|
111
|
1 /* UndefinedBehaviorSanitizer, undefined behavior detector.
|
|
145
|
2 Copyright (C) 2013-2020 Free Software Foundation, Inc.
|
|
111
|
3 Contributed by Marek Polacek <polacek@redhat.com>
|
|
|
4
|
|
|
5 This file is part of GCC.
|
|
|
6
|
|
|
7 GCC is free software; you can redistribute it and/or modify it under
|
|
|
8 the terms of the GNU General Public License as published by the Free
|
|
|
9 Software Foundation; either version 3, or (at your option) any later
|
|
|
10 version.
|
|
|
11
|
|
|
12 GCC is distributed in the hope that it will be useful, but WITHOUT ANY
|
|
|
13 WARRANTY; without even the implied warranty of MERCHANTABILITY or
|
|
|
14 FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
|
|
15 for more details.
|
|
|
16
|
|
|
17 You should have received a copy of the GNU General Public License
|
|
|
18 along with GCC; see the file COPYING3. If not see
|
|
|
19 <http://www.gnu.org/licenses/>. */
|
|
|
20
|
|
|
21 #include "config.h"
|
|
|
22 #include "system.h"
|
|
|
23 #include "coretypes.h"
|
|
|
24 #include "tm.h"
|
|
|
25 #include "c-family/c-common.h"
|
|
|
26 #include "ubsan.h"
|
|
|
27 #include "c-family/c-ubsan.h"
|
|
|
28 #include "stor-layout.h"
|
|
|
29 #include "builtins.h"
|
|
|
30 #include "gimplify.h"
|
|
|
31 #include "stringpool.h"
|
|
|
32 #include "attribs.h"
|
|
|
33 #include "asan.h"
|
|
145
|
34 #include "langhooks.h"
|
|
111
|
35
|
|
|
36 /* Instrument division by zero and INT_MIN / -1. If not instrumenting,
|
|
|
37 return NULL_TREE. */
|
|
|
38
|
|
|
39 tree
|
|
|
40 ubsan_instrument_division (location_t loc, tree op0, tree op1)
|
|
|
41 {
|
|
|
42 tree t, tt;
|
|
|
43 tree type = TREE_TYPE (op0);
|
|
|
44
|
|
|
45 /* At this point both operands should have the same type,
|
|
|
46 because they are already converted to RESULT_TYPE.
|
|
|
47 Use TYPE_MAIN_VARIANT since typedefs can confuse us. */
|
|
145
|
48 tree top0 = TYPE_MAIN_VARIANT (type);
|
|
|
49 tree top1 = TYPE_MAIN_VARIANT (TREE_TYPE (op1));
|
|
|
50 gcc_checking_assert (lang_hooks.types_compatible_p (top0, top1));
|
|
111
|
51
|
|
|
52 op0 = unshare_expr (op0);
|
|
|
53 op1 = unshare_expr (op1);
|
|
|
54
|
|
|
55 if (TREE_CODE (type) == INTEGER_TYPE
|
|
|
56 && sanitize_flags_p (SANITIZE_DIVIDE))
|
|
|
57 t = fold_build2 (EQ_EXPR, boolean_type_node,
|
|
|
58 op1, build_int_cst (type, 0));
|
|
|
59 else if (TREE_CODE (type) == REAL_TYPE
|
|
|
60 && sanitize_flags_p (SANITIZE_FLOAT_DIVIDE))
|
|
|
61 t = fold_build2 (EQ_EXPR, boolean_type_node,
|
|
|
62 op1, build_real (type, dconst0));
|
|
|
63 else
|
|
|
64 return NULL_TREE;
|
|
|
65
|
|
|
66 /* We check INT_MIN / -1 only for signed types. */
|
|
|
67 if (TREE_CODE (type) == INTEGER_TYPE
|
|
|
