re PR sanitizer/79572 (reference binding to null pointer not reported with -fsanitize...
authorJakub Jelinek <jakub@redhat.com>
Fri, 31 Mar 2017 18:39:25 +0000 (20:39 +0200)
committerJakub Jelinek <jakub@gcc.gnu.org>
Fri, 31 Mar 2017 18:39:25 +0000 (20:39 +0200)
PR c++/79572
* c-ubsan.h (ubsan_maybe_instrument_reference): Change argument to
tree *.
* c-ubsan.c (ubsan_maybe_instrument_reference): Likewise.  Handle
not just NOP_EXPR to REFERENCE_TYPE, but also INTEGER_CST with
REFERENCE_TYPE.

* cp-gimplify.c (cp_genericize_r): Sanitize INTEGER_CSTs with
REFERENCE_TYPE.  Adjust ubsan_maybe_instrument_reference caller
for NOP_EXPR to REFERENCE_TYPE.

* g++.dg/ubsan/null-8.C: New test.

From-SVN: r246621

gcc/c-family/ChangeLog
gcc/c-family/c-ubsan.c
gcc/c-family/c-ubsan.h
gcc/cp/ChangeLog
gcc/cp/cp-gimplify.c
gcc/testsuite/ChangeLog
gcc/testsuite/g++.dg/ubsan/null-8.C [new file with mode: 0644]

index 0f0bd49714a278745c7386c5c35651e932da3fa6..0d5a16f66091e4b374565447a2c4b6666134d45c 100644 (file)
@@ -1,3 +1,12 @@
+2017-03-31  Jakub Jelinek  <jakub@redhat.com>
+
+       PR c++/79572
+       * c-ubsan.h (ubsan_maybe_instrument_reference): Change argument to
+       tree *.
+       * c-ubsan.c (ubsan_maybe_instrument_reference): Likewise.  Handle
+       not just NOP_EXPR to REFERENCE_TYPE, but also INTEGER_CST with
+       REFERENCE_TYPE.
+
 2017-03-31  David Malcolm  <dmalcolm@redhat.com>
 
        PR documentation/78732
index 36aa919a872f59c15aa062708e02e17ccc9e9d24..91bdef883203ac95027801fec5f738ad41bf47a4 100644 (file)
@@ -458,17 +458,26 @@ ubsan_maybe_instrument_reference_or_call (location_t loc, tree op, tree ptype,
   return fold_build2 (COMPOUND_EXPR, TREE_TYPE (op), call, op);
 }
 
-/* Instrument a NOP_EXPR to REFERENCE_TYPE if needed.  */
+/* Instrument a NOP_EXPR to REFERENCE_TYPE or INTEGER_CST with REFERENCE_TYPE
+   type if needed.  */
 
 void
-ubsan_maybe_instrument_reference (tree stmt)
+ubsan_maybe_instrument_reference (tree *stmt_p)
 {
-  tree op = TREE_OPERAND (stmt, 0);
+  tree stmt = *stmt_p;
+  tree op = stmt;
+  if (TREE_CODE (stmt) == NOP_EXPR)
+    op = TREE_OPERAND (stmt, 0);
   op = ubsan_maybe_instrument_reference_or_call (EXPR_LOCATION (stmt), op,
                                                 TREE_TYPE (stmt),
                                                 UBSAN_REF_BINDING);
   if (op)
-    TREE_OPERAND (stmt, 0) = op;
+    {
+      if (TREE_CODE (stmt) == NOP_EXPR) 
+       TREE_OPERAND (stmt, 0) = op;
+      else
+       *stmt_p = op;
+    }
 }
 
