p, 4, &mbs);
1474  EXPECT_EQ(res, 3);
1475  EXPECT_EQ(buff[0], 'a');
1476  EXPECT_EQ(buff[1], 'b');
1477  EXPECT_EQ(buff[2], 'c');
1478  EXPECT_EQ(buff[3], '\0');
1479  EXPECT_POISONED(buff[4]);
1480}
1481
1482TEST(MemorySanitizer, wcsnrtombs) {
1483  const wchar_t *x = L"abc";
1484  const wchar_t *p = x;
1485  char buff[10];
1486  mbstate_t mbs;
1487  memset(&mbs, 0, sizeof(mbs));
1488  int res = wcsnrtombs(buff, &p, 2, 4, &mbs);
1489  EXPECT_EQ(res, 2);
1490  EXPECT_EQ(buff[0], 'a');
1491  EXPECT_EQ(buff[1], 'b');
1492  EXPECT_POISONED(buff[2]);
1493}
1494
1495TEST(MemorySanitizer, mbtowc) {
1496  const char *x = "abc";
1497  wchar_t wx;
1498  int res = mbtowc(&wx, x, 3);
1499  EXPECT_GT(res, 0);
1500  EXPECT_NOT_POISONED(wx);
1501}
1502
1503TEST(MemorySanitizer, mbrtowc) {
1504  const char *x = "abc";
1505  wchar_t wx;
1506  mbstate_t mbs;
1507  memset(&mbs, 0, sizeof(mbs));
1508  int res = mbrtowc(&wx, x, 3, &mbs);
1509  EXPECT_GT(res, 0);
1510  EXPECT_NOT_POISONED(wx);
1511}
1512
1513TEST(MemorySanitizer, gettimeofday) {
1514  struct timeval tv;
1515  struct timezone tz;
1516  break_optimization(&tv);
1517  break_optimization(&tz);
1518  assert(sizeof(tv) == 16);
1519  assert(sizeof(tz) == 8);
1520  EXPECT_POISONED(tv.tv_sec);
1521  EXPECT_POISONED(tv.tv_usec);
1522  EXPECT_POISONED(tz.tz_minuteswest);
1523  EXPECT_POISONED(tz.tz_dsttime);
1524  assert(0 == gettimeofday(&tv, &tz));
1525  EXPECT_NOT_POISONED(tv.tv_sec);
1526  EXPECT_NOT_POISONED(tv.tv_usec);
1527  EXPECT_NOT_POISONED(tz.tz_minuteswest);
1528  EXPECT_NOT_POISONED(tz.tz_dsttime);
1529}
1530
1531TEST(MemorySanitizer, clock_gettime) {
1532  struct timespec tp;
1533  EXPECT_POISONED(tp.tv_sec);
1534  EXPECT_POISONED(tp.tv_nsec);
1535  assert(0 == clock_gettime(CLOCK_REALTIME, &tp));
1536  EXPECT_NOT_POISONED(tp.tv_sec);
1537  EXPECT_NOT_POISONED(tp.tv_nsec);
1538}
1539
1540TEST(MemorySanitizer, clock_getres) {
1541  struct timespec tp;
1542  EXPECT_POISONED(tp.tv_sec);
1543  EXPECT_POISONED(tp.tv_nsec);
1544  assert(0 == clock_getres(CLOCK_REALTIME, 0));
1545  EXPECT_POISONED(tp.tv_sec);
1546  EXPECT_POISONED(tp.tv_nsec);
1547  assert(0 == clock_getres(CLOCK_REALTIME, &tp));
1548  EXPECT_NOT_POISONED(tp.tv_sec);
1549  EXPECT_NOT_POISONED(tp.tv_nsec);
1550}
1551
1552TEST(MemorySanitizer, getitimer) {
1553  struct itimerval it1, it2;
1554  int res;
1555  EXPECT_POISONED(it1.it_interval.tv_sec);
1556  EXPECT_POISONED(it1.it_interval.tv_usec);
1557  EXPECT_POISONED(it1.it_value.tv_sec);
1558  EXPECT_POISONED(it1.it_value.tv_usec);
1559  res = getitimer(ITIMER_VIRTUAL, &it1);
1560  assert(!res);
1561  EXPECT_NOT_POISONED(it1.it_interval.tv_sec);
1562  EXPECT_NOT_POISONED(it1.it_interval.tv_usec);
1563  EXPECT_NOT_POISONED(it1.it_value.tv_sec);
1564  EXPECT_NOT_POISONED(it1.it_value.tv_usec);
1565
1566  it1.it_interval.tv_sec = it1.it_value.tv_sec = 10000;
1567  it1.it_interval.tv_usec = it1.it_value.tv_usec = 0;
1568
1569  res = setitimer(ITIMER_VIRTUAL, &it1, &it2);
1570  assert(!res);
1571  EXPECT_NOT_POISONED(it2.it_interval.tv_sec);
1572  EXPECT_NOT_POISONED(it2.it_interval.tv_usec);
1573  EXPECT_NOT_POISONED(it2.it_value.tv_sec);
1574  EXPECT_NOT_POISONED(it2.it_value.tv_usec);
1575
1576  // Check that old_value can be 0, and disable the timer.
1577  memset(&it1, 0, sizeof(it1));
1578  res = setitimer(ITIMER_VIRTUAL, &it1, 0);
1579  assert(!res);
1580}
1581
1582TEST(MemorySanitizer, setitimer_null) {
1583  setitimer(ITIMER_VIRTUAL, 0, 0);
1584  // Not testing the return value, since it the behaviour seems to differ
1585  // between libc implementations and POSIX.
1586  // Should never crash, though.
1587}
1588
1589TEST(MemorySanitizer, time) {
1590  time_t t;
1591  EXPECT_POISONED(t);
1592  time_t t2 = time(&t);
1593  assert(t2 != (time_t)-1);
1594  EXPECT_NOT_POISONED(t);
1595}
1596
1597TEST(MemorySanitizer, localtime) {
1598  time_t t = 123;
1599  struct tm *time = localtime(&t);
1600  assert(time != 0);
1601  EXPECT_NOT_POISONED(time->tm_sec);
1602  EXPECT_NOT_POISONED(time->tm_hour);
1603  EXPECT_NOT_POISONED(time->tm_year);
1604  EXPECT_NOT_POISONED(time->tm_isdst);
1605  EXPECT_NE(0, strlen(time->tm_zone));
1606}
1607
1608TEST(MemorySanitizer, localtime_r) {
1609  time_t t = 123;
1610  struct tm time;
1611  struct tm *res = localtime_r(&t, &time);
1612  assert(res != 0);
1613  EXPECT_NOT_POISONED(time.tm_sec);
1614  EXPECT_NOT_POISONED(time.tm_hour);
1615  EXPECT_NOT_POISONED(time.tm_year);
1616  EXPECT_NOT_POISONED(time.tm_isdst);
1617  EXPECT_NE(0, strlen(time.tm_zone));
1618}
1619
1620TEST(MemorySanitizer, getmntent) {
1621  FILE *fp = setmntent("/etc/fstab", "r");
1622  struct mntent *mnt = getmntent(fp);
1623  ASSERT_NE((void *)0, mnt);
1624  ASSERT_NE(0, strlen(mnt->mnt_fsname));
1625  ASSERT_NE(0, strlen(mnt->mnt_dir));
1626  ASSERT_NE(0, strlen(mnt->mnt_type));
1627  ASSERT_NE(0, strlen(mnt->mnt_opts));
1628  EXPECT_NOT_POISONED(mnt->mnt_freq);
1629  EXPECT_NOT_POISONED(mnt->mnt_passno);
1630  fclose(fp);
1631}
1632
1633TEST(MemorySanitizer, getmntent_r) {
1634  FILE *fp = setmntent("/etc/fstab", "r");
1635  struct mntent mntbuf;
1636  char buf[1000];
1637  struct mntent *mnt = getmntent_r(fp, &mntbuf, buf, sizeof(buf));
1638  ASSERT_NE((void *)0, mnt);
1639  ASSERT_NE(0, strlen(mnt->mnt_fsname));
1640  ASSERT_NE(0, strlen(mnt->mnt_dir));
1641  ASSERT_NE(0, strlen(mnt->mnt_type));
1642  ASSERT_NE(0, strlen(mnt->mnt_opts));
1643  EXPECT_NOT_POISONED(mnt->mnt_freq);
1644  EXPECT_NOT_POISONED(mnt->mnt_passno);
1645  fclose(fp);
1646}
1647
1648TEST(MemorySanitizer, mmap) {
1649  const int size = 4096;
1650  void *p1, *p2;
1651  p1 = mmap(0, size, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANON, -1, 0);
1652  __msan_poison(p1, size);
1653  munmap(p1, size);
1654  for (int i = 0; i < 1000; i++) {
1655    p2 = mmap(0, size, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANON, -1, 0);
1656    if (p2 == p1)
1657      break;
1658    else
1659      munmap(p2, size);
1660  }
1661  if (p1 == p2) {
1662    EXPECT_NOT_POISONED(*(char*)p2);
1663    munmap(p2, size);
1664  }
1665}
1666
1667// FIXME: enable and add ecvt.
1668// FIXME: check why msandr does nt handle fcvt.
