lib/asan/asan_interceptors.cc

   1 //===-- asan_interceptors.cc ----------------------------------------------===//
   2 //
   3 //                     The LLVM Compiler Infrastructure
   4 //
   5 // This file is distributed under the University of Illinois Open Source
   6 // License. See LICENSE.TXT for details.
   7 //
   8 //===----------------------------------------------------------------------===//
   9 //
  10 // This file is a part of AddressSanitizer, an address sanity checker.
  11 //
  12 // Intercept various libc functions.
  13 //===----------------------------------------------------------------------===//
  14 #include "asan_interceptors.h"
  15
  16 #include "asan_allocator.h"
  17 #include "asan_internal.h"
  18 #include "asan_mapping.h"
  19 #include "asan_poisoning.h"
  20 #include "asan_report.h"
  21 #include "asan_stack.h"
  22 #include "asan_stats.h"
  23 #include "sanitizer_common/sanitizer_libc.h"
  24
  25 namespace __asan {
  26
  27 // Return true if we can quickly decide that the region is unpoisoned.
  28 static inline bool QuickCheckForUnpoisonedRegion(uptr beg, uptr size) {
  29   if (size == 0) return true;
  30   if (size <= 32)
  31     return !AddressIsPoisoned(beg) &&
  32            !AddressIsPoisoned(beg + size - 1) &&
  33            !AddressIsPoisoned(beg + size / 2);
  34   return false;
  35 }
  36
  37 // We implement ACCESS_MEMORY_RANGE, ASAN_READ_RANGE,
  38 // and ASAN_WRITE_RANGE as macro instead of function so
  39 // that no extra frames are created, and stack trace contains
  40 // relevant information only.
  41 // We check all shadow bytes.
  42 #define ACCESS_MEMORY_RANGE(offset, size, isWrite) do {                 \
  43     uptr __offset = (uptr)(offset);                                     \
  44     uptr __size = (uptr)(size);                                         \
  45     uptr __bad = 0;                                                     \
  46     if (__offset > __offset + __size) {                                 \
  47       GET_STACK_TRACE_FATAL_HERE;                                       \
  48       ReportStringFunctionSizeOverflow(__offset, __size, &stack);       \
  49     }                                                                   \
  50     if (!QuickCheckForUnpoisonedRegion(__offset, __size) &&             \
  51         (__bad = __asan_region_is_poisoned(__offset, __size))) {        \
  52       GET_CURRENT_PC_BP_SP;                                             \
  53       __asan_report_error(pc, bp, sp, __bad, isWrite, __size);          \
  54     }                                                                   \
  55   } while (0)
  56
  57 #define ASAN_READ_RANGE(offset, size) ACCESS_MEMORY_RANGE(offset, size, false)
  58 #define ASAN_WRITE_RANGE(offset, size) ACCESS_MEMORY_RANGE(offset, size, true)
  59
  60 // Behavior of functions like "memcpy" or "strcpy" is undefined
  61 // if memory intervals overlap. We report error in this case.
  62 // Macro is used to avoid creation of new frames.
  63 static inline bool RangesOverlap(const char *offset1, uptr length1,
  64                                  const char *offset2, uptr length2) {
  65   return !((offset1 + length1 <= offset2) || (offset2 + length2 <= offset1));
  66 }
  67 #define CHECK_RANGES_OVERLAP(name, _offset1, length1, _offset2, length2) do { \
  68   const char *offset1 = (const char*)_offset1; \
  69   const char *offset2 = (const char*)_offset2; \
  70   if (RangesOverlap(offset1, length1, offset2, length2)) { \
  71     GET_STACK_TRACE_FATAL_HERE; \
  72     ReportStringFunctionMemoryRangesOverlap(name, offset1, length1, \
  73                                             offset2, length2, &stack); \
  74   } \
  75 } while (0)
  76
  77 static inline uptr MaybeRealStrnlen(const char *s, uptr maxlen) {
  78 #if ASAN_INTERCEPT_STRNLEN
  79   if (REAL(strnlen) != 0) {
  80     return REAL(strnlen)(s, maxlen);
  81   }
  82 #endif
  83   return internal_strnlen(s, maxlen);
  84 }
  85
  86 void SetThreadName(const char *name) {
  87   AsanThread *t = GetCurrentThread();
  88   if (t)
  89     asanThreadRegistry().SetThreadName(t->tid(), name);
  90 }
  91
  92 int OnExit() {
  93   // FIXME: ask frontend whether we need to return failure.
