1//===-- asan_interceptors.cc ----------------------------------------------===// 2// 3// The LLVM Compiler Infrastructure 4// 5// This file is distributed under the University of Illinois Open Source 6// License. See LICENSE.TXT for details. 7// 8//===----------------------------------------------------------------------===// 9// 10// This file is a part of AddressSanitizer, an address sanity checker. 11// 12// Intercept various libc functions. 13//===----------------------------------------------------------------------===// 14 15#include "asan_interceptors.h" 16#include "asan_allocator.h" 17#include "asan_internal.h" 18#include "asan_mapping.h" 19#include "asan_poisoning.h" 20#include "asan_report.h" 21#include "asan_stack.h" 22#include "asan_stats.h" 23#include "asan_suppressions.h" 24#include "lsan/lsan_common.h" 25#include "sanitizer_common/sanitizer_libc.h" 26 27#if SANITIZER_POSIX 28#include "sanitizer_common/sanitizer_posix.h" 29#endif 30 31#if defined(__i386) && SANITIZER_LINUX 32#define ASAN_PTHREAD_CREATE_VERSION "GLIBC_2.1" 33#elif defined(__mips__) && SANITIZER_LINUX 34#define ASAN_PTHREAD_CREATE_VERSION "GLIBC_2.2" 35#endif 36 37namespace __asan { 38 39// Return true if we can quickly decide that the region is unpoisoned. 40static inline bool QuickCheckForUnpoisonedRegion(uptr beg, uptr size) { 41 if (size == 0) return true; 42 if (size <= 32) 43 return !AddressIsPoisoned(beg) && 44 !AddressIsPoisoned(beg + size - 1) && 45 !AddressIsPoisoned(beg + size / 2); 46 return false; 47} 48 49struct AsanInterceptorContext { 50 const char *interceptor_name; 51}; 52 53// We implement ACCESS_MEMORY_RANGE, ASAN_READ_RANGE, 54// and ASAN_WRITE_RANGE as macro instead of function so 55// that no extra frames are created, and stack trace contains 56// relevant information only. 57// We check all shadow bytes. 58#define ACCESS_MEMORY_RANGE(ctx, offset, size, isWrite) do { \ 59 uptr __offset = (uptr)(offset); \ 60 uptr __size = (uptr)(size); \ 61 uptr __bad = 0; \ 62 if (__offset > __offset + __size) { \ 63 GET_STACK_TRACE_FATAL_HERE; \ 64 ReportStringFunctionSizeOverflow(__offset, __size, &stack); \ 65 } \ 66 if (!QuickCheckForUnpoisonedRegion(__offset, __size) && \ 67 (__bad = __asan_region_is_poisoned(__offset, __size))) { \ 68 AsanInterceptorContext *_ctx = (AsanInterceptorContext *)ctx; \ 69 bool suppressed = false; \ 70 if (_ctx) { \ 71 suppressed = IsInterceptorSuppressed(_ctx->interceptor_name); \ 72 if (!suppressed && HaveStackTraceBasedSuppressions()) { \ 73 GET_STACK_TRACE_FATAL_HERE; \ 74 suppressed = IsStackTraceSuppressed(&stack); \ 75 } \ 76 } \ 77 if (!suppressed) { \ 78 GET_CURRENT_PC_BP_SP; \ 79 ReportGenericError(pc, bp, sp, __bad, isWrite, __size, 0, false);\ 80 } \ 81 } \ 82 } while (0) 83 84#define ASAN_READ_RANGE(ctx, offset, size) \ 85 ACCESS_MEMORY_RANGE(ctx, offset, size, false) 86#define ASAN_WRITE_RANGE(ctx, offset, size) \ 87 ACCESS_MEMORY_RANGE(ctx, offset, size, true) 88 89#define ASAN_READ_STRING_OF_LEN(ctx, s, len, n) \ 90 ASAN_READ_RANGE((ctx), (s), \ 91 common_flags()->strict_string_checks ? (len) + 1 : (n)) 92 93#define ASAN_READ_STRING(ctx, s, n) \ 94 ASAN_READ_STRING_OF_LEN((ctx), (s), REAL(strlen)(s), (n)) 95 96// Behavior of functions like "memcpy" or "strcpy" is undefined 97// if memory intervals overlap. We report error in this case. 98// Macro is used to avoid creation of new frames. 