1669TEST(MemorySanitizer, fcvt) {
1670  int a, b;
1671  break_optimization(&a);
1672  break_optimization(&b);
1673  EXPECT_POISONED(a);
1674  EXPECT_POISONED(b);
1675  char *str = fcvt(12345.6789, 10, &a, &b);
1676  EXPECT_NOT_POISONED(a);
1677  EXPECT_NOT_POISONED(b);
1678}
1679
1680TEST(MemorySanitizer, frexp) {
1681  int x;
1682  x = *GetPoisoned<int>();
1683  double r = frexp(1.1, &x);
1684  EXPECT_NOT_POISONED(r);
1685  EXPECT_NOT_POISONED(x);
1686
1687  x = *GetPoisoned<int>();
1688  float rf = frexpf(1.1, &x);
1689  EXPECT_NOT_POISONED(rf);
1690  EXPECT_NOT_POISONED(x);
1691
1692  x = *GetPoisoned<int>();
1693  double rl = frexpl(1.1, &x);
1694  EXPECT_NOT_POISONED(rl);
1695  EXPECT_NOT_POISONED(x);
1696}
1697
1698namespace {
1699
1700static int cnt;
1701
1702void SigactionHandler(int signo, siginfo_t* si, void* uc) {
1703  assert(signo == SIGPROF);
1704  assert(si);
1705  EXPECT_NOT_POISONED(si->si_errno);
1706  EXPECT_NOT_POISONED(si->si_pid);
1707#if __linux__
1708# if defined(__x86_64__)
1709  EXPECT_NOT_POISONED(((ucontext_t*)uc)->uc_mcontext.gregs[REG_RIP]);
1710# elif defined(__i386__)
1711  EXPECT_NOT_POISONED(((ucontext_t*)uc)->uc_mcontext.gregs[REG_EIP]);
1712# endif
1713#endif
1714  ++cnt;
1715}
1716
1717TEST(MemorySanitizer, sigaction) {
1718  struct sigaction act = {};
1719  struct sigaction oldact = {};
1720  struct sigaction origact = {};
1721
1722  sigaction(SIGPROF, 0, &origact);
1723
1724  act.sa_flags |= SA_SIGINFO;
1725  act.sa_sigaction = &SigactionHandler;
1726  sigaction(SIGPROF, &act, 0);
1727
1728  kill(getpid(), SIGPROF);
1729
1730  act.sa_flags &= ~SA_SIGINFO;
1731  act.sa_handler = SIG_DFL;
1732  sigaction(SIGPROF, &act, 0);
1733
1734  act.sa_flags &= ~SA_SIGINFO;
1735  act.sa_handler = SIG_IGN;
1736  sigaction(SIGPROF, &act, &oldact);
1737  EXPECT_FALSE(oldact.sa_flags & SA_SIGINFO);
1738  EXPECT_EQ(SIG_DFL, oldact.sa_handler);
1739  kill(getpid(), SIGPROF);
1740
1741  act.sa_flags |= SA_SIGINFO;
1742  act.sa_sigaction = &SigactionHandler;
1743  sigaction(SIGPROF, &act, &oldact);
1744  EXPECT_FALSE(oldact.sa_flags & SA_SIGINFO);
1745  EXPECT_EQ(SIG_IGN, oldact.sa_handler);
1746  kill(getpid(), SIGPROF);
1747
1748  act.sa_flags &= ~SA_SIGINFO;
1749  act.sa_handler = SIG_DFL;
1750  sigaction(SIGPROF, &act, &oldact);
1751  EXPECT_TRUE(oldact.sa_flags & SA_SIGINFO);
1752  EXPECT_EQ(&SigactionHandler, oldact.sa_sigaction);
1753  EXPECT_EQ(2, cnt);
1754
1755  sigaction(SIGPROF, &origact, 0);
1756}
1757
1758} // namespace
1759
1760
1761TEST(MemorySanitizer, sigemptyset) {
1762  sigset_t s;
1763  EXPECT_POISONED(s);
1764  int res = sigemptyset(&s);
1765  ASSERT_EQ(0, res);
1766  EXPECT_NOT_POISONED(s);
1767}
1768
1769TEST(MemorySanitizer, sigfillset) {
1770  sigset_t s;
1771  EXPECT_POISONED(s);
1772  int res = sigfillset(&s);
1773  ASSERT_EQ(0, res);
1774  EXPECT_NOT_POISONED(s);
1775}
1776
1777TEST(MemorySanitizer, sigpending) {
1778  sigset_t s;
1779  EXPECT_POISONED(s);
1780  int res = sigpending(&s);
1781  ASSERT_EQ(0, res);
1782  EXPECT_NOT_POISONED(s);
1783}
1784
1785TEST(MemorySanitizer, sigprocmask) {
1786  sigset_t s;
1787  EXPECT_POISONED(s);
1788  int res = sigprocmask(SIG_BLOCK, 0, &s);
1789  ASSERT_EQ(0, res);
1790  EXPECT_NOT_POISONED(s);
1791}
1792
1793struct StructWithDtor {
1794  ~StructWithDtor();
1795};
1796
1797NOINLINE StructWithDtor::~StructWithDtor() {
1798  break_optimization(0);
1799}
1800
1801TEST(MemorySanitizer, Invoke) {
1802  StructWithDtor s;  // Will cause the calls to become invokes.
1803  EXPECT_NOT_POISONED(0);
1804  EXPECT_POISONED(*GetPoisoned<int>());
1805  EXPECT_NOT_POISONED(0);
1806  EXPECT_POISONED(*GetPoisoned<int>());
1807  EXPECT_POISONED(ReturnPoisoned<S4>());
1808}
1809
1810TEST(MemorySanitizer, ptrtoint) {
1811  // Test that shadow is propagated through pointer-to-integer conversion.
1812  void* p = (void*)0xABCD;
1813  __msan_poison(((char*)&p) + 1, sizeof(p));
1814  EXPECT_NOT_POISONED((((uintptr_t)p) & 0xFF) == 0);
1815
1816  void* q = (void*)0xABCD;
1817  __msan_poison(&q, sizeof(q) - 1);
1818  EXPECT_POISONED((((uintptr_t)q) & 0xFF) == 0);
1819}
1820
1821static void vaargsfn2(int guard, ...) {
1822  va_list vl;
1823  va_start(vl, guard);
1824  EXPECT_NOT_POISONED(va_arg(vl, int));
1825  EXPECT_NOT_POISONED(va_arg(vl, int));
1826  EXPECT_NOT_POISONED(va_arg(vl, int));
1827  EXPECT_POISONED(va_arg(vl, double));
1828  va_end(vl);
1829}
1830
1831static void vaargsfn(int guard, ...) {
1832  va_list vl;
1833  va_start(vl, guard);
1834  EXPECT_NOT_POISONED(va_arg(vl, int));
1835  EXPECT_POISONED(va_arg(vl, int));
1836  // The following call will overwrite __msan_param_tls.
1837  // Checks after it test that arg shadow was somehow saved across the call.
1838  vaargsfn2(1, 2, 3, 4, *GetPoisoned<double>());
1839  EXPECT_NOT_POISONED(va_arg(vl, int));
1840  EXPECT_POISONED(va_arg(vl, int));
1841  va_end(vl);
1842}
1843
1844TEST(MemorySanitizer, VAArgTest) {
1845  int* x = GetPoisoned<int>();
1846  int* y = GetPoisoned<int>(4);
1847  vaargsfn(1, 13, *x, 42, *y);
1848}
1849
1850static void vaargsfn_many(int guard, ...) {
1851  va_list vl;
1852  va_start(vl, guard);
1853  EXPECT_NOT_POISONED(va_arg(vl, int));
1854  EXPECT_POISONED(va_arg(vl, int));
1855  EXPECT_NOT_POISONED(va_arg(vl, int));
1856  EXPECT_NOT_POISONED(va_arg(vl, int));
1857  EXPECT_NOT_POISONED(va_arg(vl, int));
1858  EXPECT_NOT_POISONED(va_arg(vl, int));
1859  EXPECT_NOT_POISONED(va_arg(vl, int));
1860  EXPECT_NOT_POISONED(va_arg(vl, int));
1861  EXPECT_NOT_POISONED(va_arg(vl, int));
1862  EXPECT_POISONED(va_arg(vl, int));
1863  va_end(vl);
1864}
1865
1866TEST(MemorySanitizer, VAArgManyTest) {
1867  int* x = GetPoisoned<int>();
1868  int* y = GetPoisoned<int>(4);
1869  vaargsfn_many(1, 2, *x, 3, 4, 5, 6, 7, 8, 9, *y);
1870}
1871
1872static void vaargsfn_pass2(va_list vl) {
1873  EXPECT_NOT_POISONED(va_arg(vl, int));
1874  EXPECT_NOT_POISONED(va_arg(vl, int));
1875  EXPECT_POISONED(va_arg(vl, int));
1876}
1877
1878static void vaargsfn_pass(int guard, ...) {
1879  va_list vl;
1880  va_start(vl, guard);
1881  EXPECT_POISONED(va_arg(vl, int));
1882  vaargsfn_pass2(vl);
1883  va_end(vl);
1884}
1885
1886TEST(MemorySanitizer, VAArgPass) {
1887  int* x = GetPoisoned<int>();
1888  int* y = GetPoisoned<int>(4);
1889  vaargsfn_pass(1, *x, 2, 3, *y);
1890}
1891
1892static void vaargsfn_copy2(va_list vl) {
1893  EXPECT_NOT_POISONED(va_arg(vl, int));
1894  EXPECT_POISONED(va_arg(vl, int));
1895}
1896
1897static void vaargsfn_copy(int guard, ...) {
1898  va_list vl;
1899  va_start(vl, guard);
1900  EXPECT_NOT_POISONED(va_arg(vl, int));
1901  EXPECT_POISONED(va_arg(vl, int));
1902  va_list vl2;
1903  va_copy(vl2, vl);
