1 /* UndefinedBehaviorSanitizer, undefined behavior detector.
2 Copyright (C) 2013-2021 Free Software Foundation, Inc.
3 Contributed by Marek Polacek <polacek@redhat.com>
5 This file is part of GCC.
7 GCC is free software; you can redistribute it and/or modify it under
8 the terms of the GNU General Public License as published by the Free
9 Software Foundation; either version 3, or (at your option) any later
12 GCC is distributed in the hope that it will be useful, but WITHOUT ANY
13 WARRANTY; without even the implied warranty of MERCHANTABILITY or
14 FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
17 You should have received a copy of the GNU General Public License
18 along with GCC; see the file COPYING3. If not see
19 <http://www.gnu.org/licenses/>. */
23 #include "coretypes.h"
26 #include "c-family/c-common.h"
29 #include "tree-pass.h"
34 #include "tree-pretty-print.h"
35 #include "stor-layout.h"
37 #include "gimple-iterator.h"
42 #include "stringpool.h"
45 #include "gimplify-me.h"
48 #include "tree-object-size.h"
50 #include "gimple-fold.h"
53 /* Map from a tree to a VAR_DECL tree. */
55 struct GTY((for_user
)) tree_type_map
{
56 struct tree_map_base type
;
60 struct tree_type_map_cache_hasher
: ggc_cache_ptr_hash
<tree_type_map
>
62 static inline hashval_t
63 hash (tree_type_map
*t
)
65 return TYPE_UID (t
->type
.from
);
69 equal (tree_type_map
*a
, tree_type_map
*b
)
71 return a
->type
.from
== b
->type
.from
;
75 keep_cache_entry (tree_type_map
*&m
)
77 return ggc_marked_p (m
->type
.from
);
82 hash_table
<tree_type_map_cache_hasher
> *decl_tree_for_type
;
84 /* Lookup a VAR_DECL for TYPE, and return it if we find one. */
87 decl_for_type_lookup (tree type
)
89 /* If the hash table is not initialized yet, create it now. */
90 if (decl_tree_for_type
== NULL
)
93 = hash_table
<tree_type_map_cache_hasher
>::create_ggc (10);
94 /* That also means we don't have to bother with the lookup. */
98 struct tree_type_map
*h
, in
;
101 h
= decl_tree_for_type
->find_with_hash (&in
, TYPE_UID (type
));
102 return h
? h
->decl
: NULL_TREE
;
105 /* Insert a mapping TYPE->DECL in the VAR_DECL for type hashtable. */
108 decl_for_type_insert (tree type
, tree decl
)
110 struct tree_type_map
*h
;
112 h
= ggc_alloc
<tree_type_map
> ();
115 *decl_tree_for_type
->find_slot_with_hash (h
, TYPE_UID (type
), INSERT
) = h
;
118 /* Helper routine, which encodes a value in the pointer_sized_int_node.
119 Arguments with precision <= POINTER_SIZE are passed directly,
120 the rest is passed by reference. T is a value we are to encode.
121 PHASE determines when this function is called. */
124 ubsan_encode_value (tree t
, enum ubsan_encode_value_phase phase
)
126 tree type
= TREE_TYPE (t
);
127 scalar_mode mode
= SCALAR_TYPE_MODE (type
);
128 const unsigned int bitsize
= GET_MODE_BITSIZE (mode
);
129 if (bitsize
<= POINTER_SIZE
)
130 switch (TREE_CODE (type
))
135 return fold_build1 (NOP_EXPR
, pointer_sized_int_node
, t
);
138 tree itype
= build_nonstandard_integer_type (bitsize
, true);
139 t
= fold_build1 (VIEW_CONVERT_EXPR
, itype
, t
);
140 return fold_convert (pointer_sized_int_node
, t
);
147 if (!DECL_P (t
) || !TREE_ADDRESSABLE (t
))
149 /* The reason for this is that we don't want to pessimize
150 code by making vars unnecessarily addressable. */
152 if (phase
!= UBSAN_ENCODE_VALUE_GENERIC
)
154 var
= create_tmp_var (type
);
155 mark_addressable (var
);
159 var
= create_tmp_var_raw (type
);
160 TREE_ADDRESSABLE (var
) = 1;
161 DECL_CONTEXT (var
) = current_function_decl
;
163 if (phase
== UBSAN_ENCODE_VALUE_RTL
)
165 rtx mem
= assign_stack_temp_for_type (mode
, GET_MODE_SIZE (mode
),
167 SET_DECL_RTL (var
, mem
);
168 expand_assignment (var
, t
, false);
169 return build_fold_addr_expr (var
);
171 if (phase
!= UBSAN_ENCODE_VALUE_GENERIC
)
173 tree tem
= build2 (MODIFY_EXPR
, void_type_node
, var
, t
);
174 t
= build_fold_addr_expr (var
);
175 return build2 (COMPOUND_EXPR
, TREE_TYPE (t
), tem
, t
);
179 var
= build4 (TARGET_EXPR
, type
, var
, t
, NULL_TREE
, NULL_TREE
);
180 return build_fold_addr_expr (var
);
184 return build_fold_addr_expr (t
);
188 /* Cached ubsan_get_type_descriptor_type () return value. */
189 static GTY(()) tree ubsan_type_descriptor_type
;
192 struct __ubsan_type_descriptor
194 unsigned short __typekind;
195 unsigned short __typeinfo;
201 ubsan_get_type_descriptor_type (void)
203 static const char *field_names
[3]
204 = { "__typekind", "__typeinfo", "__typename" };
207 if (ubsan_type_descriptor_type
)
208 return ubsan_type_descriptor_type
;
210 tree itype
= build_range_type (sizetype
, size_zero_node
, NULL_TREE
);
211 tree flex_arr_type
= build_array_type (char_type_node
, itype
);
213 ret
= make_node (RECORD_TYPE
);
214 for (int i
= 0; i
< 3; i
++)
216 fields
[i
] = build_decl (UNKNOWN_LOCATION
, FIELD_DECL
,
217 get_identifier (field_names
[i
]),
218 (i
== 2) ? flex_arr_type
219 : short_unsigned_type_node
);
220 DECL_CONTEXT (fields
[i
]) = ret
;
222 DECL_CHAIN (fields
[i
- 1]) = fields
[i
];
224 tree type_decl
= build_decl (input_location
, TYPE_DECL
,
225 get_identifier ("__ubsan_type_descriptor"),
227 DECL_IGNORED_P (type_decl
) = 1;
228 DECL_ARTIFICIAL (type_decl
) = 1;
229 TYPE_FIELDS (ret
) = fields
[0];
230 TYPE_NAME (ret
) = type_decl
;
231 TYPE_STUB_DECL (ret
) = type_decl
;
232 TYPE_ARTIFICIAL (ret
) = 1;
234 ubsan_type_descriptor_type
= ret
;
238 /* Cached ubsan_get_source_location_type () return value. */
239 static GTY(()) tree ubsan_source_location_type
;
242 struct __ubsan_source_location
244 const char *__filename;
246 unsigned int __column;
251 ubsan_get_source_location_type (void)
253 static const char *field_names
[3]
254 = { "__filename", "__line", "__column" };
256 if (ubsan_source_location_type
)
257 return ubsan_source_location_type
;
259 tree const_char_type
= build_qualified_type (char_type_node
,
262 ret
= make_node (RECORD_TYPE
);
263 for (int i
= 0; i
< 3; i
++)
265 fields
[i
] = build_decl (UNKNOWN_LOCATION
, FIELD_DECL
,
266 get_identifier (field_names
[i
]),
267 (i
== 0) ? build_pointer_type (const_char_type
)
268 : unsigned_type_node
);
269 DECL_CONTEXT (fields
[i
]) = ret
;
271 DECL_CHAIN (fields
[i
- 1]) = fields
[i
];
273 tree type_decl
= build_decl (input_location
, TYPE_DECL
,
274 get_identifier ("__ubsan_source_location"),
276 DECL_IGNORED_P (type_decl
) = 1;
277 DECL_ARTIFICIAL (type_decl
) = 1;
278 TYPE_FIELDS (ret
) = fields
[0];
279 TYPE_NAME (ret
) = type_decl
;
280 TYPE_STUB_DECL (ret
) = type_decl
;
281 TYPE_ARTIFICIAL (ret
) = 1;
283 ubsan_source_location_type
= ret
;
287 /* Helper routine that returns a CONSTRUCTOR of __ubsan_source_location
288 type with its fields filled from a location_t LOC. */
291 ubsan_source_location (location_t loc
)
293 expanded_location xloc
;
294 tree type
= ubsan_get_source_location_type ();
296 xloc
= expand_location (loc
);
298 if (xloc
.file
== NULL
)
300 str
= build_int_cst (ptr_type_node
, 0);
306 /* Fill in the values from LOC. */
307 size_t len
= strlen (xloc
.file
) + 1;
308 str
= build_string (len
, xloc
.file
);
309 TREE_TYPE (str
) = build_array_type_nelts (char_type_node
, len
);
310 TREE_READONLY (str
) = 1;
311 TREE_STATIC (str
) = 1;
312 str
= build_fold_addr_expr (str
);
314 tree ctor
= build_constructor_va (type
, 3, NULL_TREE
, str
, NULL_TREE
,
315 build_int_cst (unsigned_type_node
,
316 xloc
.line
), NULL_TREE
,
317 build_int_cst (unsigned_type_node
,
319 TREE_CONSTANT (ctor
) = 1;
320 TREE_STATIC (ctor
) = 1;
325 /* This routine returns a magic number for TYPE. */
327 static unsigned short
328 get_ubsan_type_info_for_type (tree type
)
330 if (TREE_CODE (type
) == REAL_TYPE
)
331 return tree_to_uhwi (TYPE_SIZE (type
));
332 else if (INTEGRAL_TYPE_P (type
))
334 int prec
= exact_log2 (tree_to_uhwi (TYPE_SIZE (type
)));
335 gcc_assert (prec
!= -1);
336 return (prec
<< 1) | !TYPE_UNSIGNED (type
);
342 /* Counters for internal labels. ubsan_ids[0] for Lubsan_type,
343 ubsan_ids[1] for Lubsan_data labels. */
344 static GTY(()) unsigned int ubsan_ids
[2];
346 /* Helper routine that returns ADDR_EXPR of a VAR_DECL of a type
347 descriptor. It first looks into the hash table; if not found,
348 create the VAR_DECL, put it into the hash table and return the
349 ADDR_EXPR of it. TYPE describes a particular type. PSTYLE is
350 an enum controlling how we want to print the type. */
353 ubsan_type_descriptor (tree type
, enum ubsan_print_style pstyle
)
355 /* See through any typedefs. */
356 type
= TYPE_MAIN_VARIANT (type
);
358 tree decl
= decl_for_type_lookup (type
);
359 /* It is possible that some of the earlier created DECLs were found
360 unused, in that case they weren't emitted and varpool_node::get
361 returns NULL node on them. But now we really need them. Thus,
363 if (decl
!= NULL_TREE
&& varpool_node::get (decl
))
364 return build_fold_addr_expr (decl
);
366 tree dtype
= ubsan_get_type_descriptor_type ();
368 const char *tname
= NULL
;
369 pretty_printer pretty_name
;
370 unsigned char deref_depth
= 0;
371 unsigned short tkind
, tinfo
;
373 /* Get the name of the type, or the name of the pointer type. */
374 if (pstyle
== UBSAN_PRINT_POINTER
)
376 gcc_assert (POINTER_TYPE_P (type
));
377 type2
= TREE_TYPE (type
);
379 /* Remove any '*' operators from TYPE. */
380 while (POINTER_TYPE_P (type2
))
381 deref_depth
++, type2
= TREE_TYPE (type2
);
383 if (TREE_CODE (type2
) == METHOD_TYPE
)
384 type2
= TYPE_METHOD_BASETYPE (type2
);
387 /* If an array, get its type. */
388 type2
= strip_array_types (type2
);
390 if (pstyle
== UBSAN_PRINT_ARRAY
)
392 while (POINTER_TYPE_P (type2
))
393 deref_depth
++, type2
= TREE_TYPE (type2
);
396 if (TYPE_NAME (type2
) != NULL
)
398 if (TREE_CODE (TYPE_NAME (type2
)) == IDENTIFIER_NODE
)
399 tname
= IDENTIFIER_POINTER (TYPE_NAME (type2
));
400 else if (DECL_NAME (TYPE_NAME (type2
)) != NULL
)
401 tname
= IDENTIFIER_POINTER (DECL_NAME (TYPE_NAME (type2
)));
405 /* We weren't able to determine the type name. */
408 pp_quote (&pretty_name
);
411 if (pstyle
== UBSAN_PRINT_POINTER
)
413 pp_printf (&pretty_name
, "%s%s%s%s%s%s%s",
414 TYPE_VOLATILE (type2
) ? "volatile " : "",
415 TYPE_READONLY (type2
) ? "const " : "",
416 TYPE_RESTRICT (type2
) ? "restrict " : "",
417 TYPE_ATOMIC (type2
) ? "_Atomic " : "",
418 TREE_CODE (type2
) == RECORD_TYPE
420 : TREE_CODE (type2
) == UNION_TYPE
421 ? "union " : "", tname
,
422 deref_depth
== 0 ? "" : " ");
423 while (deref_depth
-- > 0)
424 pp_star (&pretty_name
);
426 else if (pstyle
== UBSAN_PRINT_ARRAY
)
428 /* Pretty print the array dimensions. */
429 gcc_assert (TREE_CODE (type
) == ARRAY_TYPE
);
431 pp_string (&pretty_name
, tname
);
432 pp_space (&pretty_name
);
433 while (deref_depth
-- > 0)
434 pp_star (&pretty_name
);
435 while (TREE_CODE (t
) == ARRAY_TYPE
)
437 pp_left_bracket (&pretty_name
);
438 tree dom
= TYPE_DOMAIN (t
);
440 && TYPE_MAX_VALUE (dom
) != NULL_TREE
441 && TREE_CODE (TYPE_MAX_VALUE (dom
)) == INTEGER_CST
)
443 unsigned HOST_WIDE_INT m
;
444 if (tree_fits_uhwi_p (TYPE_MAX_VALUE (dom
))
445 && (m
