lib/asan/asan_interceptors.cc

   1 //===-- asan_interceptors.cc ----------------------------------------------===//
   2 //
   3 //                     The LLVM Compiler Infrastructure
   4 //
   5 // This file is distributed under the University of Illinois Open Source
   6 // License. See LICENSE.TXT for details.
   7 //
   8 //===----------------------------------------------------------------------===//
   9 //
  10 // This file is a part of AddressSanitizer, an address sanity checker.
  11 //
  12 // Intercept various libc functions.
  13 //===----------------------------------------------------------------------===//
  14 #include "asan_interceptors.h"
  15
  16 #include "asan_allocator.h"
  17 #include "asan_internal.h"
  18 #include "asan_mapping.h"
  19 #include "asan_poisoning.h"
  20 #include "asan_report.h"
  21 #include "asan_stack.h"
  22 #include "asan_stats.h"
  23 #include "sanitizer_common/sanitizer_libc.h"
  24
  25 namespace __asan {
  26
  27 // Return true if we can quickly decide that the region is unpoisoned.
  28 static inline bool QuickCheckForUnpoisonedRegion(uptr beg, uptr size) {
  29   if (size == 0) return true;
  30   if (size <= 32)
  31     return !AddressIsPoisoned(beg) &&
  32            !AddressIsPoisoned(beg + size - 1) &&
  33            !AddressIsPoisoned(beg + size / 2);
  34   return false;
  35 }
  36
  37 // We implement ACCESS_MEMORY_RANGE, ASAN_READ_RANGE,
  38 // and ASAN_WRITE_RANGE as macro instead of function so
  39 // that no extra frames are created, and stack trace contains
  40 // relevant information only.
  41 // We check all shadow bytes.
  42 #define ACCESS_MEMORY_RANGE(offset, size, isWrite) do {                 \
  43     uptr __offset = (uptr)(offset);                                     \
  44     uptr __size = (uptr)(size);                                         \
  45     uptr __bad = 0;                                                     \
  46     if (__offset > __offset + __size) {                                 \
  47       GET_STACK_TRACE_FATAL_HERE;                                       \
  48       ReportStringFunctionSizeOverflow(__offset, __size, &stack);       \
  49     }                                                                   \
  50     if (!QuickCheckForUnpoisonedRegion(__offset, __size) &&             \
  51         (__bad = __asan_region_is_poisoned(__offset, __size))) {        \
  52       GET_CURRENT_PC_BP_SP;                                             \
  53       __asan_report_error(pc, bp, sp, __bad, isWrite, __size);          \
  54     }                                                                   \
  55   } while (0)
  56
  57 #define ASAN_READ_RANGE(offset, size) ACCESS_MEMORY_RANGE(offset, size, false)
  58 #define ASAN_WRITE_RANGE(offset, size) ACCESS_MEMORY_RANGE(offset, size, true)
  59
  60 // Behavior of functions like "memcpy" or "strcpy" is undefined
  61 // if memory intervals overlap. We report error in this case.
  62 // Macro is used to avoid creation of new frames.
  63 static inline bool RangesOverlap(const char *offset1, uptr length1,
  64                                  const char *offset2, uptr length2) {
  65   return !((offset1 + length1 <= offset2) || (offset2 + length2 <= offset1));
  66 }
  67 #define CHECK_RANGES_OVERLAP(name, _offset1, length1, _offset2, length2) do { \
  68   const char *offset1 = (const char*)_offset1; \
  69   const char *offset2 = (const char*)_offset2; \
  70   if (RangesOverlap(offset1, length1, offset2, length2)) { \
  71     GET_STACK_TRACE_FATAL_HERE; \
  72     ReportStringFunctionMemoryRangesOverlap(name, offset1, length1, \
  73                                             offset2, length2, &stack); \
  74   } \
  75 } while (0)
  76
  77 static inline uptr MaybeRealStrnlen(const char *s, uptr maxlen) {
  78 #if ASAN_INTERCEPT_STRNLEN
  79   if (REAL(strnlen) != 0) {
  80     return REAL(strnlen)(s, maxlen);
  81   }
  82 #endif
  83   return internal_strnlen(s, maxlen);
  84 }
  85
  86 void SetThreadName(const char *name) {
  87   AsanThread *t = GetCurrentThread();
  88   if (t)
  89     asanThreadRegistry().SetThreadName(t->tid(), name);
  90 }
  91
  92 int OnExit() {
  93   // FIXME: ask frontend whether we need to return failure.