68 && sanitize_flags_p (SANITIZE_DIVIDE)
|
|
|
69 && !TYPE_UNSIGNED (type))
|
|
|
70 {
|
|
|
71 tree x;
|
|
|
72 tt = fold_build2 (EQ_EXPR, boolean_type_node, unshare_expr (op1),
|
|
|
73 build_int_cst (type, -1));
|
|
|
74 x = fold_build2 (EQ_EXPR, boolean_type_node, op0,
|
|
|
75 TYPE_MIN_VALUE (type));
|
|
|
76 x = fold_build2 (TRUTH_AND_EXPR, boolean_type_node, x, tt);
|
|
|
77 t = fold_build2 (TRUTH_OR_EXPR, boolean_type_node, t, x);
|
|
|
78 }
|
|
|
79
|
|
|
80 /* If the condition was folded to 0, no need to instrument
|
|
|
81 this expression. */
|
|
|
82 if (integer_zerop (t))
|
|
|
83 return NULL_TREE;
|
|
|
84
|
|
|
85 /* In case we have a SAVE_EXPR in a conditional context, we need to
|
|
|
86 make sure it gets evaluated before the condition. */
|
|
|
87 t = fold_build2 (COMPOUND_EXPR, TREE_TYPE (t), unshare_expr (op0), t);
|
|
|
88 t = fold_build2 (COMPOUND_EXPR, TREE_TYPE (t), unshare_expr (op1), t);
|
|
|
89 if (flag_sanitize_undefined_trap_on_error)
|
|
|
90 tt = build_call_expr_loc (loc, builtin_decl_explicit (BUILT_IN_TRAP), 0);
|
|
|
91 else
|
|
|
92 {
|
|
|
93 tree data = ubsan_create_data ("__ubsan_overflow_data", 1, &loc,
|
|
|
94 ubsan_type_descriptor (type), NULL_TREE,
|
|
|
95 NULL_TREE);
|
|
|
96 data = build_fold_addr_expr_loc (loc, data);
|
|
|
97 enum built_in_function bcode
|
|
|
98 = (flag_sanitize_recover & SANITIZE_DIVIDE)
|
|
|
99 ? BUILT_IN_UBSAN_HANDLE_DIVREM_OVERFLOW
|
|
|
100 : BUILT_IN_UBSAN_HANDLE_DIVREM_OVERFLOW_ABORT;
|
|
|
101 tt = builtin_decl_explicit (bcode);
|
|
|
102 op0 = unshare_expr (op0);
|
|
|
103 op1 = unshare_expr (op1);
|
|
|
104 tt = build_call_expr_loc (loc, tt, 3, data, ubsan_encode_value (op0),
|
|
|
105 ubsan_encode_value (op1));
|
|
|
106 }
|
|
|
107 t = fold_build3 (COND_EXPR, void_type_node, t, tt, void_node);
|
|
|
108
|
|
|
109 return t;
|
|
|
110 }
|
|
|
111
|
|
|
112 /* Instrument left and right shifts. */
|
|
|
113
|
|
|
114 tree
|
|
|
115 ubsan_instrument_shift (location_t loc, enum tree_code code,
|
|
|
116 tree op0, tree op1)
|
|
|
117 {
|
|
|
118 tree t, tt = NULL_TREE;
|
|
|
119 tree type0 = TREE_TYPE (op0);
|
|
|
120 tree type1 = TREE_TYPE (op1);
|
|
|
121 if (!INTEGRAL_TYPE_P (type0))
|
|
|
122 return NULL_TREE;
|
|
|
123
|
|
|
124 tree op1_utype = unsigned_type_for (type1);
|
|
|
125 HOST_WIDE_INT op0_prec = TYPE_PRECISION (type0);
|
|
|
126 tree uprecm1 = build_int_cst (op1_utype, op0_prec - 1);
|
|
|
127
|
|
|
128 op0 = unshare_expr (op0);
|
|
|
129 op1 = unshare_expr (op1);
|
|
|
130
|
|
|
131 t = fold_convert_loc (loc, op1_utype, op1);
|
|
|
132 t = fold_build2 (GT_EXPR, boolean_type_node, t, uprecm1);
|
|
|
133
|
|
|
134 /* If this is not a signed operation, don't perform overflow checks.
