From 8d2b48ae9f3e1e70dfe2aaf32abb9e74594b8875 Mon Sep 17 00:00:00 2001 From: Marek Polacek Date: Mon, 4 Sep 2017 11:30:26 +0000 Subject: [PATCH] re PR sanitizer/82072 (sanitizer does not detect an overflow from LLONG_MIN) PR sanitizer/82072 * convert.c (do_narrow): When sanitizing signed integer overflows, bail out for signed types. (convert_to_integer_1) : Likewise. * c-c++-common/ubsan/pr82072.c: New test. From-SVN: r251651 --- gcc/ChangeLog | 7 +++++++ gcc/convert.c | 14 +++++++++++++- gcc/testsuite/ChangeLog | 5 +++++ gcc/testsuite/c-c++-common/ubsan/pr82072.c | 19 +++++++++++++++++++ 4 files changed, 44 insertions(+), 1 deletion(-) create mode 100644 gcc/testsuite/c-c++-common/ubsan/pr82072.c diff --git a/gcc/ChangeLog b/gcc/ChangeLog index 85eab1558ad..0bc8b4b9b18 100644 --- a/gcc/ChangeLog +++ b/gcc/ChangeLog @@ -1,3 +1,10 @@ +2017-09-04 Marek Polacek + + PR sanitizer/82072 + * convert.c (do_narrow): When sanitizing signed integer overflows, + bail out for signed types. + (convert_to_integer_1) : Likewise. + 2017-09-04 Richard Biener PR tree-optimization/82060 diff --git a/gcc/convert.c b/gcc/convert.c index 22152cae79b..139d790fd98 100644 --- a/gcc/convert.c +++ b/gcc/convert.c @@ -434,6 +434,13 @@ do_narrow (location_t loc, typex = lang_hooks.types.type_for_size (TYPE_PRECISION (typex), TYPE_UNSIGNED (typex)); + /* The type demotion below might cause doing unsigned arithmetic + instead of signed, and thus hide overflow bugs. */ + if ((ex_form == PLUS_EXPR || ex_form == MINUS_EXPR) + && !TYPE_UNSIGNED (typex) + && sanitize_flags_p (SANITIZE_SI_OVERFLOW)) + return NULL_TREE; + /* But now perhaps TYPEX is as wide as INPREC. In that case, do nothing special here. (Otherwise would recurse infinitely in convert. */ @@ -895,7 +902,12 @@ convert_to_integer_1 (tree type, tree expr, bool dofold) TYPE_UNSIGNED (typex)); if (!TYPE_UNSIGNED (typex)) - typex = unsigned_type_for (typex); + { + /* Using unsigned arithmetic may hide overflow bugs. */ + if (sanitize_flags_p (SANITIZE_SI_OVERFLOW)) + break; + typex = unsigned_type_for (typex); + } return convert (type, fold_build1 (ex_form, typex, convert (typex, diff --git a/gcc/testsuite/ChangeLog b/gcc/testsuite/ChangeLog index 83f05b7cf9f..45cee1fe463 100644 --- a/gcc/testsuite/ChangeLog +++ b/gcc/testsuite/ChangeLog @@ -1,3 +1,8 @@ +2017-09-04 Marek Polacek + + PR sanitizer/82072 + * c-c++-common/ubsan/pr82072.c: New test. + 2017-09-04 Richard Biener PR tree-optimization/82060 diff --git a/gcc/testsuite/c-c++-common/ubsan/pr82072.c b/gcc/testsuite/c-c++-common/ubsan/pr82072.c new file mode 100644 index 00000000000..d5683406b14 --- /dev/null +++ b/gcc/testsuite/c-c++-common/ubsan/pr82072.c @@ -0,0 +1,19 @@ +/* PR sanitizer/82072 */ +/* { dg-do run } */ +/* { dg-options "-fsanitize=signed-integer-overflow" } */ + +int +main () +{ + long long l = -__LONG_LONG_MAX__ - 1; + int i = 0; + asm volatile ("" : "+r" (i)); + i -= l; + asm volatile ("" : "+r" (i)); + i = -l; + asm volatile ("" : "+r" (i)); + return 0; +} + +/* { dg-output "signed integer overflow: 0 - -9223372036854775808 cannot be represented in type 'long long int'\[^\n\r]*(\n|\r\n|\r)" } */ +/* { dg-output "\[^\n\r]*negation of -9223372036854775808 cannot be represented in type 'long long int'\[^\n\r]*; cast to an unsigned type to negate this value to itself" } */ -- 2.30.2