  94   return 0;
  95 }
  96
  97 }  // namespace __asan
  98
  99 // ---------------------- Wrappers ---------------- {{{1
 100 using namespace __asan;  // NOLINT
 101
 102 DECLARE_REAL_AND_INTERCEPTOR(void *, malloc, uptr)
 103 DECLARE_REAL_AND_INTERCEPTOR(void, free, void *)
 104
 105 #if !SANITIZER_MAC
 106 #define ASAN_INTERCEPT_FUNC(name)                                        \
 107   do {                                                                   \
 108     if ((!INTERCEPT_FUNCTION(name) || !REAL(name)))                      \
 109       VReport(1, "AddressSanitizer: failed to intercept '" #name "'\n"); \
 110   } while (0)
 111 #else
 112 // OS X interceptors don't need to be initialized with INTERCEPT_FUNCTION.
 113 #define ASAN_INTERCEPT_FUNC(name)
 114 #endif  // SANITIZER_MAC
 115
 116 #define COMMON_INTERCEPT_FUNCTION(name) ASAN_INTERCEPT_FUNC(name)
 117 #define COMMON_INTERCEPTOR_WRITE_RANGE(ctx, ptr, size) \
 118   ASAN_WRITE_RANGE(ptr, size)
 119 #define COMMON_INTERCEPTOR_READ_RANGE(ctx, ptr, size) ASAN_READ_RANGE(ptr, size)
 120 #define COMMON_INTERCEPTOR_ENTER(ctx, func, ...)                               \
 121   do {                                                                         \
 122     if (asan_init_is_running)                                                  \
 123       return REAL(func)(__VA_ARGS__);                                          \
 124     ctx = 0;                                                                   \
 125     (void) ctx;                                                                \
 126     if (SANITIZER_MAC && UNLIKELY(!asan_inited))                               \
 127       return REAL(func)(__VA_ARGS__);                                          \
 128     ENSURE_ASAN_INITED();                                                      \
 129   } while (false)
 130 #define COMMON_INTERCEPTOR_FD_ACQUIRE(ctx, fd) \
 131   do {                                         \
 132   } while (false)
 133 #define COMMON_INTERCEPTOR_FD_RELEASE(ctx, fd) \
 134   do {                                         \
 135   } while (false)
 136 #define COMMON_INTERCEPTOR_FD_SOCKET_ACCEPT(ctx, fd, newfd) \
 137   do {                                                      \
 138   } while (false)
 139 #define COMMON_INTERCEPTOR_SET_THREAD_NAME(ctx, name) SetThreadName(name)
 140 // Should be asanThreadRegistry().SetThreadNameByUserId(thread, name)
 141 // But asan does not remember UserId's for threads (pthread_t);
 142 // and remembers all ever existed threads, so the linear search by UserId
 143 // can be slow.
 144 #define COMMON_INTERCEPTOR_SET_PTHREAD_NAME(ctx, thread, name) \
 145   do {                                                         \
 146   } while (false)
 147 #define COMMON_INTERCEPTOR_BLOCK_REAL(name) REAL(name)
 148 #define COMMON_INTERCEPTOR_ON_EXIT(ctx) OnExit()
 149 #include "sanitizer_common/sanitizer_common_interceptors.inc"
 150
 151 #define COMMON_SYSCALL_PRE_READ_RANGE(p, s) ASAN_READ_RANGE(p, s)
 152 #define COMMON_SYSCALL_PRE_WRITE_RANGE(p, s) ASAN_WRITE_RANGE(p, s)
 153 #define COMMON_SYSCALL_POST_READ_RANGE(p, s) \
 154   do {                                       \
 155     (void)(p);                               \
 156     (void)(s);                               \
 157   } while (false)
 158 #define COMMON_SYSCALL_POST_WRITE_RANGE(p, s) \
 159   do {                                        \
 160     (void)(p);                                \
 161     (void)(s);                                \
 162   } while (false)
 163 #include "sanitizer_common/sanitizer_common_syscalls.inc"
 164
 165 static thread_return_t THREAD_CALLING_CONV asan_thread_start(void *arg) {
 166   AsanThread *t = (AsanThread*)arg;
 167   SetCurrentThread(t);
 168   return t->ThreadStart(GetTid());
 169 }
 170
 171 #if ASAN_INTERCEPT_PTHREAD_CREATE
 172 INTERCEPTOR(int, pthread_create, void *thread,
 173     void *attr, void *(*start_routine)(void*), void *arg) {
 174   EnsureMainThreadIDIsCorrect();
 175   // Strict init-order checking in thread-hostile.