99static inline bool RangesOverlap(const char *offset1, uptr length1, 100 const char *offset2, uptr length2) { 101 return !((offset1 + length1 <= offset2) || (offset2 + length2 <= offset1)); 102} 103#define CHECK_RANGES_OVERLAP(name, _offset1, length1, _offset2, length2) do { \ 104 const char *offset1 = (const char*)_offset1; \ 105 const char *offset2 = (const char*)_offset2; \ 106 if (RangesOverlap(offset1, length1, offset2, length2)) { \ 107 GET_STACK_TRACE_FATAL_HERE; \ 108 ReportStringFunctionMemoryRangesOverlap(name, offset1, length1, \ 109 offset2, length2, &stack); \ 110 } \ 111} while (0) 112 113static inline uptr MaybeRealStrnlen(const char *s, uptr maxlen) { 114#if SANITIZER_INTERCEPT_STRNLEN 115 if (REAL(strnlen)) { 116 return REAL(strnlen)(s, maxlen); 117 } 118#endif 119 return internal_strnlen(s, maxlen); 120} 121 122void SetThreadName(const char *name) { 123 AsanThread *t = GetCurrentThread(); 124 if (t) 125 asanThreadRegistry().SetThreadName(t->tid(), name); 126} 127 128int OnExit() { 129 // FIXME: ask frontend whether we need to return failure. 130 return 0; 131} 132 133} // namespace __asan 134 135// ---------------------- Wrappers ---------------- {{{1 136using namespace __asan; // NOLINT 137 138DECLARE_REAL_AND_INTERCEPTOR(void *, malloc, uptr) 139DECLARE_REAL_AND_INTERCEPTOR(void, free, void *) 140 141#define ASAN_INTERCEPTOR_ENTER(ctx, func) \ 142 AsanInterceptorContext _ctx = {#func}; \ 143 ctx = (void *)&_ctx; \ 144 (void) ctx; \ 145 146#define COMMON_INTERCEPT_FUNCTION(name) ASAN_INTERCEPT_FUNC(name) 147#define COMMON_INTERCEPT_FUNCTION_VER(name, ver) \ 148 ASAN_INTERCEPT_FUNC_VER(name, ver) 149#define COMMON_INTERCEPTOR_WRITE_RANGE(ctx, ptr, size) \ 150 ASAN_WRITE_RANGE(ctx, ptr, size) 151#define COMMON_INTERCEPTOR_READ_RANGE(ctx, ptr, size) \ 152 ASAN_READ_RANGE(ctx, ptr, size) 153#define COMMON_INTERCEPTOR_ENTER(ctx, func, ...) \ 154 ASAN_INTERCEPTOR_ENTER(ctx, func); \ 155 do { \ 156 if (asan_init_is_running) \ 157 return REAL(func)(__VA_ARGS__); \ 158 if (SANITIZER_MAC && UNLIKELY(!asan_inited)) \ 159 return REAL(func)(__VA_ARGS__); \ 160 ENSURE_ASAN_INITED(); \ 161 } while (false) 162#define COMMON_INTERCEPTOR_DIR_ACQUIRE(ctx, path) \ 163 do { \ 164 } while (false) 165#define COMMON_INTERCEPTOR_FD_ACQUIRE(ctx, fd) \ 166 do { \ 167 } while (false) 168#define COMMON_INTERCEPTOR_FD_RELEASE(ctx, fd) \ 169 do { \ 170 } while (false) 171#define COMMON_INTERCEPTOR_FD_SOCKET_ACCEPT(ctx, fd, newfd) \ 172 do { \ 173 } while (false) 174#define COMMON_INTERCEPTOR_SET_THREAD_NAME(ctx, name) SetThreadName(name) 175// Should be asanThreadRegistry().SetThreadNameByUserId(thread, name) 176// But asan does not remember UserId's for threads (pthread_t); 177// and remembers all ever existed threads, so the linear search by UserId 178// can be slow. 179#define COMMON_INTERCEPTOR_SET_PTHREAD_NAME(ctx, thread, name) \ 180 do { \ 181 } while (false) 182#define COMMON_INTERCEPTOR_BLOCK_REAL(name) REAL(name) 183// Strict init-order checking is dlopen-hostile: 184// https://github.com/google/sanitizers/issues/178 185#define COMMON_INTERCEPTOR_ON_DLOPEN(filename, flag) \ 186 if (flags()->strict_init_order) { \ 187 StopInitOrderChecking(); \ 188 } 189#define COMMON_INTERCEPTOR_ON_EXIT(ctx) OnExit() 190#define COMMON_INTERCEPTOR_LIBRARY_LOADED(filename, handle) \ 191 CoverageUpdateMapping() 192#define COMMON_INTERCEPTOR_LIBRARY_UNLOADED() CoverageUpdateMapping() 193#define