1904  vaargsfn_copy2(vl2);
1905  EXPECT_NOT_POISONED(va_arg(vl, int));
1906  EXPECT_POISONED(va_arg(vl, int));
1907  va_end(vl);
1908}
1909
1910TEST(MemorySanitizer, VAArgCopy) {
1911  int* x = GetPoisoned<int>();
1912  int* y = GetPoisoned<int>(4);
1913  vaargsfn_copy(1, 2, *x, 3, *y);
1914}
1915
1916static void vaargsfn_ptr(int guard, ...) {
1917  va_list vl;
1918  va_start(vl, guard);
1919  EXPECT_NOT_POISONED(va_arg(vl, int*));
1920  EXPECT_POISONED(va_arg(vl, int*));
1921  EXPECT_NOT_POISONED(va_arg(vl, int*));
1922  EXPECT_POISONED(va_arg(vl, double*));
1923  va_end(vl);
1924}
1925
1926TEST(MemorySanitizer, VAArgPtr) {
1927  int** x = GetPoisoned<int*>();
1928  double** y = GetPoisoned<double*>(8);
1929  int z;
1930  vaargsfn_ptr(1, &z, *x, &z, *y);
1931}
1932
1933static void vaargsfn_overflow(int guard, ...) {
1934  va_list vl;
1935  va_start(vl, guard);
1936  EXPECT_NOT_POISONED(va_arg(vl, int));
1937  EXPECT_NOT_POISONED(va_arg(vl, int));
1938  EXPECT_POISONED(va_arg(vl, int));
1939  EXPECT_NOT_POISONED(va_arg(vl, int));
1940  EXPECT_NOT_POISONED(va_arg(vl, int));
1941  EXPECT_NOT_POISONED(va_arg(vl, int));
1942
1943  EXPECT_NOT_POISONED(va_arg(vl, double));
1944  EXPECT_NOT_POISONED(va_arg(vl, double));
1945  EXPECT_NOT_POISONED(va_arg(vl, double));
1946  EXPECT_POISONED(va_arg(vl, double));
1947  EXPECT_NOT_POISONED(va_arg(vl, double));
1948  EXPECT_POISONED(va_arg(vl, int*));
1949  EXPECT_NOT_POISONED(va_arg(vl, double));
1950  EXPECT_NOT_POISONED(va_arg(vl, double));
1951
1952  EXPECT_POISONED(va_arg(vl, int));
1953  EXPECT_POISONED(va_arg(vl, double));
1954  EXPECT_POISONED(va_arg(vl, int*));
1955
1956  EXPECT_NOT_POISONED(va_arg(vl, int));
1957  EXPECT_NOT_POISONED(va_arg(vl, double));
1958  EXPECT_NOT_POISONED(va_arg(vl, int*));
1959
1960  EXPECT_POISONED(va_arg(vl, int));
1961  EXPECT_POISONED(va_arg(vl, double));
1962  EXPECT_POISONED(va_arg(vl, int*));
1963
1964  va_end(vl);
1965}
1966
1967TEST(MemorySanitizer, VAArgOverflow) {
1968  int* x = GetPoisoned<int>();
1969  double* y = GetPoisoned<double>(8);
1970  int** p = GetPoisoned<int*>(16);
1971  int z;
1972  vaargsfn_overflow(1,
1973      1, 2, *x, 4, 5, 6,
1974      1.1, 2.2, 3.3, *y, 5.5, *p, 7.7, 8.8,
1975      // the following args will overflow for sure
1976      *x, *y, *p,
1977      7, 9.9, &z,
1978      *x, *y, *p);
1979}
1980
1981static void vaargsfn_tlsoverwrite2(int guard, ...) {
1982  va_list vl;
1983  va_start(vl, guard);
1984  for (int i = 0; i < 20; ++i)
1985    EXPECT_NOT_POISONED(va_arg(vl, int));
1986  va_end(vl);
1987}
1988
1989static void vaargsfn_tlsoverwrite(int guard, ...) {
1990  // This call will overwrite TLS contents unless it's backed up somewhere.
1991  vaargsfn_tlsoverwrite2(2,
1992      42, 42, 42, 42, 42,
1993      42, 42, 42, 42, 42,
1994      42, 42, 42, 42, 42,
1995      42, 42, 42, 42, 42); // 20x
1996  va_list vl;
1997  va_start(vl, guard);
1998  for (int i = 0; i < 20; ++i)
1999    EXPECT_POISONED(va_arg(vl, int));
2000  va_end(vl);
2001}
2002
2003TEST(MemorySanitizer, VAArgTLSOverwrite) {
2004  int* x = GetPoisoned<int>();
2005  vaargsfn_tlsoverwrite(1,
2006      *x, *x, *x, *x, *x,
2007      *x, *x, *x, *x, *x,
2008      *x, *x, *x, *x, *x,
2009      *x, *x, *x, *x, *x); // 20x
2010
2011}
2012
2013struct StructByVal {
2014  int a, b, c, d, e, f;
2015};
2016
2017NOINLINE void StructByValTestFunc(struct StructByVal s) {
2018  EXPECT_NOT_POISONED(s.a);
2019  EXPECT_POISONED(s.b);
2020  EXPECT_NOT_POISONED(s.c);
2021  EXPECT_POISONED(s.d);
2022  EXPECT_NOT_POISONED(s.e);
2023  EXPECT_POISONED(s.f);
2024}
2025
2026NOINLINE void StructByValTestFunc1(struct StructByVal s) {
2027  StructByValTestFunc(s);
2028}
2029
2030NOINLINE void StructByValTestFunc2(int z, struct StructByVal s) {
2031  StructByValTestFunc(s);
2032}
2033
2034TEST(MemorySanitizer, StructByVal) {
2035  // Large aggregates are passed as "byval" pointer argument in LLVM.
2036  struct StructByVal s;
2037  s.a = 1;
2038  s.b = *GetPoisoned<int>();
2039  s.c = 2;
2040  s.d = *GetPoisoned<int>();
2041  s.e = 3;
2042  s.f = *GetPoisoned<int>();
2043  StructByValTestFunc(s);
2044  StructByValTestFunc1(s);
2045  StructByValTestFunc2(0, s);
2046}
2047
2048
2049#if MSAN_HAS_M128
2050NOINLINE __m128i m128Eq(__m128i *a, __m128i *b) { return _mm_cmpeq_epi16(*a, *b); }
2051NOINLINE __m128i m128Lt(__m128i *a, __m128i *b) { return _mm_cmplt_epi16(*a, *b); }
2052TEST(MemorySanitizer, m128) {
2053  __m128i a = _mm_set1_epi16(0x1234);
2054  __m128i b = _mm_set1_epi16(0x7890);
2055  EXPECT_NOT_POISONED(m128Eq(&a, &b));
2056  EXPECT_NOT_POISONED(m128Lt(&a, &b));
2057}
2058// FIXME: add more tests for __m128i.
2059#endif  // MSAN_HAS_M128
2060
2061// We should not complain when copying this poisoned hole.
2062struct StructWithHole {
2063  U4  a;
2064  // 4-byte hole.
2065  U8  b;
2066};
2067
2068NOINLINE StructWithHole ReturnStructWithHole() {
2069  StructWithHole res;
2070  __msan_poison(&res, sizeof(res));
2071  res.a = 1;
2072  res.b = 2;
2073  return res;
2074}
2075
2076TEST(MemorySanitizer, StructWithHole) {
2077  StructWithHole a = ReturnStructWithHole();
2078  break_optimization(&a);
2079}
2080
2081template <class T>
2082NOINLINE T ReturnStruct() {
2083  T res;
2084  __msan_poison(&res, sizeof(res));
2085  res.a = 1;
2086  return res;
2087}
2088
2089template <class T>
2090NOINLINE void TestReturnStruct() {
2091  T s1 = ReturnStruct<T>();
2092  EXPECT_NOT_POISONED(s1.a);
2093  EXPECT_POISONED(s1.b);
2094}
2095
2096struct SSS1 {
2097  int a, b, c;
2098};
2099struct SSS2 {
2100  int b, a, c;
2101};
2102struct SSS3 {
2103  int b, c, a;
2104};
2105struct SSS4 {
2106  int c, b, a;
2107};
2108
2109struct SSS5 {
2110  int a;
2111  float b;
2112};
2113struct SSS6 {
2114  int a;
2115  double b;
2116};
2117struct SSS7 {
2118  S8 b;
2119  int a;
2120};
2121struct SSS8 {
2122  S2 b;
2123  S8 a;
2124};
2125
2126TEST(MemorySanitizer, IntStruct3) {
2127  TestReturnStruct<SSS1>();
2128  TestReturnStruct<SSS2>();
2129  TestReturnStruct<SSS3>();
2130  TestReturnStruct<SSS4>();
2131  TestReturnStruct<SSS5>();
2132  TestReturnStruct<SSS6>();
2133  TestReturnStruct<SSS7>();
2134  TestReturnStruct<SSS8>();
2135}
2136
2137struct LongStruct {
2138  U1 a1, b1;
2139  U2 a2, b2;
2140  U4 a4, b4;
2141  U8 a8, b8;
2142};
2143
2144NOINLINE LongStruct ReturnLongStruct1() {
2145  LongStruct res;
2146  __msan_poison(&res, sizeof(res));
2147  res.a1 = res.a2 = res.a4 = res.a8 = 111;
2148  // leaves b1, .., b8 poisoned.
2149  return res;
2150}
2151
2152NOINLINE LongStruct ReturnLongStruct2() {
2153  LongStruct res;
2154  __msan_poison(&res, sizeof(res));
2155  res.b1 = res.b2 = res.b4 = res.b8 = 111;
2156  // leaves a1, .., a8 poisoned.