= tree_to_uhwi (TYPE_MAX_VALUE (dom
))) + 1 != 0)
446 pp_unsigned_wide_integer (&pretty_name
, m
+ 1);
448 pp_wide_int (&pretty_name
,
449 wi::add (wi::to_widest (TYPE_MAX_VALUE (dom
)), 1),
450 TYPE_SIGN (TREE_TYPE (dom
)));
453 /* ??? We can't determine the variable name; print VLA unspec. */
454 pp_star (&pretty_name
);
455 pp_right_bracket (&pretty_name
);
459 /* Save the tree with stripped types. */
463 pp_string (&pretty_name
, tname
);
465 pp_quote (&pretty_name
);
467 switch (TREE_CODE (eltype
))
475 /* FIXME: libubsan right now only supports float, double and
476 long double type formats. */
477 if (TYPE_MODE (eltype
) == TYPE_MODE (float_type_node
)
478 || TYPE_MODE (eltype
) == TYPE_MODE (double_type_node
)
479 || TYPE_MODE (eltype
) == TYPE_MODE (long_double_type_node
))
488 tinfo
= get_ubsan_type_info_for_type (eltype
);
490 /* Create a new VAR_DECL of type descriptor. */
491 const char *tmp
= pp_formatted_text (&pretty_name
);
492 size_t len
= strlen (tmp
) + 1;
493 tree str
= build_string (len
, tmp
);
494 TREE_TYPE (str
) = build_array_type_nelts (char_type_node
, len
);
495 TREE_READONLY (str
) = 1;
496 TREE_STATIC (str
) = 1;
499 ASM_GENERATE_INTERNAL_LABEL (tmp_name
, "Lubsan_type", ubsan_ids
[0]++);
500 decl
= build_decl (UNKNOWN_LOCATION
, VAR_DECL
, get_identifier (tmp_name
),
502 TREE_STATIC (decl
) = 1;
503 TREE_PUBLIC (decl
) = 0;
504 DECL_ARTIFICIAL (decl
) = 1;
505 DECL_IGNORED_P (decl
) = 1;
506 DECL_EXTERNAL (decl
) = 0;
508 = size_binop (PLUS_EXPR
, DECL_SIZE (decl
), TYPE_SIZE (TREE_TYPE (str
)));
509 DECL_SIZE_UNIT (decl
)
510 = size_binop (PLUS_EXPR
, DECL_SIZE_UNIT (decl
),
511 TYPE_SIZE_UNIT (TREE_TYPE (str
)));
513 tree ctor
= build_constructor_va (dtype
, 3, NULL_TREE
,
514 build_int_cst (short_unsigned_type_node
,
516 build_int_cst (short_unsigned_type_node
,
517 tinfo
), NULL_TREE
, str
);
518 TREE_CONSTANT (ctor
) = 1;
519 TREE_STATIC (ctor
) = 1;
520 DECL_INITIAL (decl
) = ctor
;
521 varpool_node::finalize_decl (decl
);
523 /* Save the VAR_DECL into the hash table. */
524 decl_for_type_insert (type
, decl
);
526 return build_fold_addr_expr (decl
);
529 /* Create a structure for the ubsan library. NAME is a name of the new
530 structure. LOCCNT is number of locations, PLOC points to array of
531 locations. The arguments in ... are of __ubsan_type_descriptor type
532 and there are at most two of them, followed by NULL_TREE, followed
533 by optional extra arguments and another NULL_TREE. */
536 ubsan_create_data (const char *name
, int loccnt
, const location_t
*ploc
, ...)
541 vec
<tree
, va_gc
> *saved_args
= NULL
;
545 /* It is possible that PCH zapped table with definitions of sanitizer
546 builtins. Reinitialize them if needed. */
547 initialize_sanitizer_builtins ();
549 /* Firstly, create a pointer to type descriptor type. */
550 tree td_type
= ubsan_get_type_descriptor_type ();
551 td_type
= build_pointer_type (td_type
);
553 /* Create the structure type. */
554 ret
= make_node (RECORD_TYPE
);
555 for (j
= 0; j
< loccnt
; j
++)
557 gcc_checking_assert (i
< 2);
558 fields
[i
] = build_decl (UNKNOWN_LOCATION
, FIELD_DECL
, NULL_TREE
,
559 ubsan_get_source_location_type ());
560 DECL_CONTEXT (fields
[i
]) = ret
;
562 DECL_CHAIN (fields
[i
- 1]) = fields
[i
];
566 va_start (args
, ploc
);
567 for (t
= va_arg (args
, tree
); t
!= NULL_TREE
;
568 i
++, t
= va_arg (args
, tree
))
570 gcc_checking_assert (i
< 4);
571 /* Save the tree arguments for later use. */
572 vec_safe_push (saved_args
, t
);
573 fields
[i
] = build_decl (UNKNOWN_LOCATION
, FIELD_DECL
, NULL_TREE
,
575 DECL_CONTEXT (fields
[i
]) = ret
;
577 DECL_CHAIN (fields
[i
- 1]) = fields
[i
];
580 for (t
= va_arg (args
, tree
); t
!= NULL_TREE
;
581 i
++, t
= va_arg (args
, tree
))
583 gcc_checking_assert (i
< 6);
584 /* Save the tree arguments for later use. */
585 vec_safe_push (saved_args
, t
);
586 fields
[i
] = build_decl (UNKNOWN_LOCATION
, FIELD_DECL
, NULL_TREE
,
588 DECL_CONTEXT (fields
[i
]) = ret
;
590 DECL_CHAIN (fields
[i
- 1]) = fields
[i
];
594 tree type_decl
= build_decl (input_location
, TYPE_DECL
,
595 get_identifier (name
), ret
);
596 DECL_IGNORED_P (type_decl
) = 1;
597 DECL_ARTIFICIAL (type_decl
) = 1;
598 TYPE_FIELDS (ret
) = fields
[0];
599 TYPE_NAME (ret
) = type_decl
;
600 TYPE_STUB_DECL (ret
) = type_decl
;
601 TYPE_ARTIFICIAL (ret
) = 1;
604 /* Now, fill in the type. */
606 ASM_GENERATE_INTERNAL_LABEL (tmp_name
, "Lubsan_data", ubsan_ids
[1]++);
607 tree var
= build_decl (UNKNOWN_LOCATION
, VAR_DECL
, get_identifier (tmp_name
),
609 TREE_STATIC (var
) = 1;
610 TREE_PUBLIC (var
) = 0;
611 DECL_ARTIFICIAL (var
) = 1;
612 DECL_IGNORED_P (var
) = 1;
613 DECL_EXTERNAL (var
) = 0;
615 vec
<constructor_elt
, va_gc
> *v
;
617 tree ctor
= build_constructor (ret
, v
);
619 /* If desirable, set the __ubsan_source_location element. */
620 for (j
= 0; j
< loccnt
; j
++)
622 location_t loc
= LOCATION_LOCUS (ploc
[j
]);
623 CONSTRUCTOR_APPEND_ELT (v
, NULL_TREE
, ubsan_source_location (loc
));
626 size_t nelts
= vec_safe_length (saved_args
);
627 for (i
= 0; i
< nelts
; i
++)
629 t
= (*saved_args
)[i
];
630 CONSTRUCTOR_APPEND_ELT (v
, NULL_TREE
, t
);
633 TREE_CONSTANT (ctor
) = 1;
634 TREE_STATIC (ctor
) = 1;
635 DECL_INITIAL (var
) = ctor
;
636 varpool_node::finalize_decl (var
);
641 /* Instrument the __builtin_unreachable call. We just call the libubsan
645 ubsan_instrument_unreachable (gimple_stmt_iterator
*gsi
)
648 location_t loc
= gimple_location (gsi_stmt (*gsi
));
650 if (flag_sanitize_undefined_trap_on_error
)
651 g
= gimple_build_call (builtin_decl_explicit (BUILT_IN_TRAP
), 0);
654 tree data
= ubsan_create_data ("__ubsan_unreachable_data", 1, &loc
,
655 NULL_TREE
, NULL_TREE
);
656 data
= build_fold_addr_expr_loc (loc
, data
);
658 = builtin_decl_explicit (BUILT_IN_UBSAN_HANDLE_BUILTIN_UNREACHABLE
);
659 g
= gimple_build_call (fn
, 1, data
);
661 gimple_set_location (g
, loc
);
662 gsi_replace (gsi
, g
, false);
666 /* Return true if T is a call to a libubsan routine. */
669 is_ubsan_builtin_p (tree t
)
671 return TREE_CODE (t
) == FUNCTION_DECL
672 && fndecl_built_in_p (t
, BUILT_IN_NORMAL
)
673 && strncmp (IDENTIFIER_POINTER (DECL_NAME (t
)),
674 "__builtin___ubsan_", 18) == 0;
677 /* Create a callgraph edge for statement STMT. */
680 ubsan_create_edge (gimple
*stmt
)
682 gcall
*call_stmt
= dyn_cast
<gcall
*> (stmt
);
683 basic_block bb
= gimple_bb (stmt
);
684 cgraph_node
*node
= cgraph_node::get (current_function_decl
);
685 tree decl
= gimple_call_fndecl (call_stmt
);
687 node
->create_edge (cgraph_node::get_create (decl
), call_stmt
, bb
->count
);
690 /* Expand the UBSAN_BOUNDS special builtin function. */
693 ubsan_expand_bounds_ifn (gimple_stmt_iterator
*gsi
)
695 gimple
*stmt
= gsi_stmt (*gsi
);
696 location_t loc
= gimple_location (stmt
);
697 gcc_assert (gimple_call_num_args (stmt
) == 3);
699 /* Pick up the arguments of the UBSAN_BOUNDS call. */
700 tree type
= TREE_TYPE (TREE_TYPE (gimple_call_arg (stmt
, 0)));
701 tree index
= gimple_call_arg (stmt
, 1);
702 tree orig_index
= index
;
703 tree bound
= gimple_call_arg (stmt
, 2);
705 gimple_stmt_iterator gsi_orig
= *gsi
;
707 /* Create condition "if (index > bound)". */
708 basic_block then_bb
, fallthru_bb
;
709 gimple_stmt_iterator cond_insert_point
710 = create_cond_insert_point (gsi
, false, false, true,
711 &then_bb
, &fallthru_bb
);
712 index
= fold_convert (TREE_TYPE (bound
), index
);
713 index
= force_gimple_operand_gsi (&cond_insert_point
, index
,
715 false, GSI_NEW_STMT
);
716 gimple
*g
= gimple_build_cond (GT_EXPR
, index
, bound
, NULL_TREE
, NULL_TREE
);
717 gimple_set_location (g
, loc
);
718 gsi_insert_after (&cond_insert_point
, g
, GSI_NEW_STMT
);
720 /* Generate __ubsan_handle_out_of_bounds call. */
721 *gsi
= gsi_after_labels (then_bb
);
722 if (flag_sanitize_undefined_trap_on_error
)
723 g
= gimple_build_call (builtin_decl_explicit (BUILT_IN_TRAP
), 0);
727 = ubsan_create_data ("__ubsan_out_of_bounds_data", 1, &loc
,
728 ubsan_type_descriptor (type
, UBSAN_PRINT_ARRAY
),
729 ubsan_type_descriptor (TREE_TYPE (orig_index
)),
730 NULL_TREE
, NULL_TREE
);
731 data
= build_fold_addr_expr_loc (loc
, data
);
732 enum built_in_function bcode
733 = (flag_sanitize_recover
& SANITIZE_BOUNDS
)
734 ? BUILT_IN_UBSAN_HANDLE_OUT_OF_BOUNDS
735 : BUILT_IN_UBSAN_HANDLE_OUT_OF_BOUNDS_ABORT
;
736 tree fn
= builtin_decl_explicit (bcode
);
737 tree val
= ubsan_encode_value (orig_index
, UBSAN_ENCODE_VALUE_GIMPLE
);
738 val
= force_gimple_operand_gsi (gsi
, val
, true, NULL_TREE
, true,
740 g
= gimple_build_call (fn
, 2, data
, val
);
742 gimple_set_location (g
, loc
);
743 gsi_insert_before (gsi
, g
, GSI_SAME_STMT
);
745 /* Get rid of the UBSAN_BOUNDS call from the IR. */
746 unlink_stmt_vdef (stmt
);
747 gsi_remove (&gsi_orig
, true);
749 /* Point GSI to next logical statement. */
750 *gsi
= gsi_start_bb (fallthru_bb
);
754 /* Expand UBSAN_NULL internal call. The type is kept on the ckind
755 argument which is a constant, because the middle-end treats pointer
756 conversions as useless and therefore the type of the first argument
757 could be changed to any other pointer type. */
760 ubsan_expand_null_ifn (gimple_stmt_iterator
*gsip
)
762 gimple_stmt_iterator gsi
= *gsip
;
763 gimple
*stmt
= gsi_stmt (gsi
);
764 location_t loc
= gimple_location (stmt
);
765 gcc_assert (gimple_call_num_args (stmt
) == 3);
766 tree ptr
= gimple_call_arg (stmt
, 0);
767 tree ckind
= gimple_call_arg (stmt
, 1);
768 tree align
= gimple_call_arg (stmt
, 2);
769 tree check_align
= NULL_TREE
;
772 basic_block cur_bb
= gsi_bb (gsi
);
775 if (!integer_zerop (align
))
777 unsigned int ptralign
= get_pointer_alignment (ptr
) / BITS_PER_UNIT
;
778 if (compare_tree_int (align
, ptralign
) == 1)
780 check_align
= make_ssa_name (pointer_sized_int_node
);
781 g
= gimple_build_assign (check_align
, NOP_EXPR
, ptr
);
782 gimple_set_location (g
, loc
);
783 gsi_insert_before (&gsi
, g
, GSI_SAME_STMT
);
786 check_null
= sanitize_flags_p (SANITIZE_NULL
);
788 if (check_align
== NULL_TREE
&& !check_null
)
790 gsi_remove (gsip
, true);
791 /* Unlink the UBSAN_NULLs vops before replacing it. */
792 unlink_stmt_vdef (stmt
);
796 /* Split the original block holding the pointer dereference. */
797 edge e
= split_block (cur_bb
, stmt
);
799 /* Get a hold on the 'condition block', the 'then block' and the
801 basic_block cond_bb
= e
->src
;
802 basic_block fallthru_bb
= e
->dest
;
803 basic_block then_bb
= create_empty_bb (cond_bb
);
804 add_bb_to_loop (then_bb
, cond_bb
->loop_father
);
805 loops_state_set (LOOPS_NEED_FIXUP
);
807 /* Make an edge coming from the 'cond block' into the 'then block';
808 this edge is unlikely taken, so set up the probability accordingly. */
809 e
= make_edge (cond_bb
, then_bb
, EDGE_TRUE_VALUE
);
810 e
->probability
= profile_probability::very_unlikely ();
811 then_bb
->count
= e
->count ();
813 /* Connect 'then block' with the 'else block'. This is needed
814 as the ubsan routines we call in the 'then block' are not noreturn.