COMMON_INTERCEPTOR_NOTHING_IS_INITIALIZED (!asan_inited) 194#define COMMON_INTERCEPTOR_GET_TLS_RANGE(begin, end) \ 195 if (AsanThread *t = GetCurrentThread()) { \ 196 *begin = t->tls_begin(); \ 197 *end = t->tls_end(); \ 198 } else { \ 199 *begin = *end = 0; \ 200 } 201// Asan needs custom handling of these: 202#undef SANITIZER_INTERCEPT_MEMSET 203#undef SANITIZER_INTERCEPT_MEMMOVE 204#undef SANITIZER_INTERCEPT_MEMCPY 205#include "sanitizer_common/sanitizer_common_interceptors.inc" 206 207// Syscall interceptors don't have contexts, we don't support suppressions 208// for them. 209#define COMMON_SYSCALL_PRE_READ_RANGE(p, s) ASAN_READ_RANGE(nullptr, p, s) 210#define COMMON_SYSCALL_PRE_WRITE_RANGE(p, s) ASAN_WRITE_RANGE(nullptr, p, s) 211#define COMMON_SYSCALL_POST_READ_RANGE(p, s) \ 212 do { \ 213 (void)(p); \ 214 (void)(s); \ 215 } while (false) 216#define COMMON_SYSCALL_POST_WRITE_RANGE(p, s) \ 217 do { \ 218 (void)(p); \ 219 (void)(s); \ 220 } while (false) 221#include "sanitizer_common/sanitizer_common_syscalls.inc" 222 223struct ThreadStartParam { 224 atomic_uintptr_t t; 225 atomic_uintptr_t is_registered; 226}; 227 228#if ASAN_INTERCEPT_PTHREAD_CREATE 229static thread_return_t THREAD_CALLING_CONV asan_thread_start(void *arg) { 230 ThreadStartParam *param = reinterpret_cast<ThreadStartParam *>(arg); 231 AsanThread *t = nullptr; 232 while ((t = reinterpret_cast<AsanThread *>( 233 atomic_load(¶m->t, memory_order_acquire))) == nullptr) 234 internal_sched_yield(); 235 SetCurrentThread(t); 236 return t->ThreadStart(GetTid(), ¶m->is_registered); 237} 238 239INTERCEPTOR(int, pthread_create, void *thread, 240 void *attr, void *(*start_routine)(void*), void *arg) { 241 EnsureMainThreadIDIsCorrect(); 242 // Strict init-order checking is thread-hostile. 243 if (flags()->strict_init_order) 244 StopInitOrderChecking(); 245 GET_STACK_TRACE_THREAD; 246 int detached = 0; 247 if (attr) 248 REAL(pthread_attr_getdetachstate)(attr, &detached); 249 ThreadStartParam param; 250 atomic_store(¶m.t, 0, memory_order_relaxed); 251 atomic_store(¶m.is_registered, 0, memory_order_relaxed); 252 int result; 253 { 254 // Ignore all allocations made by pthread_create: thread stack/TLS may be 255 // stored by pthread for future reuse even after thread destruction, and 256 // the linked list it's stored in doesn't even hold valid pointers to the 257 // objects, the latter are calculated by obscure pointer arithmetic. 258#if CAN_SANITIZE_LEAKS 259 __lsan::ScopedInterceptorDisabler disabler; 260#endif 261 result = REAL(pthread_create)(thread, attr, asan_thread_start, ¶m); 262 } 263 if (result == 0) { 264 u32 current_tid = GetCurrentTidOrInvalid(); 265 AsanThread *t = 266 AsanThread::Create(start_routine, arg, current_tid, &stack, detached); 267 atomic_store(¶m.t, reinterpret_cast<uptr>(t), memory_order_release); 268 // Wait until the AsanThread object is initialized and the ThreadRegistry 269 // entry is in "started" state. One reason for this is that after this 270 // interceptor exits, the child thread's stack may be the only thing holding 271 // the |arg| pointer. This may cause LSan to report a leak if leak checking 272 // happens at a point when the interceptor has already exited, but the stack 273 // range for the child thread is not yet known. 