replica
/
hanchenye-llvm-project
2
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

[ASan] Poison the leftmost shadow byte with a special value so that we can find 

the beginning of the fake frame when reporting an use-after-return error.
Fixes http://code.google.com/p/address-sanitizer/issues/detail?id=126

llvm-svn: 168040
This commit is contained in:
Alexander Potapenko 2012-11-15 13:40:44 +00:00
parent cc9ffd1f8a
commit b34db9e883
4 changed files with 10 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
compiler-rt/lib/asan/asan_allocator.cc
View File

@ -998,6 +998,10 @@ void FakeStack::OnFree(uptr ptr, uptr size, uptr real_stack) {
CHECK(fake_frame->descr != 0);
CHECK(fake_frame->size_minus_one == size - 1);
PoisonShadow(ptr, size, kAsanStackAfterReturnMagic);
CHECK(size >= SHADOW_GRANULARITY);
// Poison the leftmost shadow byte with a special value so that we can find
// the beginning of the fake frame when reporting an error.
PoisonShadow(ptr, SHADOW_GRANULARITY, kAsanStackAfterReturnLeftMagic);
}
} // namespace __asan

1
compiler-rt/lib/asan/asan_internal.h
View File

@ -160,6 +160,7 @@ const int kAsanStackPartialRedzoneMagic = 0xf4;
const int kAsanStackAfterReturnMagic = 0xf5;
const int kAsanInitializationOrderMagic = 0xf6;
const int kAsanUserPoisonedMemoryMagic = 0xf7;
const int kAsanStackAfterReturnLeftMagic = 0xf8;
const int kAsanGlobalRedzoneMagic = 0xf9;
const int kAsanInternalHeapMagic = 0xfe;

1
compiler-rt/lib/asan/asan_report.cc
View File

@ -450,6 +450,7 @@ void __asan_report_error(uptr pc, uptr bp, uptr sp,
bug_descr = "stack-buffer-overflow";
break;
case kAsanStackAfterReturnMagic:
case kAsanStackAfterReturnLeftMagic:
bug_descr = "stack-use-after-return";
break;
case kAsanUserPoisonedMemoryMagic:

6
compiler-rt/lib/asan/asan_thread.cc
View File

@ -131,12 +131,14 @@ const char *AsanThread::GetFrameNameByAddr(uptr addr, uptr *offset) {
u8 *shadow_bottom = (u8*)MemToShadow(bottom);
while (shadow_ptr >= shadow_bottom &&
*shadow_ptr != kAsanStackLeftRedzoneMagic) {
*shadow_ptr != kAsanStackLeftRedzoneMagic &&
*shadow_ptr != kAsanStackAfterReturnLeftMagic) {
shadow_ptr--;
}
while (shadow_ptr >= shadow_bottom &&
*shadow_ptr == kAsanStackLeftRedzoneMagic) {
(*shadow_ptr == kAsanStackLeftRedzoneMagic ||
*shadow_ptr == kAsanStackAfterReturnLeftMagic)) {
shadow_ptr--;
}