2157  return res;
2158}
2159
2160TEST(MemorySanitizer, LongStruct) {
2161  LongStruct s1 = ReturnLongStruct1();
2162  __msan_print_shadow(&s1, sizeof(s1));
2163  EXPECT_NOT_POISONED(s1.a1);
2164  EXPECT_NOT_POISONED(s1.a2);
2165  EXPECT_NOT_POISONED(s1.a4);
2166  EXPECT_NOT_POISONED(s1.a8);
2167
2168  EXPECT_POISONED(s1.b1);
2169  EXPECT_POISONED(s1.b2);
2170  EXPECT_POISONED(s1.b4);
2171  EXPECT_POISONED(s1.b8);
2172
2173  LongStruct s2 = ReturnLongStruct2();
2174  __msan_print_shadow(&s2, sizeof(s2));
2175  EXPECT_NOT_POISONED(s2.b1);
2176  EXPECT_NOT_POISONED(s2.b2);
2177  EXPECT_NOT_POISONED(s2.b4);
2178  EXPECT_NOT_POISONED(s2.b8);
2179
2180  EXPECT_POISONED(s2.a1);
2181  EXPECT_POISONED(s2.a2);
2182  EXPECT_POISONED(s2.a4);
2183  EXPECT_POISONED(s2.a8);
2184}
2185
2186TEST(MemorySanitizer, getrlimit) {
2187  struct rlimit limit;
2188  __msan_poison(&limit, sizeof(limit));
2189  int result = getrlimit(RLIMIT_DATA, &limit);
2190  assert(result == 0);
2191  EXPECT_NOT_POISONED(limit.rlim_cur);
2192  EXPECT_NOT_POISONED(limit.rlim_max);
2193}
2194
2195TEST(MemorySanitizer, getrusage) {
2196  struct rusage usage;
2197  __msan_poison(&usage, sizeof(usage));
2198  int result = getrusage(RUSAGE_SELF, &usage);
2199  assert(result == 0);
2200  EXPECT_NOT_POISONED(usage.ru_utime.tv_sec);
2201  EXPECT_NOT_POISONED(usage.ru_utime.tv_usec);
2202  EXPECT_NOT_POISONED(usage.ru_stime.tv_sec);
2203  EXPECT_NOT_POISONED(usage.ru_stime.tv_usec);
2204  EXPECT_NOT_POISONED(usage.ru_maxrss);
2205  EXPECT_NOT_POISONED(usage.ru_minflt);
2206  EXPECT_NOT_POISONED(usage.ru_majflt);
2207  EXPECT_NOT_POISONED(usage.ru_inblock);
2208  EXPECT_NOT_POISONED(usage.ru_oublock);
2209  EXPECT_NOT_POISONED(usage.ru_nvcsw);
2210  EXPECT_NOT_POISONED(usage.ru_nivcsw);
2211}
2212
2213#ifdef __GLIBC__
2214extern char *program_invocation_name;
2215#else  // __GLIBC__
2216# error "TODO: port this"
2217#endif
2218
2219static void dladdr_testfn() {}
2220
2221TEST(MemorySanitizer, dladdr) {
2222  Dl_info info;
2223  __msan_poison(&info, sizeof(info));
2224  int result = dladdr((const void*)dladdr_testfn, &info);
2225  assert(result != 0);
2226  EXPECT_NOT_POISONED((unsigned long)info.dli_fname);
2227  if (info.dli_fname)
2228    EXPECT_NOT_POISONED(strlen(info.dli_fname));
2229  EXPECT_NOT_POISONED((unsigned long)info.dli_fbase);
2230  EXPECT_NOT_POISONED((unsigned long)info.dli_sname);
2231  if (info.dli_sname)
2232    EXPECT_NOT_POISONED(strlen(info.dli_sname));
2233  EXPECT_NOT_POISONED((unsigned long)info.dli_saddr);
2234}
2235
2236#ifndef MSAN_TEST_DISABLE_DLOPEN
2237
2238static int dl_phdr_callback(struct dl_phdr_info *info, size_t size, void *data) {
2239  (*(int *)data)++;
2240  EXPECT_NOT_POISONED(info->dlpi_addr);
2241  EXPECT_NOT_POISONED(strlen(info->dlpi_name));
2242  EXPECT_NOT_POISONED(info->dlpi_phnum);
2243  for (int i = 0; i < info->dlpi_phnum; ++i)
2244    EXPECT_NOT_POISONED(info->dlpi_phdr[i]);
2245  return 0;
2246}
2247
2248// Compute the path to our loadable DSO.  We assume it's in the same
2249// directory.  Only use string routines that we intercept so far to do this.
2250static int PathToLoadable(char *buf, size_t sz) {
2251  const char *basename = "libmsan_loadable.x86_64.so";
2252  char *argv0 = program_invocation_name;
2253  char *last_slash = strrchr(argv0, '/');
2254  assert(last_slash);
2255  int res =
2256      snprintf(buf, sz, "%.*s/%s", int(last_slash - argv0), argv0, basename);
2257  return res < sz ? 0 : res;
2258}
2259
2260TEST(MemorySanitizer, dl_iterate_phdr) {
2261  char path[4096];
2262  int res = PathToLoadable(path, sizeof(path));
2263  assert(!res);
2264
2265  // Having at least one dlopen'ed library in the process makes this more
2266  // entertaining.
2267  void *lib = dlopen(path, RTLD_LAZY);
2268  ASSERT_NE((void*)0, lib);
2269
2270  int count = 0;
2271  int result = dl_iterate_phdr(dl_phdr_callback, &count);
2272  assert(count > 0);
2273
2274  dlclose(lib);
2275}
2276
2277
2278TEST(MemorySanitizer, dlopen) {
2279  char path[4096];
2280  int res = PathToLoadable(path, sizeof(path));
2281  assert(!res);
2282
2283  // We need to clear shadow for globals when doing dlopen.  In order to test
2284  // this, we have to poison the shadow for the DSO before we load it.  In
2285  // general this is difficult, but the loader tends to reload things in the
2286  // same place, so we open, close, and then reopen.  The global should always
2287  // start out clean after dlopen.
2288  for (int i = 0; i < 2; i++) {
2289    void *lib = dlopen(path, RTLD_LAZY);
2290    if (lib == NULL) {
2291      printf("dlerror: %s\n", dlerror());
2292      assert(lib != NULL);
2293    }
2294    void **(*get_dso_global)() = (void **(*)())dlsym(lib, "get_dso_global");
2295    assert(get_dso_global);
2296    void **dso_global = get_dso_global();
2297    EXPECT_NOT_POISONED(*dso_global);
2298    __msan_poison(dso_global, sizeof(*dso_global));
2299    EXPECT_POISONED(*dso_global);
2300    dlclose(lib);
2301  }
2302}
2303
2304// Regression test for a crash in dlopen() interceptor.
2305TEST(MemorySanitizer, dlopenFailed) {
2306  const char *path = "/libmsan_loadable_does_not_exist.x86_64.so";
2307  void *lib = dlopen(path, RTLD_LAZY);
2308  ASSERT_EQ(0, lib);
2309}
2310
2311#endif // MSAN_TEST_DISABLE_DLOPEN
2312
2313TEST(MemorySanitizer, sched_getaffinity) {
2314  cpu_set_t mask;
2315  int res = sched_getaffinity(getpid(), sizeof(mask), &mask);
2316  ASSERT_EQ(0, res);
2317  EXPECT_NOT_POISONED(mask);
2318}
2319
2320TEST(MemorySanitizer, scanf) {
2321  const char *input = "42 hello";
2322  int* d = new int;
2323  char* s = new char[7];
2324  int res = sscanf(input, "%d %5s", d, s);
2325  printf("res %d\n", res);
2326  assert(res == 2);
2327  EXPECT_NOT_POISONED(*d);
2328  EXPECT_NOT_POISONED(s[0]);
2329  EXPECT_NOT_POISONED(s[1]);
2330  EXPECT_NOT_POISONED(s[2]);
2331  EXPECT_NOT_POISONED(s[3]);
2332  EXPECT_NOT_POISONED(s[4]);
2333  EXPECT_NOT_POISONED(s[5]);
2334  EXPECT_POISONED(s[6]);
2335  delete s;
2336  delete d;
2337}
2338
2339static void *SimpleThread_threadfn(void* data) {
2340  return new int;
2341}
2342
2343TEST(MemorySanitizer, SimpleThread) {
2344  pthread_t t;
2345  void *p;
2346  int res = pthread_create(&t, NULL, SimpleThread_threadfn, NULL);
2347  assert(!res);
2348  EXPECT_NOT_POISONED(t);
2349  res = pthread_join(t, &p);
2350  assert(!res);
2351  EXPECT_NOT_POISONED(p);
2352  delete (int*)p;
2353}
2354
2355static void *SmallStackThread_threadfn(void* data) {
2356  return 0;
2357}
2358
2359TEST(MemorySanitizer, SmallStackThread) {
2360  pthread_attr_t attr;
2361  pthread_t t;
2362  void *p;
2363  int res;
2364  res = pthread_attr_init(&attr);
2365  ASSERT_EQ(0, res);
2366  res = pthread_attr_setstacksize(&attr, 64 * 1024);
2367  ASSERT_EQ(0, res);
2368  res = pthread_create(&t, &attr, SmallStackThread_threadfn, NULL);
2369  ASSERT_EQ(0, res);
2370  res = pthread_join(t, &p);
2371  ASSERT_EQ(0, res);
2372  res = pthread_attr_destroy(&attr);
2373  ASSERT_EQ(0, res);
2374}
2375
2376TEST(MemorySanitizer, PreAllocatedStackThread) {
2377  pthread_attr_t attr;
2378  pthread_t t;
2379  int res;
2380  res = pthread_attr_init(&attr);
2381  ASSERT_EQ(0, res);
2382  void *stack;
2383  const size_t kStackSize = 64 * 1024;
2384  res = posix_memalign(&stack, 4096, kStackSize);
2385  ASSERT_EQ(0, res);
2386  res = pthread_attr_setstack(&attr, stack, kStackSize);
2387  ASSERT_EQ(0, res);
2388  // A small self-allocated stack can not be extended by the tool.
2389  // In this case pthread_create is expected to fail.