274 while (atomic_load(¶m.is_registered, memory_order_acquire) == 0) 275 internal_sched_yield(); 276 } 277 return result; 278} 279 280INTERCEPTOR(int, pthread_join, void *t, void **arg) { 281 return real_pthread_join(t, arg); 282} 283 284DEFINE_REAL_PTHREAD_FUNCTIONS 285#endif // ASAN_INTERCEPT_PTHREAD_CREATE 286 287#if ASAN_INTERCEPT_SIGNAL_AND_SIGACTION 288 289#if SANITIZER_ANDROID 290INTERCEPTOR(void*, bsd_signal, int signum, void *handler) { 291 if (!IsHandledDeadlySignal(signum) || 292 common_flags()->allow_user_segv_handler) { 293 return REAL(bsd_signal)(signum, handler); 294 } 295 return 0; 296} 297#endif 298 299INTERCEPTOR(void*, signal, int signum, void *handler) { 300 if (!IsHandledDeadlySignal(signum) || 301 common_flags()->allow_user_segv_handler) { 302 return REAL(signal)(signum, handler); 303 } 304 return nullptr; 305} 306 307INTERCEPTOR(int, sigaction, int signum, const struct sigaction *act, 308 struct sigaction *oldact) { 309 if (!IsHandledDeadlySignal(signum) || 310 common_flags()->allow_user_segv_handler) { 311 return REAL(sigaction)(signum, act, oldact); 312 } 313 return 0; 314} 315 316namespace __sanitizer { 317int real_sigaction(int signum, const void *act, void *oldact) { 318 return REAL(sigaction)(signum, (const struct sigaction *)act, 319 (struct sigaction *)oldact); 320} 321} // namespace __sanitizer 322 323#elif SANITIZER_POSIX 324// We need to have defined REAL(sigaction) on posix systems. 325DEFINE_REAL(int, sigaction, int signum, const struct sigaction *act, 326 struct sigaction *oldact) 327#endif // ASAN_INTERCEPT_SIGNAL_AND_SIGACTION 328 329#if ASAN_INTERCEPT_SWAPCONTEXT 330static void ClearShadowMemoryForContextStack(uptr stack, uptr ssize) { 331 // Align to page size. 332 uptr PageSize = GetPageSizeCached(); 333 uptr bottom = stack & ~(PageSize - 1); 334 ssize += stack - bottom; 335 ssize = RoundUpTo(ssize, PageSize); 336 static const uptr kMaxSaneContextStackSize = 1 << 22; // 4 Mb 337 if (AddrIsInMem(bottom) && ssize && ssize <= kMaxSaneContextStackSize) { 338 PoisonShadow(bottom, ssize, 0); 339 } 340} 341 342INTERCEPTOR(int, swapcontext, struct ucontext_t *oucp, 343 struct ucontext_t *ucp) { 344 static bool reported_warning = false; 345 if (!reported_warning) { 346 Report("WARNING: ASan doesn't fully support makecontext/swapcontext " 347 "functions and may produce false positives in some cases!\n"); 348 reported_warning = true; 349 } 350 // Clear shadow memory for new context (it may share stack 351 // with current context). 352 uptr stack, ssize; 353 ReadContextStack(ucp, &stack, &ssize); 354 ClearShadowMemoryForContextStack(stack, ssize); 355 int res = REAL(swapcontext)(oucp, ucp); 356 // swapcontext technically does not return, but program may swap context to 357 // "oucp" later, that would look as if swapcontext() returned 0. 358 // We need to clear shadow for ucp once again, as it may be in arbitrary 359 // state. 360 ClearShadowMemoryForContextStack(stack, ssize); 361 return res; 362} 363#endif // ASAN_INTERCEPT_SWAPCONTEXT 364 365INTERCEPTOR(void, longjmp, void *env, int val) { 366 __asan_handle_no_return(); 367 REAL(longjmp)(env, val); 368} 369 370#if ASAN_INTERCEPT__LONGJMP 371INTERCEPTOR(void, _longjmp, void *env, int val) { 372 __asan_handle_no_return(); 373 REAL(_longjmp)(env, val); 374} 375#endif 376 377#if ASAN_INTERCEPT_SIGLONGJMP 378INTERCEPTOR(void, siglongjmp, void *env, int val) { 379 __asan_handle_no_return(); 380 REAL(siglongjmp)(env, val); 381} 382#endif 383 384#if ASAN_INTERCEPT___CXA_THROW 385INTERCEPTOR(void, __cxa_throw, void *a, void *b, void *c) { 386 CHECK(REAL(__cxa_throw)); 387 __asan_handle_no_return(); 388 REAL(__cxa_throw)(a, b, c); 389} 390#endif 391 392// memcpy is called during __asan_init() from the internals of printf(...). 