815 The 'then block' only has one outcoming edge. */
816 make_single_succ_edge (then_bb
, fallthru_bb
, EDGE_FALLTHRU
);
818 /* Set up the fallthrough basic block. */
819 e
= find_edge (cond_bb
, fallthru_bb
);
820 e
->flags
= EDGE_FALSE_VALUE
;
821 e
->probability
= profile_probability::very_likely ();
823 /* Update dominance info for the newly created then_bb; note that
824 fallthru_bb's dominance info has already been updated by
826 if (dom_info_available_p (CDI_DOMINATORS
))
827 set_immediate_dominator (CDI_DOMINATORS
, then_bb
, cond_bb
);
829 /* Put the ubsan builtin call into the newly created BB. */
830 if (flag_sanitize_undefined_trap_on_error
)
831 g
= gimple_build_call (builtin_decl_implicit (BUILT_IN_TRAP
), 0);
834 enum built_in_function bcode
835 = (flag_sanitize_recover
& ((check_align
? SANITIZE_ALIGNMENT
: 0)
836 | (check_null
? SANITIZE_NULL
: 0)))
837 ? BUILT_IN_UBSAN_HANDLE_TYPE_MISMATCH_V1
838 : BUILT_IN_UBSAN_HANDLE_TYPE_MISMATCH_V1_ABORT
;
839 tree fn
= builtin_decl_implicit (bcode
);
840 int align_log
= tree_log2 (align
);
842 = ubsan_create_data ("__ubsan_null_data", 1, &loc
,
843 ubsan_type_descriptor (TREE_TYPE (ckind
),
844 UBSAN_PRINT_POINTER
),
846 build_int_cst (unsigned_char_type_node
,
848 fold_convert (unsigned_char_type_node
, ckind
),
850 data
= build_fold_addr_expr_loc (loc
, data
);
851 g
= gimple_build_call (fn
, 2, data
,
852 check_align
? check_align
853 : build_zero_cst (pointer_sized_int_node
));
855 gimple_stmt_iterator gsi2
= gsi_start_bb (then_bb
);
856 gimple_set_location (g
, loc
);
857 gsi_insert_after (&gsi2
, g
, GSI_NEW_STMT
);
859 /* Unlink the UBSAN_NULLs vops before replacing it. */
860 unlink_stmt_vdef (stmt
);
864 g
= gimple_build_cond (EQ_EXPR
, ptr
, build_int_cst (TREE_TYPE (ptr
), 0),
865 NULL_TREE
, NULL_TREE
);
866 gimple_set_location (g
, loc
);
868 /* Replace the UBSAN_NULL with a GIMPLE_COND stmt. */
869 gsi_replace (&gsi
, g
, false);
877 /* Split the block with the condition again. */
878 e
= split_block (cond_bb
, stmt
);
879 basic_block cond1_bb
= e
->src
;
880 basic_block cond2_bb
= e
->dest
;
882 /* Make an edge coming from the 'cond1 block' into the 'then block';
883 this edge is unlikely taken, so set up the probability
885 e
= make_edge (cond1_bb
, then_bb
, EDGE_TRUE_VALUE
);
886 e
->probability
= profile_probability::very_unlikely ();
888 /* Set up the fallthrough basic block. */
889 e
= find_edge (cond1_bb
, cond2_bb
);
890 e
->flags
= EDGE_FALSE_VALUE
;
891 e
->probability
= profile_probability::very_likely ();
893 /* Update dominance info. */
894 if (dom_info_available_p (CDI_DOMINATORS
))
896 set_immediate_dominator (CDI_DOMINATORS
, fallthru_bb
, cond1_bb
);
897 set_immediate_dominator (CDI_DOMINATORS
, then_bb
, cond1_bb
);
900 gsi2
= gsi_start_bb (cond2_bb
);
903 tree mask
= build_int_cst (pointer_sized_int_node
,
904 tree_to_uhwi (align
) - 1);
905 g
= gimple_build_assign (make_ssa_name (pointer_sized_int_node
),
906 BIT_AND_EXPR
, check_align
, mask
);
907 gimple_set_location (g
, loc
);
909 gsi_insert_after (&gsi2
, g
, GSI_NEW_STMT
);
911 gsi_insert_before (&gsi
, g
, GSI_SAME_STMT
);
913 g
= gimple_build_cond (NE_EXPR
, gimple_assign_lhs (g
),
914 build_int_cst (pointer_sized_int_node
, 0),
915 NULL_TREE
, NULL_TREE
);
916 gimple_set_location (g
, loc
);
918 gsi_insert_after (&gsi2
, g
, GSI_NEW_STMT
);
920 /* Replace the UBSAN_NULL with a GIMPLE_COND stmt. */
921 gsi_replace (&gsi
, g
, false);
926 #define OBJSZ_MAX_OFFSET (1024 * 16)
928 /* Expand UBSAN_OBJECT_SIZE internal call. */
931 ubsan_expand_objsize_ifn (gimple_stmt_iterator
*gsi
)
933 gimple
*stmt
= gsi_stmt (*gsi
);
934 location_t loc
= gimple_location (stmt
);
935 gcc_assert (gimple_call_num_args (stmt
) == 4);
937 tree ptr
= gimple_call_arg (stmt
, 0);
938 tree offset
= gimple_call_arg (stmt
, 1);
939 tree size
= gimple_call_arg (stmt
, 2);
940 tree ckind
= gimple_call_arg (stmt
, 3);
941 gimple_stmt_iterator gsi_orig
= *gsi
;
944 /* See if we can discard the check. */
945 if (TREE_CODE (size
) != INTEGER_CST
946 || integer_all_onesp (size
))
947 /* Yes, __builtin_object_size couldn't determine the
949 else if (TREE_CODE (offset
) == INTEGER_CST
950 && wi::to_widest (offset
) >= -OBJSZ_MAX_OFFSET
951 && wi::to_widest (offset
) <= -1)
952 /* The offset is in range [-16K, -1]. */;
955 /* if (offset > objsize) */
956 basic_block then_bb
, fallthru_bb
;
957 gimple_stmt_iterator cond_insert_point
958 = create_cond_insert_point (gsi
, false, false, true,
959 &then_bb
, &fallthru_bb
);
960 g
= gimple_build_cond (GT_EXPR
, offset
, size
, NULL_TREE
, NULL_TREE
);
961 gimple_set_location (g
, loc
);
962 gsi_insert_after (&cond_insert_point
, g
, GSI_NEW_STMT
);
964 /* If the offset is small enough, we don't need the second
966 if (TREE_CODE (offset
) == INTEGER_CST
967 && wi::to_widest (offset
) >= 0
968 && wi::to_widest (offset
) <= OBJSZ_MAX_OFFSET
)
969 *gsi
= gsi_after_labels (then_bb
);
972 /* Don't issue run-time error if (ptr > ptr + offset). That
973 may happen when computing a POINTER_PLUS_EXPR. */
974 basic_block then2_bb
, fallthru2_bb
;
976 gimple_stmt_iterator gsi2
= gsi_after_labels (then_bb
);
977 cond_insert_point
= create_cond_insert_point (&gsi2
, false, false,
980 /* Convert the pointer to an integer type. */
981 tree p
= make_ssa_name (pointer_sized_int_node
);
982 g
= gimple_build_assign (p
, NOP_EXPR
, ptr
);
983 gimple_set_location (g
, loc
);
984 gsi_insert_before (&cond_insert_point
, g
, GSI_NEW_STMT
);
985 p
= gimple_assign_lhs (g
);
986 /* Compute ptr + offset. */
987 g
= gimple_build_assign (make_ssa_name (pointer_sized_int_node
),
988 PLUS_EXPR
, p
, offset
);
989 gimple_set_location (g
, loc
);
990 gsi_insert_after (&cond_insert_point
, g
, GSI_NEW_STMT
);
991 /* Now build the conditional and put it into the IR. */
992 g
= gimple_build_cond (LE_EXPR
, p
, gimple_assign_lhs (g
),
993 NULL_TREE
, NULL_TREE
);
994 gimple_set_location (g
, loc
);
995 gsi_insert_after (&cond_insert_point
, g
, GSI_NEW_STMT
);
996 *gsi
= gsi_after_labels (then2_bb
);
999 /* Generate __ubsan_handle_type_mismatch call. */
1000 if (flag_sanitize_undefined_trap_on_error
)
1001 g
= gimple_build_call (builtin_decl_explicit (BUILT_IN_TRAP
), 0);
1005 = ubsan_create_data ("__ubsan_objsz_data", 1, &loc
,
1006 ubsan_type_descriptor (TREE_TYPE (ptr
),
1007 UBSAN_PRINT_POINTER
),
1009 build_zero_cst (unsigned_char_type_node
),
1012 data
= build_fold_addr_expr_loc (loc
, data
);
1013 enum built_in_function bcode
1014 = (flag_sanitize_recover
& SANITIZE_OBJECT_SIZE
)
1015 ? BUILT_IN_UBSAN_HANDLE_TYPE_MISMATCH_V1
1016 : BUILT_IN_UBSAN_HANDLE_TYPE_MISMATCH_V1_ABORT
;
1017 tree p
= make_ssa_name (pointer_sized_int_node
);
1018 g
= gimple_build_assign (p
, NOP_EXPR
, ptr
);
1019 gimple_set_location (g
, loc
);
1020 gsi_insert_before (gsi
, g
, GSI_SAME_STMT
);
1021 g
= gimple_build_call (builtin_decl_explicit (bcode
), 2, data
, p
);
1023 gimple_set_location (g
, loc
);
1024 gsi_insert_before (gsi
, g
, GSI_SAME_STMT
);
1026 /* Point GSI to next logical statement. */
1027 *gsi
= gsi_start_bb (fallthru_bb
);
1029 /* Get rid of the UBSAN_OBJECT_SIZE call from the IR. */
1030 unlink_stmt_vdef (stmt
);
1031 gsi_remove (&gsi_orig
, true);
1035 /* Get rid of the UBSAN_OBJECT_SIZE call from the IR. */
1036 unlink_stmt_vdef (stmt
);
1037 gsi_remove (gsi
, true);
1041 /* Expand UBSAN_PTR internal call. */
1044 ubsan_expand_ptr_ifn (gimple_stmt_iterator
*gsip
)
1046 gimple_stmt_iterator gsi
= *gsip
;
1047 gimple
*stmt
= gsi_stmt (gsi
);
1048 location_t loc
= gimple_location (stmt
);
1049 gcc_assert (gimple_call_num_args (stmt
) == 2);
1050 tree ptr
= gimple_call_arg (stmt
, 0);
1051 tree off
= gimple_call_arg (stmt
, 1);
1053 if (integer_zerop (off
))
1055 gsi_remove (gsip
, true);
1056 unlink_stmt_vdef (stmt
);
1060 basic_block cur_bb
= gsi_bb (gsi
);
1061 tree ptrplusoff
= make_ssa_name (pointer_sized_int_node
);
1062 tree ptri
= make_ssa_name (pointer_sized_int_node
);
1063 int pos_neg
= get_range_pos_neg (off
);
1065 /* Split the original block holding the pointer dereference. */
1066 edge e
= split_block (cur_bb
, stmt
);
1068 /* Get a hold on the 'condition block', the 'then block' and the
1070 basic_block cond_bb
= e
->src
;
1071 basic_block fallthru_bb
= e
->dest
;
1072 basic_block then_bb
= create_empty_bb (cond_bb
);
1073 basic_block cond_pos_bb
= NULL
, cond_neg_bb
= NULL
;
1074 add_bb_to_loop (then_bb
, cond_bb
->loop_father
);
1075 loops_state_set (LOOPS_NEED_FIXUP
);
1077 /* Set up the fallthrough basic block. */
1078 e
->flags
= EDGE_FALSE_VALUE
;
1081 e
->probability
= profile_probability::very_likely ();
1083 /* Connect 'then block' with the 'else block'. This is needed
1084 as the ubsan routines we call in the 'then block' are not noreturn.