2390  res = pthread_create(&t, &attr, SmallStackThread_threadfn, NULL);
2391  EXPECT_NE(0, res);
2392  res = pthread_attr_destroy(&attr);
2393  ASSERT_EQ(0, res);
2394}
2395
2396TEST(MemorySanitizer, pthread_getschedparam) {
2397  int policy;
2398  struct sched_param param;
2399  int res = pthread_getschedparam(pthread_self(), &policy, &param);
2400  ASSERT_EQ(0, res);
2401  EXPECT_NOT_POISONED(policy);
2402  EXPECT_NOT_POISONED(param.sched_priority);
2403}
2404
2405TEST(MemorySanitizer, pthread_key_create) {
2406  pthread_key_t key;
2407  int res = pthread_key_create(&key, NULL);
2408  assert(!res);
2409  EXPECT_NOT_POISONED(key);
2410  res = pthread_key_delete(key);
2411  assert(!res);
2412}
2413
2414namespace {
2415struct SignalCondArg {
2416  pthread_cond_t* cond;
2417  pthread_mutex_t* mu;
2418  bool broadcast;
2419};
2420
2421void *SignalCond(void *param) {
2422  SignalCondArg *arg = reinterpret_cast<SignalCondArg *>(param);
2423  pthread_mutex_lock(arg->mu);
2424  if (arg->broadcast)
2425    pthread_cond_broadcast(arg->cond);
2426  else
2427    pthread_cond_signal(arg->cond);
2428  pthread_mutex_unlock(arg->mu);
2429  return 0;
2430}
2431}  // namespace
2432
2433TEST(MemorySanitizer, pthread_cond_wait) {
2434  pthread_cond_t cond;
2435  pthread_mutex_t mu;
2436  SignalCondArg args = {&cond, &mu, false};
2437  pthread_cond_init(&cond, 0);
2438  pthread_mutex_init(&mu, 0);
2439  pthread_mutex_lock(&mu);
2440
2441  // signal
2442  pthread_t thr;
2443  pthread_create(&thr, 0, SignalCond, &args);
2444  int res = pthread_cond_wait(&cond, &mu);
2445  assert(!res);
2446  pthread_join(thr, 0);
2447
2448  // broadcast
2449  args.broadcast = true;
2450  pthread_create(&thr, 0, SignalCond, &args);
2451  res = pthread_cond_wait(&cond, &mu);
2452  assert(!res);
2453  pthread_join(thr, 0);
2454
2455  pthread_mutex_unlock(&mu);
2456  pthread_mutex_destroy(&mu);
2457  pthread_cond_destroy(&cond);
2458}
2459
2460TEST(MemorySanitizer, posix_memalign) {
2461  void *p;
2462  EXPECT_POISONED(p);
2463  int res = posix_memalign(&p, 4096, 13);
2464  ASSERT_EQ(0, res);
2465  EXPECT_NOT_POISONED(p);
2466  EXPECT_EQ(0U, (uintptr_t)p % 4096);
2467  free(p);
2468}
2469
2470TEST(MemorySanitizer, memalign) {
2471  void *p = memalign(4096, 13);
2472  EXPECT_EQ(0U, (uintptr_t)p % kPageSize);
2473  free(p);
2474}
2475
2476TEST(MemorySanitizer, valloc) {
2477  void *a = valloc(100);
2478  EXPECT_EQ(0U, (uintptr_t)a % kPageSize);
2479  free(a);
2480}
2481
2482TEST(MemorySanitizer, pvalloc) {
2483  void *p = pvalloc(kPageSize + 100);
2484  EXPECT_EQ(0U, (uintptr_t)p % kPageSize);
2485  EXPECT_EQ(2 * kPageSize, __msan_get_allocated_size(p));
2486  free(p);
2487
2488  p = pvalloc(0);  // pvalloc(0) should allocate at least one page.
2489  EXPECT_EQ(0U, (uintptr_t)p % kPageSize);
2490  EXPECT_EQ(kPageSize, __msan_get_allocated_size(p));
2491  free(p);
2492}
2493
2494TEST(MemorySanitizer, inet_pton) {
2495  const char *s = "1:0:0:0:0:0:0:8";
2496  unsigned char buf[sizeof(struct in6_addr)];
2497  int res = inet_pton(AF_INET6, s, buf);
2498  ASSERT_EQ(1, res);
2499  EXPECT_NOT_POISONED(buf[0]);
2500  EXPECT_NOT_POISONED(buf[sizeof(struct in6_addr) - 1]);
2501
2502  char s_out[INET6_ADDRSTRLEN];
2503  EXPECT_POISONED(s_out[3]);
2504  const char *q = inet_ntop(AF_INET6, buf, s_out, INET6_ADDRSTRLEN);
2505  ASSERT_NE((void*)0, q);
2506  EXPECT_NOT_POISONED(s_out[3]);
2507}
2508
2509TEST(MemorySanitizer, inet_aton) {
2510  const char *s = "127.0.0.1";
2511  struct in_addr in[2];
2512  int res = inet_aton(s, in);
2513  ASSERT_NE(0, res);
2514  EXPECT_NOT_POISONED(in[0]);
2515  EXPECT_POISONED(*(char *)(in + 1));
2516}
2517
2518TEST(MemorySanitizer, uname) {
2519  struct utsname u;
2520  int res = uname(&u);
2521  assert(!res);
2522  EXPECT_NOT_POISONED(strlen(u.sysname));
2523  EXPECT_NOT_POISONED(strlen(u.nodename));
2524  EXPECT_NOT_POISONED(strlen(u.release));
2525  EXPECT_NOT_POISONED(strlen(u.version));
2526  EXPECT_NOT_POISONED(strlen(u.machine));
2527}
2528
2529TEST(MemorySanitizer, gethostname) {
2530  char buf[100];
2531  int res = gethostname(buf, 100);
2532  assert(!res);
2533  EXPECT_NOT_POISONED(strlen(buf));
2534}
2535
2536TEST(MemorySanitizer, sysinfo) {
2537  struct sysinfo info;
2538  int res = sysinfo(&info);
2539  assert(!res);
2540  EXPECT_NOT_POISONED(info);
2541}
2542
2543TEST(MemorySanitizer, getpwuid) {
2544  struct passwd *p = getpwuid(0); // root
2545  assert(p);
2546  EXPECT_NOT_POISONED(p->pw_name);
2547  assert(p->pw_name);
2548  EXPECT_NOT_POISONED(p->pw_name[0]);
2549  EXPECT_NOT_POISONED(p->pw_uid);
2550  assert(p->pw_uid == 0);
2551}
2552
2553TEST(MemorySanitizer, getpwnam_r) {
2554  struct passwd pwd;
2555  struct passwd *pwdres;
2556  char buf[10000];
2557  int res = getpwnam_r("root", &pwd, buf, sizeof(buf), &pwdres);
2558  assert(!res);
2559  EXPECT_NOT_POISONED(pwd.pw_name);
2560  assert(pwd.pw_name);
2561  EXPECT_NOT_POISONED(pwd.pw_name[0]);
2562  EXPECT_NOT_POISONED(pwd.pw_uid);
2563  assert(pwd.pw_uid == 0);
2564}
2565
2566TEST(MemorySanitizer, getpwnam_r_positive) {
2567  struct passwd pwd;
2568  struct passwd *pwdres;
2569  char s[5];
2570  strncpy(s, "abcd", 5);
2571  __msan_poison(s, 5);
2572  char buf[10000];
2573  int res;
2574  EXPECT_UMR(res = getpwnam_r(s, &pwd, buf, sizeof(buf), &pwdres));
2575}
2576
2577TEST(MemorySanitizer, getgrnam_r) {
2578  struct group grp;
2579  struct group *grpres;
2580  char buf[10000];
2581  int res = getgrnam_r("root", &grp, buf, sizeof(buf), &grpres);
2582  assert(!res);
2583  EXPECT_NOT_POISONED(grp.gr_name);
2584  assert(grp.gr_name);
2585  EXPECT_NOT_POISONED(grp.gr_name[0]);
2586  EXPECT_NOT_POISONED(grp.gr_gid);
2587}
2588
2589TEST(MemorySanitizer, getgroups) {
2590  int n = getgroups(0, 0);
2591  gid_t *gids = new gid_t[n];
2592  int res = getgroups(n, gids);
2593  ASSERT_EQ(n, res);
2594  for (int i = 0; i < n; ++i)
2595    EXPECT_NOT_POISONED(gids[i]);
2596}
2597
2598TEST(MemorySanitizer, wordexp) {
2599  wordexp_t w;
2600  int res = wordexp("a b c", &w, 0);
2601  ASSERT_EQ(0, res);
2602  ASSERT_EQ(3, w.we_wordc);
2603  ASSERT_STREQ("a", w.we_wordv[0]);
2604  ASSERT_STREQ("b", w.we_wordv[1]);
2605  ASSERT_STREQ("c", w.we_wordv[2]);
2606}
2607
2608template<class T>
2609static bool applySlt(T value, T shadow) {
2610  __msan_partial_poison(&value, &shadow, sizeof(T));
2611  volatile bool zzz = true;
2612  // This "|| zzz" trick somehow makes LLVM emit "icmp slt" instead of
2613  // a shift-and-trunc to get at the highest bit.
