ubsan_handlers_cxx.cc revision 302408 
1//===-- ubsan_handlers_cxx.cc ---------------------------------------------===//
2//
3//                     The LLVM Compiler Infrastructure
4//
5// This file is distributed under the University of Illinois Open Source
6// License. See LICENSE.TXT for details.
7//
8//===----------------------------------------------------------------------===//
9//
10// Error logging entry points for the UBSan runtime, which are only used for C++
11// compilations. This file is permitted to use language features which require
12// linking against a C++ ABI library.
13//
14//===----------------------------------------------------------------------===//
15
16#include "ubsan_platform.h"
17#if CAN_SANITIZE_UB
18#include "ubsan_handlers_cxx.h"
19#include "ubsan_diag.h"
20#include "ubsan_type_hash.h"
21
22#include "sanitizer_common/sanitizer_common.h"
23#include "sanitizer_common/sanitizer_suppressions.h"
24
25using namespace __sanitizer;
26using namespace __ubsan;
27
28namespace __ubsan {
29  extern const char *TypeCheckKinds[];
30}
31
32// Returns true if UBSan has printed an error report.
33static bool HandleDynamicTypeCacheMiss(
34    DynamicTypeCacheMissData *Data, ValueHandle Pointer, ValueHandle Hash,
35    ReportOptions Opts) {
36  if (checkDynamicType((void*)Pointer, Data->TypeInfo, Hash))
37    // Just a cache miss. The type matches after all.
38    return false;
39
40  // Check if error report should be suppressed.
41  DynamicTypeInfo DTI = getDynamicTypeInfoFromObject((void*)Pointer);
42  if (DTI.isValid() && IsVptrCheckSuppressed(DTI.getMostDerivedTypeName()))
43    return false;
44
45  SourceLocation Loc = Data->Loc.acquire();
46  ErrorType ET = ErrorType::DynamicTypeMismatch;
47  if (ignoreReport(Loc, Opts, ET))
48    return false;
49
50  ScopedReport R(Opts, Loc, ET);
51
52  Diag(Loc, DL_Error,
53       "%0 address %1 which does not point to an object of type %2")
54    << TypeCheckKinds[Data->TypeCheckKind] << (void*)Pointer << Data->Type;
55
56  // If possible, say what type it actually points to.
57  if (!DTI.isValid())
58    Diag(Pointer, DL_Note, "object has invalid vptr")
59        << TypeName(DTI.getMostDerivedTypeName())
60        << Range(Pointer, Pointer + sizeof(uptr), "invalid vptr");
61  else if (!DTI.getOffset())
62    Diag(Pointer, DL_Note, "object is of type %0")
63        << TypeName(DTI.getMostDerivedTypeName())
64        << Range(Pointer, Pointer + sizeof(uptr), "vptr for %0");
65  else
66    // FIXME: Find the type at the specified offset, and include that
67    //        in the note.
68    Diag(Pointer - DTI.getOffset(), DL_Note,
69         "object is base class subobject at offset %0 within object of type %1")
70        << DTI.getOffset() << TypeName(DTI.getMostDerivedTypeName())
71        << TypeName(DTI.getSubobjectTypeName())
72        << Range(Pointer, Pointer + sizeof(uptr),
73                 "vptr for %2 base class of %1");
74  return true;
75}
76
77void __ubsan::__ubsan_handle_dynamic_type_cache_miss(
78    DynamicTypeCacheMissData *Data, ValueHandle Pointer, ValueHandle Hash) {
79  GET_REPORT_OPTIONS(false);
80  HandleDynamicTypeCacheMiss(Data, Pointer, Hash, Opts);
81}
82void __ubsan::__ubsan_handle_dynamic_type_cache_miss_abort(
83    DynamicTypeCacheMissData *Data, ValueHandle Pointer, ValueHandle Hash) {
84  // Note: -fsanitize=vptr is always recoverable.
85  GET_REPORT_OPTIONS(false);
86  if (HandleDynamicTypeCacheMiss(Data, Pointer, Hash, Opts))
87    Die();
88}
89
90static void HandleCFIBadType(CFIBadTypeData *Data, ValueHandle Vtable,
91                             ReportOptions Opts) {
92  SourceLocation Loc = Data->Loc.acquire();
93  ErrorType ET = ErrorType::CFIBadType;
94
95  if (ignoreReport(Loc, Opts, ET))
96    return;
97
98  ScopedReport R(Opts, Loc, ET);
99  DynamicTypeInfo DTI = getDynamicTypeInfoFromVtable((void*)Vtable);
100
101  static const char *TypeCheckKinds[] = {
102    "virtual call",
103    "non-virtual call",
104    "base-to-derived cast",
105    "cast to unrelated type",
106  };
107
108  Diag(Loc, DL_Error, "control flow integrity check for type %0 failed during "
109                      "%1 (vtable address %2)")
110      << Data->Type << TypeCheckKinds[Data->TypeCheckKind] << (void *)Vtable;
111
112  // If possible, say what type it actually points to.
113  if (!DTI.isValid())
114    Diag(Vtable, DL_Note, "invalid vtable");
115  else
116    Diag(Vtable, DL_Note, "vtable is of type %0")
117        << TypeName(DTI.getMostDerivedTypeName());
118}
119
120void __ubsan::__ubsan_handle_cfi_bad_type(CFIBadTypeData *Data,
121                                          ValueHandle Vtable) {
122  GET_REPORT_OPTIONS(false);
123  HandleCFIBadType(Data, Vtable, Opts);
124}
125
126void __ubsan::__ubsan_handle_cfi_bad_type_abort(CFIBadTypeData *Data,
127                                                ValueHandle Vtable) {
128  GET_REPORT_OPTIONS(true);
129  HandleCFIBadType(Data, Vtable, Opts);
130  Die();
131}
132
133#endif  // CAN_SANITIZE_UB
134