 176   if (flags()->strict_init_order)
 177     StopInitOrderChecking();
 178   GET_STACK_TRACE_THREAD;
 179   int detached = 0;
 180   if (attr != 0)
 181     REAL(pthread_attr_getdetachstate)(attr, &detached);
 182
 183   u32 current_tid = GetCurrentTidOrInvalid();
 184   AsanThread *t = AsanThread::Create(start_routine, arg);
 185   CreateThreadContextArgs args = { t, &stack };
 186   asanThreadRegistry().CreateThread(*(uptr*)t, detached, current_tid, &args);
 187   return REAL(pthread_create)(thread, attr, asan_thread_start, t);
 188 }
 189 #endif  // ASAN_INTERCEPT_PTHREAD_CREATE
 190
 191 #if ASAN_INTERCEPT_SIGNAL_AND_SIGACTION
 192
 193 #if SANITIZER_ANDROID
 194 INTERCEPTOR(void*, bsd_signal, int signum, void *handler) {
 195   if (!AsanInterceptsSignal(signum) ||
 196       common_flags()->allow_user_segv_handler) {
 197     return REAL(bsd_signal)(signum, handler);
 198   }
 199   return 0;
 200 }
 201 #else
 202 INTERCEPTOR(void*, signal, int signum, void *handler) {
 203   if (!AsanInterceptsSignal(signum) ||
 204       common_flags()->allow_user_segv_handler) {
 205     return REAL(signal)(signum, handler);
 206   }
 207   return 0;
 208 }
 209 #endif
 210
 211 INTERCEPTOR(int, sigaction, int signum, const struct sigaction *act,
 212                             struct sigaction *oldact) {
 213   if (!AsanInterceptsSignal(signum) ||
 214       common_flags()->allow_user_segv_handler) {
 215     return REAL(sigaction)(signum, act, oldact);
 216   }
 217   return 0;
 218 }
 219
 220 namespace __sanitizer {
 221 int real_sigaction(int signum, const void *act, void *oldact) {
 222   return REAL(sigaction)(signum,
 223                          (struct sigaction *)act, (struct sigaction *)oldact);
 224 }
 225 }  // namespace __sanitizer
 226
 227 #elif SANITIZER_POSIX
 228 // We need to have defined REAL(sigaction) on posix systems.
 229 DEFINE_REAL(int, sigaction, int signum, const struct sigaction *act,
 230     struct sigaction *oldact)
 231 #endif  // ASAN_INTERCEPT_SIGNAL_AND_SIGACTION
 232
 233 #if ASAN_INTERCEPT_SWAPCONTEXT
 234 static void ClearShadowMemoryForContextStack(uptr stack, uptr ssize) {
 235   // Align to page size.
 236   uptr PageSize = GetPageSizeCached();
 237   uptr bottom = stack & ~(PageSize - 1);
 238   ssize += stack - bottom;
 239   ssize = RoundUpTo(ssize, PageSize);
 240   static const uptr kMaxSaneContextStackSize = 1 << 22;  // 4 Mb
 241   if (ssize && ssize <= kMaxSaneContextStackSize) {
 242     PoisonShadow(bottom, ssize, 0);
 243   }
 244 }
 245
 246 INTERCEPTOR(int, swapcontext, struct ucontext_t *oucp,
 247             struct ucontext_t *ucp) {
 248   static bool reported_warning = false;
 249   if (!reported_warning) {
 250     Report("WARNING: ASan doesn't fully support makecontext/swapcontext "
 251            "functions and may produce false positives in some cases!\n");
 252     reported_warning = true;
 253   }
 254   // Clear shadow memory for new context (it may share stack
 255   // with current context).
 256   uptr stack, ssize;
 257   ReadContextStack(ucp, &stack, &ssize);
 258   ClearShadowMemoryForContextStack(stack, ssize);
 259   int res = REAL(swapcontext)(oucp, ucp);
 260   // swapcontext technically does not return, but program may swap context to
 261   // "oucp" later, that would look as if swapcontext() returned 0.
 262   // We need to clear shadow for ucp once again, as it may be in arbitrary
 263   // state.
 264   ClearShadowMemoryForContextStack(stack, ssize);
 265   return res;
 266 }
 267 #endif  // ASAN_INTERCEPT_SWAPCONTEXT
 268
 269 INTERCEPTOR(void, longjmp, void *env, int val) {
 270   __asan_handle_no_return();
 271   REAL(longjmp)(env, val);
 272 }
 273
 274 #if ASAN_INTERCEPT__LONGJMP
 275 INTERCEPTOR(void, _longjmp, void *env, int val) {
 276   __asan_handle_no_return();
 277   REAL(_longjmp)(env, val);
 278 }
 279 #endif
 280
 281 #if ASAN_INTERCEPT_SIGLONGJMP
 282 INTERCEPTOR(void, siglongjmp, void *env, int val) {
 283   __asan_handle_no_return();
 284   REAL(siglongjmp)(env, val);
 285 }
 286 #endif
 287
 288 #if ASAN_INTERCEPT___CXA_THROW
 289 INTERCEPTOR(void, __cxa_throw, void *a, void *b, void *c) {
 290   CHECK(REAL(__cxa_throw));
 291   __asan_handle_no_return();
 292   REAL(__cxa_throw)(a, b, c);
 293 }
 294 #endif
 295
 296 #if ASAN_INTERCEPT_MLOCKX
 297 // intercept mlock and friends.