1085 The 'then block' only has one outcoming edge. */
1086 make_single_succ_edge (then_bb
, fallthru_bb
, EDGE_FALLTHRU
);
1088 /* Make an edge coming from the 'cond block' into the 'then block';
1089 this edge is unlikely taken, so set up the probability
1091 e
= make_edge (cond_bb
, then_bb
, EDGE_TRUE_VALUE
);
1092 e
->probability
= profile_probability::very_unlikely ();
1093 then_bb
->count
= e
->count ();
1097 e
->probability
= profile_probability::even ();
1099 e
= split_block (fallthru_bb
, (gimple
*) NULL
);
1100 cond_neg_bb
= e
->src
;
1101 fallthru_bb
= e
->dest
;
1102 e
->probability
= profile_probability::very_likely ();
1103 e
->flags
= EDGE_FALSE_VALUE
;
1105 e
= make_edge (cond_neg_bb
, then_bb
, EDGE_TRUE_VALUE
);
1106 e
->probability
= profile_probability::very_unlikely ();
1107 then_bb
->count
= e
->count ();
1109 cond_pos_bb
= create_empty_bb (cond_bb
);
1110 add_bb_to_loop (cond_pos_bb
, cond_bb
->loop_father
);
1112 e
= make_edge (cond_bb
, cond_pos_bb
, EDGE_TRUE_VALUE
);
1113 e
->probability
= profile_probability::even ();
1114 cond_pos_bb
->count
= e
->count ();
1116 e
= make_edge (cond_pos_bb
, then_bb
, EDGE_TRUE_VALUE
);
1117 e
->probability
= profile_probability::very_unlikely ();
1119 e
= make_edge (cond_pos_bb
, fallthru_bb
, EDGE_FALSE_VALUE
);
1120 e
->probability
= profile_probability::very_likely ();
1122 make_single_succ_edge (then_bb
, fallthru_bb
, EDGE_FALLTHRU
);
1125 gimple
*g
= gimple_build_assign (ptri
, NOP_EXPR
, ptr
);
1126 gimple_set_location (g
, loc
);
1127 gsi_insert_before (&gsi
, g
, GSI_SAME_STMT
);
1128 g
= gimple_build_assign (ptrplusoff
, PLUS_EXPR
, ptri
, off
);
1129 gimple_set_location (g
, loc
);
1130 gsi_insert_before (&gsi
, g
, GSI_SAME_STMT
);
1132 /* Update dominance info for the newly created then_bb; note that
1133 fallthru_bb's dominance info has already been updated by
1135 if (dom_info_available_p (CDI_DOMINATORS
))
1137 set_immediate_dominator (CDI_DOMINATORS
, then_bb
, cond_bb
);
1140 set_immediate_dominator (CDI_DOMINATORS
, cond_pos_bb
, cond_bb
);
1141 set_immediate_dominator (CDI_DOMINATORS
, fallthru_bb
, cond_bb
);
1145 /* Put the ubsan builtin call into the newly created BB. */
1146 if (flag_sanitize_undefined_trap_on_error
)
1147 g
= gimple_build_call (builtin_decl_implicit (BUILT_IN_TRAP
), 0);
1150 enum built_in_function bcode
1151 = (flag_sanitize_recover
& SANITIZE_POINTER_OVERFLOW
)
1152 ? BUILT_IN_UBSAN_HANDLE_POINTER_OVERFLOW
1153 : BUILT_IN_UBSAN_HANDLE_POINTER_OVERFLOW_ABORT
;
1154 tree fn
= builtin_decl_implicit (bcode
);
1156 = ubsan_create_data ("__ubsan_ptrovf_data", 1, &loc
,
1157 NULL_TREE
, NULL_TREE
);
1158 data
= build_fold_addr_expr_loc (loc
, data
);
1159 g
= gimple_build_call (fn
, 3, data
, ptr
, ptrplusoff
);
1161 gimple_stmt_iterator gsi2
= gsi_start_bb (then_bb
);
1162 gimple_set_location (g
, loc
);
1163 gsi_insert_after (&gsi2
, g
, GSI_NEW_STMT
);
1165 /* Unlink the UBSAN_PTRs vops before replacing it. */
1166 unlink_stmt_vdef (stmt
);
1168 if (TREE_CODE (off
) == INTEGER_CST
)
1169 g
= gimple_build_cond (wi::neg_p (wi::to_wide (off
)) ? LT_EXPR
: GE_EXPR
,
1170 ptri
, fold_build1 (NEGATE_EXPR
, sizetype
, off
),
1171 NULL_TREE
, NULL_TREE
);
1172 else if (pos_neg
!= 3)
1173 g
= gimple_build_cond (pos_neg
== 1 ? LT_EXPR
: GT_EXPR
,
1174 ptrplusoff
, ptri
, NULL_TREE
, NULL_TREE
);
1177 gsi2
= gsi_start_bb (cond_pos_bb
);
1178 g
= gimple_build_cond (LT_EXPR
, ptrplusoff
, ptri
, NULL_TREE
, NULL_TREE
);
1179 gimple_set_location (g
, loc
);
1180 gsi_insert_after (&gsi2
, g
, GSI_NEW_STMT
);
1182 gsi2
= gsi_start_bb (cond_neg_bb
);
1183 g
= gimple_build_cond (GT_EXPR
, ptrplusoff
, ptri
, NULL_TREE
, NULL_TREE
);
1184 gimple_set_location (g
, loc
);
1185 gsi_insert_after (&gsi2
, g
, GSI_NEW_STMT
);
1187 gimple_seq seq
= NULL
;
1188 tree t
= gimple_build (&seq
, loc
, NOP_EXPR
, ssizetype
, off
);
1189 t
= gimple_build (&seq
, loc
, GE_EXPR
, boolean_type_node
,
1191 gsi_insert_seq_before (&gsi
, seq
, GSI_SAME_STMT
);
1192 g
= gimple_build_cond (NE_EXPR
, t
, boolean_false_node
,
1193 NULL_TREE
, NULL_TREE
);
1195 gimple_set_location (g
, loc
);
1196 /* Replace the UBSAN_PTR with a GIMPLE_COND stmt. */
1197 gsi_replace (&gsi
, g
, false);
1202 /* Cached __ubsan_vptr_type_cache decl. */
1203 static GTY(()) tree ubsan_vptr_type_cache_decl
;
1205 /* Expand UBSAN_VPTR internal call. The type is kept on the ckind
1206 argument which is a constant, because the middle-end treats pointer
1207 conversions as useless and therefore the type of the first argument
1208 could be changed to any other pointer type. */
1211 ubsan_expand_vptr_ifn (gimple_stmt_iterator
*gsip
)
1213 gimple_stmt_iterator gsi
= *gsip
;
1214 gimple
*stmt
= gsi_stmt (gsi
);
1215 location_t loc
= gimple_location (stmt
);
1216 gcc_assert (gimple_call_num_args (stmt
) == 5);
1217 tree op
= gimple_call_arg (stmt
, 0);
1218 tree vptr
= gimple_call_arg (stmt
, 1);
1219 tree str_hash
= gimple_call_arg (stmt
, 2);
1220 tree ti_decl_addr
= gimple_call_arg (stmt
, 3);
1221 tree ckind_tree
= gimple_call_arg (stmt
, 4);
1222 ubsan_null_ckind ckind
= (ubsan_null_ckind
) tree_to_uhwi (ckind_tree
);
1223 tree type
= TREE_TYPE (TREE_TYPE (ckind_tree
));
1225 basic_block fallthru_bb
= NULL
;
1227 if (ckind
== UBSAN_DOWNCAST_POINTER
)
1229 /* Guard everything with if (op != NULL) { ... }. */
1230 basic_block then_bb
;
1231 gimple_stmt_iterator cond_insert_point
1232 = create_cond_insert_point (gsip
, false, false, true,
1233 &then_bb
, &fallthru_bb
);
1234 g
= gimple_build_cond (NE_EXPR
, op
, build_zero_cst (TREE_TYPE (op
)),
1235 NULL_TREE
, NULL_TREE
);
1236 gimple_set_location (g
, loc
);
1237 gsi_insert_after (&cond_insert_point
, g
, GSI_NEW_STMT
);
1238 *gsip
= gsi_after_labels (then_bb
);
1239 gsi_remove (&gsi
, false);
1240 gsi_insert_before (gsip
, stmt
, GSI_NEW_STMT
);
1244 tree htype
= TREE_TYPE (str_hash
);
1245 tree cst
= wide_int_to_tree (htype
,
1246 wi::uhwi (((uint64_t) 0x9ddfea08 << 32)
1248 g
= gimple_build_assign (make_ssa_name (htype
), BIT_XOR_EXPR
,
1250 gimple_set_location (g
, loc
);
1251 gsi_insert_before (gsip
, g
, GSI_SAME_STMT
);
1252 g
= gimple_build_assign (make_ssa_name (htype
), MULT_EXPR
,
1253 gimple_assign_lhs (g
), cst
);
1254 gimple_set_location (g
, loc
);
1255 gsi_insert_before (gsip
, g
, GSI_SAME_STMT
);
1256 tree t1
= gimple_assign_lhs (g
);
1257 g
= gimple_build_assign (make_ssa_name (htype
), LSHIFT_EXPR
,
1258 t1
, build_int_cst (integer_type_node
, 47));
1259 gimple_set_location (g
, loc
);
1260 tree t2
= gimple_assign_lhs (g
);
1261 gsi_insert_before (gsip
, g
, GSI_SAME_STMT
);
1262 g
= gimple_build_assign (make_ssa_name (htype
), BIT_XOR_EXPR
,
1264 gimple_set_location (g
, loc
);
1265 gsi_insert_before (gsip
, g
, GSI_SAME_STMT
);
1266 g
= gimple_build_assign (make_ssa_name (htype
), BIT_XOR_EXPR
,
1267 t2
, gimple_assign_lhs (g
));
1268 gimple_set_location (g
, loc
);
1269 gsi_insert_before (gsip
, g
, GSI_SAME_STMT
);
1270 g
= gimple_build_assign (make_ssa_name (htype
), MULT_EXPR
,
1271 gimple_assign_lhs (g
), cst
);
1272 gimple_set_location (g
, loc
);
1273 gsi_insert_before (gsip
, g
, GSI_SAME_STMT
);
1274 tree t3
= gimple_assign_lhs (g
);
1275 g
= gimple_build_assign (make_ssa_name (htype
), LSHIFT_EXPR
,
1276 t3
, build_int_cst (integer_type_node
, 47));
1277 gimple_set_location (g
, loc
);
1278 gsi_insert_before (gsip
, g
, GSI_SAME_STMT
);
1279 g
= gimple_build_assign (make_ssa_name (htype
), BIT_XOR_EXPR
,
1280 t3
, gimple_assign_lhs (g
));
1281 gimple_set_location (g
, loc
);
1282 gsi_insert_before (gsip
, g
, GSI_SAME_STMT
);
1283 g
= gimple_build_assign (make_ssa_name (htype
), MULT_EXPR
,
1284 gimple_assign_lhs (g
), cst
);
1285 gimple_set_location (g
, loc
);
1286 gsi_insert_before (gsip
, g
, GSI_SAME_STMT
);
1287 if (!useless_type_conversion_p (pointer_sized_int_node
, htype
))
1289 g
= gimple_build_assign (make_ssa_name (pointer_sized_int_node
),
1290 NOP_EXPR
, gimple_assign_lhs (g
));
1291 gimple_set_location (g
, loc
);
1292 gsi_insert_before (gsip
, g
, GSI_SAME_STMT
);
1294 tree hash
= gimple_assign_lhs (g
);
1296 if (ubsan_vptr_type_cache_decl
== NULL_TREE
)
1298 tree atype
= build_array_type_nelts (pointer_sized_int_node
, 128);
1299 tree array
= build_decl (UNKNOWN_LOCATION
, VAR_DECL
,
1300 get_identifier ("__ubsan_vptr_type_cache"),
1302 DECL_ARTIFICIAL (array
) = 1;
1303 DECL_IGNORED_P (array
) = 1;