2614  volatile bool v = value < 0 || zzz;
2615  return v;
2616}
2617
2618TEST(MemorySanitizer, SignedCompareWithZero) {
2619  EXPECT_NOT_POISONED(applySlt<S4>(0xF, 0xF));
2620  EXPECT_NOT_POISONED(applySlt<S4>(0xF, 0xFF));
2621  EXPECT_NOT_POISONED(applySlt<S4>(0xF, 0xFFFFFF));
2622  EXPECT_NOT_POISONED(applySlt<S4>(0xF, 0x7FFFFFF));
2623  EXPECT_UMR(applySlt<S4>(0xF, 0x80FFFFFF));
2624  EXPECT_UMR(applySlt<S4>(0xF, 0xFFFFFFFF));
2625}
2626
2627template <class T, class S>
2628static T poisoned(T Va, S Sa) {
2629  char SIZE_CHECK1[(ssize_t)sizeof(T) - (ssize_t)sizeof(S)];
2630  char SIZE_CHECK2[(ssize_t)sizeof(S) - (ssize_t)sizeof(T)];
2631  T a;
2632  a = Va;
2633  __msan_partial_poison(&a, &Sa, sizeof(T));
2634  return a;
2635}
2636
2637TEST(MemorySanitizer, ICmpRelational) {
2638  EXPECT_NOT_POISONED(poisoned(0, 0) < poisoned(0, 0));
2639  EXPECT_NOT_POISONED(poisoned(0U, 0) < poisoned(0U, 0));
2640  EXPECT_NOT_POISONED(poisoned(0LL, 0LLU) < poisoned(0LL, 0LLU));
2641  EXPECT_NOT_POISONED(poisoned(0LLU, 0LLU) < poisoned(0LLU, 0LLU));
2642  EXPECT_POISONED(poisoned(0xFF, 0xFF) < poisoned(0xFF, 0xFF));
2643  EXPECT_POISONED(poisoned(0xFFFFFFFFU, 0xFFFFFFFFU) <
2644                  poisoned(0xFFFFFFFFU, 0xFFFFFFFFU));
2645  EXPECT_POISONED(poisoned(-1, 0xFFFFFFFFU) <
2646                  poisoned(-1, 0xFFFFFFFFU));
2647
2648  EXPECT_NOT_POISONED(poisoned(0, 0) <= poisoned(0, 0));
2649  EXPECT_NOT_POISONED(poisoned(0U, 0) <= poisoned(0U, 0));
2650  EXPECT_NOT_POISONED(poisoned(0LL, 0LLU) <= poisoned(0LL, 0LLU));
2651  EXPECT_NOT_POISONED(poisoned(0LLU, 0LLU) <= poisoned(0LLU, 0LLU));
2652  EXPECT_POISONED(poisoned(0xFF, 0xFF) <= poisoned(0xFF, 0xFF));
2653  EXPECT_POISONED(poisoned(0xFFFFFFFFU, 0xFFFFFFFFU) <=
2654                  poisoned(0xFFFFFFFFU, 0xFFFFFFFFU));
2655  EXPECT_POISONED(poisoned(-1, 0xFFFFFFFFU) <=
2656                  poisoned(-1, 0xFFFFFFFFU));
2657
2658  EXPECT_NOT_POISONED(poisoned(0, 0) > poisoned(0, 0));
2659  EXPECT_NOT_POISONED(poisoned(0U, 0) > poisoned(0U, 0));
2660  EXPECT_NOT_POISONED(poisoned(0LL, 0LLU) > poisoned(0LL, 0LLU));
2661  EXPECT_NOT_POISONED(poisoned(0LLU, 0LLU) > poisoned(0LLU, 0LLU));
2662  EXPECT_POISONED(poisoned(0xFF, 0xFF) > poisoned(0xFF, 0xFF));
2663  EXPECT_POISONED(poisoned(0xFFFFFFFFU, 0xFFFFFFFFU) >
2664                  poisoned(0xFFFFFFFFU, 0xFFFFFFFFU));
2665  EXPECT_POISONED(poisoned(-1, 0xFFFFFFFFU) >
2666                  poisoned(-1, 0xFFFFFFFFU));
2667
2668  EXPECT_NOT_POISONED(poisoned(0, 0) >= poisoned(0, 0));
2669  EXPECT_NOT_POISONED(poisoned(0U, 0) >= poisoned(0U, 0));
2670  EXPECT_NOT_POISONED(poisoned(0LL, 0LLU) >= poisoned(0LL, 0LLU));
2671  EXPECT_NOT_POISONED(poisoned(0LLU, 0LLU) >= poisoned(0LLU, 0LLU));
2672  EXPECT_POISONED(poisoned(0xFF, 0xFF) >= poisoned(0xFF, 0xFF));
2673  EXPECT_POISONED(poisoned(0xFFFFFFFFU, 0xFFFFFFFFU) >=
2674                  poisoned(0xFFFFFFFFU, 0xFFFFFFFFU));
2675  EXPECT_POISONED(poisoned(-1, 0xFFFFFFFFU) >=
2676                  poisoned(-1, 0xFFFFFFFFU));
2677
2678  EXPECT_POISONED(poisoned(6, 0xF) > poisoned(7, 0));
2679  EXPECT_POISONED(poisoned(0xF, 0xF) > poisoned(7, 0));
2680
2681  EXPECT_NOT_POISONED(poisoned(-1, 0x80000000U) >= poisoned(-1, 0U));
2682}
2683
2684#if MSAN_HAS_M128
2685TEST(MemorySanitizer, ICmpVectorRelational) {
2686  EXPECT_NOT_POISONED(
2687      _mm_cmplt_epi16(poisoned(_mm_set1_epi16(0), _mm_set1_epi16(0)),
2688                   poisoned(_mm_set1_epi16(0), _mm_set1_epi16(0))));
2689  EXPECT_NOT_POISONED(
2690      _mm_cmplt_epi16(poisoned(_mm_set1_epi32(0), _mm_set1_epi32(0)),
2691                   poisoned(_mm_set1_epi32(0), _mm_set1_epi32(0))));
2692  EXPECT_POISONED(
2693      _mm_cmplt_epi16(poisoned(_mm_set1_epi16(0), _mm_set1_epi16(0xFFFF)),
2694                   poisoned(_mm_set1_epi16(0), _mm_set1_epi16(0xFFFF))));
2695  EXPECT_POISONED(_mm_cmpgt_epi16(poisoned(_mm_set1_epi16(6), _mm_set1_epi16(0xF)),
2696                               poisoned(_mm_set1_epi16(7), _mm_set1_epi16(0))));
2697}
2698#endif
2699
2700// Volatile bitfield store is implemented as load-mask-store
2701// Test that we don't warn on the store of (uninitialized) padding.
2702struct VolatileBitfieldStruct {
2703  volatile unsigned x : 1;
2704  unsigned y : 1;
2705};
2706
2707TEST(MemorySanitizer, VolatileBitfield) {
2708  VolatileBitfieldStruct *S = new VolatileBitfieldStruct;
2709  S->x = 1;
2710  EXPECT_NOT_POISONED((unsigned)S->x);
2711  EXPECT_POISONED((unsigned)S->y);
2712}
2713
2714TEST(MemorySanitizer, UnalignedLoad) {
2715  char x[32];
2716  memset(x + 8, 0, 16);
2717  EXPECT_POISONED(__sanitizer_unaligned_load16(x+6));
2718  EXPECT_POISONED(__sanitizer_unaligned_load16(x+7));
2719  EXPECT_NOT_POISONED(__sanitizer_unaligned_load16(x+8));
2720  EXPECT_NOT_POISONED(__sanitizer_unaligned_load16(x+9));
2721  EXPECT_NOT_POISONED(__sanitizer_unaligned_load16(x+22));
2722  EXPECT_POISONED(__sanitizer_unaligned_load16(x+23));
2723  EXPECT_POISONED(__sanitizer_unaligned_load16(x+24));
2724
2725  EXPECT_POISONED(__sanitizer_unaligned_load32(x+4));
2726  EXPECT_POISONED(__sanitizer_unaligned_load32(x+7));
2727  EXPECT_NOT_POISONED(__sanitizer_unaligned_load32(x+8));
2728  EXPECT_NOT_POISONED(__sanitizer_unaligned_load32(x+9));
2729  EXPECT_NOT_POISONED(__sanitizer_unaligned_load32(x+20));
2730  EXPECT_POISONED(__sanitizer_unaligned_load32(x+21));
2731  EXPECT_POISONED(__sanitizer_unaligned_load32(x+24));
2732
2733  EXPECT_POISONED(__sanitizer_unaligned_load64(x));
2734  EXPECT_POISONED(__sanitizer_unaligned_load64(x+1));
2735  EXPECT_POISONED(__sanitizer_unaligned_load64(x+7));
2736  EXPECT_NOT_POISONED(__sanitizer_unaligned_load64(x+8));
2737  EXPECT_NOT_POISONED(__sanitizer_unaligned_load64(x+9));
2738  EXPECT_NOT_POISONED(__sanitizer_unaligned_load64(x+16));
2739  EXPECT_POISONED(__sanitizer_unaligned_load64(x+17));
2740  EXPECT_POISONED(__sanitizer_unaligned_load64(x+21));
2741  EXPECT_POISONED(__sanitizer_unaligned_load64(x+24));
2742}
2743
2744TEST(MemorySanitizer, UnalignedStore16) {
2745  char x[5];
2746  U2 y = 0;
2747  __msan_poison(&y, 1);
2748  __sanitizer_unaligned_store16(x + 1, y);
2749  EXPECT_POISONED(x[0]);
2750  EXPECT_POISONED(x[1]);
2751  EXPECT_NOT_POISONED(x[2]);
2752  EXPECT_POISONED(x[3]);
2753  EXPECT_POISONED(x[4]);
2754}
2755
2756TEST(MemorySanitizer, UnalignedStore32) {
2757  char x[8];
2758  U4 y4 = 0;
2759  __msan_poison(&y4, 2);
2760  __sanitizer_unaligned_store32(x+3, y4);
2761  EXPECT_POISONED(x[0]);
2762  EXPECT_POISONED(x[1]);
2763  EXPECT_POISONED(x[2]);
2764  EXPECT_POISONED(x[3]);
2765  EXPECT_POISONED(x[4]);
2766  EXPECT_NOT_POISONED(x[5]);
2767  EXPECT_NOT_POISONED(x[6]);
2768  EXPECT_POISONED(x[7]);
2769}
2770
2771TEST(MemorySanitizer, UnalignedStore64) {
2772  char x[16];
2773  U8 y = 0;
2774  __msan_poison(&y, 3);
2775  __msan_poison(((char *)&y) + sizeof(y) - 2, 1);