 298 // Since asan maps 16T of RAM, mlock is completely unfriendly to asan.
 299 // All functions return 0 (success).
 300 static void MlockIsUnsupported() {
 301   static bool printed = false;
 302   if (printed) return;
 303   printed = true;
 304   VPrintf(1,
 305           "INFO: AddressSanitizer ignores "
 306           "mlock/mlockall/munlock/munlockall\n");
 307 }
 308
 309 INTERCEPTOR(int, mlock, const void *addr, uptr len) {
 310   MlockIsUnsupported();
 311   return 0;
 312 }
 313
 314 INTERCEPTOR(int, munlock, const void *addr, uptr len) {
 315   MlockIsUnsupported();
 316   return 0;
 317 }
 318
 319 INTERCEPTOR(int, mlockall, int flags) {
 320   MlockIsUnsupported();
 321   return 0;
 322 }
 323
 324 INTERCEPTOR(int, munlockall, void) {
 325   MlockIsUnsupported();
 326   return 0;
 327 }
 328 #endif
 329
 330 static inline int CharCmp(unsigned char c1, unsigned char c2) {
 331   return (c1 == c2) ? 0 : (c1 < c2) ? -1 : 1;
 332 }
 333
 334 INTERCEPTOR(int, memcmp, const void *a1, const void *a2, uptr size) {
 335   if (UNLIKELY(!asan_inited)) return internal_memcmp(a1, a2, size);
 336   ENSURE_ASAN_INITED();
 337   if (flags()->replace_intrin) {
 338     if (flags()->strict_memcmp) {
 339       // Check the entire regions even if the first bytes of the buffers are
 340       // different.
 341       ASAN_READ_RANGE(a1, size);
 342       ASAN_READ_RANGE(a2, size);
 343       // Fallthrough to REAL(memcmp) below.
 344     } else {
 345       unsigned char c1 = 0, c2 = 0;
 346       const unsigned char *s1 = (const unsigned char*)a1;
 347       const unsigned char *s2 = (const unsigned char*)a2;
 348       uptr i;
 349       for (i = 0; i < size; i++) {
 350         c1 = s1[i];
 351         c2 = s2[i];
 352         if (c1 != c2) break;
 353       }
 354       ASAN_READ_RANGE(s1, Min(i + 1, size));
 355       ASAN_READ_RANGE(s2, Min(i + 1, size));
 356       return CharCmp(c1, c2);
 357     }
 358   }
 359   return REAL(memcmp(a1, a2, size));
 360 }
 361
 362 void *__asan_memcpy(void *to, const void *from, uptr size) {
 363   if (UNLIKELY(!asan_inited)) return internal_memcpy(to, from, size);
 364   // memcpy is called during __asan_init() from the internals
 365   // of printf(...).
 366   if (asan_init_is_running) {
 367     return REAL(memcpy)(to, from, size);
 368   }
 369   ENSURE_ASAN_INITED();
 370   if (flags()->replace_intrin) {
 371     if (to != from) {
 372       // We do not treat memcpy with to==from as a bug.
 373       // See http://llvm.org/bugs/show_bug.cgi?id=11763.
 374       CHECK_RANGES_OVERLAP("memcpy", to, size, from, size);
 375     }
 376     ASAN_READ_RANGE(from, size);
 377     ASAN_WRITE_RANGE(to, size);
 378   }
 379   return REAL(memcpy)(to, from, size);
 380 }
 381
 382 void *__asan_memset(void *block, int c, uptr size) {
 383   if (UNLIKELY(!asan_inited)) return internal_memset(block, c, size);
 384   // memset is called inside Printf.
 385   if (asan_init_is_running) {
 386     return REAL(memset)(block, c, size);
 387   }
 388   ENSURE_ASAN_INITED();
 389   if (flags()->replace_intrin) {
 390     ASAN_WRITE_RANGE(block, size);
 391   }
 392   return REAL(memset)(block, c, size);
 393 }
 394
 395 void *__asan_memmove(void *to, const void *from, uptr size) {
 396   if (UNLIKELY(!asan_inited))
 397     return internal_memmove(to, from, size);
 398   ENSURE_ASAN_INITED();
 399   if (flags()->replace_intrin) {
 400     ASAN_READ_RANGE(from, size);
 401     ASAN_WRITE_RANGE(to, size);
 402   }
 403   return internal_memmove(to, from, size);
 404 }
 405
 406 INTERCEPTOR(void*, memmove, void *to, const void *from, uptr size) {
 407   return __asan_memmove(to, from, size);
 408 }
 409
 410 INTERCEPTOR(void*, memcpy, void *to, const void *from, uptr size) {
 411 #if !SANITIZER_MAC
 412   return __asan_memcpy(to, from, size);
 413 #else
 414   // At least on 10.7 and 10.8 both memcpy() and memmove() are being replaced
 415   // with WRAP(memcpy). As a result, false positives are reported for memmove()
 416   // calls. If we just disable error reporting with
 417   // ASAN_OPTIONS=replace_intrin=0, memmove() is still replaced with
 418   // internal_memcpy(), which may lead to crashes, see
 419   // http://llvm.org/bugs/show_bug.cgi?id=16362.