 /* Instrument a CALL_EXPR to a method if needed.  */
index dc0897d605f9f2dccbcc5feedaf626167c7b8016..3c3ffc7f7a2c4dca47d304e3087bd3765e7ebfd1 100644 (file)
@@ -28,7 +28,7 @@ extern tree ubsan_instrument_return (location_t);
 extern tree ubsan_instrument_bounds (location_t, tree, tree *, bool);
 extern bool ubsan_array_ref_instrumented_p (const_tree);
 extern void ubsan_maybe_instrument_array_ref (tree *, bool);
-extern void ubsan_maybe_instrument_reference (tree);
+extern void ubsan_maybe_instrument_reference (tree *);
 extern void ubsan_maybe_instrument_member_call (tree, bool);
 
 /* Declare this here as well as in ubsan.h. */
index 14eee1c33409008b1017524b11610cb823e283e8..743847908d0c431759d1a07871ea898e58f1aeef 100644 (file)
@@ -1,5 +1,10 @@
 2017-03-31  Jakub Jelinek  <jakub@redhat.com>
 
+       PR c++/79572
+       * cp-gimplify.c (cp_genericize_r): Sanitize INTEGER_CSTs with
+       REFERENCE_TYPE.  Adjust ubsan_maybe_instrument_reference caller
+       for NOP_EXPR to REFERENCE_TYPE.
+
        PR libstdc++/80251
        * cp-tree.h (enum cp_trait_kind): Add CPTK_IS_AGGREGATE.
        * cxx-pretty-print.c (pp_cxx_trait_expression): Handle
index 354ae1af852699f4ad35a62abb64f174e2df9ed3..6e49daf84997c8aafb46f989f0df04cab8ac96c1 100644 (file)
@@ -1130,6 +1130,19 @@ cp_genericize_r (tree *stmt_p, int *walk_subtrees, void *data)
        }
     }
 
+  if (TREE_CODE (stmt) == INTEGER_CST
+      && TREE_CODE (TREE_TYPE (stmt)) == REFERENCE_TYPE
+      && (flag_sanitize & (SANITIZE_NULL | SANITIZE_ALIGNMENT))
+      && !wtd->no_sanitize_p)
+    {
+      ubsan_maybe_instrument_reference (stmt_p);
+      if (*stmt_p != stmt)
+       {
+         *walk_subtrees = 0;
+         return NULL_TREE;
+       }
+    }
+
   /* Other than invisiref parms, don't walk the same tree twice.  */
   if (p_set->contains (stmt))
     {
@@ -1477,7 +1490,7 @@ cp_genericize_r (tree *stmt_p, int *walk_subtrees, void *data)
       if ((flag_sanitize & (SANITIZE_NULL | SANITIZE_ALIGNMENT))
          && TREE_CODE (stmt) == NOP_EXPR
          && TREE_CODE (TREE_TYPE (stmt)) == REFERENCE_TYPE)
-       ubsan_maybe_instrument_reference (stmt);
+       ubsan_maybe_instrument_reference (stmt_p);
       else if (TREE_CODE (stmt) == CALL_EXPR)
        {
          tree fn = CALL_EXPR_FN (stmt);
index 02581a2ca65aa7d351b73adfb4f5e2817f84491d..134fc2a309c0f2b8b2f9fd670b31f1213f62479a 100644 (file)
@@ -1,3 +1,8 @@
+2017-03-31  Jakub Jelinek  <jakub@redhat.com>
+
+       PR c++/79572
+       * g++.dg/ubsan/null-8.C: New test.
+
 2017-03-31  Pat Haugen  <pthaugen@us.ibm.com>
 
        PR target/80107
diff --git a/gcc/testsuite/g++.dg/ubsan/null-8.C b/gcc/testsuite/g++.dg/ubsan/null-8.C
new file mode 100644 (file)
index 0000000..259a213
--- /dev/null
@@ -0,0 +1,19 @@
+// PR c++/79572
+// { dg-do run }
+// { dg-options "-fsanitize=null -std=c++14" }
+// { dg-output "reference binding to null pointer of type 'const int'" }
+
+void
+foo (const int &iref)
+{
+  if (&iref)
+    __builtin_printf ("iref %d\n", iref);
+  else
+    __builtin_printf ("iref is NULL\n");
+}
+
+int
+main ()
+{
+  foo (*((int*) __null));
+}