From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (qmail 16080 invoked by alias); 21 Jun 2017 08:05:08 -0000 Mailing-List: contact gcc-patches-help@gcc.gnu.org; run by ezmlm Precedence: bulk List-Id: List-Archive: List-Post: List-Help: Sender: gcc-patches-owner@gcc.gnu.org Received: (qmail 16034 invoked by uid 89); 21 Jun 2017 08:05:07 -0000 Authentication-Results: sourceware.org; auth=none X-Virus-Found: No X-Spam-SWARE-Status: No, score=-16.9 required=5.0 tests=BAYES_00,GIT_PATCH_1,GIT_PATCH_2,GIT_PATCH_3,SPF_PASS,T_RP_MATCHES_RCVD autolearn=ham version=3.3.2 spammy= X-HELO: mx1.suse.de Received: from mx2.suse.de (HELO mx1.suse.de) (195.135.220.15) by sourceware.org (qpsmtpd/0.93/v0.84-503-g423c35a) with ESMTP; Wed, 21 Jun 2017 08:05:05 +0000 Received: from relay1.suse.de (charybdis-ext.suse.de [195.135.220.254]) by mx1.suse.de (Postfix) with ESMTP id 8A9C9AB5D; Wed, 21 Jun 2017 08:05:03 +0000 (UTC) Date: Wed, 21 Jun 2017 08:05:00 -0000 From: Richard Biener To: Jakub Jelinek cc: =?ISO-8859-15?Q?Martin_Li=A8ka?= , gcc-patches@gcc.gnu.org Subject: Re: [RFC PATCH] -fsanitize=pointer-overflow support (PR sanitizer/80998) In-Reply-To: <20170621080048.GN2123@tucnak> Message-ID: References: <20170619182515.GA2123@tucnak> <20170621080048.GN2123@tucnak> User-Agent: Alpine 2.20 (LSU 67 2015-01-07) MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII X-SW-Source: 2017-06/txt/msg01545.txt.bz2 On Wed, 21 Jun 2017, Jakub Jelinek wrote: > On Tue, Jun 20, 2017 at 09:41:43AM +0200, Richard Biener wrote: > > > 2) libcpp/line-map.c has this: > > > static int > > > location_adhoc_data_update (void **slot, void *data) > > > { > > > *((char **) slot) += *((int64_t *) data); > > > return 1; > > > } > > > where the (why int64_t always?, we really need just intptr_t) adjusts > > > one pointer from an unrelated one (result of realloc). That is a UB > > > and actually can trigger this sanitization if the two regions are > > > far away from each other, e.g. on i686-linux: > > > ../../libcpp/line-map.c:102:21: runtime error: pointer index expression with base 0x0899e308 overflowed to 0xf74c4ab8 > > > ../../libcpp/line-map.c:102:21: runtime error: pointer index expression with base 0x08add7c0 overflowed to 0xf74c9a08 > > > ../../libcpp/line-map.c:102:21: runtime error: pointer index expression with base 0x092ba308 overflowed to 0xf741cab8 > > > ../../libcpp/line-map.c:102:21: runtime error: pointer index expression with base 0x0a3757c0 overflowed to 0xf7453a08 > > > Shall we perform the addition in uintptr_t instead to make it > > > implementation defined rather than UB? > > > > Yes. > > Here is a patch for 2), bootstrap-ubsan bootstrapped/regtested on > x86_64-linux and i686-linux, ok for trunk? Ok. Richard. > Note both ptrdiff_t and uintptr_t are already used in libcpp, so I think > it shouldn't create new portability issues. > > 2017-06-21 Jakub Jelinek > > * line-map.c (location_adhoc_data_update): Perform addition in > uintptr_t type rather than char * type. Read *data using > ptrdiff_t type instead of int64_t. > (get_combined_adhoc_loc): Change offset type to ptrdiff_t from > int64_t. > > --- libcpp/line-map.c.jj 2017-06-19 08:28:18.000000000 +0200 > +++ libcpp/line-map.c 2017-06-20 16:43:25.193063344 +0200 > @@ -99,7 +99,8 @@ location_adhoc_data_eq (const void *l1, > static int > location_adhoc_data_update (void **slot, void *data) > { > - *((char **) slot) += *((int64_t *) data); > + *((char **) slot) > + = (char *) ((uintptr_t) *((char **) slot) + *((ptrdiff_t *) data)); > return 1; > } > > @@ -221,7 +222,7 @@ get_combined_adhoc_loc (struct line_maps > set->location_adhoc_data_map.allocated) > { > char *orig_data = (char *) set->location_adhoc_data_map.data; > - int64_t offset; > + ptrdiff_t offset; > /* Cast away extern "C" from the type of xrealloc. */ > line_map_realloc reallocator = (set->reallocator > ? set->reallocator > > > Jakub > > -- Richard Biener SUSE LINUX GmbH, GF: Felix Imendoerffer, Jane Smithard, Graham Norton, HRB 21284 (AG Nuernberg)