 420   return __asan_memmove(to, from, size);
 421 #endif  // !SANITIZER_MAC
 422 }
 423
 424 INTERCEPTOR(void*, memset, void *block, int c, uptr size) {
 425   return __asan_memset(block, c, size);
 426 }
 427
 428 INTERCEPTOR(char*, strchr, const char *str, int c) {
 429   if (UNLIKELY(!asan_inited)) return internal_strchr(str, c);
 430   // strchr is called inside create_purgeable_zone() when MallocGuardEdges=1 is
 431   // used.
 432   if (asan_init_is_running) {
 433     return REAL(strchr)(str, c);
 434   }
 435   ENSURE_ASAN_INITED();
 436   char *result = REAL(strchr)(str, c);
 437   if (flags()->replace_str) {
 438     uptr bytes_read = (result ? result - str : REAL(strlen)(str)) + 1;
 439     ASAN_READ_RANGE(str, bytes_read);
 440   }
 441   return result;
 442 }
 443
 444 #if ASAN_INTERCEPT_INDEX
 445 # if ASAN_USE_ALIAS_ATTRIBUTE_FOR_INDEX
 446 INTERCEPTOR(char*, index, const char *string, int c)
 447   ALIAS(WRAPPER_NAME(strchr));
 448 # else
 449 #  if SANITIZER_MAC
 450 DECLARE_REAL(char*, index, const char *string, int c)
 451 OVERRIDE_FUNCTION(index, strchr);
 452 #  else
 453 DEFINE_REAL(char*, index, const char *string, int c)
 454 #  endif
 455 # endif
 456 #endif  // ASAN_INTERCEPT_INDEX
 457
 458 // For both strcat() and strncat() we need to check the validity of |to|
 459 // argument irrespective of the |from| length.
 460 INTERCEPTOR(char*, strcat, char *to, const char *from) {  // NOLINT
 461   ENSURE_ASAN_INITED();
 462   if (flags()->replace_str) {
 463     uptr from_length = REAL(strlen)(from);
 464     ASAN_READ_RANGE(from, from_length + 1);
 465     uptr to_length = REAL(strlen)(to);
 466     ASAN_READ_RANGE(to, to_length);
 467     ASAN_WRITE_RANGE(to + to_length, from_length + 1);
 468     // If the copying actually happens, the |from| string should not overlap
 469     // with the resulting string starting at |to|, which has a length of
 470     // to_length + from_length + 1.
 471     if (from_length > 0) {
 472       CHECK_RANGES_OVERLAP("strcat", to, from_length + to_length + 1,
 473                            from, from_length + 1);
 474     }
 475   }
 476   return REAL(strcat)(to, from);  // NOLINT
 477 }
 478
 479 INTERCEPTOR(char*, strncat, char *to, const char *from, uptr size) {
 480   ENSURE_ASAN_INITED();
 481   if (flags()->replace_str) {
 482     uptr from_length = MaybeRealStrnlen(from, size);
 483     uptr copy_length = Min(size, from_length + 1);
 484     ASAN_READ_RANGE(from, copy_length);
 485     uptr to_length = REAL(strlen)(to);
 486     ASAN_READ_RANGE(to, to_length);
 487     ASAN_WRITE_RANGE(to + to_length, from_length + 1);
 488     if (from_length > 0) {
 489       CHECK_RANGES_OVERLAP("strncat", to, to_length + copy_length + 1,
 490                            from, copy_length);
 491     }
 492   }
 493   return REAL(strncat)(to, from, size);
 494 }
 495
 496 INTERCEPTOR(char*, strcpy, char *to, const char *from) {  // NOLINT
 497 #if SANITIZER_MAC
 498   if (UNLIKELY(!asan_inited)) return REAL(strcpy)(to, from);  // NOLINT
 499 #endif
 500   // strcpy is called from malloc_default_purgeable_zone()
 501   // in __asan::ReplaceSystemAlloc() on Mac.
