102 lines · cpp
1// RUN: %clangxx_cfi -o %t1 %s2// RUN: %expect_crash %run %t1 2>&1 | FileCheck --check-prefix=CFI %s3 4// RUN: %clangxx_cfi -DB32 -o %t2 %s5// RUN: %expect_crash %run %t2 2>&1 | FileCheck --check-prefix=CFI %s6 7// RUN: %clangxx_cfi -DB64 -o %t3 %s8// RUN: %expect_crash %run %t3 2>&1 | FileCheck --check-prefix=CFI %s9 10// RUN: %clangxx_cfi -DBM -o %t4 %s11// RUN: %expect_crash %run %t4 2>&1 | FileCheck --check-prefix=CFI %s12 13// RUN: %clangxx_cfi -O1 -o %t5 %s14// RUN: %expect_crash %run %t5 2>&1 | FileCheck --check-prefix=CFI %s15 16// RUN: %clangxx_cfi -O1 -DB32 -o %t6 %s17// RUN: %expect_crash %run %t6 2>&1 | FileCheck --check-prefix=CFI %s18 19// RUN: %clangxx_cfi -O1 -DB64 -o %t7 %s20// RUN: %expect_crash %run %t7 2>&1 | FileCheck --check-prefix=CFI %s21 22// RUN: %clangxx_cfi -O1 -DBM -o %t8 %s23// RUN: %expect_crash %run %t8 2>&1 | FileCheck --check-prefix=CFI %s24 25// RUN: %clangxx_cfi -O2 -o %t9 %s26// RUN: %expect_crash %run %t9 2>&1 | FileCheck --check-prefix=CFI %s27 28// RUN: %clangxx_cfi -O2 -DB32 -o %t10 %s29// RUN: %expect_crash %run %t10 2>&1 | FileCheck --check-prefix=CFI %s30 31// RUN: %clangxx_cfi -O2 -DB64 -o %t11 %s32// RUN: %expect_crash %run %t11 2>&1 | FileCheck --check-prefix=CFI %s33 34// RUN: %clangxx_cfi -O2 -DBM -o %t12 %s35// RUN: %expect_crash %run %t12 2>&1 | FileCheck --check-prefix=CFI %s36 37// RUN: %clangxx_cfi -O3 -o %t13 %s38// RUN: %expect_crash %run %t13 2>&1 | FileCheck --check-prefix=CFI %s39 40// RUN: %clangxx_cfi -O3 -DB32 -o %t14 %s41// RUN: %expect_crash %run %t14 2>&1 | FileCheck --check-prefix=CFI %s42 43// RUN: %clangxx_cfi -O3 -DB64 -o %t15 %s44// RUN: %expect_crash %run %t15 2>&1 | FileCheck --check-prefix=CFI %s45 46// RUN: %clangxx_cfi -O3 -DBM -o %t16 %s47// RUN: %expect_crash %run %t16 2>&1 | FileCheck --check-prefix=CFI %s48 49// RUN: %clangxx_cfi_diag -o %t17 %s50// RUN: %run %t17 2>&1 | FileCheck --check-prefix=CFI-DIAG %s51 52// RUN: %clangxx -o %t18 %s53// RUN: %run %t18 2>&1 | FileCheck --check-prefix=NCFI %s54 55// RUN: %clangxx_cfi -DCHECK_NO_SANITIZE_CFI -o %t19 %s56// RUN: %run %t19 2>&1 | FileCheck --check-prefix=NCFI %s57 58// Tests that the CFI mechanism crashes the program when making a virtual call59// to an object of the wrong class but with a compatible vtable, by casting a60// pointer to such an object and attempting to make a call through it.61 62// REQUIRES: cxxabi63 64#include <stdio.h>65#include "utils.h"66 67struct A {68 virtual void f();69};70 71void A::f() {}72 73struct B {74 virtual void f();75};76 77void B::f() {}78 79#if defined(CHECK_NO_SANITIZE_CFI)80__attribute__((no_sanitize("cfi")))81#endif82int main() {83 create_derivers<B>();84 85 A *a = new A;86 break_optimization(a);87 88 // CFI: 189 // NCFI: 190 fprintf(stderr, "1\n");91 92 // CFI-DIAG: runtime error: control flow integrity check for type 'B' failed during cast to unrelated type93 // CFI-DIAG-NEXT: note: vtable is of type '{{(struct )?}}A'94 // CFI-DIAG: runtime error: control flow integrity check for type 'B' failed during virtual call95 // CFI-DIAG-NEXT: note: vtable is of type '{{(struct )?}}A'96 ((B *)a)->f(); // UB here97 98 // CFI-NOT: {{^2$}}99 // NCFI: {{^2$}}100 fprintf(stderr, "2\n");101}102