393// We do not treat memcpy with to==from as a bug. 394// See http://llvm.org/bugs/show_bug.cgi?id=11763. 395#define ASAN_MEMCPY_IMPL(ctx, to, from, size) do { \ 396 if (UNLIKELY(!asan_inited)) return internal_memcpy(to, from, size); \ 397 if (asan_init_is_running) { \ 398 return REAL(memcpy)(to, from, size); \ 399 } \ 400 ENSURE_ASAN_INITED(); \ 401 if (flags()->replace_intrin) { \ 402 if (to != from) { \ 403 CHECK_RANGES_OVERLAP("memcpy", to, size, from, size); \ 404 } \ 405 ASAN_READ_RANGE(ctx, from, size); \ 406 ASAN_WRITE_RANGE(ctx, to, size); \ 407 } \ 408 return REAL(memcpy)(to, from, size); \ 409 } while (0) 410 411 412void *__asan_memcpy(void *to, const void *from, uptr size) { 413 ASAN_MEMCPY_IMPL(nullptr, to, from, size); 414} 415 416// memset is called inside Printf. 417#define ASAN_MEMSET_IMPL(ctx, block, c, size) do { \ 418 if (UNLIKELY(!asan_inited)) return internal_memset(block, c, size); \ 419 if (asan_init_is_running) { \ 420 return REAL(memset)(block, c, size); \ 421 } \ 422 ENSURE_ASAN_INITED(); \ 423 if (flags()->replace_intrin) { \ 424 ASAN_WRITE_RANGE(ctx, block, size); \ 425 } \ 426 return REAL(memset)(block, c, size); \ 427 } while (0) 428 429void *__asan_memset(void *block, int c, uptr size) { 430 ASAN_MEMSET_IMPL(nullptr, block, c, size); 431} 432 433#define ASAN_MEMMOVE_IMPL(ctx, to, from, size) do { \ 434 if (UNLIKELY(!asan_inited)) \ 435 return internal_memmove(to, from, size); \ 436 ENSURE_ASAN_INITED(); \ 437 if (flags()->replace_intrin) { \ 438 ASAN_READ_RANGE(ctx, from, size); \ 439 ASAN_WRITE_RANGE(ctx, to, size); \ 440 } \ 441 return internal_memmove(to, from, size); \ 442 } while (0) 443 444void *__asan_memmove(void *to, const void *from, uptr size) { 445 ASAN_MEMMOVE_IMPL(nullptr, to, from, size); 446} 447 448INTERCEPTOR(void*, memmove, void *to, const void *from, uptr size) { 449 void *ctx; 450 ASAN_INTERCEPTOR_ENTER(ctx, memmove); 451 ASAN_MEMMOVE_IMPL(ctx, to, from, size); 452} 453 454INTERCEPTOR(void*, memcpy, void *to, const void *from, uptr size) { 455 void *ctx; 456 ASAN_INTERCEPTOR_ENTER(ctx, memcpy); 457#if !SANITIZER_MAC 458 ASAN_MEMCPY_IMPL(ctx, to, from, size); 459#else 460 // At least on 10.7 and 10.8 both memcpy() and memmove() are being replaced 461 // with WRAP(memcpy). As a result, false positives are reported for memmove() 462 // calls. If we just disable error reporting with 463 // ASAN_OPTIONS=replace_intrin=0, memmove() is still replaced with 464 // internal_memcpy(), which may lead to crashes, see 465 // http://llvm.org/bugs/show_bug.cgi?id=16362. 466 ASAN_MEMMOVE_IMPL(ctx, to, from, size); 467#endif // !SANITIZER_MAC 468} 469 470INTERCEPTOR(void*, memset, void *block, int c, uptr size) { 471 void *ctx; 472 ASAN_INTERCEPTOR_ENTER(ctx, memset); 473 ASAN_MEMSET_IMPL(ctx, block, c, size); 474} 475 476#if ASAN_INTERCEPT_INDEX 477# if ASAN_USE_ALIAS_ATTRIBUTE_FOR_INDEX 478INTERCEPTOR(char*, index, const char *string, int c) 479 ALIAS(WRAPPER_NAME(strchr)); 480# else 481# if SANITIZER_MAC 482DECLARE_REAL(char*, index, const char *string, int c) 483OVERRIDE_FUNCTION(index, strchr); 484# else 485DEFINE_REAL(char*, index, const char *string, int c) 486# endif 487# endif 488#endif // ASAN_INTERCEPT_INDEX 489 490// For both strcat() and strncat() we need to check the validity of |to| 491// argument irrespective of the |from| length. 