 502   if (asan_init_is_running) {
 503     return REAL(strcpy)(to, from);  // NOLINT
 504   }
 505   ENSURE_ASAN_INITED();
 506   if (flags()->replace_str) {
 507     uptr from_size = REAL(strlen)(from) + 1;
 508     CHECK_RANGES_OVERLAP("strcpy", to, from_size, from, from_size);
 509     ASAN_READ_RANGE(from, from_size);
 510     ASAN_WRITE_RANGE(to, from_size);
 511   }
 512   return REAL(strcpy)(to, from);  // NOLINT
 513 }
 514
 515 #if ASAN_INTERCEPT_STRDUP
 516 INTERCEPTOR(char*, strdup, const char *s) {
 517   if (UNLIKELY(!asan_inited)) return internal_strdup(s);
 518   ENSURE_ASAN_INITED();
 519   uptr length = REAL(strlen)(s);
 520   if (flags()->replace_str) {
 521     ASAN_READ_RANGE(s, length + 1);
 522   }
 523   GET_STACK_TRACE_MALLOC;
 524   void *new_mem = asan_malloc(length + 1, &stack);
 525   REAL(memcpy)(new_mem, s, length + 1);
 526   return reinterpret_cast<char*>(new_mem);
 527 }
 528 #endif
 529
 530 INTERCEPTOR(uptr, strlen, const char *s) {
 531   if (UNLIKELY(!asan_inited)) return internal_strlen(s);
 532   // strlen is called from malloc_default_purgeable_zone()
 533   // in __asan::ReplaceSystemAlloc() on Mac.
 534   if (asan_init_is_running) {
 535     return REAL(strlen)(s);
 536   }
 537   ENSURE_ASAN_INITED();
 538   uptr length = REAL(strlen)(s);
 539   if (flags()->replace_str) {
 540     ASAN_READ_RANGE(s, length + 1);
 541   }
 542   return length;
 543 }
 544
 545 INTERCEPTOR(uptr, wcslen, const wchar_t *s) {
 546   uptr length = REAL(wcslen)(s);
 547   if (!asan_init_is_running) {
 548     ENSURE_ASAN_INITED();
 549     ASAN_READ_RANGE(s, (length + 1) * sizeof(wchar_t));
 550   }
 551   return length;
 552 }
 553
 554 INTERCEPTOR(char*, strncpy, char *to, const char *from, uptr size) {
 555   ENSURE_ASAN_INITED();
 556   if (flags()->replace_str) {
 557     uptr from_size = Min(size, MaybeRealStrnlen(from, size) + 1);
 558     CHECK_RANGES_OVERLAP("strncpy", to, from_size, from, from_size);
 559     ASAN_READ_RANGE(from, from_size);
 560     ASAN_WRITE_RANGE(to, size);
 561   }
 562   return REAL(strncpy)(to, from, size);
 563 }
 564
 565 #if ASAN_INTERCEPT_STRNLEN
 566 INTERCEPTOR(uptr, strnlen, const char *s, uptr maxlen) {
 567   ENSURE_ASAN_INITED();
 568   uptr length = REAL(strnlen)(s, maxlen);
 569   if (flags()->replace_str) {
 570     ASAN_READ_RANGE(s, Min(length + 1, maxlen));
 571   }
 572   return length;
 573 }
 574 #endif  // ASAN_INTERCEPT_STRNLEN
 575
 576 static inline bool IsValidStrtolBase(int base) {
 577   return (base == 0) || (2 <= base && base <= 36);
 578 }
 579
 580 static inline void FixRealStrtolEndptr(const char *nptr, char **endptr) {
 581   CHECK(endptr);
 582   if (nptr == *endptr) {
 583     // No digits were found at strtol call, we need to find out the last
 584     // symbol accessed by strtoll on our own.
 585     // We get this symbol by skipping leading blanks and optional +/- sign.
 586     while (IsSpace(*nptr)) nptr++;
 587     if (*nptr == '+' || *nptr == '-') nptr++;
 588     *endptr = (char*)nptr;
 589   }
 590   CHECK(*endptr >= nptr);
 591 }
 592
 593 INTERCEPTOR(long, strtol, const char *nptr,  // NOLINT
 594             char **endptr, int base) {
 595   ENSURE_ASAN_INITED();
 596   if (!flags()->replace_str) {
 597     return REAL(strtol)(nptr, endptr, base);
 598   }
 599   char *real_endptr;
 600   long result = REAL(strtol)(nptr, &real_endptr, base);  // NOLINT
 601   if (endptr != 0) {
 602     *endptr = real_endptr;
 603   }
 604   if (IsValidStrtolBase(base)) {
 605     FixRealStrtolEndptr(nptr, &real_endptr);
 606     ASAN_READ_RANGE(nptr, (real_endptr - nptr) + 1);
 607   }
 608   return result;
 609 }
 610
 611 INTERCEPTOR(int, atoi, const char *nptr) {
 612 #if SANITIZER_MAC
 613   if (UNLIKELY(!asan_inited)) return REAL(atoi)(nptr);
 614 #endif
 615   ENSURE_ASAN_INITED();
 616   if (!flags()->replace_str) {
 617     return REAL(atoi)(nptr);
 618   }
 619   char *real_endptr;
 620   // "man atoi" tells that behavior of atoi(nptr) is the same as
 621   // strtol(nptr, 0, 10), i.e. it sets errno to ERANGE if the
 622   // parsed integer can't be stored in *long* type (even if it's
 623   // different from int). So, we just imitate this behavior.