|
|
|
135 Also punt on bit-fields. */
|
|
|
136 if (TYPE_OVERFLOW_WRAPS (type0)
|
|
131
|
137 || maybe_ne (GET_MODE_BITSIZE (TYPE_MODE (type0)),
|
|
|
138 TYPE_PRECISION (type0))
|
|
145
|
139 || !sanitize_flags_p (SANITIZE_SHIFT_BASE)
|
|
|
140 /* In C++2a and later, shifts are well defined except when
|
|
|
141 the second operand is not within bounds. */
|
|
|
142 || cxx_dialect >= cxx2a)
|
|
111
|
143 ;
|
|
|
144
|
|
|
145 /* For signed x << y, in C99/C11, the following:
|
|
|
146 (unsigned) x >> (uprecm1 - y)
|
|
|
147 if non-zero, is undefined. */
|
|
|
148 else if (code == LSHIFT_EXPR && flag_isoc99 && cxx_dialect < cxx11)
|
|
|
149 {
|
|
|
150 tree x = fold_build2 (MINUS_EXPR, op1_utype, uprecm1,
|
|
|
151 fold_convert (op1_utype, unshare_expr (op1)));
|
|
|
152 tt = fold_convert_loc (loc, unsigned_type_for (type0), op0);
|
|
|
153 tt = fold_build2 (RSHIFT_EXPR, TREE_TYPE (tt), tt, x);
|
|
|
154 tt = fold_build2 (NE_EXPR, boolean_type_node, tt,
|
|
|
155 build_int_cst (TREE_TYPE (tt), 0));
|
|
|
156 }
|
|
|
157
|
|
|
158 /* For signed x << y, in C++11 and later, the following:
|
|
|
159 x < 0 || ((unsigned) x >> (uprecm1 - y))
|
|
|
160 if > 1, is undefined. */
|
|
|
161 else if (code == LSHIFT_EXPR && cxx_dialect >= cxx11)
|
|
|
162 {
|
|
|
163 tree x = fold_build2 (MINUS_EXPR, op1_utype, uprecm1,
|
|
|
164 fold_convert (op1_utype, unshare_expr (op1)));
|
|
|
165 tt = fold_convert_loc (loc, unsigned_type_for (type0),
|
|
|
166 unshare_expr (op0));
|
|
|
167 tt = fold_build2 (RSHIFT_EXPR, TREE_TYPE (tt), tt, x);
|
|
|
168 tt = fold_build2 (GT_EXPR, boolean_type_node, tt,
|
|
|
169 build_int_cst (TREE_TYPE (tt), 1));
|
|
|
170 x = fold_build2 (LT_EXPR, boolean_type_node, unshare_expr (op0),
|
|
|
171 build_int_cst (type0, 0));
|
|
|
172 tt = fold_build2 (TRUTH_OR_EXPR, boolean_type_node, x, tt);
|
|
|
173 }
|
|
|
174
|
|
|
175 /* If the condition was folded to 0, no need to instrument
|
|
|
176 this expression. */
|
|
|
177 if (integer_zerop (t) && (tt == NULL_TREE || integer_zerop (tt)))
|
|
|
178 return NULL_TREE;
|
|
|
179
|
|
|
180 /* In case we have a SAVE_EXPR in a conditional context, we need to
|
|
|
181 make sure it gets evaluated before the condition. */
|
|
|
182 t = fold_build2 (COMPOUND_EXPR, TREE_TYPE (t), unshare_expr (op0), t);
|
|
|
183 t = fold_build2 (COMPOUND_EXPR, TREE_TYPE (t), unshare_expr (op1), t);
|
|
|
184
|
|
|
185 enum sanitize_code recover_kind = SANITIZE_SHIFT_EXPONENT;
|
|
|
186 tree else_t = void_node;
|
|
|
187 if (tt)
|
|
|
188 {
|
|
|
189 if (!sanitize_flags_p (SANITIZE_SHIFT_EXPONENT))