1304 TREE_PUBLIC (array
) = 1;
1305 TREE_STATIC (array
) = 1;
1306 DECL_EXTERNAL (array
) = 1;
1307 DECL_VISIBILITY (array
) = VISIBILITY_DEFAULT
;
1308 DECL_VISIBILITY_SPECIFIED (array
) = 1;
1309 varpool_node::finalize_decl (array
);
1310 ubsan_vptr_type_cache_decl
= array
;
1313 g
= gimple_build_assign (make_ssa_name (pointer_sized_int_node
),
1315 build_int_cst (pointer_sized_int_node
, 127));
1316 gimple_set_location (g
, loc
);
1317 gsi_insert_before (gsip
, g
, GSI_SAME_STMT
);
1319 tree c
= build4_loc (loc
, ARRAY_REF
, pointer_sized_int_node
,
1320 ubsan_vptr_type_cache_decl
, gimple_assign_lhs (g
),
1321 NULL_TREE
, NULL_TREE
);
1322 g
= gimple_build_assign (make_ssa_name (pointer_sized_int_node
),
1324 gimple_set_location (g
, loc
);
1325 gsi_insert_before (gsip
, g
, GSI_SAME_STMT
);
1327 basic_block then_bb
, fallthru2_bb
;
1328 gimple_stmt_iterator cond_insert_point
1329 = create_cond_insert_point (gsip
, false, false, true,
1330 &then_bb
, &fallthru2_bb
);
1331 g
= gimple_build_cond (NE_EXPR
, gimple_assign_lhs (g
), hash
,
1332 NULL_TREE
, NULL_TREE
);
1333 gimple_set_location (g
, loc
);
1334 gsi_insert_after (&cond_insert_point
, g
, GSI_NEW_STMT
);
1335 *gsip
= gsi_after_labels (then_bb
);
1336 if (fallthru_bb
== NULL
)
1337 fallthru_bb
= fallthru2_bb
;
1340 = ubsan_create_data ("__ubsan_vptr_data", 1, &loc
,
1341 ubsan_type_descriptor (type
), NULL_TREE
, ti_decl_addr
,
1342 build_int_cst (unsigned_char_type_node
, ckind
),
1344 data
= build_fold_addr_expr_loc (loc
, data
);
1345 enum built_in_function bcode
1346 = (flag_sanitize_recover
& SANITIZE_VPTR
)
1347 ? BUILT_IN_UBSAN_HANDLE_DYNAMIC_TYPE_CACHE_MISS
1348 : BUILT_IN_UBSAN_HANDLE_DYNAMIC_TYPE_CACHE_MISS_ABORT
;
1350 g
= gimple_build_call (builtin_decl_explicit (bcode
), 3, data
, op
, hash
);
1351 gimple_set_location (g
, loc
);
1352 gsi_insert_before (gsip
, g
, GSI_SAME_STMT
);
1354 /* Point GSI to next logical statement. */
1355 *gsip
= gsi_start_bb (fallthru_bb
);
1357 /* Get rid of the UBSAN_VPTR call from the IR. */
1358 unlink_stmt_vdef (stmt
);
1359 gsi_remove (&gsi
, true);
1363 /* Instrument a memory reference. BASE is the base of MEM, IS_LHS says
1364 whether the pointer is on the left hand side of the assignment. */
1367 instrument_mem_ref (tree mem
, tree base
, gimple_stmt_iterator
*iter
,
1370 enum ubsan_null_ckind ikind
= is_lhs
? UBSAN_STORE_OF
: UBSAN_LOAD_OF
;
1371 unsigned int align
= 0;
1372 if (sanitize_flags_p (SANITIZE_ALIGNMENT
))
1374 align
= min_align_of_type (TREE_TYPE (base
));
1378 if (align
== 0 && !sanitize_flags_p (SANITIZE_NULL
))
1380 tree t
= TREE_OPERAND (base
, 0);
1381 if (!POINTER_TYPE_P (TREE_TYPE (t
)))
1383 if (RECORD_OR_UNION_TYPE_P (TREE_TYPE (base
)) && mem
!= base
)
1384 ikind
= UBSAN_MEMBER_ACCESS
;
1385 tree kind
= build_int_cst (build_pointer_type (TREE_TYPE (base
)), ikind
);
1386 tree alignt
= build_int_cst (pointer_sized_int_node
, align
);
1387 gcall
*g
= gimple_build_call_internal (IFN_UBSAN_NULL
, 3, t
, kind
, alignt
);
1388 gimple_set_location (g
, gimple_location (gsi_stmt (*iter
)));
1389 gsi_insert_before (iter
, g
, GSI_SAME_STMT
);
1392 /* Perform the pointer instrumentation. */
1395 instrument_null (gimple_stmt_iterator gsi
, tree t
, bool is_lhs
)
1397 /* Handle also e.g. &s->i. */
1398 if (TREE_CODE (t
) == ADDR_EXPR
)
1399 t
= TREE_OPERAND (t
, 0);
1400 tree base
= get_base_address (t
);
1401 if (base
!= NULL_TREE
1402 && TREE_CODE (base
) == MEM_REF
1403 && TREE_CODE (TREE_OPERAND (base
, 0)) == SSA_NAME
)
1404 instrument_mem_ref (t
, base
, &gsi
, is_lhs
);
1407 /* Instrument pointer arithmetics PTR p+ OFF. */
1410 instrument_pointer_overflow (gimple_stmt_iterator
*gsi
, tree ptr
, tree off
)
1412 if (TYPE_PRECISION (sizetype
) != POINTER_SIZE
)
1414 gcall
*g
= gimple_build_call_internal (IFN_UBSAN_PTR
, 2, ptr
, off
);
1415 gimple_set_location (g
, gimple_location (gsi_stmt (*gsi
)));
1416 gsi_insert_before (gsi
, g
, GSI_SAME_STMT
);
1419 /* Instrument pointer arithmetics if any. */
1422 maybe_instrument_pointer_overflow (gimple_stmt_iterator
*gsi
, tree t
)
1424 if (TYPE_PRECISION (sizetype
) != POINTER_SIZE
)
1427 /* Handle also e.g. &s->i. */
1428 if (TREE_CODE (t
) == ADDR_EXPR
)
1429 t
= TREE_OPERAND (t
, 0);
1431 if (!handled_component_p (t
) && TREE_CODE (t
) != MEM_REF
)
1434 poly_int64 bitsize
, bitpos
, bytepos
;
1437 int volatilep
= 0, reversep
, unsignedp
= 0;
1438 tree inner
= get_inner_reference (t
, &bitsize
, &bitpos
, &offset
, &mode
,
1439 &unsignedp
, &reversep
, &volatilep
);
1440 tree moff
= NULL_TREE
;
1442 bool decl_p
= DECL_P (inner
);
1446 if (DECL_REGISTER (inner
))
1449 /* If BASE is a fixed size automatic variable or
1450 global variable defined in the current TU and bitpos
1451 fits, don't instrument anything. */
1452 poly_int64 base_size
;
1453 if (offset
== NULL_TREE
1454 && maybe_ne (bitpos
, 0)
1456 || TREE_CODE (base
) == PARM_DECL
1457 || TREE_CODE (base
) == RESULT_DECL
)
1458 && poly_int_tree_p (DECL_SIZE (base
), &base_size
)
1459 && known_ge (base_size
, bitpos
)
1460 && (!is_global_var (base
) || decl_binds_to_current_def_p (base
)))
1463 else if (TREE_CODE (inner
) == MEM_REF
)
1465 base
= TREE_OPERAND (inner
, 0);
1466 if (TREE_CODE (base
) == ADDR_EXPR
1467 && DECL_P (TREE_OPERAND (base
, 0))
1468 && !TREE_ADDRESSABLE (TREE_OPERAND (base
, 0))
1469 && !is_global_var (TREE_OPERAND (base
, 0)))
1471 moff
= TREE_OPERAND (inner
, 1);
1472 if (integer_zerop (moff
))
1478 if (!POINTER_TYPE_P (TREE_TYPE (base
)) && !DECL_P (base
))
1480 bytepos
= bits_to_bytes_round_down (bitpos
);
1481 if (offset
== NULL_TREE
&& known_eq (bytepos
, 0) && moff
== NULL_TREE
)
1484 tree base_addr
= base
;
1486 base_addr
= build1 (ADDR_EXPR
,
1487 build_pointer_type (TREE_TYPE (base
)), base
);
1489 if (maybe_ne (bytepos
, 0))
1492 t
= fold_build2 (PLUS_EXPR
, TREE_TYPE (t
), t
,
1493 build_int_cst (TREE_TYPE (t
), bytepos
));
1495 t
= size_int (bytepos
);
1500 t
= fold_build2 (PLUS_EXPR
, TREE_TYPE (t
), t
,
1501 fold_convert (TREE_TYPE (t
), moff
));
1503 t
= fold_convert (sizetype
, moff
);
1505 t
= force_gimple_operand_gsi (gsi
, t
, true, NULL_TREE
, true,
1507 base_addr
= force_gimple_operand_gsi (gsi
, base_addr
, true, NULL_TREE
, true,
1509 instrument_pointer_overflow (gsi
, base_addr
, t
);
1512 /* Build an ubsan builtin call for the signed-integer-overflow
1513 sanitization. CODE says what kind of builtin are we building,
1514 LOC is a location, LHSTYPE is the type of LHS, OP0 and OP1
1515 are operands of the binary operation. */
1518 ubsan_build_overflow_builtin (tree_code code
, location_t loc
, tree lhstype
,
1519 tree op0
, tree op1
, tree
*datap
)
1521 if (flag_sanitize_undefined_trap_on_error
)
1522 return build_call_expr_loc (loc
, builtin_decl_explicit (BUILT_IN_TRAP
), 0);
1525 if (datap
&& *datap
)
1528 data
= ubsan_create_data ("__ubsan_overflow_data", 1, &loc
,
1529 ubsan_type_descriptor (lhstype
), NULL_TREE
,
1533 enum built_in_function fn_code
;
1538 fn_code
= (flag_sanitize_recover
& SANITIZE_SI_OVERFLOW
)
1539 ? BUILT_IN_UBSAN_HANDLE_ADD_OVERFLOW
1540 : BUILT_IN_UBSAN_HANDLE_ADD_OVERFLOW_ABORT
;
1543 fn_code
= (flag_sanitize_recover
& SANITIZE_SI_OVERFLOW
)
1544 ? BUILT_IN_UBSAN_HANDLE_SUB_OVERFLOW
1545 : BUILT_IN_UBSAN_HANDLE_SUB_OVERFLOW_ABORT
;
1548 fn_code
= (flag_sanitize_recover
& SANITIZE_SI_OVERFLOW
)
1549 ? BUILT_IN_UBSAN_HANDLE_MUL_OVERFLOW
1550 : BUILT_IN_UBSAN_HANDLE_MUL_OVERFLOW_ABORT
;
1553 fn_code
= (flag_sanitize_recover
& SANITIZE_SI_OVERFLOW
)
1554 ? BUILT_IN_UBSAN_HANDLE_NEGATE_OVERFLOW
1555 : BUILT_IN_UBSAN_HANDLE_NEGATE_OVERFLOW_ABORT
;
1560 tree fn
= builtin_decl_explicit (fn_code
);
1561 return build_call_expr_loc (loc
, fn
, 2 + (code
!= NEGATE_EXPR
),
1562 build_fold_addr_expr_loc (loc
, data
),
1563 ubsan_encode_value (op0
, UBSAN_ENCODE_VALUE_RTL
),
1565 ? ubsan_encode_value (op1
,
1566 UBSAN_ENCODE_VALUE_RTL
)
1570 /* Perform the signed integer instrumentation. GSI is the iterator
1571 pointing at statement we are trying to instrument. */
1574 instrument_si_overflow (gimple_stmt_iterator gsi
)
1576 gimple
*stmt
= gsi_stmt (gsi
);
1577 tree_code code
= gimple_assign_rhs_code (stmt
);
1578 tree lhs
= gimple_assign_lhs (stmt
);
1579 tree lhstype
= TREE_TYPE (lhs
);
1580 tree lhsinner
= VECTOR_TYPE_P (lhstype
) ? TREE_TYPE (lhstype
) : lhstype
;
1584 /* If this is not a signed operation, don't instrument anything here.