  94   return 0;
  95 }
  96
  97 }  // namespace __asan
  98
  99 // ---------------------- Wrappers ---------------- {{{1
 100 using namespace __asan;  // NOLINT
 101
 102 DECLARE_REAL_AND_INTERCEPTOR(void *, malloc, uptr)
 103 DECLARE_REAL_AND_INTERCEPTOR(void, free, void *)
 104
 105 #if !SANITIZER_MAC
 106 #define ASAN_INTERCEPT_FUNC(name)                                        \
 107   do {                                                                   \
 108     if ((!INTERCEPT_FUNCTION(name) || !REAL(name)))                      \
 109       VReport(1, "AddressSanitizer: failed to intercept '" #name "'\n"); \
 110   } while (0)
 111 #else
 112 // OS X interceptors don't need to be initialized with INTERCEPT_FUNCTION.
 113 #define ASAN_INTERCEPT_FUNC(name)
 114 #endif  // SANITIZER_MAC
 115
 116 #define COMMON_INTERCEPT_FUNCTION(name) ASAN_INTERCEPT_FUNC(name)
 117 #define COMMON_INTERCEPTOR_WRITE_RANGE(ctx, ptr, size) \
 118   ASAN_WRITE_RANGE(ptr, size)
 119 #define COMMON_INTERCEPTOR_READ_RANGE(ctx, ptr, size) ASAN_READ_RANGE(ptr, size)
 120 #define COMMON_INTERCEPTOR_ENTER(ctx, func, ...)                               \
 121   do {                                                                         \
 122     if (asan_init_is_running)                                                  \
 123       return REAL(func)(__VA_ARGS__);                                          \
 124     ctx = 0;                                                                   \
 125     (void) ctx;                                                                \
 126     if (SANITIZER_MAC && UNLIKELY(!asan_inited))                               \
 127       return REAL(func)(__VA_ARGS__);                                          \
 128     ENSURE_ASAN_INITED();                                                      \
 129   } while (false)
 130 #define COMMON_INTERCEPTOR_FD_ACQUIRE(ctx, fd) \
 131   do {                                         \
 132   } while (false)
 133 #define COMMON_INTERCEPTOR_FD_RELEASE(ctx, fd) \
 134   do {                                         \
 135   } while (false)
 136 #define COMMON_INTERCEPTOR_FD_SOCKET_ACCEPT(ctx, fd, newfd) \
 137   do {                                                      \
 138   } while (false)
 139 #define COMMON_INTERCEPTOR_SET_THREAD_NAME(ctx, name) SetThreadName(name)
 140 // Should be asanThreadRegistry().SetThreadNameByUserId(thread, name)
 141 // But asan does not remember UserId's for threads (pthread_t);
 142 // and remembers all ever existed threads, so the linear search by UserId
 143 // can be slow.
 144 #define COMMON_INTERCEPTOR_SET_PTHREAD_NAME(ctx, thread, name) \
 145   do {                                                         \
 146   } while (false)
 147 #define COMMON_INTERCEPTOR_BLOCK_REAL(name) REAL(name)
 148 #define COMMON_INTERCEPTOR_ON_EXIT(ctx) OnExit()
 149 #include "sanitizer_common/sanitizer_common_interceptors.inc"
 150
 151 #define COMMON_SYSCALL_PRE_READ_RANGE(p, s) ASAN_READ_RANGE(p, s)
 152 #define COMMON_SYSCALL_PRE_WRITE_RANGE(p, s) ASAN_WRITE_RANGE(p, s)
 153 #define COMMON_SYSCALL_POST_READ_RANGE(p, s) \
 154   do {                                       \
 155     (void)(p);                               \
 156     (void)(s);                               \
 157   } while (false)
 158 #define COMMON_SYSCALL_POST_WRITE_RANGE(p, s) \
 159   do {                                        \
 160     (void)(p);                                \
 161     (void)(s);                                \
 162   } while (false)
 163 #include "sanitizer_common/sanitizer_common_syscalls.inc"
 164
 165 static thread_return_t THREAD_CALLING_CONV asan_thread_start(void *arg) {
 166   AsanThread *t = (AsanThread*)arg;
 167   SetCurrentThread(t);
 168   return t->ThreadStart(GetTid());
 169 }
 170
 171 #if ASAN_INTERCEPT_PTHREAD_CREATE
 172 INTERCEPTOR(int, pthread_create, void *thread,
 173     void *attr, void *(*start_routine)(void*), void *arg) {
 174   EnsureMainThreadIDIsCorrect();
 175   // Strict init-order checking in thread-hostile.
