1799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar//===-- ubsan_type_hash_itanium.cc ----------------------------------------===// 2799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar// 3799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar// The LLVM Compiler Infrastructure 4799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar// 5799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar// This file is distributed under the University of Illinois Open Source 6799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar// License. See LICENSE.TXT for details. 7799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar// 8799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar//===----------------------------------------------------------------------===// 9799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar// 10799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar// Implementation of type hashing/lookup for Itanium C++ ABI. 11799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar// 12799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar//===----------------------------------------------------------------------===// 13799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar 14799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar#include "sanitizer_common/sanitizer_platform.h" 15799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar#include "ubsan_platform.h" 16799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar#if CAN_SANITIZE_UB && !SANITIZER_WINDOWS 17799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar#include "ubsan_type_hash.h" 18799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar 19799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar#include "sanitizer_common/sanitizer_common.h" 20799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar 21799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar// The following are intended to be binary compatible with the definitions 22799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar// given in the Itanium ABI. We make no attempt to be ODR-compatible with 23799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar// those definitions, since existing ABI implementations aren't. 24799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar 25799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainarnamespace std { 26799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar class type_info { 27799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar public: 28799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar virtual ~type_info(); 29799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar 30799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar const char *__type_name; 31799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar }; 32799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar} 33799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar 34799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainarnamespace __cxxabiv1 { 35799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar 36799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar/// Type info for classes with no bases, and base class for type info for 37799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar/// classes with bases. 38799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainarclass __class_type_info : public std::type_info { 39799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar ~__class_type_info() override; 40799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar}; 41799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar 42799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar/// Type info for classes with simple single public inheritance. 43799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainarclass __si_class_type_info : public __class_type_info { 44799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainarpublic: 45799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar ~__si_class_type_info() override; 46799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar 47799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar const __class_type_info *__base_type; 48799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar}; 49799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar 50799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainarclass __base_class_type_info { 51799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainarpublic: 52799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar const __class_type_info *__base_type; 53799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar long __offset_flags; 54799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar 55799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar enum __offset_flags_masks { 56799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar __virtual_mask = 0x1, 57799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar __public_mask = 0x2, 58799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar __offset_shift = 8 59799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar }; 60799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar}; 61799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar 62799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar/// Type info for classes with multiple, virtual, or non-public inheritance. 63799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainarclass __vmi_class_type_info : public __class_type_info { 64799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainarpublic: 65799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar ~__vmi_class_type_info() override; 66799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar 67799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar unsigned int flags; 68799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar unsigned int base_count; 69799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar __base_class_type_info base_info[1]; 70799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar}; 71799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar 72799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar} 73799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar 74799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainarnamespace abi = __cxxabiv1; 75799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar 76799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar// We implement a simple two-level cache for type-checking results. For each 77799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar// (vptr,type) pair, a hash is computed. This hash is assumed to be globally 78799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar// unique; if it collides, we will get false negatives, but: 79799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar// * such a collision would have to occur on the *first* bad access, 80799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar// * the probability of such a collision is low (and for a 64-bit target, is 81799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar// negligible), and 82799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar// * the vptr, and thus the hash, can be affected by ASLR, so multiple runs 83799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar// give better coverage. 84799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar// 85799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar// The first caching layer is a small hash table with no chaining; buckets are 86799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar// reused as needed. The second caching layer is a large hash table with open 87799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar// chaining. We can freely evict from either layer since this is just a cache. 