1585 Also punt on bit-fields. */
1586 if (!INTEGRAL_TYPE_P (lhsinner
)
1587 || TYPE_OVERFLOW_WRAPS (lhsinner
)
1588 || maybe_ne (GET_MODE_BITSIZE (TYPE_MODE (lhsinner
)),
1589 TYPE_PRECISION (lhsinner
)))
1600 i = UBSAN_CHECK_{ADD,SUB,MUL} (u, 5); */
1601 a
= gimple_assign_rhs1 (stmt
);
1602 b
= gimple_assign_rhs2 (stmt
);
1603 g
= gimple_build_call_internal (code
== PLUS_EXPR
1604 ? IFN_UBSAN_CHECK_ADD
1605 : code
== MINUS_EXPR
1606 ? IFN_UBSAN_CHECK_SUB
1607 : IFN_UBSAN_CHECK_MUL
, 2, a
, b
);
1608 gimple_call_set_lhs (g
, lhs
);
1609 gsi_replace (&gsi
, g
, true);
1612 /* Represent i = -u;
1614 i = UBSAN_CHECK_SUB (0, u); */
1615 a
= build_zero_cst (lhstype
);
1616 b
= gimple_assign_rhs1 (stmt
);
1617 g
= gimple_build_call_internal (IFN_UBSAN_CHECK_SUB
, 2, a
, b
);
1618 gimple_call_set_lhs (g
, lhs
);
1619 gsi_replace (&gsi
, g
, true);
1622 /* Transform i = ABS_EXPR<u>;
1624 _N = UBSAN_CHECK_SUB (0, u);
1625 i = ABS_EXPR<_N>; */
1626 a
= build_zero_cst (lhstype
);
1627 b
= gimple_assign_rhs1 (stmt
);
1628 g
= gimple_build_call_internal (IFN_UBSAN_CHECK_SUB
, 2, a
, b
);
1629 a
= make_ssa_name (lhstype
);
1630 gimple_call_set_lhs (g
, a
);
1631 gimple_set_location (g
, gimple_location (stmt
));
1632 gsi_insert_before (&gsi
, g
, GSI_SAME_STMT
);
1633 gimple_assign_set_rhs1 (stmt
, a
);
1641 /* Instrument loads from (non-bitfield) bool and C++ enum values
1642 to check if the memory value is outside of the range of the valid
1646 instrument_bool_enum_load (gimple_stmt_iterator
*gsi
)
1648 gimple
*stmt
= gsi_stmt (*gsi
);
1649 tree rhs
= gimple_assign_rhs1 (stmt
);
1650 tree type
= TREE_TYPE (rhs
);
1651 tree minv
= NULL_TREE
, maxv
= NULL_TREE
;
1653 if (TREE_CODE (type
) == BOOLEAN_TYPE
1654 && sanitize_flags_p (SANITIZE_BOOL
))
1656 minv
= boolean_false_node
;
1657 maxv
= boolean_true_node
;
1659 else if (TREE_CODE (type
) == ENUMERAL_TYPE
1660 && sanitize_flags_p (SANITIZE_ENUM
)
1661 && TREE_TYPE (type
) != NULL_TREE
1662 && TREE_CODE (TREE_TYPE (type
)) == INTEGER_TYPE
1663 && (TYPE_PRECISION (TREE_TYPE (type
))
1664 < GET_MODE_PRECISION (SCALAR_INT_TYPE_MODE (type
))))
1666 minv
= TYPE_MIN_VALUE (TREE_TYPE (type
));
1667 maxv
= TYPE_MAX_VALUE (TREE_TYPE (type
));
1672 int modebitsize
= GET_MODE_BITSIZE (SCALAR_INT_TYPE_MODE (type
));
1673 poly_int64 bitsize
, bitpos
;
1676 int volatilep
= 0, reversep
, unsignedp
= 0;
1677 tree base
= get_inner_reference (rhs
, &bitsize
, &bitpos
, &offset
, &mode
,
1678 &unsignedp
, &reversep
, &volatilep
);
1679 tree utype
= build_nonstandard_integer_type (modebitsize
, 1);
1681 if ((VAR_P (base
) && DECL_HARD_REGISTER (base
))
1682 || !multiple_p (bitpos
, modebitsize
)
1683 || maybe_ne (bitsize
, modebitsize
)
1684 || GET_MODE_BITSIZE (SCALAR_INT_TYPE_MODE (utype
)) != modebitsize
1685 || TREE_CODE (gimple_assign_lhs (stmt
)) != SSA_NAME
)
1688 bool ends_bb
= stmt_ends_bb_p (stmt
);
1689 location_t loc
= gimple_location (stmt
);
1690 tree lhs
= gimple_assign_lhs (stmt
);
1691 tree ptype
= build_pointer_type (TREE_TYPE (rhs
));
1692 tree atype
= reference_alias_ptr_type (rhs
);
1693 gimple
*g
= gimple_build_assign (make_ssa_name (ptype
),
1694 build_fold_addr_expr (rhs
));
1695 gimple_set_location (g
, loc
);
1696 gsi_insert_before (gsi
, g
, GSI_SAME_STMT
);
1697 tree mem
= build2 (MEM_REF
, utype
, gimple_assign_lhs (g
),
1698 build_int_cst (atype
, 0));
1699 tree urhs
= make_ssa_name (utype
);
1702 gimple_assign_set_lhs (stmt
, urhs
);
1703 g
= gimple_build_assign (lhs
, NOP_EXPR
, urhs
);
1704 gimple_set_location (g
, loc
);
1705 edge e
= find_fallthru_edge (gimple_bb (stmt
)->succs
);
1706 gsi_insert_on_edge_immediate (e
, g
);
1707 gimple_assign_set_rhs_from_tree (gsi
, mem
);
1709 *gsi
= gsi_for_stmt (g
);
1714 g
= gimple_build_assign (urhs
, mem
);
1715 gimple_set_location (g
, loc
);
1716 gsi_insert_before (gsi
, g
, GSI_SAME_STMT
);
1718 minv
= fold_convert (utype
, minv
);
1719 maxv
= fold_convert (utype
, maxv
);
1720 if (!integer_zerop (minv
))
1722 g
= gimple_build_assign (make_ssa_name (utype
), MINUS_EXPR
, urhs
, minv
);
1723 gimple_set_location (g
, loc
);
1724 gsi_insert_before (gsi
, g
, GSI_SAME_STMT
);
1727 gimple_stmt_iterator gsi2
= *gsi
;
1728 basic_block then_bb
, fallthru_bb
;
1729 *gsi
= create_cond_insert_point (gsi
, true, false, true,
1730 &then_bb
, &fallthru_bb
);
1731 g
= gimple_build_cond (GT_EXPR
, gimple_assign_lhs (g
),
1732 int_const_binop (MINUS_EXPR
, maxv
, minv
),
1733 NULL_TREE
, NULL_TREE
);
1734 gimple_set_location (g
, loc
);
1735 gsi_insert_after (gsi
, g
, GSI_NEW_STMT
);
1739 gimple_assign_set_rhs_with_ops (&gsi2
, NOP_EXPR
, urhs
);
1743 gsi2
= gsi_after_labels (then_bb
);
1744 if (flag_sanitize_undefined_trap_on_error
)
1745 g
= gimple_build_call (builtin_decl_explicit (BUILT_IN_TRAP
), 0);
1748 tree data
= ubsan_create_data ("__ubsan_invalid_value_data", 1, &loc
,
1749 ubsan_type_descriptor (type
), NULL_TREE
,
1751 data
= build_fold_addr_expr_loc (loc
, data
);
1752 enum built_in_function bcode
1753 = (flag_sanitize_recover
& (TREE_CODE (type
) == BOOLEAN_TYPE
1754 ? SANITIZE_BOOL
: SANITIZE_ENUM
))
1755 ? BUILT_IN_UBSAN_HANDLE_LOAD_INVALID_VALUE
1756 : BUILT_IN_UBSAN_HANDLE_LOAD_INVALID_VALUE_ABORT
;
1757 tree fn
= builtin_decl_explicit (bcode
);
1759 tree val
= ubsan_encode_value (urhs
, UBSAN_ENCODE_VALUE_GIMPLE
);
1760 val
= force_gimple_operand_gsi (&gsi2
, val
, true, NULL_TREE
, true,
1762 g
= gimple_build_call (fn
, 2, data
, val
);
1764 gimple_set_location (g
, loc
);
1765 gsi_insert_before (&gsi2
, g
, GSI_SAME_STMT
);
1766 ubsan_create_edge (g
);
1767 *gsi
= gsi_for_stmt (stmt
);
1770 /* Determine if we can propagate given LOCATION to ubsan_data descriptor to use
1771 new style handlers. Libubsan uses heuristics to destinguish between old and
1772 new styles and relies on these properties for filename:
1774 a) Location's filename must not be NULL.
1775 b) Location's filename must not be equal to "".
1776 c) Location's filename must not be equal to "\1".
1777 d) First two bytes of filename must not contain '\xff' symbol. */
1780 ubsan_use_new_style_p (location_t loc
)
1782 if (loc
== UNKNOWN_LOCATION
)
1785 expanded_location xloc
= expand_location (loc
);
1786 if (xloc
.file
== NULL
|| startswith (xloc
.file
, "\1")
1787 || xloc
.file
[0] == '\0' || xloc
.file
[0] == '\xff'
1788 || xloc
.file
[1] == '\xff')
1794 /* Instrument float point-to-integer conversion. TYPE is an integer type of
1795 destination, EXPR is floating-point expression. */
1798 ubsan_instrument_float_cast (location_t loc
, tree type
, tree expr
)
1800 tree expr_type
= TREE_TYPE (expr
);
1801 tree t
, tt
, fn
, min
, max
;
1802 machine_mode mode
= TYPE_MODE (expr_type
);
1803 int prec
= TYPE_PRECISION (type
);
1804 bool uns_p
= TYPE_UNSIGNED (type
);
1805 if (loc
== UNKNOWN_LOCATION
)
1806 loc
= input_location
;
1808 /* Float to integer conversion first truncates toward zero, so
1809 even signed char c = 127.875f; is not problematic.