 176   if (flags()->strict_init_order)
 177     StopInitOrderChecking();
 178   GET_STACK_TRACE_THREAD;
 179   int detached = 0;
 180   if (attr != 0)
 181     REAL(pthread_attr_getdetachstate)(attr, &detached);
 182
 183   u32 current_tid = GetCurrentTidOrInvalid();
 184   AsanThread *t = AsanThread::Create(start_routine, arg);
 185   CreateThreadContextArgs args = { t, &stack };
 186   asanThreadRegistry().CreateThread(*(uptr*)t, detached, current_tid, &args);
 187   return REAL(pthread_create)(thread, attr, asan_thread_start, t);
 188 }
 189 #endif  // ASAN_INTERCEPT_PTHREAD_CREATE
 190
 191 #if ASAN_INTERCEPT_SIGNAL_AND_SIGACTION
 192
 193 #if SANITIZER_ANDROID
 194 INTERCEPTOR(void*, bsd_signal, int signum, void *handler) {
 195   if (!AsanInterceptsSignal(signum) ||
 196       common_flags()->allow_user_segv_handler) {
 197     return REAL(bsd_signal)(signum, handler);
 198   }
 199   return 0;
 200 }
 201 #else
 202 INTERCEPTOR(void*, signal, int signum, void *handler) {
 203   if (!AsanInterceptsSignal(signum) ||
 204       common_flags()->allow_user_segv_handler) {
 205     return REAL(signal)(signum, handler);
 206   }
 207   return 0;
 208 }
 209 #endif
 210
 211 INTERCEPTOR(int, sigaction, int signum, const struct sigaction *act,
 212                             struct sigaction *oldact) {
 213   if (!AsanInterceptsSignal(signum) ||
 214       common_flags()->allow_user_segv_handler) {
 215     return REAL(sigaction)(signum, act, oldact);
 216   }
 217   return 0;
 218 }
 219
 220 namespace __sanitizer {
 221 int real_sigaction(int signum, const void *act, void *oldact) {
 222   return REAL(sigaction)(signum,
 223                          (struct sigaction *)act, (struct sigaction *)oldact);
 224 }
 225 }  // namespace __sanitizer
 226
 227 #elif SANITIZER_POSIX
 228 // We need to have defined REAL(sigaction) on posix systems.
 229 DEFINE_REAL(int, sigaction, int signum, const struct sigaction *act,
 230     struct sigaction *oldact)
 231 #endif  // ASAN_INTERCEPT_SIGNAL_AND_SIGACTION
 232
 233 #if ASAN_INTERCEPT_SWAPCONTEXT
 234 static void ClearShadowMemoryForContextStack(uptr stack, uptr ssize) {
 235   // Align to page size.
 236   uptr PageSize = GetPageSizeCached();
 237   uptr bottom = stack & ~(PageSize - 1);
 238   ssize += stack - bottom;
 239   ssize = RoundUpTo(ssize, PageSize);
 240   static const uptr kMaxSaneContextStackSize = 1 << 22;  // 4 Mb
 241   if (ssize && ssize <= kMaxSaneContextStackSize) {
 242     PoisonShadow(bottom, ssize, 0);
 243   }
 244 }
 245
 246 INTERCEPTOR(int, swapcontext, struct ucontext_t *oucp,
 247             struct ucontext_t *ucp) {
 248   static bool reported_warning = false;
 249   if (!reported_warning) {
 250     Report("WARNING: ASan doesn't fully support makecontext/swapcontext "
 251            "functions and may produce false positives in some cases!\n");
 252     reported_warning = true;
 253   }
 254   // Clear shadow memory for new context (it may share stack
 255   // with current context).
 256   uptr stack, ssize;
 257   ReadContextStack(ucp, &stack, &ssize);
 258   ClearShadowMemoryForContextStack(stack, ssize);
 259   int res = REAL(swapcontext)(oucp, ucp);
 260   // swapcontext technically does not return, but program may swap context to
 261   // "oucp" later, that would look as if swapcontext() returned 0.
 262   // We need to clear shadow for ucp once again, as it may be in arbitrary
 263   // state.
 264   ClearShadowMemoryForContextStack(stack, ssize);
 265   return res;
 266 }
 267 #endif  // ASAN_INTERCEPT_SWAPCONTEXT
 268
 269 INTERCEPTOR(void, longjmp, void *env, int val) {
 270   __asan_handle_no_return();
 271   REAL(longjmp)(env, val);
 272 }
 273
 274 #if ASAN_INTERCEPT__LONGJMP
 275 INTERCEPTOR(void, _longjmp, void *env, int val) {
 276   __asan_handle_no_return();
 277   REAL(_longjmp)(env, val);
 278 }
 279 #endif
 280
 281 #if ASAN_INTERCEPT_SIGLONGJMP
 282 INTERCEPTOR(void, siglongjmp, void *env, int val) {
 283   __asan_handle_no_return();
 284   REAL(siglongjmp)(env, val);
 285 }
 286 #endif
 287
 288 #if ASAN_INTERCEPT___CXA_THROW
 289 INTERCEPTOR(void, __cxa_throw, void *a, void *b, void *c) {
 290   CHECK(REAL(__cxa_throw));
 291   __asan_handle_no_return();
 292   REAL(__cxa_throw)(a, b, c);
 293 }
 294 #endif
 295
 296 // intercept mlock and friends.
