test/asan/TestCases/strncpy-overflow.cc

   1 // RUN: %clangxx_asan -O0 %s -o %t && not %t 2>&1 | FileCheck %s --check-prefix=CHECK-%os --check-prefix=CHECK
   2 // RUN: %clangxx_asan -O1 %s -o %t && not %t 2>&1 | FileCheck %s --check-prefix=CHECK-%os --check-prefix=CHECK
   3 // RUN: %clangxx_asan -O2 %s -o %t && not %t 2>&1 | FileCheck %s --check-prefix=CHECK-%os --check-prefix=CHECK
   4 // RUN: %clangxx_asan -O3 %s -o %t && not %t 2>&1 | FileCheck %s --check-prefix=CHECK-%os --check-prefix=CHECK
   5
   6 // REQUIRES: compiler-rt-optimized
   7
   8 #include <string.h>
   9 #include <stdlib.h>
  10 int main(int argc, char **argv) {
  11   char *hello = (char*)malloc(6);
  12   strcpy(hello, "hello");
  13   char *short_buffer = (char*)malloc(9);
  14   strncpy(short_buffer, hello, 10);  // BOOM
  15   // CHECK: {{WRITE of size 10 at 0x.* thread T0}}
  16   // CHECK-Linux: {{    #0 0x.* in .*strncpy}}
  17   // CHECK-Darwin: {{    #0 0x.* in wrap_strncpy}}
  18   // CHECK: {{    #1 0x.* in main .*strncpy-overflow.cc:}}[[@LINE-4]]
  19   // CHECK: {{0x.* is located 0 bytes to the right of 9-byte region}}
  20   // CHECK: {{allocated by thread T0 here:}}
  21
  22   // CHECK-Linux: {{    #0 0x.* in .*malloc}}
  23   // CHECK-Linux: {{    #1 0x.* in main .*strncpy-overflow.cc:}}[[@LINE-10]]
  24
  25   // CHECK-Darwin: {{    #0 0x.* in wrap_malloc.*}}
  26   // CHECK-Darwin: {{    #1 0x.* in main .*strncpy-overflow.cc:}}[[@LINE-13]]
  27   return short_buffer[8];
  28 }