|
|
|
190 {
|
|
|
191 t = fold_build1 (TRUTH_NOT_EXPR, boolean_type_node, t);
|
|
|
192 t = fold_build2 (TRUTH_AND_EXPR, boolean_type_node, t, tt);
|
|
|
193 recover_kind = SANITIZE_SHIFT_BASE;
|
|
|
194 }
|
|
|
195 else
|
|
|
196 {
|
|
|
197 if (flag_sanitize_undefined_trap_on_error
|
|
|
198 || ((!(flag_sanitize_recover & SANITIZE_SHIFT_EXPONENT))
|
|
|
199 == (!(flag_sanitize_recover & SANITIZE_SHIFT_BASE))))
|
|
|
200 t = fold_build2 (TRUTH_OR_EXPR, boolean_type_node, t, tt);
|
|
|
201 else
|
|
|
202 else_t = tt;
|
|
|
203 }
|
|
|
204 }
|
|
|
205
|
|
|
206 if (flag_sanitize_undefined_trap_on_error)
|
|
|
207 tt = build_call_expr_loc (loc, builtin_decl_explicit (BUILT_IN_TRAP), 0);
|
|
|
208 else
|
|
|
209 {
|
|
|
210 tree data = ubsan_create_data ("__ubsan_shift_data", 1, &loc,
|
|
|
211 ubsan_type_descriptor (type0),
|
|
|
212 ubsan_type_descriptor (type1), NULL_TREE,
|
|
|
213 NULL_TREE);
|
|
|
214 data = build_fold_addr_expr_loc (loc, data);
|
|
|
215
|
|
|
216 enum built_in_function bcode
|
|
|
217 = (flag_sanitize_recover & recover_kind)
|
|
|
218 ? BUILT_IN_UBSAN_HANDLE_SHIFT_OUT_OF_BOUNDS
|
|
|
219 : BUILT_IN_UBSAN_HANDLE_SHIFT_OUT_OF_BOUNDS_ABORT;
|
|
|
220 tt = builtin_decl_explicit (bcode);
|
|
|
221 op0 = unshare_expr (op0);
|
|
|
222 op1 = unshare_expr (op1);
|
|
|
223 tt = build_call_expr_loc (loc, tt, 3, data, ubsan_encode_value (op0),
|
|
|
224 ubsan_encode_value (op1));
|
|
|
225 if (else_t != void_node)
|
|
|
226 {
|
|
|
227 bcode = (flag_sanitize_recover & SANITIZE_SHIFT_BASE)
|
|
|
228 ? BUILT_IN_UBSAN_HANDLE_SHIFT_OUT_OF_BOUNDS
|
|
|
229 : BUILT_IN_UBSAN_HANDLE_SHIFT_OUT_OF_BOUNDS_ABORT;
|
|
|
230 tree else_tt = builtin_decl_explicit (bcode);
|
|
|
231 op0 = unshare_expr (op0);
|
|
|
232 op1 = unshare_expr (op1);
|
|
|
233 else_tt = build_call_expr_loc (loc, else_tt, 3, data,
|
|
|
234 ubsan_encode_value (op0),
|
|
|
235 ubsan_encode_value (op1));
|
|
|
236 else_t = fold_build3 (COND_EXPR, void_type_node, else_t,
|
|
|
237 else_tt, void_node);
|
|
|
238 }
|
|
|
239 }
|
|
|
240 t = fold_build3 (COND_EXPR, void_type_node, t, tt, else_t);
|
|
|
241
|
|
|
242 return t;
|
|
|
243 }
|
|
|
244
|
|
|
245 /* Instrument variable length array bound. */
|
|
|
246
|
|
|
247 tree
|
|
|
248 ubsan_instrument_vla (location_t loc, tree size)
|
|
|
249 {
|
|
|
250 tree type = TREE_TYPE (size);
|
|
|
251 tree t, tt;
|
|
|
252
|
|
|
253 t = fold_build2 (LE_EXPR, boolean_type_node, size, build_int_cst (type, 0));
|
|
|
254 if (flag_sanitize_undefined_trap_on_error)
|
|
|