 297 // Since asan maps 16T of RAM, mlock is completely unfriendly to asan.
 298 // All functions return 0 (success).
 299 static void MlockIsUnsupported() {
 300   static bool printed = false;
 301   if (printed) return;
 302   printed = true;
 303   VPrintf(1,
 304           "INFO: AddressSanitizer ignores "
 305           "mlock/mlockall/munlock/munlockall\n");
 306 }
 307
 308 INTERCEPTOR(int, mlock, const void *addr, uptr len) {
 309   MlockIsUnsupported();
 310   return 0;
 311 }
 312
 313 INTERCEPTOR(int, munlock, const void *addr, uptr len) {
 314   MlockIsUnsupported();
 315   return 0;
 316 }
 317
 318 INTERCEPTOR(int, mlockall, int flags) {
 319   MlockIsUnsupported();
 320   return 0;
 321 }
 322
 323 INTERCEPTOR(int, munlockall, void) {
 324   MlockIsUnsupported();
 325   return 0;
 326 }
 327
 328 static inline int CharCmp(unsigned char c1, unsigned char c2) {
 329   return (c1 == c2) ? 0 : (c1 < c2) ? -1 : 1;
 330 }
 331
 332 INTERCEPTOR(int, memcmp, const void *a1, const void *a2, uptr size) {
 333   if (UNLIKELY(!asan_inited)) return internal_memcmp(a1, a2, size);
 334   ENSURE_ASAN_INITED();
 335   if (flags()->replace_intrin) {
 336     if (flags()->strict_memcmp) {
 337       // Check the entire regions even if the first bytes of the buffers are
 338       // different.
 339       ASAN_READ_RANGE(a1, size);
 340       ASAN_READ_RANGE(a2, size);
 341       // Fallthrough to REAL(memcmp) below.
 342     } else {
 343       unsigned char c1 = 0, c2 = 0;
 344       const unsigned char *s1 = (const unsigned char*)a1;
 345       const unsigned char *s2 = (const unsigned char*)a2;
 346       uptr i;
 347       for (i = 0; i < size; i++) {
 348         c1 = s1[i];
 349         c2 = s2[i];
 350         if (c1 != c2) break;
 351       }
 352       ASAN_READ_RANGE(s1, Min(i + 1, size));
 353       ASAN_READ_RANGE(s2, Min(i + 1, size));
 354       return CharCmp(c1, c2);
 355     }
 356   }
 357   return REAL(memcmp(a1, a2, size));
 358 }
 359
 360 void *__asan_memcpy(void *to, const void *from, uptr size) {
 361   if (UNLIKELY(!asan_inited)) return internal_memcpy(to, from, size);
 362   // memcpy is called during __asan_init() from the internals
 363   // of printf(...).
 364   if (asan_init_is_running) {
 365     return REAL(memcpy)(to, from, size);
 366   }
 367   ENSURE_ASAN_INITED();
 368   if (flags()->replace_intrin) {
 369     if (to != from) {
 370       // We do not treat memcpy with to==from as a bug.
 371       // See http://llvm.org/bugs/show_bug.cgi?id=11763.
 372       CHECK_RANGES_OVERLAP("memcpy", to, size, from, size);
 373     }
 374     ASAN_READ_RANGE(from, size);
 375     ASAN_WRITE_RANGE(to, size);
 376   }
 377   return REAL(memcpy)(to, from, size);
 378 }
 379
 380 void *__asan_memset(void *block, int c, uptr size) {
 381   if (UNLIKELY(!asan_inited)) return internal_memset(block, c, size);
 382   // memset is called inside Printf.
 383   if (asan_init_is_running) {
 384     return REAL(memset)(block, c, size);
 385   }
 386   ENSURE_ASAN_INITED();
 387   if (flags()->replace_intrin) {
 388     ASAN_WRITE_RANGE(block, size);
 389   }
 390   return REAL(memset)(block, c, size);
 391 }
 392
 393 void *__asan_memmove(void *to, const void *from, uptr size) {
 394   if (UNLIKELY(!asan_inited))
 395     return internal_memmove(to, from, size);
 396   ENSURE_ASAN_INITED();
 397   if (flags()->replace_intrin) {
 398     ASAN_READ_RANGE(from, size);
 399     ASAN_WRITE_RANGE(to, size);
 400   }
 401   return internal_memmove(to, from, size);
 402 }
 403
 404 INTERCEPTOR(void*, memmove, void *to, const void *from, uptr size) {
 405   return __asan_memmove(to, from, size);
 406 }
 407
 408 INTERCEPTOR(void*, memcpy, void *to, const void *from, uptr size) {
 409 #if !SANITIZER_MAC
 410   return __asan_memcpy(to, from, size);
 411 #else
 412   // At least on 10.7 and 10.8 both memcpy() and memmove() are being replaced
 413   // with WRAP(memcpy). As a result, false positives are reported for memmove()
 414   // calls. If we just disable error reporting with
 415   // ASAN_OPTIONS=replace_intrin=0, memmove() is still replaced with
 416   // internal_memcpy(), which may lead to crashes, see
 417   // http://llvm.org/bugs/show_bug.cgi?id=16362.