 624   int result = REAL(strtol)(nptr, &real_endptr, 10);
 625   FixRealStrtolEndptr(nptr, &real_endptr);
 626   ASAN_READ_RANGE(nptr, (real_endptr - nptr) + 1);
 627   return result;
 628 }
 629
 630 INTERCEPTOR(long, atol, const char *nptr) {  // NOLINT
 631 #if SANITIZER_MAC
 632   if (UNLIKELY(!asan_inited)) return REAL(atol)(nptr);
 633 #endif
 634   ENSURE_ASAN_INITED();
 635   if (!flags()->replace_str) {
 636     return REAL(atol)(nptr);
 637   }
 638   char *real_endptr;
 639   long result = REAL(strtol)(nptr, &real_endptr, 10);  // NOLINT
 640   FixRealStrtolEndptr(nptr, &real_endptr);
 641   ASAN_READ_RANGE(nptr, (real_endptr - nptr) + 1);
 642   return result;
 643 }
 644
 645 #if ASAN_INTERCEPT_ATOLL_AND_STRTOLL
 646 INTERCEPTOR(long long, strtoll, const char *nptr,  // NOLINT
 647             char **endptr, int base) {
 648   ENSURE_ASAN_INITED();
 649   if (!flags()->replace_str) {
 650     return REAL(strtoll)(nptr, endptr, base);
 651   }
 652   char *real_endptr;
 653   long long result = REAL(strtoll)(nptr, &real_endptr, base);  // NOLINT
 654   if (endptr != 0) {
 655     *endptr = real_endptr;
 656   }
 657   // If base has unsupported value, strtoll can exit with EINVAL
 658   // without reading any characters. So do additional checks only
 659   // if base is valid.
 660   if (IsValidStrtolBase(base)) {
 661     FixRealStrtolEndptr(nptr, &real_endptr);
 662     ASAN_READ_RANGE(nptr, (real_endptr - nptr) + 1);
 663   }
 664   return result;
 665 }
 666
 667 INTERCEPTOR(long long, atoll, const char *nptr) {  // NOLINT
 668   ENSURE_ASAN_INITED();
 669   if (!flags()->replace_str) {
 670     return REAL(atoll)(nptr);
 671   }
 672   char *real_endptr;
 673   long long result = REAL(strtoll)(nptr, &real_endptr, 10);  // NOLINT
 674   FixRealStrtolEndptr(nptr, &real_endptr);
 675   ASAN_READ_RANGE(nptr, (real_endptr - nptr) + 1);
 676   return result;
 677 }
 678 #endif  // ASAN_INTERCEPT_ATOLL_AND_STRTOLL
 679
 680 static void AtCxaAtexit(void *unused) {
 681   (void)unused;
 682   StopInitOrderChecking();
 683 }
 684
 685 #if ASAN_INTERCEPT___CXA_ATEXIT
 686 INTERCEPTOR(int, __cxa_atexit, void (*func)(void *), void *arg,
 687             void *dso_handle) {
 688 #if SANITIZER_MAC
 689   if (UNLIKELY(!asan_inited)) return REAL(__cxa_atexit)(func, arg, dso_handle);
 690 #endif
 691   ENSURE_ASAN_INITED();
 692   int res = REAL(__cxa_atexit)(func, arg, dso_handle);
 693   REAL(__cxa_atexit)(AtCxaAtexit, 0, 0);
 694   return res;
 695 }
 696 #endif  // ASAN_INTERCEPT___CXA_ATEXIT
 697
 698 #if SANITIZER_WINDOWS
 699 INTERCEPTOR_WINAPI(DWORD, CreateThread,
 700                    void* security, uptr stack_size,
 701                    DWORD (__stdcall *start_routine)(void*), void* arg,
 702                    DWORD thr_flags, void* tid) {
 703   // Strict init-order checking in thread-hostile.
 704   if (flags()->strict_init_order)
 705     StopInitOrderChecking();
 706   GET_STACK_TRACE_THREAD;
 707   u32 current_tid = GetCurrentTidOrInvalid();
 708   AsanThread *t = AsanThread::Create(start_routine, arg);
 709   CreateThreadContextArgs args = { t, &stack };
 710   bool detached = false;  // FIXME: how can we determine it on Windows?
