[gcc(refs/users/uecker/heads/vla)] c: introduce ubsan checking for assigment of VM types 4/4

[gcc(refs/users/uecker/heads/vla)] c: introduce ubsan checking for assigment of VM types 4/4

[Martin Uecker]

https://gcc.gnu.org/g:50965998f02aa9a84640d4da8346f2eda187318c

commit 50965998f02aa9a84640d4da8346f2eda187318c
Author: Martin Uecker <uecker@tugraz.at>
Date:   Sun May 28 13:45:03 2023 +0200

    c: introduce ubsan checking for assigment of VM types 4/4
    
    Support instrumentation of functions called via pointers.  To do so,
    record the declaration with the parameter types, so that it can be
    retrieved later.
    
    gcc/c:
            c-decl.cc (get_parm_info): Record function declaration
            for arguments.
            c-type.cc (process_vm_constraints): Instrument functions
            called via pointers.
    
    gcc/testsuide/gcc.dg:
            * ubsan/vm-bounds-2.c: Add warning.
            * ubsan/vm-bounds-5.c: New test.

Diff:
---
 gcc/c/c-decl.cc                          |  3 ++
 gcc/c/c-typeck.cc                        | 15 ++++++-
 gcc/testsuite/gcc.dg/ubsan/vm-bounds-2.c |  2 +-
 gcc/testsuite/gcc.dg/ubsan/vm-bounds-5.c | 72 ++++++++++++++++++++++++++++++++
 4 files changed, 89 insertions(+), 3 deletions(-)

diff --git a/gcc/c/c-decl.cc b/gcc/c/c-decl.cc
index ecd10ebb69c..52c90a9946c 100644
--- a/gcc/c/c-decl.cc
+++ b/gcc/c/c-decl.cc
@@ -8410,6 +8410,9 @@ get_parm_info (bool ellipsis, tree expr)
 		 declared types.  The back end may override this later.  */
 	      DECL_ARG_TYPE (decl) = type;
 	      types = tree_cons (0, type, types);
+
+	      /* Record the decl for use of UBSan bounds checking.  */
+	      TREE_PURPOSE (types) = decl;
 	    }
 	  break;
 
diff --git a/gcc/c/c-typeck.cc b/gcc/c/c-typeck.cc
index 321fe1eec1c..0b5a29d21b4 100644
--- a/gcc/c/c-typeck.cc
+++ b/gcc/c/c-typeck.cc
@@ -3602,9 +3602,20 @@ process_vm_constraints (location_t location,
 	}
       else
 	{
-	  /* Functions called via pointers are not yet supported.  */
-	  return void_node;
+	  while (FUNCTION_TYPE != TREE_CODE (function))
+	    function = TREE_TYPE (function);
+
+	  args = TREE_PURPOSE (TYPE_ARG_TYPES (function));
+
+	  if (!args)
+	    {
+	      /* FIXME: this can happen when forming composite types for the
+		 conditional operator.  */
+	      warning_at (location, 0, "Function call not instrumented.");
+	      return void_node;
+	    }
 	}
+      gcc_assert (PARM_DECL == TREE_CODE (args));
     }
 
   FOR_EACH_VEC_SAFE_ELT (instr_vec, i, d)
diff --git a/gcc/testsuite/gcc.dg/ubsan/vm-bounds-2.c b/gcc/testsuite/gcc.dg/ubsan/vm-bounds-2.c
index 22f06231eaa..093cbddd2ea 100644
--- a/gcc/testsuite/gcc.dg/ubsan/vm-bounds-2.c
+++ b/gcc/testsuite/gcc.dg/ubsan/vm-bounds-2.c
@@ -31,7 +31,7 @@ void f(void)
 
 	int u = 3; int v = 4;
 	char a[u][v];
-	(1 ? f1 : f2)(u, v, a);
+	(1 ? f1 : f2)(u, v, a);	/* { dg-warning "Function call not instrumented." } */
 }
 
 /* size expression in parameter */
diff --git a/gcc/testsuite/gcc.dg/ubsan/vm-bounds-5.c b/gcc/testsuite/gcc.dg/ubsan/vm-bounds-5.c
new file mode 100644
index 00000000000..1a251e39deb
--- /dev/null
+++ b/gcc/testsuite/gcc.dg/ubsan/vm-bounds-5.c
@@ -0,0 +1,72 @@
+/* { dg-do run } */
+/* { dg-options "-fsanitize=vla-bound" } */
+
+
+void foo1(void (*p)(int n, char (*a)[n]))
+{
+	char A0[3];
+	(*p)(3, &A0);
+	(*p)(4, &A0);	/* */
+	/* { dg-output "bound 4 of type 'char \\\[\\\*\\\]' does not match bound 3 of type 'char \\\[3\\\]'\[^\n\r]*(\n|\r\n|\r)" } */
+}
+
+void b0(int n, char (*a)[n]) { }
+
+
+int n;
+
+void foo2(void (*p)(int n, char (*a)[n]))
+{
+	n = 4;
+	char A0[3];
+	(*p)(3, &A0);
+	(*p)(4, &A0);
+	/* { dg-output "\[^\n\r]*bound 4 of type 'char \\\[\\\*\\\]' does not match bound 3 of type 'char \\\[3\\\]'\[^\n\r]*(\n|\r\n|\r)" } */
+}
+
+void foo3(void (*p)(int n0, char (*a)[n]))
+{
+	n = 4;
+	char A0[3];
+	(*p)(3, &A0);	/* */
+	/* { dg-output "\[^\n\r]*bound 4 of type 'char \\\[\\\*\\\]' does not match bound 3 of type 'char \\\[3\\\]'\[^\n\r]*(\n|\r\n|\r)" } */
+	(*p)(4, &A0);	/* */
+	/* { dg-output "\[^\n\r]*bound 4 of type 'char \\\[\\\*\\\]' does not match bound 3 of type 'char \\\[3\\\]'\[^\n\r]*(\n|\r\n|\r)" } */
+}
+
+void foo4(void (*p)(int n, char (*a)[n]))
+{
+	n = 3;
+	char A0[3];
+	(*p)(3, &A0);
+	(*p)(4, &A0);	/* */
+	/* { dg-output "\[^\n\r]*bound 4 of type 'char \\\[\\\*\\\]' does not match bound 3 of type 'char \\\[3\\\]'" } */
+}
+
+
+void foo5(void (*p)(int n0, char (*a)[n]))
+{
+	n = 3;
+	char A0[3];
+	(*p)(3, &A0);
+	(*p)(4, &A0);
+}
+
+
+void b1(int n0, char (*a)[n]) { }
+
+
+
+int main()
+{
+	foo1(&b0);
+
+	foo2(&b1);
+	foo3(&b1); // we should diagnose mismatch and run-time discrepancies
+
+	foo4(&b1);
+	foo5(&b1); // we should diagnose mismatch and run-time discrepancies
+}
+
+
+