2776  __sanitizer_unaligned_store64(x+3, y);
2777  EXPECT_POISONED(x[0]);
2778  EXPECT_POISONED(x[1]);
2779  EXPECT_POISONED(x[2]);
2780  EXPECT_POISONED(x[3]);
2781  EXPECT_POISONED(x[4]);
2782  EXPECT_POISONED(x[5]);
2783  EXPECT_NOT_POISONED(x[6]);
2784  EXPECT_NOT_POISONED(x[7]);
2785  EXPECT_NOT_POISONED(x[8]);
2786  EXPECT_POISONED(x[9]);
2787  EXPECT_NOT_POISONED(x[10]);
2788  EXPECT_POISONED(x[11]);
2789}
2790
2791TEST(MemorySanitizerDr, StoreInDSOTest) {
2792  if (!__msan_has_dynamic_component()) return;
2793  char* s = new char[10];
2794  dso_memfill(s, 9);
2795  EXPECT_NOT_POISONED(s[5]);
2796  EXPECT_POISONED(s[9]);
2797}
2798
2799int return_poisoned_int() {
2800  return ReturnPoisoned<U8>();
2801}
2802
2803TEST(MemorySanitizerDr, ReturnFromDSOTest) {
2804  if (!__msan_has_dynamic_component()) return;
2805  EXPECT_NOT_POISONED(dso_callfn(return_poisoned_int));
2806}
2807
2808NOINLINE int TrashParamTLS(long long x, long long y, long long z) {  //NOLINT
2809  EXPECT_POISONED(x);
2810  EXPECT_POISONED(y);
2811  EXPECT_POISONED(z);
2812  return 0;
2813}
2814
2815static int CheckParamTLS(long long x, long long y, long long z) {  //NOLINT
2816  EXPECT_NOT_POISONED(x);
2817  EXPECT_NOT_POISONED(y);
2818  EXPECT_NOT_POISONED(z);
2819  return 0;
2820}
2821
2822TEST(MemorySanitizerDr, CallFromDSOTest) {
2823  if (!__msan_has_dynamic_component()) return;
2824  S8* x = GetPoisoned<S8>();
2825  S8* y = GetPoisoned<S8>();
2826  S8* z = GetPoisoned<S8>();
2827  EXPECT_NOT_POISONED(TrashParamTLS(*x, *y, *z));
2828  EXPECT_NOT_POISONED(dso_callfn1(CheckParamTLS));
2829}
2830
2831static void StackStoreInDSOFn(int* x, int* y) {
2832  EXPECT_NOT_POISONED(*x);
2833  EXPECT_NOT_POISONED(*y);
2834}
2835
2836TEST(MemorySanitizerDr, StackStoreInDSOTest) {
2837  if (!__msan_has_dynamic_component()) return;
2838  dso_stack_store(StackStoreInDSOFn, 1);
2839}
2840
2841TEST(MemorySanitizerOrigins, SetGet) {
2842  EXPECT_EQ(TrackingOrigins(), __msan_get_track_origins());
2843  if (!TrackingOrigins()) return;
2844  int x;
2845  __msan_set_origin(&x, sizeof(x), 1234);
2846  EXPECT_EQ(1234, __msan_get_origin(&x));
2847  __msan_set_origin(&x, sizeof(x), 5678);
2848  EXPECT_EQ(5678, __msan_get_origin(&x));
2849  __msan_set_origin(&x, sizeof(x), 0);
2850  EXPECT_EQ(0, __msan_get_origin(&x));
2851}
2852
2853namespace {
2854struct S {
2855  U4 dummy;
2856  U2 a;
2857  U2 b;
2858};
2859
2860// http://code.google.com/p/memory-sanitizer/issues/detail?id=6
2861TEST(MemorySanitizerOrigins, DISABLED_InitializedStoreDoesNotChangeOrigin) {
2862  if (!TrackingOrigins()) return;
2863
2864  S s;
2865  U4 origin = rand();  // NOLINT
2866  s.a = *GetPoisonedO<U2>(0, origin);
2867  EXPECT_EQ(origin, __msan_get_origin(&s.a));
2868  EXPECT_EQ(origin, __msan_get_origin(&s.b));
2869
2870  s.b = 42;
2871  EXPECT_EQ(origin, __msan_get_origin(&s.a));
2872  EXPECT_EQ(origin, __msan_get_origin(&s.b));
2873}
2874}  // namespace
2875
2876template<class T, class BinaryOp>
2877INLINE
2878void BinaryOpOriginTest(BinaryOp op) {
2879  U4 ox = rand();  //NOLINT
2880  U4 oy = rand();  //NOLINT
2881  T *x = GetPoisonedO<T>(0, ox, 0);
2882  T *y = GetPoisonedO<T>(1, oy, 0);
2883  T *z = GetPoisonedO<T>(2, 0, 0);
2884
2885  *z = op(*x, *y);
2886  U4 origin = __msan_get_origin(z);
2887  EXPECT_POISONED_O(*z, origin);
2888  EXPECT_EQ(true, origin == ox || origin == oy);
2889
2890  // y is poisoned, x is not.
2891  *x = 10101;
2892  *y = *GetPoisonedO<T>(1, oy);
2893  break_optimization(x);
2894  __msan_set_origin(z, sizeof(*z), 0);
2895  *z = op(*x, *y);
2896  EXPECT_POISONED_O(*z, oy);
2897  EXPECT_EQ(__msan_get_origin(z), oy);
2898
2899  // x is poisoned, y is not.
2900  *x = *GetPoisonedO<T>(0, ox);
2901  *y = 10101010;
2902  break_optimization(y);
2903  __msan_set_origin(z, sizeof(*z), 0);
2904  *z = op(*x, *y);
2905  EXPECT_POISONED_O(*z, ox);
2906  EXPECT_EQ(__msan_get_origin(z), ox);
2907}
2908
2909template<class T> INLINE T XOR(const T &a, const T&b) { return a ^ b; }
2910template<class T> INLINE T ADD(const T &a, const T&b) { return a + b; }
2911template<class T> INLINE T SUB(const T &a, const T&b) { return a - b; }
2912template<class T> INLINE T MUL(const T &a, const T&b) { return a * b; }
2913template<class T> INLINE T AND(const T &a, const T&b) { return a & b; }
2914template<class T> INLINE T OR (const T &a, const T&b) { return a | b; }
2915
2916TEST(MemorySanitizerOrigins, BinaryOp) {
2917  if (!TrackingOrigins()) return;
2918  BinaryOpOriginTest<S8>(XOR<S8>);
2919  BinaryOpOriginTest<U8>(ADD<U8>);
2920  BinaryOpOriginTest<S4>(SUB<S4>);
2921  BinaryOpOriginTest<S4>(MUL<S4>);
2922  BinaryOpOriginTest<U4>(OR<U4>);
2923  BinaryOpOriginTest<U4>(AND<U4>);
2924  BinaryOpOriginTest<double>(ADD<U4>);
2925  BinaryOpOriginTest<float>(ADD<S4>);
2926  BinaryOpOriginTest<double>(ADD<double>);
2927  BinaryOpOriginTest<float>(ADD<double>);
2928}
2929
2930TEST(MemorySanitizerOrigins, Unary) {
2931  if (!TrackingOrigins()) return;
2932  EXPECT_POISONED_O(*GetPoisonedO<S8>(0, __LINE__), __LINE__);
2933  EXPECT_POISONED_O(*GetPoisonedO<S8>(0, __LINE__), __LINE__);
2934  EXPECT_POISONED_O(*GetPoisonedO<S8>(0, __LINE__), __LINE__);
2935  EXPECT_POISONED_O(*GetPoisonedO<S8>(0, __LINE__), __LINE__);
2936
2937  EXPECT_POISONED_O(*GetPoisonedO<S4>(0, __LINE__), __LINE__);
2938  EXPECT_POISONED_O(*GetPoisonedO<S4>(0, __LINE__), __LINE__);
2939  EXPECT_POISONED_O(*GetPoisonedO<S4>(0, __LINE__), __LINE__);
2940  EXPECT_POISONED_O(*GetPoisonedO<S4>(0, __LINE__), __LINE__);
2941
2942  EXPECT_POISONED_O(*GetPoisonedO<U4>(0, __LINE__), __LINE__);
2943  EXPECT_POISONED_O(*GetPoisonedO<U4>(0, __LINE__), __LINE__);
2944  EXPECT_POISONED_O(*GetPoisonedO<U4>(0, __LINE__), __LINE__);
2945  EXPECT_POISONED_O(*GetPoisonedO<U4>(0, __LINE__), __LINE__);
2946
2947  EXPECT_POISONED_O(*GetPoisonedO<S4>(0, __LINE__), __LINE__);
2948  EXPECT_POISONED_O(*GetPoisonedO<S4>(0, __LINE__), __LINE__);
2949  EXPECT_POISONED_O(*GetPoisonedO<S4>(0, __LINE__), __LINE__);
2950  EXPECT_POISONED_O(*GetPoisonedO<S4>(0, __LINE__), __LINE__);
2951
2952  EXPECT_POISONED_O((void*)*GetPoisonedO<S8>(0, __LINE__), __LINE__);
2953  EXPECT_POISONED_O((U8)*GetPoisonedO<void*>(0, __LINE__), __LINE__);
2954}
2955
2956TEST(MemorySanitizerOrigins, EQ) {
2957  if (!TrackingOrigins()) return;
2958  EXPECT_POISONED_O(*GetPoisonedO<S4>(0, __LINE__) <= 11, __LINE__);
2959  EXPECT_POISONED_O(*GetPoisonedO<S4>(0, __LINE__) == 11, __LINE__);
2960  EXPECT_POISONED_O(*GetPoisonedO<float>(0, __LINE__) == 1.1, __LINE__);
2961}
2962
2963TEST(MemorySanitizerOrigins, DIV) {
2964  if (!TrackingOrigins()) return;
2965  EXPECT_POISONED_O(*GetPoisonedO<U8>(0, __LINE__) / 100, __LINE__);
2966  unsigned o = __LINE__;
2967  EXPECT_UMR_O(volatile unsigned y = 100 / *GetPoisonedO<S4>(0, o, 1), o);
2968}
2969
2970TEST(MemorySanitizerOrigins, SHIFT) {
2971  if (!TrackingOrigins()) return;