 418   return __asan_memmove(to, from, size);
 419 #endif  // !SANITIZER_MAC
 420 }
 421
 422 INTERCEPTOR(void*, memset, void *block, int c, uptr size) {
 423   return __asan_memset(block, c, size);
 424 }
 425
 426 INTERCEPTOR(char*, strchr, const char *str, int c) {
 427   if (UNLIKELY(!asan_inited)) return internal_strchr(str, c);
 428   // strchr is called inside create_purgeable_zone() when MallocGuardEdges=1 is
 429   // used.
 430   if (asan_init_is_running) {
 431     return REAL(strchr)(str, c);
 432   }
 433   ENSURE_ASAN_INITED();
 434   char *result = REAL(strchr)(str, c);
 435   if (flags()->replace_str) {
 436     uptr bytes_read = (result ? result - str : REAL(strlen)(str)) + 1;
 437     ASAN_READ_RANGE(str, bytes_read);
 438   }
 439   return result;
 440 }
 441
 442 #if ASAN_INTERCEPT_INDEX
 443 # if ASAN_USE_ALIAS_ATTRIBUTE_FOR_INDEX
 444 INTERCEPTOR(char*, index, const char *string, int c)
 445   ALIAS(WRAPPER_NAME(strchr));
 446 # else
 447 #  if SANITIZER_MAC
 448 DECLARE_REAL(char*, index, const char *string, int c)
 449 OVERRIDE_FUNCTION(index, strchr);
 450 #  else
 451 DEFINE_REAL(char*, index, const char *string, int c)
 452 #  endif
 453 # endif
 454 #endif  // ASAN_INTERCEPT_INDEX
 455
 456 // For both strcat() and strncat() we need to check the validity of |to|
 457 // argument irrespective of the |from| length.
 458 INTERCEPTOR(char*, strcat, char *to, const char *from) {  // NOLINT
 459   ENSURE_ASAN_INITED();
 460   if (flags()->replace_str) {
 461     uptr from_length = REAL(strlen)(from);
 462     ASAN_READ_RANGE(from, from_length + 1);
 463     uptr to_length = REAL(strlen)(to);
 464     ASAN_READ_RANGE(to, to_length);
 465     ASAN_WRITE_RANGE(to + to_length, from_length + 1);
 466     // If the copying actually happens, the |from| string should not overlap
 467     // with the resulting string starting at |to|, which has a length of
 468     // to_length + from_length + 1.
 469     if (from_length > 0) {
 470       CHECK_RANGES_OVERLAP("strcat", to, from_length + to_length + 1,
 471                            from, from_length + 1);
 472     }
 473   }
 474   return REAL(strcat)(to, from);  // NOLINT
 475 }
 476
 477 INTERCEPTOR(char*, strncat, char *to, const char *from, uptr size) {
 478   ENSURE_ASAN_INITED();
 479   if (flags()->replace_str) {
 480     uptr from_length = MaybeRealStrnlen(from, size);
 481     uptr copy_length = Min(size, from_length + 1);
 482     ASAN_READ_RANGE(from, copy_length);
 483     uptr to_length = REAL(strlen)(to);
 484     ASAN_READ_RANGE(to, to_length);
 485     ASAN_WRITE_RANGE(to + to_length, from_length + 1);
 486     if (from_length > 0) {
 487       CHECK_RANGES_OVERLAP("strncat", to, to_length + copy_length + 1,
 488                            from, copy_length);
 489     }
 490   }
 491   return REAL(strncat)(to, from, size);
 492 }
 493
 494 INTERCEPTOR(char*, strcpy, char *to, const char *from) {  // NOLINT
 495 #if SANITIZER_MAC
 496   if (UNLIKELY(!asan_inited)) return REAL(strcpy)(to, from);  // NOLINT
 497 #endif
 498   // strcpy is called from malloc_default_purgeable_zone()
 499   // in __asan::ReplaceSystemAlloc() on Mac.