255 tt = build_call_expr_loc (loc, builtin_decl_explicit (BUILT_IN_TRAP), 0);
|
|
|
256 else
|
|
|
257 {
|
|
|
258 tree data = ubsan_create_data ("__ubsan_vla_data", 1, &loc,
|
|
|
259 ubsan_type_descriptor (type), NULL_TREE,
|
|
|
260 NULL_TREE);
|
|
|
261 data = build_fold_addr_expr_loc (loc, data);
|
|
|
262 enum built_in_function bcode
|
|
|
263 = (flag_sanitize_recover & SANITIZE_VLA)
|
|
|
264 ? BUILT_IN_UBSAN_HANDLE_VLA_BOUND_NOT_POSITIVE
|
|
|
265 : BUILT_IN_UBSAN_HANDLE_VLA_BOUND_NOT_POSITIVE_ABORT;
|
|
|
266 tt = builtin_decl_explicit (bcode);
|
|
|
267 tt = build_call_expr_loc (loc, tt, 2, data, ubsan_encode_value (size));
|
|
|
268 }
|
|
|
269 t = fold_build3 (COND_EXPR, void_type_node, t, tt, void_node);
|
|
|
270
|
|
|
271 return t;
|
|
|
272 }
|
|
|
273
|
|
|
274 /* Instrument missing return in C++ functions returning non-void. */
|
|
|
275
|
|
|
276 tree
|
|
|
277 ubsan_instrument_return (location_t loc)
|
|
|
278 {
|
|
|
279 if (flag_sanitize_undefined_trap_on_error)
|
|
|
280 return build_call_expr_loc (loc, builtin_decl_explicit (BUILT_IN_TRAP), 0);
|
|
|
281
|
|
|
282 tree data = ubsan_create_data ("__ubsan_missing_return_data", 1, &loc,
|
|
|
283 NULL_TREE, NULL_TREE);
|
|
|
284 tree t = builtin_decl_explicit (BUILT_IN_UBSAN_HANDLE_MISSING_RETURN);
|
|
|
285 return build_call_expr_loc (loc, t, 1, build_fold_addr_expr_loc (loc, data));
|
|
|
286 }
|
|
|
287
|
|
|
288 /* Instrument array bounds for ARRAY_REFs. We create special builtin,
|
|
|
289 that gets expanded in the sanopt pass, and make an array dimension
|
|
|
290 of it. ARRAY is the array, *INDEX is an index to the array.
|
|
|
291 Return NULL_TREE if no instrumentation is emitted.
|
|
|
292 IGNORE_OFF_BY_ONE is true if the ARRAY_REF is inside a ADDR_EXPR. */
|
|
|
293
|
|
|
294 tree
|
|
|
295 ubsan_instrument_bounds (location_t loc, tree array, tree *index,
|
|
|
296 bool ignore_off_by_one)
|
|
|
297 {
|
|
|
298 tree type = TREE_TYPE (array);
|
|
|
299 tree domain = TYPE_DOMAIN (type);
|
|
|
300
|
|
|
301 if (domain == NULL_TREE || TYPE_MAX_VALUE (domain) == NULL_TREE)
|
|
|
302 return NULL_TREE;
|
|
|
303
|
|
|
304 tree bound = TYPE_MAX_VALUE (domain);
|
|
|
305 if (ignore_off_by_one)
|
|
|
306 bound = fold_build2 (PLUS_EXPR, TREE_TYPE (bound), bound,
|
|
|
307 build_int_cst (TREE_TYPE (bound), 1));
|
|
|
308
|
|
|
309 /* Detect flexible array members and suchlike, unless
|
|
|
310 -fsanitize=bounds-strict. */
|
|
|
311 tree base = get_base_address (array);
|
|
|
312 if (!sanitize_flags_p (SANITIZE_BOUNDS_STRICT)
|
|
|