 711   asanThreadRegistry().CreateThread(*(uptr*)t, detached, current_tid, &args);
 712   return REAL(CreateThread)(security, stack_size,
 713                             asan_thread_start, t, thr_flags, tid);
 714 }
 715
 716 namespace __asan {
 717 void InitializeWindowsInterceptors() {
 718   ASAN_INTERCEPT_FUNC(CreateThread);
 719 }
 720
 721 }  // namespace __asan
 722 #endif
 723
 724 // ---------------------- InitializeAsanInterceptors ---------------- {{{1
 725 namespace __asan {
 726 void InitializeAsanInterceptors() {
 727   static bool was_called_once;
 728   CHECK(was_called_once == false);
 729   was_called_once = true;
 730   InitializeCommonInterceptors();
 731
 732   // Intercept mem* functions.
 733   ASAN_INTERCEPT_FUNC(memcmp);
 734   ASAN_INTERCEPT_FUNC(memmove);
 735   ASAN_INTERCEPT_FUNC(memset);
 736   if (PLATFORM_HAS_DIFFERENT_MEMCPY_AND_MEMMOVE) {
 737     ASAN_INTERCEPT_FUNC(memcpy);
 738   }
 739
 740   // Intercept str* functions.
 741   ASAN_INTERCEPT_FUNC(strcat);  // NOLINT
 742   ASAN_INTERCEPT_FUNC(strchr);
 743   ASAN_INTERCEPT_FUNC(strcpy);  // NOLINT
 744   ASAN_INTERCEPT_FUNC(strlen);
 745   ASAN_INTERCEPT_FUNC(wcslen);
 746   ASAN_INTERCEPT_FUNC(strncat);
 747   ASAN_INTERCEPT_FUNC(strncpy);
 748 #if ASAN_INTERCEPT_STRDUP
 749   ASAN_INTERCEPT_FUNC(strdup);
 750 #endif
 751 #if ASAN_INTERCEPT_STRNLEN
 752   ASAN_INTERCEPT_FUNC(strnlen);
 753 #endif
 754 #if ASAN_INTERCEPT_INDEX && ASAN_USE_ALIAS_ATTRIBUTE_FOR_INDEX
 755   ASAN_INTERCEPT_FUNC(index);
 756 #endif
 757
 758   ASAN_INTERCEPT_FUNC(atoi);
 759   ASAN_INTERCEPT_FUNC(atol);
 760   ASAN_INTERCEPT_FUNC(strtol);
 761 #if ASAN_INTERCEPT_ATOLL_AND_STRTOLL
 762   ASAN_INTERCEPT_FUNC(atoll);
 763   ASAN_INTERCEPT_FUNC(strtoll);
 764 #endif
 765
 766 #if ASAN_INTERCEPT_MLOCKX
 767   // Intercept mlock/munlock.
 768   ASAN_INTERCEPT_FUNC(mlock);
 769   ASAN_INTERCEPT_FUNC(munlock);
 770   ASAN_INTERCEPT_FUNC(mlockall);
 771   ASAN_INTERCEPT_FUNC(munlockall);
 772 #endif
 773
 774   // Intecept signal- and jump-related functions.
 775   ASAN_INTERCEPT_FUNC(longjmp);
 776 #if ASAN_INTERCEPT_SIGNAL_AND_SIGACTION
 777   ASAN_INTERCEPT_FUNC(sigaction);
 778 #if SANITIZER_ANDROID
 779   ASAN_INTERCEPT_FUNC(bsd_signal);
 780 #else
 781   ASAN_INTERCEPT_FUNC(signal);
 782 #endif
 783 #endif
 784 #if ASAN_INTERCEPT_SWAPCONTEXT
 785   ASAN_INTERCEPT_FUNC(swapcontext);
 786 #endif
 787 #if ASAN_INTERCEPT__LONGJMP
 788   ASAN_INTERCEPT_FUNC(_longjmp);
 789 #endif
 790 #if ASAN_INTERCEPT_SIGLONGJMP
 791   ASAN_INTERCEPT_FUNC(siglongjmp);
 792 #endif
 793
 794   // Intercept exception handling functions.
 795 #if ASAN_INTERCEPT___CXA_THROW
 796   INTERCEPT_FUNCTION(__cxa_throw);
 797 #endif
 798
 799   // Intercept threading-related functions
 800 #if ASAN_INTERCEPT_PTHREAD_CREATE
 801   ASAN_INTERCEPT_FUNC(pthread_create);
 802 #endif
 803
 804   // Intercept atexit function.
 805 #if ASAN_INTERCEPT___CXA_ATEXIT
 806   ASAN_INTERCEPT_FUNC(__cxa_atexit);
 807 #endif
 808
 809   // Some Windows-specific interceptors.
 810 #if SANITIZER_WINDOWS
 811   InitializeWindowsInterceptors();
 812 #endif
 813
 814   VReport(1, "AddressSanitizer: libc interceptors initialized\n");
 815 }
 816
 817 }  // namespace __asan