492INTERCEPTOR(char*, strcat, char *to, const char *from) { // NOLINT 493 void *ctx; 494 ASAN_INTERCEPTOR_ENTER(ctx, strcat); // NOLINT 495 ENSURE_ASAN_INITED(); 496 if (flags()->replace_str) { 497 uptr from_length = REAL(strlen)(from); 498 ASAN_READ_RANGE(ctx, from, from_length + 1); 499 uptr to_length = REAL(strlen)(to); 500 ASAN_READ_STRING_OF_LEN(ctx, to, to_length, to_length); 501 ASAN_WRITE_RANGE(ctx, to + to_length, from_length + 1); 502 // If the copying actually happens, the |from| string should not overlap 503 // with the resulting string starting at |to|, which has a length of 504 // to_length + from_length + 1. 505 if (from_length > 0) { 506 CHECK_RANGES_OVERLAP("strcat", to, from_length + to_length + 1, 507 from, from_length + 1); 508 } 509 } 510 return REAL(strcat)(to, from); // NOLINT 511} 512 513INTERCEPTOR(char*, strncat, char *to, const char *from, uptr size) { 514 void *ctx; 515 ASAN_INTERCEPTOR_ENTER(ctx, strncat); 516 ENSURE_ASAN_INITED(); 517 if (flags()->replace_str) { 518 uptr from_length = MaybeRealStrnlen(from, size); 519 uptr copy_length = Min(size, from_length + 1); 520 ASAN_READ_RANGE(ctx, from, copy_length); 521 uptr to_length = REAL(strlen)(to); 522 ASAN_READ_STRING_OF_LEN(ctx, to, to_length, to_length); 523 ASAN_WRITE_RANGE(ctx, to + to_length, from_length + 1); 524 if (from_length > 0) { 525 CHECK_RANGES_OVERLAP("strncat", to, to_length + copy_length + 1, 526 from, copy_length); 527 } 528 } 529 return REAL(strncat)(to, from, size); 530} 531 532INTERCEPTOR(char*, strcpy, char *to, const char *from) { // NOLINT 533 void *ctx; 534 ASAN_INTERCEPTOR_ENTER(ctx, strcpy); // NOLINT 535#if SANITIZER_MAC 536 if (UNLIKELY(!asan_inited)) return REAL(strcpy)(to, from); // NOLINT 537#endif 538 // strcpy is called from malloc_default_purgeable_zone() 539 // in __asan::ReplaceSystemAlloc() on Mac. 540 if (asan_init_is_running) { 541 return REAL(strcpy)(to, from); // NOLINT 542 } 543 ENSURE_ASAN_INITED(); 544 if (flags()->replace_str) { 545 uptr from_size = REAL(strlen)(from) + 1; 546 CHECK_RANGES_OVERLAP("strcpy", to, from_size, from, from_size); 547 ASAN_READ_RANGE(ctx, from, from_size); 548 ASAN_WRITE_RANGE(ctx, to, from_size); 549 } 550 return REAL(strcpy)(to, from); // NOLINT 551} 552 553INTERCEPTOR(char*, strdup, const char *s) { 554 void *ctx; 555 ASAN_INTERCEPTOR_ENTER(ctx, strdup); 556 if (UNLIKELY(!asan_inited)) return internal_strdup(s); 557 ENSURE_ASAN_INITED(); 558 uptr length = REAL(strlen)(s); 559 if (flags()->replace_str) { 560 ASAN_READ_RANGE(ctx, s, length + 1); 561 } 562 GET_STACK_TRACE_MALLOC; 563 void *new_mem = asan_malloc(length + 1, &stack); 564 REAL(memcpy)(new_mem, s, length + 1); 565 return reinterpret_cast<char*>(new_mem); 566} 567 568#if ASAN_INTERCEPT___STRDUP 569INTERCEPTOR(char*, __strdup, const char *s) { 570 void *ctx; 571 ASAN_INTERCEPTOR_ENTER(ctx, strdup); 572 if (UNLIKELY(!asan_inited)) return internal_strdup(s); 573 ENSURE_ASAN_INITED(); 574 uptr length = REAL(strlen)(s); 575 if (flags()->replace_str) { 576 ASAN_READ_RANGE(ctx, s, length + 1); 577 } 578 GET_STACK_TRACE_MALLOC; 579 void *new_mem = asan_malloc(length + 1, &stack); 580 REAL(memcpy)(new_mem, s, length + 1); 581 return reinterpret_cast<char*>(new_mem); 582} 583#endif // ASAN_INTERCEPT___STRDUP 584 585INTERCEPTOR(SIZE_T, wcslen, const wchar_t *s) { 586 void *ctx; 587 ASAN_INTERCEPTOR_ENTER(ctx, wcslen); 588 SIZE_T length = REAL(wcslen)(s); 589 if (!asan_init_is_running) { 590 ENSURE_ASAN_INITED(); 591 ASAN_READ_RANGE(ctx, s, (length + 1) * sizeof(wchar_t)); 592 } 593 return length; 594} 595 596INTERCEPTOR(char*, strncpy, char *to, const char *from, uptr size) { 597 void *ctx; 598 ASAN_INTERCEPTOR_ENTER(ctx, strncpy); 599 ENSURE_ASAN_INITED(); 600 if (flags()->replace_str) { 601 uptr from_size = Min(size, MaybeRealStrnlen(from, size) + 1); 602 CHECK_RANGES_OVERLAP("strncpy", to, from_size, from, from_size); 603 ASAN_READ_RANGE(ctx, from, from_size); 604 ASAN_WRITE_RANGE(ctx, to, size); 605 } 606 return REAL(strncpy)(to, from, size); 607} 608 609INTERCEPTOR(long, strtol, const char *nptr, // NOLINT 610 char **endptr, int base) { 611 void *ctx; 612 ASAN_INTERCEPTOR_ENTER(ctx, strtol); 613 ENSURE_ASAN_INITED(); 614 if (!flags()->replace_str) { 615 return REAL(strtol)(nptr, endptr, base); 616 } 617 char *real_endptr; 618 long result = REAL(strtol)(nptr, &real_endptr, base); // NOLINT 619 StrtolFixAndCheck(ctx, nptr, endptr, real_endptr, base); 620 return result; 621} 622 623INTERCEPTOR(int, atoi, const char *nptr) { 624 void *ctx; 625 ASAN_INTERCEPTOR_ENTER(ctx, atoi); 626#if SANITIZER_MAC 627 if (UNLIKELY(!asan_inited)) return REAL(atoi)(nptr); 628#endif 629 ENSURE_ASAN_INITED(); 630 if (!flags()->replace_str) { 631 return REAL(atoi)(nptr); 632 } 633 char *real_endptr; 634 // "man atoi" tells that behavior of atoi(nptr) is the same as 635 // strtol(nptr, 0, 10), i.e. it sets errno to ERANGE if the 636 // parsed integer can't be stored in *long* type (even if it's 637 // different from int). So, we just imitate this behavior. 638 int result = REAL(strtol)(nptr, &real_endptr, 10); 639 FixRealStrtolEndptr(nptr, &real_endptr); 640 ASAN_READ_STRING(ctx, nptr, (real_endptr - nptr) + 1); 641 return result; 642} 643 644INTERCEPTOR(long, atol, const char *nptr) { // NOLINT 645 void *ctx; 646 ASAN_INTERCEPTOR_ENTER(ctx, atol); 647#if SANITIZER_MAC 648 if (UNLIKELY(!asan_inited)) return REAL(atol)(nptr); 649#endif 650 ENSURE_ASAN_INITED(); 651 if (!flags()->replace_str) { 652 return REAL(atol)(nptr); 653 } 654 char *real_endptr; 655 long result = REAL(strtol)(nptr, &real_endptr, 10); // NOLINT 656 FixRealStrtolEndptr(nptr, &real_endptr); 657 ASAN_READ_STRING(ctx, nptr, (real_endptr - nptr) + 1); 658 return result; 659} 660 661#if ASAN_INTERCEPT_ATOLL_AND_STRTOLL 662INTERCEPTOR(long long, strtoll, const char *nptr, // NOLINT 663 char **endptr, int base) { 664 void *ctx; 665 ASAN_INTERCEPTOR_ENTER(ctx, strtoll); 666 ENSURE_ASAN_INITED(); 667 if (!flags()->replace_str) { 668 return REAL(strtoll)(nptr, endptr, base); 669 } 670 char *real_endptr; 671 long long result = REAL(strtoll)(nptr, &real_endptr, base); // NOLINT 672 StrtolFixAndCheck(ctx, nptr, endptr, real_endptr, base); 673 return result; 674} 675 676INTERCEPTOR(long long, atoll, const char *nptr) { // NOLINT 677 void *ctx; 678 ASAN_INTERCEPTOR_ENTER(ctx, atoll); 679 ENSURE_ASAN_INITED(); 680 if (!flags()->replace_str) { 681 return REAL(atoll)(nptr); 682 } 683 char *real_endptr; 684 long long result = REAL(strtoll)(nptr, &real_endptr, 10); // NOLINT 685 FixRealStrtolEndptr(nptr, &real_endptr); 686 ASAN_READ_STRING(ctx, nptr, (real_endptr - nptr) + 1); 687 return result; 