313 && TREE_CODE (array) == COMPONENT_REF
|
|
|
314 && base && (INDIRECT_REF_P (base) || TREE_CODE (base) == MEM_REF))
|
|
|
315 {
|
|
|
316 tree next = NULL_TREE;
|
|
|
317 tree cref = array;
|
|
|
318
|
|
|
319 /* Walk all structs/unions. */
|
|
|
320 while (TREE_CODE (cref) == COMPONENT_REF)
|
|
|
321 {
|
|
|
322 if (TREE_CODE (TREE_TYPE (TREE_OPERAND (cref, 0))) == RECORD_TYPE)
|
|
|
323 for (next = DECL_CHAIN (TREE_OPERAND (cref, 1));
|
|
|
324 next && TREE_CODE (next) != FIELD_DECL;
|
|
|
325 next = DECL_CHAIN (next))
|
|
|
326 ;
|
|
|
327 if (next)
|
|
|
328 /* Not a last element. Instrument it. */
|
|
|
329 break;
|
|
|
330 /* Ok, this is the last field of the structure/union. But the
|
|
|
331 aggregate containing the field must be the last field too,
|
|
|
332 recursively. */
|
|
|
333 cref = TREE_OPERAND (cref, 0);
|
|
|
334 }
|
|
|
335 if (!next)
|
|
|
336 /* Don't instrument this flexible array member-like array in non-strict
|
|
|
337 -fsanitize=bounds mode. */
|
|
|
338 return NULL_TREE;
|
|
|
339 }
|
|
|
340
|
|
|
341 /* Don't emit instrumentation in the most common cases. */
|
|
|
342 tree idx = NULL_TREE;
|
|
|
343 if (TREE_CODE (*index) == INTEGER_CST)
|
|
|
344 idx = *index;
|
|
|
345 else if (TREE_CODE (*index) == BIT_AND_EXPR
|
|
|
346 && TREE_CODE (TREE_OPERAND (*index, 1)) == INTEGER_CST)
|
|
|
347 idx = TREE_OPERAND (*index, 1);
|
|
|
348 if (idx
|
|
|
349 && TREE_CODE (bound) == INTEGER_CST
|
|
|
350 && tree_int_cst_sgn (idx) >= 0
|
|
|
351 && tree_int_cst_le (idx, bound))
|
|
|
352 return NULL_TREE;
|
|
|
353
|
|
|
354 *index = save_expr (*index);
|
|
|
355 /* Create a "(T *) 0" tree node to describe the array type. */
|
|
|
356 tree zero_with_type = build_int_cst (build_pointer_type (type), 0);
|
|
|
357 return build_call_expr_internal_loc (loc, IFN_UBSAN_BOUNDS,
|
|
|
358 void_type_node, 3, zero_with_type,
|
|
|
359 *index, bound);
|
|
|
360 }
|
|
|
361
|
|
|
362 /* Return true iff T is an array that was instrumented by SANITIZE_BOUNDS. */
|
|
|
363
|
|
|
364 bool
|
|
|
365 ubsan_array_ref_instrumented_p (const_tree t)
|
|
|
366 {
|
|
|
367 if (TREE_CODE (t) != ARRAY_REF)
|
|
|
368 return false;
|
|
|
369
|
|
|
370 tree op1 = TREE_OPERAND (t, 1);
|
|
|
371 return TREE_CODE (op1) == COMPOUND_EXPR
|
|
|
372 && TREE_CODE (TREE_OPERAND (op1, 0)) == CALL_EXPR
|
|
|
373 && CALL_EXPR_FN (TREE_OPERAND (op1, 0)) == NULL_TREE
|
|
|
374 && CALL_EXPR_IFN (TREE_OPERAND (op1, 0)) == IFN_UBSAN_BOUNDS;
|
|
|
375 }
|
|
|
376
|
|
|
377 /* Instrument an ARRAY_REF, if it hasn't already been instrumented.