88799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar// 89799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar// FIXME: Make these hash table accesses thread-safe. The races here are benign: 90799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar// assuming the unsequenced loads and stores don't misbehave too badly, 91799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar// the worst case is false negatives or poor cache behavior, not false 92799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar// positives or crashes. 93799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar 94799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar/// Find a bucket to store the given hash value in. 95799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainarstatic __ubsan::HashValue *getTypeCacheHashTableBucket(__ubsan::HashValue V) { 96799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar static const unsigned HashTableSize = 65537; 97799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar static __ubsan::HashValue __ubsan_vptr_hash_set[HashTableSize]; 98799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar 99799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar unsigned First = (V & 65535) ^ 1; 100799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar unsigned Probe = First; 101799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar for (int Tries = 5; Tries; --Tries) { 102799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar if (!__ubsan_vptr_hash_set[Probe] || __ubsan_vptr_hash_set[Probe] == V) 103799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar return &__ubsan_vptr_hash_set[Probe]; 104799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar Probe += ((V >> 16) & 65535) + 1; 105799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar if (Probe >= HashTableSize) 106799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar Probe -= HashTableSize; 107799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar } 108799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar // FIXME: Pick a random entry from the probe sequence to evict rather than 109799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar // just taking the first. 110799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar return &__ubsan_vptr_hash_set[First]; 111799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar} 112799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar 113799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar/// \brief Determine whether \p Derived has a \p Base base class subobject at 114799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar/// offset \p Offset. 115799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainarstatic bool isDerivedFromAtOffset(const abi::__class_type_info *Derived, 116799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar const abi::__class_type_info *Base, 117799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar sptr Offset) { 118c58a43648cd6121c51a2e795a28e2ef90d7813e6Pirama Arumuga Nainar if (Derived->__type_name == Base->__type_name || 119c58a43648cd6121c51a2e795a28e2ef90d7813e6Pirama Arumuga Nainar (SANITIZER_NON_UNIQUE_TYPEINFO && 120c58a43648cd6121c51a2e795a28e2ef90d7813e6Pirama Arumuga Nainar !internal_strcmp(Derived->__type_name, Base->__type_name))) 121799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar return Offset == 0; 122799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar 123799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar if (const abi::__si_class_type_info *SI = 124799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar dynamic_cast<const abi::__si_class_type_info*>(Derived)) 125799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar return isDerivedFromAtOffset(SI->__base_type, Base, Offset); 126799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar 127799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar const abi::__vmi_class_type_info *VTI = 128799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar dynamic_cast<const abi::__vmi_class_type_info*>(Derived); 129799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar if (!VTI) 130799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar // No base class subobjects. 131799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar return false; 132799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar 133799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar // Look for a base class which is derived from \p Base at the right offset. 134799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar for (unsigned int base = 0; base != VTI->base_count; ++base) { 135799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar // FIXME: Curtail the recursion if this base can't possibly contain the 136799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar // given offset. 137799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar sptr OffsetHere = VTI->base_info[base].__offset_flags >> 138799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar abi::__base_class_type_info::__offset_shift; 139799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar if (VTI->base_info[base].__offset_flags & 140799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar abi::__base_class_type_info::__virtual_mask) 141799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar // For now, just punt on virtual bases and say 'yes'. 142799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar // FIXME: OffsetHere is the offset in the vtable of the virtual base 143799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar // offset. Read the vbase offset out of the vtable and use it. 144799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar return true; 145799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar if (isDerivedFromAtOffset(VTI->base_info[base].__base_type, 146799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar Base, Offset - OffsetHere)) 147799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar return true; 148799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar } 149799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar 150799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar return false; 151799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar} 152799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar 153799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar/// \brief Find the derived-most dynamic base class of \p Derived at offset 154799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar/// \p Offset. 155799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainarstatic const abi::__class_type_info *findBaseAtOffset( 156799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar const abi::__class_type_info *Derived, sptr Offset) { 157799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar if (!Offset) 158799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar return Derived; 159799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar 160799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar if (const abi::__si_class_type_info *SI = 161799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar dynamic_cast<const abi::__si_class_type_info*>(Derived)) 162799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar return findBaseAtOffset(SI->__base_type, Offset); 163799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar 164799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar const abi::__vmi_class_type_info *VTI = 165799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar dynamic_cast<const abi::__vmi_class_type_info*>(Derived); 166799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar if (!VTI) 167799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar // No base class subobjects. 168799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar return 0; 169799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar 170799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar for (unsigned int base = 0; base != VTI->base_count; ++base) { 171799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar sptr OffsetHere = VTI->base_info[base].__offset_flags >> 172799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar abi::__base_class_type_info::__offset_shift; 173799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar if (VTI->base_info[base].