diff options
author | Etienne Bergeron <etienneb@google.com> | 2016-12-08 15:53:33 +0000 |
---|---|---|
committer | Etienne Bergeron <etienneb@google.com> | 2016-12-08 15:53:33 +0000 |
commit | 58ee3b786db033d9564dbc5601fed071bada382f (patch) | |
tree | 4b11e1e4f3ddae791d7d415eb8dce7636003c0e2 | |
parent | 39c16dfbceb55323e946b8330b4f8d4a08179431 (diff) | |
download | bcm5719-llvm-58ee3b786db033d9564dbc5601fed071bada382f.tar.gz bcm5719-llvm-58ee3b786db033d9564dbc5601fed071bada382f.zip |
[compiler-rt][asan] Fix overlaping parameters for memmove/memcpy on windows.
Summary:
On windows, memmove and memcpy may be the same functions (on 64-bits).
```
-- f:\dd\vctools\crt\vcruntime\src\string\amd64\memcpy.asm --------------------
OPTION PROLOGUE:NONE, EPILOGUE:NONE
memmove = memcpy
mov r11, rcx ; save destination address
```
This is causing ASAN to report overlaping parameters when instrumenting chromium.
```
D:\src\chromium\src>out\asan64\chrome.exe --no-sandbox
[8956:6208:1121/162511:ERROR:entry.cc(167)] Entry::Deserialize: dictionary has no interface_provider_specs key
[8956:11560:1121/162511:ERROR:external_registry_loader_win.cc(130)] Missing value path for key Software\Google\Chrome\Ex
tensions\doeiiacdhfmpdeckdaifnjaemmkkdlkf.
=================================================================
==5132==ERROR: AddressSanitizer: memcpy-param-overlap: memory ranges [0x000000237ee8,0x000000237eea) and [0x000000237ee9
, 0x000000237eeb) overlap
```
The error triggered on chromium:
```
Child-SP RetAddr Call Site
00000000`00166520 00000001`400a4886 chrome!__asan::ReportStringFunctionMemoryRangesOverlap+0x23 [d:\src\llvm\llvm\projects\compiler-rt\lib\asan\asan_report.cc @ 305]
*** WARNING: Unable to verify checksum for D:\src\chromium\src\out\asan64dynamic\libglesv2.dll
00000000`001672a0 000007fe`e1859607 chrome!__asan_wrap_memcpy+0xf6 [d:\src\llvm\llvm\projects\compiler-rt\lib\asan\asan_interceptors.cc @ 458]
00000000`00167b30 000007fe`e184bcbc libglesv2!__acrt_fp_strflt_to_string+0xb7 [d:\th\minkernel\crts\ucrt\src\appcrt\convert\_fptostr.cpp @ 86]
(Inline Function) --------`-------- libglesv2!fp_format_f+0x57 [d:\th\minkernel\crts\ucrt\src\appcrt\convert\cvt.cpp @ 578]
00000000`00167b60 000007fe`e182e2a2 libglesv2!__acrt_fp_format+0x180 [d:\th\minkernel\crts\ucrt\src\appcrt\convert\cvt.cpp @ 722]
00000000`00167bf0 000007fe`e182ce80 libglesv2!__crt_stdio_output::output_processor<char,__crt_stdio_output::stream_output_adapter<char>,__crt_stdio_output::format_validation_
```
This bug is similar to: https://llvm.org/bugs/show_bug.cgi?id=16362
Reviewers: rnk, zaks.anna, filcab
Subscribers: filcab, kubabrecka, chrisha, llvm-commits, dberris
Differential Revision: https://reviews.llvm.org/D27052
llvm-svn: 289063
-rw-r--r-- | compiler-rt/lib/asan/asan_interceptors.cc | 22 |
1 files changed, 11 insertions, 11 deletions
diff --git a/compiler-rt/lib/asan/asan_interceptors.cc b/compiler-rt/lib/asan/asan_interceptors.cc index 8f38587083d..23f2e44b015 100644 --- a/compiler-rt/lib/asan/asan_interceptors.cc +++ b/compiler-rt/lib/asan/asan_interceptors.cc @@ -454,17 +454,17 @@ INTERCEPTOR(void*, memmove, void *to, const void *from, uptr size) { INTERCEPTOR(void*, memcpy, void *to, const void *from, uptr size) { void *ctx; ASAN_INTERCEPTOR_ENTER(ctx, memcpy); -#if !SANITIZER_MAC - ASAN_MEMCPY_IMPL(ctx, to, from, size); -#else - // At least on 10.7 and 10.8 both memcpy() and memmove() are being replaced - // with WRAP(memcpy). As a result, false positives are reported for memmove() - // calls. If we just disable error reporting with - // ASAN_OPTIONS=replace_intrin=0, memmove() is still replaced with - // internal_memcpy(), which may lead to crashes, see - // http://llvm.org/bugs/show_bug.cgi?id=16362. - ASAN_MEMMOVE_IMPL(ctx, to, from, size); -#endif // !SANITIZER_MAC + if (PLATFORM_HAS_DIFFERENT_MEMCPY_AND_MEMMOVE) { + ASAN_MEMCPY_IMPL(ctx, to, from, size); + } else { + // At least on 10.7 and 10.8 both memcpy() and memmove() are being replaced + // with WRAP(memcpy). As a result, false positives are reported for + // memmove() calls. If we just disable error reporting with + // ASAN_OPTIONS=replace_intrin=0, memmove() is still replaced with + // internal_memcpy(), which may lead to crashes, see + // http://llvm.org/bugs/show_bug.cgi?id=16362. + ASAN_MEMMOVE_IMPL(ctx, to, from, size); + } } INTERCEPTOR(void*, memset, void *block, int c, uptr size) { |