|
|
|
378 IGNORE_OFF_BY_ONE is true if the ARRAY_REF is inside a ADDR_EXPR. */
|
|
|
379
|
|
|
380 void
|
|
|
381 ubsan_maybe_instrument_array_ref (tree *expr_p, bool ignore_off_by_one)
|
|
|
382 {
|
|
|
383 if (!ubsan_array_ref_instrumented_p (*expr_p)
|
|
|
384 && sanitize_flags_p (SANITIZE_BOUNDS | SANITIZE_BOUNDS_STRICT)
|
|
|
385 && current_function_decl != NULL_TREE)
|
|
|
386 {
|
|
|
387 tree op0 = TREE_OPERAND (*expr_p, 0);
|
|
|
388 tree op1 = TREE_OPERAND (*expr_p, 1);
|
|
|
389 tree e = ubsan_instrument_bounds (EXPR_LOCATION (*expr_p), op0, &op1,
|
|
|
390 ignore_off_by_one);
|
|
|
391 if (e != NULL_TREE)
|
|
|
392 {
|
|
|
393 tree t = copy_node (*expr_p);
|
|
|
394 TREE_OPERAND (t, 1) = build2 (COMPOUND_EXPR, TREE_TYPE (op1),
|
|
|
395 e, op1);
|
|
|
396 *expr_p = t;
|
|
|
397 }
|
|
|
398 }
|
|
|
399 }
|
|
|
400
|
|
|
401 static tree
|
|
|
402 ubsan_maybe_instrument_reference_or_call (location_t loc, tree op, tree ptype,
|
|
|
403 enum ubsan_null_ckind ckind)
|
|
|
404 {
|
|
|
405 if (!sanitize_flags_p (SANITIZE_ALIGNMENT | SANITIZE_NULL)
|
|
|
406 || current_function_decl == NULL_TREE)
|
|
|
407 return NULL_TREE;
|
|
|
408
|
|
|
409 tree type = TREE_TYPE (ptype);
|
|
|
410 tree orig_op = op;
|
|
|
411 bool instrument = false;
|
|
|
412 unsigned int mina = 0;
|
|
|
413
|
|
|
414 if (sanitize_flags_p (SANITIZE_ALIGNMENT))
|
|
|
415 {
|
|
|
416 mina = min_align_of_type (type);
|
|
|
417 if (mina <= 1)
|
|
|
418 mina = 0;
|
|
|
419 }
|
|
|
420 while ((TREE_CODE (op) == NOP_EXPR
|
|
|
421 || TREE_CODE (op) == NON_LVALUE_EXPR)
|
|
|
422 && TREE_CODE (TREE_TYPE (op)) == POINTER_TYPE)
|
|
|
423 op = TREE_OPERAND (op, 0);
|
|
|
424 if (TREE_CODE (op) == NOP_EXPR
|
|
|
425 && TREE_CODE (TREE_TYPE (op)) == REFERENCE_TYPE)
|
|
|
426 {
|
|
|
427 if (mina && mina > min_align_of_type (TREE_TYPE (TREE_TYPE (op))))
|
|
|
428 instrument = true;
|
|
|
429 }
|
|
|
430 else
|
|
|
431 {
|
|
|
432 if (sanitize_flags_p (SANITIZE_NULL) && TREE_CODE (op) == ADDR_EXPR)
|
|
|
433 {
|
|
|
434 bool strict_overflow_p = false;
|
|
|
435 /* tree_single_nonzero_warnv_p will not return true for non-weak
|
|
|
436 non-automatic decls with -fno-delete-null-pointer-checks,
|
|
|
437 which is disabled during -fsanitize=null. We don't want to
|
|
|
438 instrument those, just weak vars though. */
|
|
|
439 int save_flag_delete_null_pointer_checks
|
|
|
440 = flag_delete_null_pointer_checks;
|
|
|
441 flag_delete_null_pointer_checks = 1;
|
|