 500   if (asan_init_is_running) {
 501     return REAL(strcpy)(to, from);  // NOLINT
 502   }
 503   ENSURE_ASAN_INITED();
 504   if (flags()->replace_str) {
 505     uptr from_size = REAL(strlen)(from) + 1;
 506     CHECK_RANGES_OVERLAP("strcpy", to, from_size, from, from_size);
 507     ASAN_READ_RANGE(from, from_size);
 508     ASAN_WRITE_RANGE(to, from_size);
 509   }
 510   return REAL(strcpy)(to, from);  // NOLINT
 511 }
 512
 513 #if ASAN_INTERCEPT_STRDUP
 514 INTERCEPTOR(char*, strdup, const char *s) {
 515   if (UNLIKELY(!asan_inited)) return internal_strdup(s);
 516   ENSURE_ASAN_INITED();
 517   uptr length = REAL(strlen)(s);
 518   if (flags()->replace_str) {
 519     ASAN_READ_RANGE(s, length + 1);
 520   }
 521   GET_STACK_TRACE_MALLOC;
 522   void *new_mem = asan_malloc(length + 1, &stack);
 523   REAL(memcpy)(new_mem, s, length + 1);
 524   return reinterpret_cast<char*>(new_mem);
 525 }
 526 #endif
 527
 528 INTERCEPTOR(uptr, strlen, const char *s) {
 529   if (UNLIKELY(!asan_inited)) return internal_strlen(s);
 530   // strlen is called from malloc_default_purgeable_zone()
 531   // in __asan::ReplaceSystemAlloc() on Mac.
 532   if (asan_init_is_running) {
 533     return REAL(strlen)(s);
 534   }
 535   ENSURE_ASAN_INITED();
 536   uptr length = REAL(strlen)(s);
 537   if (flags()->replace_str) {
 538     ASAN_READ_RANGE(s, length + 1);
 539   }
 540   return length;
 541 }
 542
 543 INTERCEPTOR(uptr, wcslen, const wchar_t *s) {
 544   uptr length = REAL(wcslen)(s);
 545   if (!asan_init_is_running) {
 546     ENSURE_ASAN_INITED();
 547     ASAN_READ_RANGE(s, (length + 1) * sizeof(wchar_t));
 548   }
 549   return length;
 550 }
 551
 552 INTERCEPTOR(char*, strncpy, char *to, const char *from, uptr size) {
 553   ENSURE_ASAN_INITED();
 554   if (flags()->replace_str) {
 555     uptr from_size = Min(size, MaybeRealStrnlen(from, size) + 1);
 556     CHECK_RANGES_OVERLAP("strncpy", to, from_size, from, from_size);
 557     ASAN_READ_RANGE(from, from_size);
 558     ASAN_WRITE_RANGE(to, size);
 559   }
 560   return REAL(strncpy)(to, from, size);
 561 }
 562
 563 #if ASAN_INTERCEPT_STRNLEN
 564 INTERCEPTOR(uptr, strnlen, const char *s, uptr maxlen) {
 565   ENSURE_ASAN_INITED();
 566   uptr length = REAL(strnlen)(s, maxlen);
 567   if (flags()->replace_str) {
 568     ASAN_READ_RANGE(s, Min(length + 1, maxlen));
 569   }
 570   return length;
 571 }
 572 #endif  // ASAN_INTERCEPT_STRNLEN
 573
 574 static inline bool IsValidStrtolBase(int base) {
 575   return (base == 0) || (2 <= base && base <= 36);
 576 }
 577
 578 static inline void FixRealStrtolEndptr(const char *nptr, char **endptr) {
 579   CHECK(endptr);
 580   if (nptr == *endptr) {
 581     // No digits were found at strtol call, we need to find out the last
 582     // symbol accessed by strtoll on our own.
 583     // We get this symbol by skipping leading blanks and optional +/- sign.
 584     while (IsSpace(*nptr)) nptr++;
 585     if (*nptr == '+' || *nptr == '-') nptr++;
 586     *endptr = (char*)nptr;
 587   }
 588   CHECK(*endptr >= nptr);
 589 }
 590
 591 INTERCEPTOR(long, strtol, const char *nptr,  // NOLINT
 592             char **endptr, int base) {
 593   ENSURE_ASAN_INITED();
 594   if (!flags()->replace_str) {
 595     return REAL(strtol)(nptr, endptr, base);
 596   }
 597   char *real_endptr;
 598   long result = REAL(strtol)(nptr, &real_endptr, base);  // NOLINT
 599   if (endptr != 0) {
 600     *endptr = real_endptr;
 601   }
 602   if (IsValidStrtolBase(base)) {
 603     FixRealStrtolEndptr(nptr, &real_endptr);
 604     ASAN_READ_RANGE(nptr, (real_endptr - nptr) + 1);
 605   }
 606   return result;
 607 }
 608
 609 INTERCEPTOR(int, atoi, const char *nptr) {
 610 #if SANITIZER_MAC
 611   if (UNLIKELY(!asan_inited)) return REAL(atoi)(nptr);
 612 #endif
 613   ENSURE_ASAN_INITED();
 614   if (!flags()->replace_str) {
 615     return REAL(atoi)(nptr);
 616   }
 617   char *real_endptr;
 618   // "man atoi" tells that behavior of atoi(nptr) is the same as
 619   // strtol(nptr, 0, 10), i.e. it sets errno to ERANGE if the
 620   // parsed integer can't be stored in *long* type (even if it's
 621   // different from int). So, we just imitate this behavior.
