[Bug sanitizer/65081] New: -fsanitize=object-size fails with simple pointer arithm

[Bug sanitizer/65081] New: -fsanitize=object-size fails with simple pointer arithm

[larsbj at gullik dot net]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=65081

            Bug ID: 65081
           Summary: -fsanitize=object-size fails with simple pointer
                    arithm
           Product: gcc
           Version: 5.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: sanitizer
          Assignee: unassigned at gcc dot gnu.org
          Reporter: larsbj at gullik dot net
                CC: dodji at gcc dot gnu.org, dvyukov at gcc dot gnu.org,
                    jakub at gcc dot gnu.org, kcc at gcc dot gnu.org

With:

gcc (GCC) 5.0.0 20150216 (experimental) as of 220738

and this test snippet:

-----------

struct intro {
    int a;
    char pad_[1];
};

struct intro b;

struct intro * alloc()
{
    struct intro * i = &b;
    return i + 1;
}

int main(void)
{
    struct intro * i = alloc() - 1;
    i->a = 1;
}
-----------

I get this report:

test.c:17:10: runtime error: store to address 0x0000006010a0 with insufficient
space for an object of type 'int'
0x0000006010a0: note: pointer points here
 00 00 00 00  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  00 00 00 00 00
00 00 00  00 00 00 00
              ^

When compiled like this:

 gcc -O1 -fsanitize=object-size test.c

-fno-inline removes the runtime error, as do removing the pad_ from the intro
struct.

This is possibly an duplicate of bug 63303, but the errors are quite different.

[Bug sanitizer/65081] -fsanitize=object-size fails with simple pointer arithm

[redi at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=65081

Jonathan Wakely <redi at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |NEW
   Last reconfirmed|                            |2015-02-16
     Ever confirmed|0                           |1

[Bug sanitizer/65081] -fsanitize=object-size fails with simple pointer arithm

[mpolacek at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=65081

Marek Polacek <mpolacek at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |mpolacek at gcc dot gnu.org

--- Comment #1 from Marek Polacek <mpolacek at gcc dot gnu.org> ---
-fno-inline removes the runtime error because __builtin_object_size then can't
determine the size of the object, and -fsanitize=object-size is dependent on
__bos.
E.g., run this slightly modified (printf line added) code:

struct intro
{
  int a;
  char pad_[1];
};

struct intro b;

struct intro *
alloc ()
{
  struct intro *i = &b;
  return i + 1;
}

int
main (void)
{
  struct intro *i = alloc () - 1;
  __builtin_printf ("%zd\n", __builtin_object_size (&i->a, 0));
  i->a = 1;
}

$ xgcc -O e.c; ./a.out 
8
$ xgcc -O e.c -fno-inline; ./a.out 
-1

-1 means that __bos wasn't able to determine the size of an object.

[Bug sanitizer/65081] -fsanitize=object-size fails with simple pointer arithm

[mpolacek at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=65081

Marek Polacek <mpolacek at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|---                         |6.0

--- Comment #2 from Marek Polacek <mpolacek at gcc dot gnu.org> ---
But yeah, I think we'll need POINTER_DIFF_EXPR to fix this...

[Bug sanitizer/65081] -fsanitize=object-size fails with simple pointer arithm

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=65081

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|6.0                         |5.0

--- Comment #3 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
I think we should just make the IFN_OBJECT_SIZE expansion smarter.
In particular, we pass 3 interesting arguments to IFN_OBJECT_SIZE:
addr, addr - base, __builtin_object_size (base, 0) (we use ptr, offset, size
names for those).
The latter two are sizetype, so unsigned, but really, if addr - base is
"negative", then we shouldn't call __ubsan_handle*.
Now, the question is what to treat as "negative".  One possibility is just to
look at the sign of the second argument, cheaper, but might not be appropriate.
The other possibility is to check if ptr + offset < ptr and not warn in that
case, that is slower, but perhaps more precise.  Of course the comparison would
need to be performed on integers, so (unsigned long) ptr > (unsigned long) ptr
+ offset or so.  And, it could be done only after the initial comparison, so it
wouldn't affect programs not hit by this sanitizer bug before, other than
growing -fsanitize=undefined code size.

[Bug sanitizer/65081] -fsanitize=object-size fails with simple pointer arithm

[mpolacek at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=65081

Marek Polacek <mpolacek at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |ASSIGNED
           Assignee|unassigned at gcc dot gnu.org      |mpolacek at gcc dot gnu.org

--- Comment #4 from Marek Polacek <mpolacek at gcc dot gnu.org> ---
Thus mine.

[Bug sanitizer/65081] -fsanitize=object-size fails with simple pointer arithm

[mpolacek at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=65081

--- Comment #5 from Marek Polacek <mpolacek at gcc dot gnu.org> ---
Author: mpolacek
Date: Wed Feb 18 09:46:59 2015
New Revision: 220784

URL: https://gcc.gnu.org/viewcvs?rev=220784&root=gcc&view=rev
Log:
    PR sanitizer/65081
    * ubsan.c (OBJSZ_MAX_OFFSET): Define.
    (ubsan_expand_objsize_ifn): Don't emit run-time check if the offset
    is in range [-16K, -1].  Don't issue run-time error if
    (ptr > ptr + offset).

    * c-c++-common/ubsan/pr65081.c: New test.

Added:
    trunk/gcc/testsuite/c-c++-common/ubsan/pr65081.c
Modified:
    trunk/gcc/ChangeLog
    trunk/gcc/testsuite/ChangeLog
    trunk/gcc/ubsan.c

[Bug sanitizer/65081] -fsanitize=object-size fails with simple pointer arithm

[mpolacek at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=65081

Marek Polacek <mpolacek at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|---                         |FIXED

--- Comment #6 from Marek Polacek <mpolacek at gcc dot gnu.org> ---
Fixed for GCC 5.