1810 Therefore, we should complain only if EXPR is unordered or smaller
1811 or equal than TYPE_MIN_VALUE - 1.0 or greater or equal than
1812 TYPE_MAX_VALUE + 1.0. */
1813 if (REAL_MODE_FORMAT (mode
)->b
== 2)
1815 /* For maximum, TYPE_MAX_VALUE might not be representable
1816 in EXPR_TYPE, e.g. if TYPE is 64-bit long long and
1817 EXPR_TYPE is IEEE single float, but TYPE_MAX_VALUE + 1.0 is
1818 either representable or infinity. */
1819 REAL_VALUE_TYPE maxval
= dconst1
;
1820 SET_REAL_EXP (&maxval
, REAL_EXP (&maxval
) + prec
- !uns_p
);
1821 real_convert (&maxval
, mode
, &maxval
);
1822 max
= build_real (expr_type
, maxval
);
1824 /* For unsigned, assume -1.0 is always representable. */
1826 min
= build_minus_one_cst (expr_type
);
1829 /* TYPE_MIN_VALUE is generally representable (or -inf),
1830 but TYPE_MIN_VALUE - 1.0 might not be. */
1831 REAL_VALUE_TYPE minval
= dconstm1
, minval2
;
1832 SET_REAL_EXP (&minval
, REAL_EXP (&minval
) + prec
- 1);
1833 real_convert (&minval
, mode
, &minval
);
1834 real_arithmetic (&minval2
, MINUS_EXPR
, &minval
, &dconst1
);
1835 real_convert (&minval2
, mode
, &minval2
);
1836 if (real_compare (EQ_EXPR
, &minval
, &minval2
)
1837 && !real_isinf (&minval
))
1839 /* If TYPE_MIN_VALUE - 1.0 is not representable and
1840 rounds to TYPE_MIN_VALUE, we need to subtract
1841 more. As REAL_MODE_FORMAT (mode)->p is the number
1842 of base digits, we want to subtract a number that
1843 will be 1 << (REAL_MODE_FORMAT (mode)->p - 1)
1844 times smaller than minval. */
1846 gcc_assert (prec
> REAL_MODE_FORMAT (mode
)->p
);
1847 SET_REAL_EXP (&minval2
,
1848 REAL_EXP (&minval2
) + prec
- 1
1849 - REAL_MODE_FORMAT (mode
)->p
+ 1);
1850 real_arithmetic (&minval2
, MINUS_EXPR
, &minval
, &minval2
);
1851 real_convert (&minval2
, mode
, &minval2
);
1853 min
= build_real (expr_type
, minval2
);
1856 else if (REAL_MODE_FORMAT (mode
)->b
== 10)
1858 /* For _Decimal128 up to 34 decimal digits, - sign,
1859 dot, e, exponent. */
1862 int p
= REAL_MODE_FORMAT (mode
)->p
;
1863 REAL_VALUE_TYPE maxval
, minval
;
1865 /* Use mpfr_snprintf rounding to compute the smallest
1866 representable decimal number greater or equal than
1867 1 << (prec - !uns_p). */
1868 mpfr_init2 (m
, prec
+ 2);
1869 mpfr_set_ui_2exp (m
, 1, prec
- !uns_p
, MPFR_RNDN
);
1870 mpfr_snprintf (buf
, sizeof buf
, "%.*RUe", p
- 1, m
);
1871 decimal_real_from_string (&maxval
, buf
);
1872 max
= build_real (expr_type
, maxval
);
1874 /* For unsigned, assume -1.0 is always representable. */
1876 min
= build_minus_one_cst (expr_type
);
1879 /* Use mpfr_snprintf rounding to compute the largest
1880 representable decimal number less or equal than
1881 (-1 << (prec - 1)) - 1. */
1882 mpfr_set_si_2exp (m
, -1, prec
- 1, MPFR_RNDN
);
1883 mpfr_sub_ui (m
, m
, 1, MPFR_RNDN
);
1884 mpfr_snprintf (buf
, sizeof buf
, "%.*RDe", p
- 1, m
);
1885 decimal_real_from_string (&minval
, buf
);
1886 min
= build_real (expr_type
, minval
);
1893 if (HONOR_NANS (mode
))
1895 t
= fold_build2 (UNLE_EXPR
, boolean_type_node
, expr
, min
);
1896 tt
= fold_build2 (UNGE_EXPR
, boolean_type_node
, expr
, max
);
1900 t
= fold_build2 (LE_EXPR
, boolean_type_node
, expr
, min
);
1901 tt
= fold_build2 (GE_EXPR
, boolean_type_node
, expr
, max
);
1903 t
= fold_build2 (TRUTH_OR_EXPR
, boolean_type_node
, t
, tt
);
1904 if (integer_zerop (t
))
1907 if (flag_sanitize_undefined_trap_on_error
)
1908 fn
= build_call_expr_loc (loc
, builtin_decl_explicit (BUILT_IN_TRAP
), 0);
1911 location_t
*loc_ptr
= NULL
;
1912 unsigned num_locations
= 0;
1913 /* Figure out if we can propagate location to ubsan_data and use new
1914 style handlers in libubsan. */
1915 if (ubsan_use_new_style_p (loc
))
1920 /* Create the __ubsan_handle_float_cast_overflow fn call. */
1921 tree data
= ubsan_create_data ("__ubsan_float_cast_overflow_data",
1922 num_locations
, loc_ptr
,
1923 ubsan_type_descriptor (expr_type
),
1924 ubsan_type_descriptor (type
), NULL_TREE
,
1926 enum built_in_function bcode
1927 = (flag_sanitize_recover
& SANITIZE_FLOAT_CAST
)
1928 ? BUILT_IN_UBSAN_HANDLE_FLOAT_CAST_OVERFLOW
1929 : BUILT_IN_UBSAN_HANDLE_FLOAT_CAST_OVERFLOW_ABORT
;
1930 fn
= builtin_decl_explicit (bcode
);
1931 fn
= build_call_expr_loc (loc
, fn
, 2,
1932 build_fold_addr_expr_loc (loc
, data
),
1933 ubsan_encode_value (expr
));
1936 return fold_build3 (COND_EXPR
, void_type_node
, t
, fn
, integer_zero_node
);
1939 /* Instrument values passed to function arguments with nonnull attribute. */
1942 instrument_nonnull_arg (gimple_stmt_iterator
*gsi
)
1944 gimple
*stmt
= gsi_stmt (*gsi
);
1946 /* infer_nonnull_range needs flag_delete_null_pointer_checks set,
1947 while for nonnull sanitization it is clear. */
1948 int save_flag_delete_null_pointer_checks
= flag_delete_null_pointer_checks
;
1949 flag_delete_null_pointer_checks
= 1;
1950 loc
[0] = gimple_location (stmt
);
1951 loc
[1] = UNKNOWN_LOCATION
;
1952 for (unsigned int i
= 0; i
< gimple_call_num_args (stmt
); i
++)
1954 tree arg
= gimple_call_arg (stmt
, i
);
1955 if (POINTER_TYPE_P (TREE_TYPE (arg
))
1956 && infer_nonnull_range_by_attribute (stmt
, arg
))
1959 if (!is_gimple_val (arg
))
1961 g
= gimple_build_assign (make_ssa_name (TREE_TYPE (arg
)), arg
);
1962 gimple_set_location (g
, loc
[0]);
1963 gsi_insert_before (gsi
, g
, GSI_SAME_STMT
);
1964 arg
= gimple_assign_lhs (g
);
1967 basic_block then_bb
, fallthru_bb
;
1968 *gsi
= create_cond_insert_point (gsi
, true, false, true,
1969 &then_bb
, &fallthru_bb
);
1970 g
= gimple_build_cond (EQ_EXPR
, arg
,
1971 build_zero_cst (TREE_TYPE (arg
)),
1972 NULL_TREE
, NULL_TREE
);
1973 gimple_set_location (g
, loc
[0]);
1974 gsi_insert_after (gsi
, g
, GSI_NEW_STMT
);
1976 *gsi
= gsi_after_labels (then_bb
);
1977 if (flag_sanitize_undefined_trap_on_error
)
1978 g
= gimple_build_call (builtin_decl_explicit (BUILT_IN_TRAP
), 0);
1981 tree data
= ubsan_create_data ("__ubsan_nonnull_arg_data",
1983 build_int_cst (integer_type_node
,
1986 data
= build_fold_addr_expr_loc (loc
[0], data
);
1987 enum built_in_function bcode
1988 = (flag_sanitize_recover
& SANITIZE_NONNULL_ATTRIBUTE
)
1989 ? BUILT_IN_UBSAN_HANDLE_NONNULL_ARG
1990 : BUILT_IN_UBSAN_HANDLE_NONNULL_ARG_ABORT
;
1991 tree fn
= builtin_decl_explicit (bcode
);
1993 g
= gimple_build_call (fn
, 1, data
);
1995 gimple_set_location (g
, loc
[0]);
1996 gsi_insert_before (gsi
, g
, GSI_SAME_STMT
);
1997 ubsan_create_edge (g
);
1999 *gsi
= gsi_for_stmt (stmt
);
2001 flag_delete_null_pointer_checks
= save_flag_delete_null_pointer_checks
;
2004 /* Instrument returns in functions with returns_nonnull attribute. */
2007 instrument_nonnull_return (gimple_stmt_iterator
*gsi
)
2009 greturn
*stmt
= as_a
<greturn
*> (gsi_stmt (*gsi
));
2011 tree arg
= gimple_return_retval (stmt
);
2012 /* infer_nonnull_range needs flag_delete_null_pointer_checks set,
2013 while for nonnull return sanitization it is clear. */
2014 int save_flag_delete_null_pointer_checks
= flag_delete_null_pointer_checks
;
2015 flag_delete_null_pointer_checks
= 1;
2016 loc
[0] = gimple_location (stmt
);
2017 loc
[1] = UNKNOWN_LOCATION
;
2019 && POINTER_TYPE_P (TREE_TYPE (arg
))
2020 && is_gimple_val (arg
)
2021 && infer_nonnull_range_by_attribute (stmt
, arg
))
2023 basic_block then_bb
, fallthru_bb
;
2024 *gsi
= create_cond_insert_point (gsi
, true, false, true,
2025 &then_bb
, &fallthru_bb
);
2026 gimple
*g
= gimple_build_cond (EQ_EXPR
, arg
,
2027 build_zero_cst (TREE_TYPE (arg
)),
2028 NULL_TREE
, NULL_TREE
);
2029 gimple_set_location (g
, loc
[0]);
2030 gsi_insert_after (gsi
, g
, GSI_NEW_STMT
);
2032 *gsi
= gsi_after_labels (then_bb
);
2033 if (flag_sanitize_undefined_trap_on_error
)
2034 g
= gimple_build_call (builtin_decl_explicit (BUILT_IN_TRAP
), 0);
2037 tree data
= ubsan_create_data ("__ubsan_nonnull_return_data",
2038 1, &loc
[1], NULL_TREE
, NULL_TREE
);
2039 data
= build_fold_addr_expr_loc (loc
[0], data
);
2040 tree data2
= ubsan_create_data ("__ubsan_nonnull_return_data",
2041 1, &loc
[0], NULL_TREE
, NULL_TREE
);
2042 data2
= build_fold_addr_expr_loc (loc
[0], data2
);
2043 enum built_in_function bcode
2044 = (flag_sanitize_recover
& SANITIZE_RETURNS_NONNULL_ATTRIBUTE
)
2045 ? BUILT_IN_UBSAN_HANDLE_NONNULL_RETURN_V1
2046 : BUILT_IN_UBSAN_HANDLE_NONNULL_RETURN_V1_ABORT
;
2047 tree fn
= builtin_decl_explicit (bcode
);
2049 g
= gimple_build_call (fn
, 2, data
, data2
);
2051 gimple_set_location (g
, loc
[0]);
2052 gsi_insert_before (gsi
, g
, GSI_SAME_STMT
);
2053 ubsan_create_edge (g
);
2054 *gsi
= gsi_for_stmt (stmt
);
2056 flag_delete_null_pointer_checks
= save_flag_delete_null_pointer_checks
;
2059 /* Instrument memory references. Here we check whether the pointer
2060 points to an out-of-bounds location. */
2063 instrument_object_size (gimple_stmt_iterator
*gsi
, tree t
, bool is_lhs
)
2065 gimple
*stmt
= gsi_stmt (*gsi
);
2066 location_t loc
= gimple_location (stmt
);
2068 tree index
= NULL_TREE
;
2069 HOST_WIDE_INT size_in_bytes
;
2071 type
= TREE_TYPE (t
);
2072 if (VOID_TYPE_P (type
))
2075 switch (TREE_CODE (t
))
2078 if (TREE_CODE (t
) == COMPONENT_REF
2079 && DECL_BIT_FIELD_REPRESENTATIVE (TREE_OPERAND (t
, 1)) != NULL_TREE
)
2081 tree repr
= DECL_BIT_FIELD_REPRESENTATIVE (TREE_OPERAND (t
, 1));
2082 t
= build3 (COMPONENT_REF
, TREE_TYPE (repr
), TREE_OPERAND (t
, 0),
2083 repr
, TREE_OPERAND (t
, 2));
2087 index
= TREE_OPERAND (t
, 1);
2099 size_in_bytes
= int_size_in_bytes (type
);
2100 if (size_in_bytes
<= 0)
2103 poly_int64 bitsize
, bitpos
;
2106 int volatilep
= 0, reversep
, unsignedp
= 0;
2107 tree inner
