diff options
| author | Vlad Tsyrklevich <vlad@tsyrklevich.net> | 2018-08-30 20:44:51 +0000 |
|---|---|---|
| committer | Vlad Tsyrklevich <vlad@tsyrklevich.net> | 2018-08-30 20:44:51 +0000 |
| commit | 2499aeead93a28cff56816c6ce7c093d227a0084 (patch) | |
| tree | cec8fefa533fbf9c87869b83e60fc59d6173aa0e /llvm/test/Transforms/SafeStack/X86 | |
| parent | e4c3c6c873bdb967ec6dc258939f7a6b908a269f (diff) | |
| download | bcm5719-llvm-2499aeead93a28cff56816c6ce7c093d227a0084.tar.gz bcm5719-llvm-2499aeead93a28cff56816c6ce7c093d227a0084.zip | |
SafeStack: Prevent OOB reads with mem intrinsics
Summary:
Currently, the SafeStack analysis disallows out-of-bounds writes but not
out-of-bounds reads for mem intrinsics like llvm.memcpy. This could
cause leaks of pointers to the safe stack by leaking spilled registers/
frame pointers. Check for allocas used as source or destination pointers
to mem intrinsics.
Reviewers: eugenis
Reviewed By: eugenis
Subscribers: pcc, llvm-commits, kcc
Differential Revision: https://reviews.llvm.org/D51334
llvm-svn: 341116
Diffstat (limited to 'llvm/test/Transforms/SafeStack/X86')
| -rw-r--r-- | llvm/test/Transforms/SafeStack/X86/memintrinsic-oob-read.ll | 14 |
1 files changed, 14 insertions, 0 deletions
diff --git a/llvm/test/Transforms/SafeStack/X86/memintrinsic-oob-read.ll b/llvm/test/Transforms/SafeStack/X86/memintrinsic-oob-read.ll new file mode 100644 index 00000000000..90af6b3e540 --- /dev/null +++ b/llvm/test/Transforms/SafeStack/X86/memintrinsic-oob-read.ll @@ -0,0 +1,14 @@ +; RUN: opt -safe-stack -S -mtriple=i386-pc-linux-gnu < %s -o - | FileCheck %s +; RUN: opt -safe-stack -S -mtriple=x86_64-pc-linux-gnu < %s -o - | FileCheck %s + +target datalayout = "e-m:e-i64:64-f80:128-n8:16:32:64-S128" +target triple = "x86_64-unknown-linux-gnu" + +declare void @llvm.memcpy.p0i8.p0i8.i64(i8* nocapture writeonly, i8* nocapture readonly, i64, i1) + +; CHECK: __safestack_unsafe_stack_ptr +define void @oob_read(i8* %ptr) safestack { + %1 = alloca i8 + call void @llvm.memcpy.p0i8.p0i8.i64(i8* align 1 %ptr, i8* align 1 %1, i64 4, i1 false) + ret void +} |