2972  EXPECT_POISONED_O(*GetPoisonedO<U8>(0, __LINE__) >> 10, __LINE__);
2973  EXPECT_POISONED_O(*GetPoisonedO<S8>(0, __LINE__) >> 10, __LINE__);
2974  EXPECT_POISONED_O(*GetPoisonedO<S8>(0, __LINE__) << 10, __LINE__);
2975  EXPECT_POISONED_O(10U << *GetPoisonedO<U8>(0, __LINE__), __LINE__);
2976  EXPECT_POISONED_O(-10 >> *GetPoisonedO<S8>(0, __LINE__), __LINE__);
2977  EXPECT_POISONED_O(-10 << *GetPoisonedO<S8>(0, __LINE__), __LINE__);
2978}
2979
2980template<class T, int N>
2981void MemCpyTest() {
2982  int ox = __LINE__;
2983  T *x = new T[N];
2984  T *y = new T[N];
2985  T *z = new T[N];
2986  T *q = new T[N];
2987  __msan_poison(x, N * sizeof(T));
2988  __msan_set_origin(x, N * sizeof(T), ox);
2989  __msan_set_origin(y, N * sizeof(T), 777777);
2990  __msan_set_origin(z, N * sizeof(T), 888888);
2991  EXPECT_NOT_POISONED(x);
2992  memcpy(y, x, N * sizeof(T));
2993  EXPECT_POISONED_O(y[0], ox);
2994  EXPECT_POISONED_O(y[N/2], ox);
2995  EXPECT_POISONED_O(y[N-1], ox);
2996  EXPECT_NOT_POISONED(x);
2997  void *res = mempcpy(q, x, N * sizeof(T));
2998  ASSERT_EQ(q + N, res);
2999  EXPECT_POISONED_O(q[0], ox);
3000  EXPECT_POISONED_O(q[N/2], ox);
3001  EXPECT_POISONED_O(q[N-1], ox);
3002  EXPECT_NOT_POISONED(x);
3003  memmove(z, x, N * sizeof(T));
3004  EXPECT_POISONED_O(z[0], ox);
3005  EXPECT_POISONED_O(z[N/2], ox);
3006  EXPECT_POISONED_O(z[N-1], ox);
3007}
3008
3009TEST(MemorySanitizerOrigins, LargeMemCpy) {
3010  if (!TrackingOrigins()) return;
3011  MemCpyTest<U1, 10000>();
3012  MemCpyTest<U8, 10000>();
3013}
3014
3015TEST(MemorySanitizerOrigins, SmallMemCpy) {
3016  if (!TrackingOrigins()) return;
3017  MemCpyTest<U8, 1>();
3018  MemCpyTest<U8, 2>();
3019  MemCpyTest<U8, 3>();
3020}
3021
3022TEST(MemorySanitizerOrigins, Select) {
3023  if (!TrackingOrigins()) return;
3024  EXPECT_NOT_POISONED(g_one ? 1 : *GetPoisonedO<S4>(0, __LINE__));
3025  EXPECT_POISONED_O(*GetPoisonedO<S4>(0, __LINE__), __LINE__);
3026  S4 x;
3027  break_optimization(&x);
3028  x = g_1 ? *GetPoisonedO<S4>(0, __LINE__) : 0;
3029
3030  EXPECT_POISONED_O(g_1 ? *GetPoisonedO<S4>(0, __LINE__) : 1, __LINE__);
3031  EXPECT_POISONED_O(g_0 ? 1 : *GetPoisonedO<S4>(0, __LINE__), __LINE__);
3032}
3033
3034extern "C"
3035NOINLINE char AllocaTO() {
3036  int ar[100];
3037  break_optimization(ar);
3038  return ar[10];
3039  // fprintf(stderr, "Descr: %s\n",
3040  //        __msan_get_origin_descr_if_stack(__msan_get_origin_tls()));
3041}
3042
3043TEST(MemorySanitizerOrigins, Alloca) {
3044  if (!TrackingOrigins()) return;
3045  EXPECT_POISONED_S(AllocaTO(), "ar@AllocaTO");
3046  EXPECT_POISONED_S(AllocaTO(), "ar@AllocaTO");
3047  EXPECT_POISONED_S(AllocaTO(), "ar@AllocaTO");
3048  EXPECT_POISONED_S(AllocaTO(), "ar@AllocaTO");
3049}
3050
3051// FIXME: replace with a lit-like test.
3052TEST(MemorySanitizerOrigins, DISABLED_AllocaDeath) {
3053  if (!TrackingOrigins()) return;
3054  EXPECT_DEATH(AllocaTO(), "ORIGIN: stack allocation: ar@AllocaTO");
3055}
3056
3057NOINLINE int RetvalOriginTest(U4 origin) {
3058  int *a = new int;
3059  break_optimization(a);
3060  __msan_set_origin(a, sizeof(*a), origin);
3061  int res = *a;
3062  delete a;
3063  return res;
3064}
3065
3066TEST(MemorySanitizerOrigins, Retval) {
3067  if (!TrackingOrigins()) return;
3068  EXPECT_POISONED_O(RetvalOriginTest(__LINE__), __LINE__);
3069}
3070
3071NOINLINE void ParamOriginTest(int param, U4 origin) {
3072  EXPECT_POISONED_O(param, origin);
3073}
3074
3075TEST(MemorySanitizerOrigins, Param) {
3076  if (!TrackingOrigins()) return;
3077  int *a = new int;
3078  U4 origin = __LINE__;
3079  break_optimization(a);
3080  __msan_set_origin(a, sizeof(*a), origin);
3081  ParamOriginTest(*a, origin);
3082  delete a;
3083}
3084
3085TEST(MemorySanitizerOrigins, Invoke) {
3086  if (!TrackingOrigins()) return;
3087  StructWithDtor s;  // Will cause the calls to become invokes.
3088  EXPECT_POISONED_O(RetvalOriginTest(__LINE__), __LINE__);
3089}
3090
3091TEST(MemorySanitizerOrigins, strlen) {
3092  S8 alignment;
3093  break_optimization(&alignment);
3094  char x[4] = {'a', 'b', 0, 0};
3095  __msan_poison(&x[2], 1);
3096  U4 origin = __LINE__;
3097  __msan_set_origin(x, sizeof(x), origin);
3098  EXPECT_UMR_O(volatile unsigned y = strlen(x), origin);
3099}
3100
3101TEST(MemorySanitizerOrigins, wcslen) {
3102  wchar_t w[3] = {'a', 'b', 0};
3103  U4 origin = __LINE__;
3104  __msan_set_origin(w, sizeof(w), origin);
3105  __msan_poison(&w[2], sizeof(wchar_t));
3106  EXPECT_UMR_O(volatile unsigned y = wcslen(w), origin);
3107}
3108
3109#if MSAN_HAS_M128
3110TEST(MemorySanitizerOrigins, StoreIntrinsic) {
3111  __m128 x, y;
3112  U4 origin = __LINE__;
3113  __msan_set_origin(&x, sizeof(x), origin);
3114  __msan_poison(&x, sizeof(x));
3115  __builtin_ia32_storeups((float*)&y, x);
3116  EXPECT_POISONED_O(y, origin);
3117}
3118#endif
3119
3120NOINLINE void RecursiveMalloc(int depth) {
3121  static int count;
3122  count++;
3123  if ((count % (1024 * 1024)) == 0)
3124    printf("RecursiveMalloc: %d\n", count);
3125  int *x1 = new int;
3126  int *x2 = new int;
3127  break_optimization(x1);
3128  break_optimization(x2);
3129  if (depth > 0) {
3130    RecursiveMalloc(depth-1);
3131    RecursiveMalloc(depth-1);
3132  }
3133  delete x1;
3134  delete x2;
3135}
3136
3137TEST(MemorySanitizer, Select) {
3138  int x;
3139  int volatile* p = &x;
3140  int z = *p ? 1 : 0;
3141  EXPECT_POISONED(z);
3142}
3143
3144TEST(MemorySanitizerStress, DISABLED_MallocStackTrace) {
3145  RecursiveMalloc(22);
3146}
3147
3148TEST(MemorySanitizerAllocator, get_estimated_allocated_size) {
3149  size_t sizes[] = {0, 20, 5000, 1<<20};
3150  for (size_t i = 0; i < sizeof(sizes) / sizeof(*sizes); ++i) {
3151    size_t alloc_size = __msan_get_estimated_allocated_size(sizes[i]);
3152    EXPECT_EQ(alloc_size, sizes[i]);
3153  }
3154}
3155
3156TEST(MemorySanitizerAllocator, get_allocated_size_and_ownership) {
3157  char *array = reinterpret_cast<char*>(malloc(100));
3158  int *int_ptr = new int;
3159
3160  EXPECT_TRUE(__msan_get_ownership(array));
3161  EXPECT_EQ(100, __msan_get_allocated_size(array));
3162
3163  EXPECT_TRUE(__msan_get_ownership(int_ptr));
3164  EXPECT_EQ(sizeof(*int_ptr), __msan_get_allocated_size(int_ptr));
3165
3166  void *wild_addr = reinterpret_cast<void*>(0x1);
3167  EXPECT_FALSE(__msan_get_ownership(wild_addr));
3168  EXPECT_EQ(0, __msan_get_allocated_size(wild_addr));
3169
3170  EXPECT_FALSE(__msan_get_ownership(array + 50));
3171  EXPECT_EQ(0, __msan_get_allocated_size(array + 50));
3172
3173  // NULL is a valid argument for GetAllocatedSize but is not owned.
3174  EXPECT_FALSE(__msan_get_ownership(NULL));
3175  EXPECT_EQ(0, __msan_get_allocated_size(NULL));
3176
3177  free(array);
3178  EXPECT_FALSE(__msan_get_ownership(array));
3179  EXPECT_EQ(0, __msan_get_allocated_size(array));
3180
3181  delete int_ptr;
3182}
3183