|
442 if (!tree_single_nonzero_warnv_p (op, &strict_overflow_p)
|
|
|
443 || strict_overflow_p)
|
|
|
444 instrument = true;
|
|
|
445 flag_delete_null_pointer_checks
|
|
|
446 = save_flag_delete_null_pointer_checks;
|
|
|
447 }
|
|
|
448 else if (sanitize_flags_p (SANITIZE_NULL))
|
|
|
449 instrument = true;
|
|
|
450 if (mina && mina > 1)
|
|
|
451 {
|
|
|
452 if (!POINTER_TYPE_P (TREE_TYPE (op))
|
|
|
453 || mina > get_pointer_alignment (op) / BITS_PER_UNIT)
|
|
|
454 instrument = true;
|
|
|
455 }
|
|
|
456 }
|
|
|
457 if (!instrument)
|
|
|
458 return NULL_TREE;
|
|
|
459 op = save_expr (orig_op);
|
|
|
460 gcc_assert (POINTER_TYPE_P (ptype));
|
|
|
461 if (TREE_CODE (ptype) == REFERENCE_TYPE)
|
|
|
462 ptype = build_pointer_type (TREE_TYPE (ptype));
|
|
|
463 tree kind = build_int_cst (ptype, ckind);
|
|
|
464 tree align = build_int_cst (pointer_sized_int_node, mina);
|
|
|
465 tree call
|
|
|
466 = build_call_expr_internal_loc (loc, IFN_UBSAN_NULL, void_type_node,
|
|
|
467 3, op, kind, align);
|
|
|
468 TREE_SIDE_EFFECTS (call) = 1;
|
|
|
469 return fold_build2 (COMPOUND_EXPR, TREE_TYPE (op), call, op);
|
|
|
470 }
|
|
|
471
|
|
|
472 /* Instrument a NOP_EXPR to REFERENCE_TYPE or INTEGER_CST with REFERENCE_TYPE
|
|
|
473 type if needed. */
|
|
|
474
|
|
|
475 void
|
|
|
476 ubsan_maybe_instrument_reference (tree *stmt_p)
|
|
|
477 {
|
|
|
478 tree stmt = *stmt_p;
|
|
|
479 tree op = stmt;
|
|
|
480 if (TREE_CODE (stmt) == NOP_EXPR)
|
|
|
481 op = TREE_OPERAND (stmt, 0);
|
|
|
482 op = ubsan_maybe_instrument_reference_or_call (EXPR_LOCATION (stmt), op,
|
|
|
483 TREE_TYPE (stmt),
|
|
|
484 UBSAN_REF_BINDING);
|
|
|
485 if (op)
|
|
|
486 {
|
|
|
487 if (TREE_CODE (stmt) == NOP_EXPR)
|
|
|
488 TREE_OPERAND (stmt, 0) = op;
|
|
|
489 else
|
|
|
490 *stmt_p = op;
|
|
|
491 }
|
|
|
492 }
|
|
|
493
|
|
|
494 /* Instrument a CALL_EXPR to a method if needed. */
|
|
|
495
|
|
|
496 void
|
|
|
497 ubsan_maybe_instrument_member_call (tree stmt, bool is_ctor)
|
|
|
498 {
|
|
|
499 if (call_expr_nargs (stmt) == 0)
|
|
|
500 return;
|
|
|
501 tree op = CALL_EXPR_ARG (stmt, 0);
|
|
|
502 if (op == error_mark_node
|
|
|
503 || !POINTER_TYPE_P (TREE_TYPE (op)))
|
|
|
504 return;
|
|
|
505 op = ubsan_maybe_instrument_reference_or_call (EXPR_LOCATION (stmt), op,
|
|
|
506 TREE_TYPE (op),
|
|
|
507 is_ctor ? UBSAN_CTOR_CALL
|
|
|
508 : UBSAN_MEMBER_CALL);
|
|
|
509 if (op)
|
|
|
510 CALL_EXPR_ARG (stmt, 0) = op;
|
|
|
511 }
|
