libsanitizer/ubsan/ubsan_handlers_cxx.cc

   1 //===-- ubsan_handlers_cxx.cc ---------------------------------------------===//
   2 //
   3 // This file is distributed under the University of Illinois Open Source
   4 // License. See LICENSE.TXT for details.
   5 //
   6 //===----------------------------------------------------------------------===//
   7 //
   8 // Error logging entry points for the UBSan runtime, which are only used for C++
   9 // compilations. This file is permitted to use language features which require
  10 // linking against a C++ ABI library.
  11 //
  12 //===----------------------------------------------------------------------===//
  13
  14 #include "ubsan_platform.h"
  15 #if CAN_SANITIZE_UB
  16 #include "ubsan_handlers_cxx.h"
  17 #include "ubsan_diag.h"
  18 #include "ubsan_type_hash.h"
  19
  20 #include "sanitizer_common/sanitizer_common.h"
  21 #include "sanitizer_common/sanitizer_suppressions.h"
  22
  23 using namespace __sanitizer;
  24 using namespace __ubsan;
  25
  26 namespace __ubsan {
  27   extern const char *TypeCheckKinds[];
  28 }
  29
  30 static void HandleDynamicTypeCacheMiss(
  31     DynamicTypeCacheMissData *Data, ValueHandle Pointer, ValueHandle Hash,
  32     ReportOptions Opts) {
  33   if (checkDynamicType((void*)Pointer, Data->TypeInfo, Hash))
  34     // Just a cache miss. The type matches after all.
  35     return;
  36
  37   // Check if error report should be suppressed.
  38   DynamicTypeInfo DTI = getDynamicTypeInfoFromObject((void*)Pointer);
  39   if (DTI.isValid() && IsVptrCheckSuppressed(DTI.getMostDerivedTypeName()))
  40     return;
  41
  42   SourceLocation Loc = Data->Loc.acquire();
  43   if (Loc.isDisabled())
  44     return;
  45
  46   ScopedReport R(Opts, Loc, ErrorType::DynamicTypeMismatch);
  47
  48   Diag(Loc, DL_Error,
  49        "%0 address %1 which does not point to an object of type %2")
  50     << TypeCheckKinds[Data->TypeCheckKind] << (void*)Pointer << Data->Type;
  51
  52   // If possible, say what type it actually points to.
  53   if (!DTI.isValid())
  54     Diag(Pointer, DL_Note, "object has invalid vptr")
  55         << TypeName(DTI.getMostDerivedTypeName())
  56         << Range(Pointer, Pointer + sizeof(uptr), "invalid vptr");
  57   else if (!DTI.getOffset())
  58     Diag(Pointer, DL_Note, "object is of type %0")
  59         << TypeName(DTI.getMostDerivedTypeName())
  60         << Range(Pointer, Pointer + sizeof(uptr), "vptr for %0");
  61   else
  62     // FIXME: Find the type at the specified offset, and include that
  63     //        in the note.
  64     Diag(Pointer - DTI.getOffset(), DL_Note,
  65          "object is base class subobject at offset %0 within object of type %1")
  66         << DTI.getOffset() << TypeName(DTI.getMostDerivedTypeName())
  67         << TypeName(DTI.getSubobjectTypeName())
  68         << Range(Pointer, Pointer + sizeof(uptr),
  69                  "vptr for %2 base class of %1");
  70 }
  71
  72 void __ubsan::__ubsan_handle_dynamic_type_cache_miss(
  73     DynamicTypeCacheMissData *Data, ValueHandle Pointer, ValueHandle Hash) {
  74   GET_REPORT_OPTIONS(false);
  75   HandleDynamicTypeCacheMiss(Data, Pointer, Hash, Opts);
  76 }
  77 void __ubsan::__ubsan_handle_dynamic_type_cache_miss_abort(
  78     DynamicTypeCacheMissData *Data, ValueHandle Pointer, ValueHandle Hash) {
  79   GET_REPORT_OPTIONS(true);
  80   HandleDynamicTypeCacheMiss(Data, Pointer, Hash, Opts);
  81 }
  82
  83 static void HandleCFIBadType(CFIBadTypeData *Data, ValueHandle Vtable,
  84                              ReportOptions Opts) {
  85   SourceLocation Loc = Data->Loc.acquire();
  86   ScopedReport R(Opts, Loc, ErrorType::CFIBadType);
  87   DynamicTypeInfo DTI = getDynamicTypeInfoFromVtable((void*)Vtable);
  88
  89   static const char *TypeCheckKinds[] = {
  90     "virtual call",
  91     "non-virtual call",
  92     "base-to-derived cast",
  93     "cast to unrelated type",
  94   };
  95
  96   Diag(Loc, DL_Error, "control flow integrity check for type %0 failed during "
  97                       "%1 (vtable address %2)")
  98       << Data->Type << TypeCheckKinds[Data->TypeCheckKind] << (void *)Vtable;
  99
 100   // If possible, say what type it actually points to.
 101   if (!DTI.isValid())
 102     Diag(Vtable, DL_Note, "invalid vtable");
 103   else
 104     Diag(Vtable, DL_Note, "vtable is of type %0")
 105         << TypeName(DTI.getMostDerivedTypeName());
 106 }
 107
 108 void __ubsan::__ubsan_handle_cfi_bad_type(CFIBadTypeData *Data,
 109                                           ValueHandle Vtable) {
 110   GET_REPORT_OPTIONS(false);
 111   HandleCFIBadType(Data, Vtable, Opts);
 112 }
 113
 114 void __ubsan::__ubsan_handle_cfi_bad_type_abort(CFIBadTypeData *Data,
 115                                                 ValueHandle Vtable) {
 116   GET_REPORT_OPTIONS(true);
 117   HandleCFIBadType(Data, Vtable, Opts);
 118 }
 119
 120 #endif  // CAN_SANITIZE_UB