1 //===-- ubsan_handlers_cxx.cc ---------------------------------------------===//
3 // This file is distributed under the University of Illinois Open Source
4 // License. See LICENSE.TXT for details.
6 //===----------------------------------------------------------------------===//
8 // Error logging entry points for the UBSan runtime, which are only used for C++
9 // compilations. This file is permitted to use language features which require
10 // linking against a C++ ABI library.
12 //===----------------------------------------------------------------------===//
14 #include "ubsan_platform.h"
16 #include "ubsan_handlers.h"
17 #include "ubsan_handlers_cxx.h"
18 #include "ubsan_diag.h"
19 #include "ubsan_type_hash.h"
21 #include "sanitizer_common/sanitizer_common.h"
22 #include "sanitizer_common/sanitizer_suppressions.h"
24 using namespace __sanitizer
;
25 using namespace __ubsan
;
28 extern const char *TypeCheckKinds
[];
31 // Returns true if UBSan has printed an error report.
32 static bool HandleDynamicTypeCacheMiss(
33 DynamicTypeCacheMissData
*Data
, ValueHandle Pointer
, ValueHandle Hash
,
35 if (checkDynamicType((void*)Pointer
, Data
->TypeInfo
, Hash
))
36 // Just a cache miss. The type matches after all.
39 // Check if error report should be suppressed.
40 DynamicTypeInfo DTI
= getDynamicTypeInfoFromObject((void*)Pointer
);
41 if (DTI
.isValid() && IsVptrCheckSuppressed(DTI
.getMostDerivedTypeName()))
44 SourceLocation Loc
= Data
->Loc
.acquire();
45 ErrorType ET
= ErrorType::DynamicTypeMismatch
;
46 if (ignoreReport(Loc
, Opts
, ET
))
49 ScopedReport
R(Opts
, Loc
, ET
);
51 Diag(Loc
, DL_Error
, ET
,
52 "%0 address %1 which does not point to an object of type %2")
53 << TypeCheckKinds
[Data
->TypeCheckKind
] << (void*)Pointer
<< Data
->Type
;
55 // If possible, say what type it actually points to.
57 if (DTI
.getOffset() < -VptrMaxOffsetToTop
|| DTI
.getOffset() > VptrMaxOffsetToTop
) {
58 Diag(Pointer
, DL_Note
, ET
,
59 "object has a possibly invalid vptr: abs(offset to top) too big")
60 << TypeName(DTI
.getMostDerivedTypeName())
61 << Range(Pointer
, Pointer
+ sizeof(uptr
), "possibly invalid vptr");
63 Diag(Pointer
, DL_Note
, ET
, "object has invalid vptr")
64 << TypeName(DTI
.getMostDerivedTypeName())
65 << Range(Pointer
, Pointer
+ sizeof(uptr
), "invalid vptr");
67 } else if (!DTI
.getOffset())
68 Diag(Pointer
, DL_Note
, ET
, "object is of type %0")
69 << TypeName(DTI
.getMostDerivedTypeName())
70 << Range(Pointer
, Pointer
+ sizeof(uptr
), "vptr for %0");
72 // FIXME: Find the type at the specified offset, and include that
74 Diag(Pointer
- DTI
.getOffset(), DL_Note
, ET
,
75 "object is base class subobject at offset %0 within object of type %1")
76 << DTI
.getOffset() << TypeName(DTI
.getMostDerivedTypeName())
77 << TypeName(DTI
.getSubobjectTypeName())
78 << Range(Pointer
, Pointer
+ sizeof(uptr
),
79 "vptr for %2 base class of %1");
83 void __ubsan::__ubsan_handle_dynamic_type_cache_miss(
84 DynamicTypeCacheMissData
*Data
, ValueHandle Pointer
, ValueHandle Hash
) {
85 GET_REPORT_OPTIONS(false);
86 HandleDynamicTypeCacheMiss(Data
, Pointer
, Hash
, Opts
);
88 void __ubsan::__ubsan_handle_dynamic_type_cache_miss_abort(
89 DynamicTypeCacheMissData
*Data
, ValueHandle Pointer
, ValueHandle Hash
) {
90 // Note: -fsanitize=vptr is always recoverable.
91 GET_REPORT_OPTIONS(false);
92 if (HandleDynamicTypeCacheMiss(Data
, Pointer
, Hash
, Opts
))
97 void __ubsan_handle_cfi_bad_type(CFICheckFailData
*Data
, ValueHandle Vtable
,
98 bool ValidVtable
, ReportOptions Opts
) {
99 SourceLocation Loc
= Data
->Loc
.acquire();
100 ErrorType ET
= ErrorType::CFIBadType
;
102 if (ignoreReport(Loc
, Opts
, ET
))
105 ScopedReport
R(Opts
, Loc
, ET
);
106 DynamicTypeInfo DTI
= ValidVtable
107 ? getDynamicTypeInfoFromVtable((void *)Vtable
)
108 : DynamicTypeInfo(0, 0, 0);
110 const char *CheckKindStr
;
111 switch (Data
->CheckKind
) {
113 CheckKindStr
= "virtual call";
116 CheckKindStr
= "non-virtual call";
118 case CFITCK_DerivedCast
:
119 CheckKindStr
= "base-to-derived cast";
121 case CFITCK_UnrelatedCast
:
122 CheckKindStr
= "cast to unrelated type";
125 CheckKindStr
= "virtual pointer to member function call";
128 case CFITCK_NVMFCall
:
132 Diag(Loc
, DL_Error
, ET
,
133 "control flow integrity check for type %0 failed during "
134 "%1 (vtable address %2)")
135 << Data
->Type
<< CheckKindStr
<< (void *)Vtable
;
137 // If possible, say what type it actually points to.
139 Diag(Vtable
, DL_Note
, ET
, "invalid vtable");
141 Diag(Vtable
, DL_Note
, ET
, "vtable is of type %0")
142 << TypeName(DTI
.getMostDerivedTypeName());
144 // If the failure involved different DSOs for the check location and vtable,
145 // report the DSO names.
146 const char *DstModule
= Symbolizer::GetOrInit()->GetModuleNameForPc(Vtable
);
148 DstModule
= "(unknown)";
150 const char *SrcModule
= Symbolizer::GetOrInit()->GetModuleNameForPc(Opts
.pc
);
152 SrcModule
= "(unknown)";
154 if (internal_strcmp(SrcModule
, DstModule
))
155 Diag(Loc
, DL_Note
, ET
, "check failed in %0, vtable located in %1")
156 << SrcModule
<< DstModule
;
158 } // namespace __ubsan
160 #endif // CAN_SANITIZE_UB