 622   int result = REAL(strtol)(nptr, &real_endptr, 10);
 623   FixRealStrtolEndptr(nptr, &real_endptr);
 624   ASAN_READ_RANGE(nptr, (real_endptr - nptr) + 1);
 625   return result;
 626 }
 627
 628 INTERCEPTOR(long, atol, const char *nptr) {  // NOLINT
 629 #if SANITIZER_MAC
 630   if (UNLIKELY(!asan_inited)) return REAL(atol)(nptr);
 631 #endif
 632   ENSURE_ASAN_INITED();
 633   if (!flags()->replace_str) {
 634     return REAL(atol)(nptr);
 635   }
 636   char *real_endptr;
 637   long result = REAL(strtol)(nptr, &real_endptr, 10);  // NOLINT
 638   FixRealStrtolEndptr(nptr, &real_endptr);
 639   ASAN_READ_RANGE(nptr, (real_endptr - nptr) + 1);
 640   return result;
 641 }
 642
 643 #if ASAN_INTERCEPT_ATOLL_AND_STRTOLL
 644 INTERCEPTOR(long long, strtoll, const char *nptr,  // NOLINT
 645             char **endptr, int base) {
 646   ENSURE_ASAN_INITED();
 647   if (!flags()->replace_str) {
 648     return REAL(strtoll)(nptr, endptr, base);
 649   }
 650   char *real_endptr;
 651   long long result = REAL(strtoll)(nptr, &real_endptr, base);  // NOLINT
 652   if (endptr != 0) {
 653     *endptr = real_endptr;
 654   }
 655   // If base has unsupported value, strtoll can exit with EINVAL
 656   // without reading any characters. So do additional checks only
 657   // if base is valid.
 658   if (IsValidStrtolBase(base)) {
 659     FixRealStrtolEndptr(nptr, &real_endptr);
 660     ASAN_READ_RANGE(nptr, (real_endptr - nptr) + 1);
 661   }
 662   return result;
 663 }
 664
 665 INTERCEPTOR(long long, atoll, const char *nptr) {  // NOLINT
 666   ENSURE_ASAN_INITED();
 667   if (!flags()->replace_str) {
 668     return REAL(atoll)(nptr);
 669   }
 670   char *real_endptr;
 671   long long result = REAL(strtoll)(nptr, &real_endptr, 10);  // NOLINT
 672   FixRealStrtolEndptr(nptr, &real_endptr);
 673   ASAN_READ_RANGE(nptr, (real_endptr - nptr) + 1);
 674   return result;
 675 }
 676 #endif  // ASAN_INTERCEPT_ATOLL_AND_STRTOLL
 677
 678 static void AtCxaAtexit(void *unused) {
 679   (void)unused;
 680   StopInitOrderChecking();
 681 }
 682
 683 #if ASAN_INTERCEPT___CXA_ATEXIT
 684 INTERCEPTOR(int, __cxa_atexit, void (*func)(void *), void *arg,
 685             void *dso_handle) {
 686 #if SANITIZER_MAC
 687   if (UNLIKELY(!asan_inited)) return REAL(__cxa_atexit)(func, arg, dso_handle);
 688 #endif
 689   ENSURE_ASAN_INITED();
 690   int res = REAL(__cxa_atexit)(func, arg, dso_handle);
 691   REAL(__cxa_atexit)(AtCxaAtexit, 0, 0);
 692   return res;
 693 }
 694 #endif  // ASAN_INTERCEPT___CXA_ATEXIT
 695
 696 #if SANITIZER_WINDOWS
 697 INTERCEPTOR_WINAPI(DWORD, CreateThread,
 698                    void* security, uptr stack_size,
 699                    DWORD (__stdcall *start_routine)(void*), void* arg,
 700                    DWORD thr_flags, void* tid) {
 701   // Strict init-order checking in thread-hostile.
 702   if (flags()->strict_init_order)
 703     StopInitOrderChecking();
 704   GET_STACK_TRACE_THREAD;
 705   u32 current_tid = GetCurrentTidOrInvalid();
 706   AsanThread *t = AsanThread::Create(start_routine, arg);
 707   CreateThreadContextArgs args = { t, &stack };
 708   bool detached = false;  // FIXME: how can we determine it on Windows?