= get_inner_reference (t
, &bitsize
, &bitpos
, &offset
, &mode
,
2108 &unsignedp
, &reversep
, &volatilep
);
2110 if (!multiple_p (bitpos
, BITS_PER_UNIT
)
2111 || maybe_ne (bitsize
, size_in_bytes
* BITS_PER_UNIT
))
2114 bool decl_p
= DECL_P (inner
);
2118 if (DECL_REGISTER (inner
))
2122 else if (TREE_CODE (inner
) == MEM_REF
)
2123 base
= TREE_OPERAND (inner
, 0);
2126 tree ptr
= build1 (ADDR_EXPR
, build_pointer_type (TREE_TYPE (t
)), t
);
2128 while (TREE_CODE (base
) == SSA_NAME
)
2130 gimple
*def_stmt
= SSA_NAME_DEF_STMT (base
);
2131 if (gimple_assign_ssa_name_copy_p (def_stmt
)
2132 || (gimple_assign_cast_p (def_stmt
)
2133 && POINTER_TYPE_P (TREE_TYPE (gimple_assign_rhs1 (def_stmt
))))
2134 || (is_gimple_assign (def_stmt
)
2135 && gimple_assign_rhs_code (def_stmt
) == POINTER_PLUS_EXPR
))
2137 tree rhs1
= gimple_assign_rhs1 (def_stmt
);
2138 if (TREE_CODE (rhs1
) == SSA_NAME
2139 && SSA_NAME_OCCURS_IN_ABNORMAL_PHI (rhs1
))
2148 if (!POINTER_TYPE_P (TREE_TYPE (base
)) && !DECL_P (base
))
2152 tree base_addr
= base
;
2153 gimple
*bos_stmt
= NULL
;
2155 base_addr
= build1 (ADDR_EXPR
,
2156 build_pointer_type (TREE_TYPE (base
)), base
);
2157 unsigned HOST_WIDE_INT size
;
2158 if (compute_builtin_object_size (base_addr
, 0, &size
))
2159 sizet
= build_int_cst (sizetype
, size
);
2162 if (LOCATION_LOCUS (loc
) == UNKNOWN_LOCATION
)
2163 loc
= input_location
;
2164 /* Generate __builtin_object_size call. */
2165 sizet
= builtin_decl_explicit (BUILT_IN_OBJECT_SIZE
);
2166 sizet
= build_call_expr_loc (loc
, sizet
, 2, base_addr
,
2168 sizet
= force_gimple_operand_gsi (gsi
, sizet
, false, NULL_TREE
, true,
2170 /* If the call above didn't end up being an integer constant, go one
2171 statement back and get the __builtin_object_size stmt. Save it,
2172 we might need it later. */
2173 if (SSA_VAR_P (sizet
))
2176 bos_stmt
= gsi_stmt (*gsi
);
2178 /* Move on to where we were. */
2185 /* Generate UBSAN_OBJECT_SIZE (ptr, ptr+sizeof(*ptr)-base, objsize, ckind)
2187 /* ptr + sizeof (*ptr) - base */
2188 t
= fold_build2 (MINUS_EXPR
, sizetype
,
2189 fold_convert (pointer_sized_int_node
, ptr
),
2190 fold_convert (pointer_sized_int_node
, base_addr
));
2191 t
= fold_build2 (PLUS_EXPR
, sizetype
, t
, TYPE_SIZE_UNIT (type
));
2193 /* Perhaps we can omit the check. */
2194 if (TREE_CODE (t
) == INTEGER_CST
2195 && TREE_CODE (sizet
) == INTEGER_CST
2196 && tree_int_cst_le (t
, sizet
))
2199 if (index
!= NULL_TREE
2200 && TREE_CODE (index
) == SSA_NAME
2201 && TREE_CODE (sizet
) == INTEGER_CST
)
2203 gimple
*def
= SSA_NAME_DEF_STMT (index
);
2204 if (is_gimple_assign (def
)
2205 && gimple_assign_rhs_code (def
) == BIT_AND_EXPR
2206 && TREE_CODE (gimple_assign_rhs2 (def
)) == INTEGER_CST
)
2208 tree cst
= gimple_assign_rhs2 (def
);
2209 tree sz
= fold_build2 (EXACT_DIV_EXPR
, sizetype
, sizet
,
2210 TYPE_SIZE_UNIT (type
));
2211 if (tree_int_cst_sgn (cst
) >= 0
2212 && tree_int_cst_lt (cst
, sz
))
2217 if (bos_stmt
&& gimple_call_builtin_p (bos_stmt
, BUILT_IN_OBJECT_SIZE
))
2218 ubsan_create_edge (bos_stmt
);
2220 /* We have to emit the check. */
2221 t
= force_gimple_operand_gsi (gsi
, t
, true, NULL_TREE
, true,
2223 ptr
= force_gimple_operand_gsi (gsi
, ptr
, true, NULL_TREE
, true,
2225 tree ckind
= build_int_cst (unsigned_char_type_node
,
2226 is_lhs
? UBSAN_STORE_OF
: UBSAN_LOAD_OF
);
2227 gimple
*g
= gimple_build_call_internal (IFN_UBSAN_OBJECT_SIZE
, 4,
2228 ptr
, t
, sizet
, ckind
);
2229 gimple_set_location (g
, loc
);
2230 gsi_insert_before (gsi
, g
, GSI_SAME_STMT
);
2233 /* Instrument values passed to builtin functions. */
2236 instrument_builtin (gimple_stmt_iterator
*gsi
)
2238 gimple
*stmt
= gsi_stmt (*gsi
);
2239 location_t loc
= gimple_location (stmt
);
2241 enum built_in_function fcode
2242 = DECL_FUNCTION_CODE (gimple_call_fndecl (stmt
));
2246 CASE_INT_FN (BUILT_IN_CLZ
):
2249 CASE_INT_FN (BUILT_IN_CTZ
):
2250 arg
= gimple_call_arg (stmt
, 0);
2251 if (!integer_nonzerop (arg
))
2254 if (!is_gimple_val (arg
))
2256 g
= gimple_build_assign (make_ssa_name (TREE_TYPE (arg
)), arg
);
2257 gimple_set_location (g
, loc
);
2258 gsi_insert_before (gsi
, g
, GSI_SAME_STMT
);
2259 arg
= gimple_assign_lhs (g
);
2262 basic_block then_bb
, fallthru_bb
;
2263 *gsi
= create_cond_insert_point (gsi
, true, false, true,
2264 &then_bb
, &fallthru_bb
);
2265 g
= gimple_build_cond (EQ_EXPR
, arg
,
2266 build_zero_cst (TREE_TYPE (arg
)),
2267 NULL_TREE
, NULL_TREE
);
2268 gimple_set_location (g
, loc
);
2269 gsi_insert_after (gsi
, g
, GSI_NEW_STMT
);
2271 *gsi
= gsi_after_labels (then_bb
);
2272 if (flag_sanitize_undefined_trap_on_error
)
2273 g
= gimple_build_call (builtin_decl_explicit (BUILT_IN_TRAP
), 0);
2276 tree t
= build_int_cst (unsigned_char_type_node
, kind
);
2277 tree data
= ubsan_create_data ("__ubsan_builtin_data",
2278 1, &loc
, NULL_TREE
, t
, NULL_TREE
);
2279 data
= build_fold_addr_expr_loc (loc
, data
);
2280 enum built_in_function bcode
2281 = (flag_sanitize_recover
& SANITIZE_BUILTIN
)
2282 ? BUILT_IN_UBSAN_HANDLE_INVALID_BUILTIN
2283 : BUILT_IN_UBSAN_HANDLE_INVALID_BUILTIN_ABORT
;
2284 tree fn
= builtin_decl_explicit (bcode
);
2286 g
= gimple_build_call (fn
, 1, data
);
2288 gimple_set_location (g
, loc
);
2289 gsi_insert_before (gsi
, g
, GSI_SAME_STMT
);
2290 ubsan_create_edge (g
);
2292 *gsi
= gsi_for_stmt (stmt
);
2301 const pass_data pass_data_ubsan
=
2303 GIMPLE_PASS
, /* type */
2305 OPTGROUP_NONE
, /* optinfo_flags */
2306 TV_TREE_UBSAN
, /* tv_id */
2307 ( PROP_cfg
| PROP_ssa
), /* properties_required */
2308 0, /* properties_provided */
2309 0, /* properties_destroyed */
2310 0, /* todo_flags_start */
2311 TODO_update_ssa
, /* todo_flags_finish */
2314 class pass_ubsan
: public gimple_opt_pass
2317 pass_ubsan (gcc::context
*ctxt
)
2318 : gimple_opt_pass (pass_data_ubsan
, ctxt
)
2321 /* opt_pass methods: */
2322 virtual bool gate (function
*)
2324 return sanitize_flags_p ((SANITIZE_NULL
| SANITIZE_SI_OVERFLOW
2325 | SANITIZE_BOOL
| SANITIZE_ENUM
2326 | SANITIZE_ALIGNMENT
2327 | SANITIZE_NONNULL_ATTRIBUTE
2328 | SANITIZE_RETURNS_NONNULL_ATTRIBUTE
2329 | SANITIZE_OBJECT_SIZE
2330 | SANITIZE_POINTER_OVERFLOW
2331 | SANITIZE_BUILTIN
));
2334 virtual unsigned int execute (function
*);
2336 }; // class pass_ubsan
2339 pass_ubsan::execute (function
*fun
)
2342 gimple_stmt_iterator gsi
;
2343 unsigned int ret
= 0;
2345 initialize_sanitizer_builtins ();
2347 FOR_EACH_BB_FN (bb
, fun
)
2349 for (gsi
= gsi_start_bb (bb
); !gsi_end_p (gsi
);)
2351 gimple
*stmt
= gsi_stmt (gsi
);
2352 if (is_gimple_debug (stmt
) || gimple_clobber_p (stmt
))
2358 if ((sanitize_flags_p (SANITIZE_SI_OVERFLOW
, fun
->decl
))
2359 && is_gimple_assign (stmt
))
2360 instrument_si_overflow (gsi
);
2362 if (sanitize_flags_p (SANITIZE_NULL
| SANITIZE_ALIGNMENT
, fun
->decl
))
2364 if (gimple_store_p (stmt
))
2365 instrument_null (gsi
, gimple_get_lhs (stmt
), true);
2366 if (gimple_assign_single_p (stmt
))
2367 instrument_null (gsi
, gimple_assign_rhs1 (stmt
), false);
2368 if (is_gimple_call (stmt
))
2370 unsigned args_num
= gimple_call_num_args (stmt
);
2371 for (unsigned i
= 0; i
< args_num
; ++i
)
2373 tree arg
= gimple_call_arg (stmt
, i
);
2374 if (is_gimple_reg (arg
) || is_gimple_min_invariant (arg
))
2376 instrument_null (gsi
, arg
, false);
2381 if (sanitize_flags_p (SANITIZE_BOOL
| SANITIZE_ENUM
, fun
->decl
)
2382 && gimple_assign_load_p (stmt
))
2384 instrument_bool_enum_load (&gsi
);
2385 bb
= gimple_bb (stmt
);
2388 if (sanitize_flags_p (SANITIZE_NONNULL_ATTRIBUTE
, fun
->decl
)
2389 && is_gimple_call (stmt
)
2390 && !gimple_call_internal_p (stmt
))
2392 instrument_nonnull_arg (&gsi
);
2393 bb
= gimple_bb (stmt
);
2396 if (sanitize_flags_p (SANITIZE_BUILTIN
, fun
->decl
)
2397 && gimple_call_builtin_p (stmt
, BUILT_IN_NORMAL
))
2399 instrument_builtin (&gsi
);
2400 bb
= gimple_bb (stmt
);
2403 if (sanitize_flags_p (SANITIZE_RETURNS_NONNULL_ATTRIBUTE
, fun
->decl
)
2404 && gimple_code (stmt
) == GIMPLE_RETURN
)
2406 instrument_nonnull_return (&gsi
);
2407 bb
= gimple_bb (stmt
);
2410 if (sanitize_flags_p (SANITIZE_OBJECT_SIZE
, fun
->decl
))
2412 if (gimple_store_p (stmt
))
2413 instrument_object_size (&gsi
, gimple_get_lhs (stmt
), true);
2414 if (gimple_assign_load_p (stmt
))
2415 instrument_object_size (&gsi
, gimple_assign_rhs1 (stmt
),
2417 if (is_gimple_call (stmt
))
2419 unsigned args_num
= gimple_call_num_args (stmt
);
2420 for (unsigned i
= 0; i
< args_num
; ++i
)
2422 tree arg
= gimple_call_arg (stmt
, i
);
2423 if (is_gimple_reg (arg
) || is_gimple_min_invariant (arg
))
2425 instrument_object_size (&gsi
, arg
, false);
2430 if (sanitize_flags_p (SANITIZE_POINTER_OVERFLOW
, fun
->decl
))
2432 if (is_gimple_assign (stmt
)
2433 && gimple_assign_rhs_code (stmt
) == POINTER_PLUS_EXPR
)
2434 instrument_pointer_overflow (&gsi
,
2435 gimple_assign_rhs1 (stmt
),
2436 gimple_assign_rhs2 (stmt
));
2437 if (gimple_store_p (stmt
))
2438 maybe_instrument_pointer_overflow (&gsi
,
2439 gimple_get_lhs (stmt
));
2440 if (gimple_assign_single_p (stmt
))
2441 maybe_instrument_pointer_overflow (&gsi
,
2442 gimple_assign_rhs1 (stmt
));
2443 if (is_gimple_call (stmt
))
2445 unsigned args_num
= gimple_call_num_args (stmt
);
2446 for (unsigned i
= 0; i
< args_num
; ++i
)
2448 tree arg
= gimple_call_arg (stmt
, i
);
2449 if (is_gimple_reg (arg
))
2451 maybe_instrument_pointer_overflow (&gsi
, arg
);
2458 if (gimple_purge_dead_eh_edges (bb
))
2459 ret
= TODO_cleanup_cfg
;
2467 make_pass_ubsan (gcc::context
*ctxt
)
2469 return new pass_ubsan (ctxt
);
2472 #include "gt-ubsan.h"