libsanitizer/ubsan/ubsan_handlers_cxx.cc

   1 //===-- ubsan_handlers_cxx.cc ---------------------------------------------===//
   2 //
   3 // This file is distributed under the University of Illinois Open Source
   4 // License. See LICENSE.TXT for details.
   5 //
   6 //===----------------------------------------------------------------------===//
   7 //
   8 // Error logging entry points for the UBSan runtime, which are only used for C++
   9 // compilations. This file is permitted to use language features which require
  10 // linking against a C++ ABI library.
  11 //
  12 //===----------------------------------------------------------------------===//
  13
  14 #include "ubsan_platform.h"
  15 #if CAN_SANITIZE_UB
  16 #include "ubsan_handlers.h"
  17 #include "ubsan_handlers_cxx.h"
  18 #include "ubsan_diag.h"
  19 #include "ubsan_type_hash.h"
  20
  21 #include "sanitizer_common/sanitizer_common.h"
  22 #include "sanitizer_common/sanitizer_suppressions.h"
  23
  24 using namespace __sanitizer;
  25 using namespace __ubsan;
  26
  27 namespace __ubsan {
  28   extern const char *TypeCheckKinds[];
  29 }
  30
  31 // Returns true if UBSan has printed an error report.
  32 static bool HandleDynamicTypeCacheMiss(
  33     DynamicTypeCacheMissData *Data, ValueHandle Pointer, ValueHandle Hash,
  34     ReportOptions Opts) {
  35   if (checkDynamicType((void*)Pointer, Data->TypeInfo, Hash))
  36     // Just a cache miss. The type matches after all.
  37     return false;
  38
  39   // Check if error report should be suppressed.
  40   DynamicTypeInfo DTI = getDynamicTypeInfoFromObject((void*)Pointer);
  41   if (DTI.isValid() && IsVptrCheckSuppressed(DTI.getMostDerivedTypeName()))
  42     return false;
  43
  44   SourceLocation Loc = Data->Loc.acquire();
  45   ErrorType ET = ErrorType::DynamicTypeMismatch;
  46   if (ignoreReport(Loc, Opts, ET))
  47     return false;
  48
  49   ScopedReport R(Opts, Loc, ET);
  50
  51   Diag(Loc, DL_Error, ET,
  52        "%0 address %1 which does not point to an object of type %2")
  53     << TypeCheckKinds[Data->TypeCheckKind] << (void*)Pointer << Data->Type;
  54
  55   // If possible, say what type it actually points to.
  56   if (!DTI.isValid()) {
  57     if (DTI.getOffset() < -VptrMaxOffsetToTop || DTI.getOffset() > VptrMaxOffsetToTop) {
  58       Diag(Pointer, DL_Note, ET,
  59            "object has a possibly invalid vptr: abs(offset to top) too big")
  60           << TypeName(DTI.getMostDerivedTypeName())
  61           << Range(Pointer, Pointer + sizeof(uptr), "possibly invalid vptr");
  62     } else {
  63       Diag(Pointer, DL_Note, ET, "object has invalid vptr")
  64           << TypeName(DTI.getMostDerivedTypeName())
  65           << Range(Pointer, Pointer + sizeof(uptr), "invalid vptr");
  66     }
  67   } else if (!DTI.getOffset())
  68     Diag(Pointer, DL_Note, ET, "object is of type %0")
  69         << TypeName(DTI.getMostDerivedTypeName())
  70         << Range(Pointer, Pointer + sizeof(uptr), "vptr for %0");
  71   else
  72     // FIXME: Find the type at the specified offset, and include that
  73     //        in the note.
  74     Diag(Pointer - DTI.getOffset(), DL_Note, ET,
  75          "object is base class subobject at offset %0 within object of type %1")
  76         << DTI.getOffset() << TypeName(DTI.getMostDerivedTypeName())
  77         << TypeName(DTI.getSubobjectTypeName())
  78         << Range(Pointer, Pointer + sizeof(uptr),
  79                  "vptr for %2 base class of %1");
  80   return true;
  81 }
  82
  83 void __ubsan::__ubsan_handle_dynamic_type_cache_miss(
  84     DynamicTypeCacheMissData *Data, ValueHandle Pointer, ValueHandle Hash) {
  85   GET_REPORT_OPTIONS(false);
  86   HandleDynamicTypeCacheMiss(Data, Pointer, Hash, Opts);
  87 }
  88 void __ubsan::__ubsan_handle_dynamic_type_cache_miss_abort(
  89     DynamicTypeCacheMissData *Data, ValueHandle Pointer, ValueHandle Hash) {
  90   // Note: -fsanitize=vptr is always recoverable.
  91   GET_REPORT_OPTIONS(false);
  92   if (HandleDynamicTypeCacheMiss(Data, Pointer, Hash, Opts))
  93     Die();
  94 }
  95
  96 namespace __ubsan {
  97 void __ubsan_handle_cfi_bad_type(CFICheckFailData *Data, ValueHandle Vtable,
  98                                  bool ValidVtable, ReportOptions Opts) {
  99   SourceLocation Loc = Data->Loc.acquire();
 100   ErrorType ET = ErrorType::CFIBadType;
 101
 102   if (ignoreReport(Loc, Opts, ET))
 103     return;
 104
 105   ScopedReport R(Opts, Loc, ET);
 106   DynamicTypeInfo DTI = ValidVtable
 107                             ? getDynamicTypeInfoFromVtable((void *)Vtable)
 108                             : DynamicTypeInfo(0, 0, 0);
 109
 110   const char *CheckKindStr;
 111   switch (Data->CheckKind) {
 112   case CFITCK_VCall:
 113     CheckKindStr = "virtual call";
 114     break;
 115   case CFITCK_NVCall:
 116     CheckKindStr = "non-virtual call";
 117     break;
 118   case CFITCK_DerivedCast:
 119     CheckKindStr = "base-to-derived cast";
 120     break;
 121   case CFITCK_UnrelatedCast:
 122     CheckKindStr = "cast to unrelated type";
 123     break;
 124   case CFITCK_VMFCall:
 125     CheckKindStr = "virtual pointer to member function call";
 126     break;
 127   case CFITCK_ICall:
 128   case CFITCK_NVMFCall:
 129     Die();
 130   }
 131
 132   Diag(Loc, DL_Error, ET,
 133        "control flow integrity check for type %0 failed during "
 134        "%1 (vtable address %2)")
 135       << Data->Type << CheckKindStr << (void *)Vtable;
 136
 137   // If possible, say what type it actually points to.
 138   if (!DTI.isValid())
 139     Diag(Vtable, DL_Note, ET, "invalid vtable");
 140   else
 141     Diag(Vtable, DL_Note, ET, "vtable is of type %0")
 142         << TypeName(DTI.getMostDerivedTypeName());
 143
 144   // If the failure involved different DSOs for the check location and vtable,
 145   // report the DSO names.
 146   const char *DstModule = Symbolizer::GetOrInit()->GetModuleNameForPc(Vtable);
 147   if (!DstModule)
 148     DstModule = "(unknown)";
 149
 150   const char *SrcModule = Symbolizer::GetOrInit()->GetModuleNameForPc(Opts.pc);
 151   if (!SrcModule)
 152     SrcModule = "(unknown)";
 153
 154   if (internal_strcmp(SrcModule, DstModule))
 155     Diag(Loc, DL_Note, ET, "check failed in %0, vtable located in %1")
 156         << SrcModule << DstModule;
 157 }
 158 }  // namespace __ubsan
 159
 160 #endif // CAN_SANITIZE_UB