45 lines · c
1// RUN: %clang_hwasan -O0 -DISREAD=1 %s -o %t && not %run %t 2>&1 | FileCheck %s --check-prefixes=CHECK2// RUN: %clang_hwasan -O1 -DISREAD=1 %s -o %t && not %run %t 2>&1 | FileCheck %s --check-prefixes=CHECK3// RUN: %clang_hwasan -O2 -DISREAD=1 %s -o %t && not %run %t 2>&1 | FileCheck %s --check-prefixes=CHECK4// RUN: %clang_hwasan -O3 -DISREAD=1 %s -o %t && not %run %t 2>&1 | FileCheck %s --check-prefixes=CHECK5 6// RUN: %clang_hwasan -O0 -DISREAD=0 %s -o %t && not %run %t 2>&1 | FileCheck %s --check-prefixes=CHECK7 8#include <stdlib.h>9#include <stdio.h>10#include <sanitizer/hwasan_interface.h>11 12int main() {13 __hwasan_enable_allocator_tagging();14 char * volatile x = (char*)malloc(10);15 free(x);16 __hwasan_disable_allocator_tagging();17 fprintf(stderr, ISREAD ? "Going to do a READ\n" : "Going to do a WRITE\n");18 fflush(stderr);19 // CHECK: Going to do a [[TYPE:[A-Z]*]]20 int r = 0;21 if (ISREAD) r = x[5]; else x[5] = 42; // should be on the same line.22 // CHECK: ERROR: HWAddressSanitizer: tag-mismatch on address {{.*}} at pc {{[0x]+}}[[PC:.*]]23 // CHECK: [[TYPE]] of size 1 at {{.*}} tags: [[PTR_TAG:[0-9a-f][0-9a-f]]]/[[MEM_TAG:[0-9a-f][0-9a-f]]] (ptr/mem)24 // CHECK: #{{[0-9]}} {{[0-9]+}}{{.*}}[[PC]]25 // If we instrument using calls (default on x86), main is not the top frame26 // of the fault.27 // CHECK: in main {{.*}}use-after-free.c:[[@LINE-6]]28 // Offset is 5 or 11 depending on left/right alignment.29 // CHECK: is a small unallocated heap chunk; size: {{16|32}} offset: {{5|11}}30 // CHECK: Cause: use-after-free31 // CHECK: is located 5 bytes inside a 10-byte region32 //33 // CHECK: freed by thread {{.*}} here:34 // CHECK: #0 {{.*}} in {{.*}}free{{.*}} {{.*}}hwasan_allocation_functions.cpp35 // CHECK: #1 {{.*}} in main {{.*}}use-after-free.c:[[@LINE-20]]36 37 // CHECK: previously allocated by thread {{.*}} here:38 // CHECK: #0 {{.*}} in {{.*}}malloc{{.*}} {{.*}}hwasan_allocation_functions.cpp39 // CHECK: #1 {{.*}} in main {{.*}}use-after-free.c:[[@LINE-25]]40 // CHECK: Memory tags around the buggy address (one tag corresponds to 16 bytes):41 // CHECK: =>{{.*}}[[MEM_TAG]]42 // CHECK: SUMMARY: HWAddressSanitizer: tag-mismatch {{.*}} in main43 return r;44}45