__offset_flags & 174799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar abi::__base_class_type_info::__virtual_mask) 175799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar // FIXME: Can't handle virtual bases yet. 176799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar continue; 177799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar if (const abi::__class_type_info *Base = 178799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar findBaseAtOffset(VTI->base_info[base].__base_type, 179799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar Offset - OffsetHere)) 180799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar return Base; 181799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar } 182799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar 183799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar return 0; 184799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar} 185799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar 186799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainarnamespace { 187799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar 188799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainarstruct VtablePrefix { 189799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar /// The offset from the vptr to the start of the most-derived object. 190799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar /// This will only be greater than zero in some virtual base class vtables 191799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar /// used during object con-/destruction, and will usually be exactly zero. 192799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar sptr Offset; 193799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar /// The type_info object describing the most-derived class type. 194799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar std::type_info *TypeInfo; 195799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar}; 196799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga NainarVtablePrefix *getVtablePrefix(void *Vtable) { 197799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar VtablePrefix *Vptr = reinterpret_cast<VtablePrefix*>(Vtable); 198799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar if (!Vptr) 199799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar return 0; 200799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar VtablePrefix *Prefix = Vptr - 1; 201799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar if (!Prefix->TypeInfo) 202799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar // This can't possibly be a valid vtable. 203799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar return 0; 204799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar return Prefix; 205799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar} 206799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar 207799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar} 208799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar 209799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainarbool __ubsan::checkDynamicType(void *Object, void *Type, HashValue Hash) { 210799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar // A crash anywhere within this function probably means the vptr is corrupted. 211799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar // FIXME: Perform these checks more cautiously. 212799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar 213799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar // Check whether this is something we've evicted from the cache. 214799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar HashValue *Bucket = getTypeCacheHashTableBucket(Hash); 215799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar if (*Bucket == Hash) { 216799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar __ubsan_vptr_type_cache[Hash % VptrTypeCacheSize] = Hash; 217799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar return true; 218799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar } 219799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar 220799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar void *VtablePtr = *reinterpret_cast<void **>(Object); 221799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar VtablePrefix *Vtable = getVtablePrefix(VtablePtr); 222799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar if (!Vtable) 223799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar return false; 224c58a43648cd6121c51a2e795a28e2ef90d7813e6Pirama Arumuga Nainar if (Vtable->Offset < -VptrMaxOffsetToTop || Vtable->Offset > VptrMaxOffsetToTop) { 225c58a43648cd6121c51a2e795a28e2ef90d7813e6Pirama Arumuga Nainar // Too large or too small offset are signs of Vtable corruption. 226c58a43648cd6121c51a2e795a28e2ef90d7813e6Pirama Arumuga Nainar return false; 227c58a43648cd6121c51a2e795a28e2ef90d7813e6Pirama Arumuga Nainar } 228799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar 229799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar // Check that this is actually a type_info object for a class type. 230799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar abi::__class_type_info *Derived = 231799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar dynamic_cast<abi::__class_type_info*>(Vtable->TypeInfo); 232799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar if (!Derived) 233799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar return false; 234799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar 235799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar abi::__class_type_info *Base = (abi::__class_type_info*)Type; 236799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar if (!isDerivedFromAtOffset(Derived, Base, -Vtable->Offset)) 237799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar return false; 238799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar 239799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar // Success. Cache this result. 240799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar __ubsan_vptr_type_cache[Hash % VptrTypeCacheSize] = Hash; 241799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar *Bucket = Hash; 242799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar return true; 243799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar} 244799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar 245799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar__ubsan::DynamicTypeInfo 246799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar__ubsan::getDynamicTypeInfoFromVtable(void *VtablePtr) { 247799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar VtablePrefix *Vtable = getVtablePrefix(VtablePtr); 248799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar if (!Vtable) 249799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar return DynamicTypeInfo(0, 0, 0); 250c58a43648cd6121c51a2e795a28e2ef90d7813e6Pirama Arumuga Nainar if (Vtable->Offset < -VptrMaxOffsetToTop || Vtable->Offset > VptrMaxOffsetToTop) 251c58a43648cd6121c51a2e795a28e2ef90d7813e6Pirama Arumuga Nainar return DynamicTypeInfo(0, Vtable->Offset, 0); 252799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar const abi::__class_type_info *ObjectType = findBaseAtOffset( 253799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar static_cast<const abi::__class_type_info*>(Vtable->TypeInfo), 254799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar -Vtable->Offset); 255799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar return DynamicTypeInfo(Vtable->TypeInfo->__type_name, -Vtable->Offset, 256799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar ObjectType ? ObjectType->__type_name : "<unknown>"); 257799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar} 258799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar 259799172d60d32feb1acba1a6867f3a9c39a999e5cPirama Arumuga Nainar#endif // CAN_SANITIZE_UB && !SANITIZER_WINDOWS 260