 709   asanThreadRegistry().CreateThread(*(uptr*)t, detached, current_tid, &args);
 710   return REAL(CreateThread)(security, stack_size,
 711                             asan_thread_start, t, thr_flags, tid);
 712 }
 713
 714 namespace __asan {
 715 void InitializeWindowsInterceptors() {
 716   ASAN_INTERCEPT_FUNC(CreateThread);
 717 }
 718
 719 }  // namespace __asan
 720 #endif
 721
 722 // ---------------------- InitializeAsanInterceptors ---------------- {{{1
 723 namespace __asan {
 724 void InitializeAsanInterceptors() {
 725   static bool was_called_once;
 726   CHECK(was_called_once == false);
 727   was_called_once = true;
 728   InitializeCommonInterceptors();
 729
 730   // Intercept mem* functions.
 731   ASAN_INTERCEPT_FUNC(memcmp);
 732   ASAN_INTERCEPT_FUNC(memmove);
 733   ASAN_INTERCEPT_FUNC(memset);
 734   if (PLATFORM_HAS_DIFFERENT_MEMCPY_AND_MEMMOVE) {
 735     ASAN_INTERCEPT_FUNC(memcpy);
 736   }
 737
 738   // Intercept str* functions.
 739   ASAN_INTERCEPT_FUNC(strcat);  // NOLINT
 740   ASAN_INTERCEPT_FUNC(strchr);
 741   ASAN_INTERCEPT_FUNC(strcpy);  // NOLINT
 742   ASAN_INTERCEPT_FUNC(strlen);
 743   ASAN_INTERCEPT_FUNC(wcslen);
 744   ASAN_INTERCEPT_FUNC(strncat);
 745   ASAN_INTERCEPT_FUNC(strncpy);
 746 #if ASAN_INTERCEPT_STRDUP
 747   ASAN_INTERCEPT_FUNC(strdup);
 748 #endif
 749 #if ASAN_INTERCEPT_STRNLEN
 750   ASAN_INTERCEPT_FUNC(strnlen);
 751 #endif
 752 #if ASAN_INTERCEPT_INDEX && ASAN_USE_ALIAS_ATTRIBUTE_FOR_INDEX
 753   ASAN_INTERCEPT_FUNC(index);
 754 #endif
 755
 756   ASAN_INTERCEPT_FUNC(atoi);
 757   ASAN_INTERCEPT_FUNC(atol);
 758   ASAN_INTERCEPT_FUNC(strtol);
 759 #if ASAN_INTERCEPT_ATOLL_AND_STRTOLL
 760   ASAN_INTERCEPT_FUNC(atoll);
 761   ASAN_INTERCEPT_FUNC(strtoll);
 762 #endif
 763
 764 #if ASAN_INTERCEPT_MLOCKX
 765   // Intercept mlock/munlock.
 766   ASAN_INTERCEPT_FUNC(mlock);
 767   ASAN_INTERCEPT_FUNC(munlock);
 768   ASAN_INTERCEPT_FUNC(mlockall);
 769   ASAN_INTERCEPT_FUNC(munlockall);
 770 #endif
 771
 772   // Intecept signal- and jump-related functions.
 773   ASAN_INTERCEPT_FUNC(longjmp);
 774 #if ASAN_INTERCEPT_SIGNAL_AND_SIGACTION
 775   ASAN_INTERCEPT_FUNC(sigaction);
 776 #if SANITIZER_ANDROID
 777   ASAN_INTERCEPT_FUNC(bsd_signal);
 778 #else
 779   ASAN_INTERCEPT_FUNC(signal);
 780 #endif
 781 #endif
 782 #if ASAN_INTERCEPT_SWAPCONTEXT
 783   ASAN_INTERCEPT_FUNC(swapcontext);
 784 #endif
 785 #if ASAN_INTERCEPT__LONGJMP
 786   ASAN_INTERCEPT_FUNC(_longjmp);
 787 #endif
 788 #if ASAN_INTERCEPT_SIGLONGJMP
 789   ASAN_INTERCEPT_FUNC(siglongjmp);
 790 #endif
 791
 792   // Intercept exception handling functions.
 793 #if ASAN_INTERCEPT___CXA_THROW
 794   INTERCEPT_FUNCTION(__cxa_throw);
 795 #endif
 796
 797   // Intercept threading-related functions
 798 #if ASAN_INTERCEPT_PTHREAD_CREATE
 799   ASAN_INTERCEPT_FUNC(pthread_create);
 800 #endif
 801
 802   // Intercept atexit function.
 803 #if ASAN_INTERCEPT___CXA_ATEXIT
 804   ASAN_INTERCEPT_FUNC(__cxa_atexit);
 805 #endif
 806
 807   // Some Windows-specific interceptors.
 808 #if SANITIZER_WINDOWS
 809   InitializeWindowsInterceptors();
 810 #endif
 811
 812   VReport(1, "AddressSanitizer: libc interceptors initialized\n");
 813 }
 814
 815 }  // namespace __asan