From 1842a04ce06a470b731bc9a29bfec17e6e147c3f Mon Sep 17 00:00:00 2001 From: Markus Trippelsdorf Date: Wed, 9 Sep 2015 16:34:59 +0000 Subject: [PATCH] Fix sanitizer/67258 by cherry picking upstream patch PR sanitizer/67258 * ubsan/ubsan_type_hash.cc: Cherry pick upstream r244101. Upstraem patch: commit 1d2477faafda9ad2cc19927b3c31efd22747f013 Author: Alexey Samsonov Date: Wed Aug 5 19:35:46 2015 +0000 [UBSan] Fix UBSan-vptr false positive. Offset from vptr to the start of most-derived object can actually be positive in some virtual base class vtables. Patch by Stephan Bergmann! git-svn-id: https://llvm.org/svn/llvm-project/compiler-rt/trunk@244101 91177308-0d34-0410-b5e6-96231b3b80d8 From-SVN: r227591 --- gcc/testsuite/g++.dg/ubsan/vptr-10.C | 15 +++++++++++++++ libsanitizer/ChangeLog | 5 +++++ libsanitizer/ubsan/ubsan_type_hash.cc | 6 +++--- 3 files changed, 23 insertions(+), 3 deletions(-) create mode 100644 gcc/testsuite/g++.dg/ubsan/vptr-10.C diff --git a/gcc/testsuite/g++.dg/ubsan/vptr-10.C b/gcc/testsuite/g++.dg/ubsan/vptr-10.C new file mode 100644 index 00000000000..e05c33b90ba --- /dev/null +++ b/gcc/testsuite/g++.dg/ubsan/vptr-10.C @@ -0,0 +1,15 @@ +// { dg-do run } +// { dg-options "-fsanitize=vptr -fno-sanitize-recover=vptr" } + +struct A +{ + virtual ~A() {} +}; +struct B : virtual A {}; +struct C : virtual A {}; +struct D : B, virtual C {}; + +int main() +{ + D d; +} diff --git a/libsanitizer/ChangeLog b/libsanitizer/ChangeLog index 4995299d058..ba4c4239509 100644 --- a/libsanitizer/ChangeLog +++ b/libsanitizer/ChangeLog @@ -1,3 +1,8 @@ +2015-09-09 Markus Trippelsdorf + + PR sanitizer/67258 + * ubsan/ubsan_type_hash.cc: Cherry pick upstream r244101. + 2015-07-29 Markus Trippelsdorf PR sanitizer/63927 diff --git a/libsanitizer/ubsan/ubsan_type_hash.cc b/libsanitizer/ubsan/ubsan_type_hash.cc index d01009426db..5eab1f561f2 100644 --- a/libsanitizer/ubsan/ubsan_type_hash.cc +++ b/libsanitizer/ubsan/ubsan_type_hash.cc @@ -186,8 +186,8 @@ namespace { struct VtablePrefix { /// The offset from the vptr to the start of the most-derived object. - /// This should never be greater than zero, and will usually be exactly - /// zero. + /// This will only be greater than zero in some virtual base class vtables + /// used during object con-/destruction, and will usually be exactly zero. sptr Offset; /// The type_info object describing the most-derived class type. std::type_info *TypeInfo; @@ -197,7 +197,7 @@ VtablePrefix *getVtablePrefix(void *Object) { if (!*VptrPtr) return 0; VtablePrefix *Prefix = *VptrPtr - 1; - if (Prefix->Offset > 0 || !Prefix->TypeInfo) + if (!Prefix->TypeInfo) // This can't possibly be a valid vtable. return 0; return Prefix; -- 2.30.2