688} 689#endif // ASAN_INTERCEPT_ATOLL_AND_STRTOLL 690 691#if ASAN_INTERCEPT___CXA_ATEXIT 692static void AtCxaAtexit(void *unused) { 693 (void)unused; 694 StopInitOrderChecking(); 695} 696 697INTERCEPTOR(int, __cxa_atexit, void (*func)(void *), void *arg, 698 void *dso_handle) { 699#if SANITIZER_MAC 700 if (UNLIKELY(!asan_inited)) return REAL(__cxa_atexit)(func, arg, dso_handle); 701#endif 702 ENSURE_ASAN_INITED(); 703 int res = REAL(__cxa_atexit)(func, arg, dso_handle); 704 REAL(__cxa_atexit)(AtCxaAtexit, nullptr, nullptr); 705 return res; 706} 707#endif // ASAN_INTERCEPT___CXA_ATEXIT 708 709#if ASAN_INTERCEPT_FORK 710INTERCEPTOR(int, fork, void) { 711 ENSURE_ASAN_INITED(); 712 if (common_flags()->coverage) CovBeforeFork(); 713 int pid = REAL(fork)(); 714 if (common_flags()->coverage) CovAfterFork(pid); 715 return pid; 716} 717#endif // ASAN_INTERCEPT_FORK 718 719// ---------------------- InitializeAsanInterceptors ---------------- {{{1 720namespace __asan { 721void InitializeAsanInterceptors() { 722 static bool was_called_once; 723 CHECK(was_called_once == false); 724 was_called_once = true; 725 InitializeCommonInterceptors(); 726 727 // Intercept mem* functions. 728 ASAN_INTERCEPT_FUNC(memcpy); 729 ASAN_INTERCEPT_FUNC(memset); 730 if (PLATFORM_HAS_DIFFERENT_MEMCPY_AND_MEMMOVE) { 731 // In asan, REAL(memmove) is not used, but it is used in msan. 732 ASAN_INTERCEPT_FUNC(memmove); 733 } 734 CHECK(REAL(memcpy)); 735 736 // Intercept str* functions. 737 ASAN_INTERCEPT_FUNC(strcat); // NOLINT 738 ASAN_INTERCEPT_FUNC(strcpy); // NOLINT 739 ASAN_INTERCEPT_FUNC(wcslen); 740 ASAN_INTERCEPT_FUNC(strncat); 741 ASAN_INTERCEPT_FUNC(strncpy); 742 ASAN_INTERCEPT_FUNC(strdup); 743#if ASAN_INTERCEPT___STRDUP 744 ASAN_INTERCEPT_FUNC(__strdup); 745#endif 746#if ASAN_INTERCEPT_INDEX && ASAN_USE_ALIAS_ATTRIBUTE_FOR_INDEX 747 ASAN_INTERCEPT_FUNC(index); 748#endif 749 750 ASAN_INTERCEPT_FUNC(atoi); 751 ASAN_INTERCEPT_FUNC(atol); 752 ASAN_INTERCEPT_FUNC(strtol); 753#if ASAN_INTERCEPT_ATOLL_AND_STRTOLL 754 ASAN_INTERCEPT_FUNC(atoll); 755 ASAN_INTERCEPT_FUNC(strtoll); 756#endif 757 758 // Intecept signal- and jump-related functions. 759 ASAN_INTERCEPT_FUNC(longjmp); 760#if ASAN_INTERCEPT_SIGNAL_AND_SIGACTION 761 ASAN_INTERCEPT_FUNC(sigaction); 762#if SANITIZER_ANDROID 763 ASAN_INTERCEPT_FUNC(bsd_signal); 764#endif 765 ASAN_INTERCEPT_FUNC(signal); 766#endif 767#if ASAN_INTERCEPT_SWAPCONTEXT 768 ASAN_INTERCEPT_FUNC(swapcontext); 769#endif 770#if ASAN_INTERCEPT__LONGJMP 771 ASAN_INTERCEPT_FUNC(_longjmp); 772#endif 773#if ASAN_INTERCEPT_SIGLONGJMP 774 ASAN_INTERCEPT_FUNC(siglongjmp); 775#endif 776 777 // Intercept exception handling functions. 778#if ASAN_INTERCEPT___CXA_THROW 779 ASAN_INTERCEPT_FUNC(__cxa_throw); 780#endif 781 782 // Intercept threading-related functions 783#if ASAN_INTERCEPT_PTHREAD_CREATE 784#if defined(ASAN_PTHREAD_CREATE_VERSION) 785 ASAN_INTERCEPT_FUNC_VER(pthread_create, ASAN_PTHREAD_CREATE_VERSION); 786#else 787 ASAN_INTERCEPT_FUNC(pthread_create); 788#endif 789 ASAN_INTERCEPT_FUNC(pthread_join); 790#endif 791 792 // Intercept atexit function. 793#if ASAN_INTERCEPT___CXA_ATEXIT 794 ASAN_INTERCEPT_FUNC(__cxa_atexit); 795#endif 796 797#if ASAN_INTERCEPT_FORK 798 ASAN_INTERCEPT_FUNC(fork); 799#endif 800 801 InitializePlatformInterceptors(); 802 803 VReport(1, "AddressSanitizer: libc interceptors initialized\n"); 804} 805 806} // namespace __asan 807