1 //===-- ubsan_handlers_cxx.cc ---------------------------------------------===//
2 //
3 // This file is distributed under the University of Illinois Open Source
4 // License. See LICENSE.TXT for details.
5 //
6 //===----------------------------------------------------------------------===//
7 //
8 // Error logging entry points for the UBSan runtime, which are only used for C++
9 // compilations. This file is permitted to use language features which require
10 // linking against a C++ ABI library.
11 //
12 //===----------------------------------------------------------------------===//
13
14 #include "ubsan_platform.h"
15 #if CAN_SANITIZE_UB
16 #include "ubsan_handlers_cxx.h"
17 #include "ubsan_diag.h"
18 #include "ubsan_type_hash.h"
19
20 #include "sanitizer_common/sanitizer_common.h"
21 #include "sanitizer_common/sanitizer_suppressions.h"
22
23 using namespace __sanitizer;
24 using namespace __ubsan;
25
26 namespace __ubsan {
27 extern const char *TypeCheckKinds[];
28 }
29
HandleDynamicTypeCacheMiss(DynamicTypeCacheMissData * Data,ValueHandle Pointer,ValueHandle Hash,ReportOptions Opts)30 static void HandleDynamicTypeCacheMiss(
31 DynamicTypeCacheMissData *Data, ValueHandle Pointer, ValueHandle Hash,
32 ReportOptions Opts) {
33 if (checkDynamicType((void*)Pointer, Data->TypeInfo, Hash))
34 // Just a cache miss. The type matches after all.
35 return;
36
37 // Check if error report should be suppressed.
38 DynamicTypeInfo DTI = getDynamicTypeInfoFromObject((void*)Pointer);
39 if (DTI.isValid() && IsVptrCheckSuppressed(DTI.getMostDerivedTypeName()))
40 return;
41
42 SourceLocation Loc = Data->Loc.acquire();
43 if (Loc.isDisabled())
44 return;
45
46 ScopedReport R(Opts, Loc, ErrorType::DynamicTypeMismatch);
47
48 Diag(Loc, DL_Error,
49 "%0 address %1 which does not point to an object of type %2")
50 << TypeCheckKinds[Data->TypeCheckKind] << (void*)Pointer << Data->Type;
51
52 // If possible, say what type it actually points to.
53 if (!DTI.isValid())
54 Diag(Pointer, DL_Note, "object has invalid vptr")
55 << TypeName(DTI.getMostDerivedTypeName())
56 << Range(Pointer, Pointer + sizeof(uptr), "invalid vptr");
57 else if (!DTI.getOffset())
58 Diag(Pointer, DL_Note, "object is of type %0")
59 << TypeName(DTI.getMostDerivedTypeName())
60 << Range(Pointer, Pointer + sizeof(uptr), "vptr for %0");
61 else
62 // FIXME: Find the type at the specified offset, and include that
63 // in the note.
64 Diag(Pointer - DTI.getOffset(), DL_Note,
65 "object is base class subobject at offset %0 within object of type %1")
66 << DTI.getOffset() << TypeName(DTI.getMostDerivedTypeName())
67 << TypeName(DTI.getSubobjectTypeName())
68 << Range(Pointer, Pointer + sizeof(uptr),
69 "vptr for %2 base class of %1");
70 }
71
__ubsan_handle_dynamic_type_cache_miss(DynamicTypeCacheMissData * Data,ValueHandle Pointer,ValueHandle Hash)72 void __ubsan::__ubsan_handle_dynamic_type_cache_miss(
73 DynamicTypeCacheMissData *Data, ValueHandle Pointer, ValueHandle Hash) {
74 GET_REPORT_OPTIONS(false);
75 HandleDynamicTypeCacheMiss(Data, Pointer, Hash, Opts);
76 }
__ubsan_handle_dynamic_type_cache_miss_abort(DynamicTypeCacheMissData * Data,ValueHandle Pointer,ValueHandle Hash)77 void __ubsan::__ubsan_handle_dynamic_type_cache_miss_abort(
78 DynamicTypeCacheMissData *Data, ValueHandle Pointer, ValueHandle Hash) {
79 GET_REPORT_OPTIONS(true);
80 HandleDynamicTypeCacheMiss(Data, Pointer, Hash, Opts);
81 }
82
HandleCFIBadType(CFIBadTypeData * Data,ValueHandle Vtable,ReportOptions Opts)83 static void HandleCFIBadType(CFIBadTypeData *Data, ValueHandle Vtable,
84 ReportOptions Opts) {
85 SourceLocation Loc = Data->Loc.acquire();
86 ScopedReport R(Opts, Loc, ErrorType::CFIBadType);
87 DynamicTypeInfo DTI = getDynamicTypeInfoFromVtable((void*)Vtable);
88
89 static const char *TypeCheckKinds[] = {
90 "virtual call",
91 "non-virtual call",
92 "base-to-derived cast",
93 "cast to unrelated type",
94 };
95
96 Diag(Loc, DL_Error, "control flow integrity check for type %0 failed during "
97 "%1 (vtable address %2)")
98 << Data->Type << TypeCheckKinds[Data->TypeCheckKind] << (void *)Vtable;
99
100 // If possible, say what type it actually points to.
101 if (!DTI.isValid())
102 Diag(Vtable, DL_Note, "invalid vtable");
103 else
104 Diag(Vtable, DL_Note, "vtable is of type %0")
105 << TypeName(DTI.getMostDerivedTypeName());
106 }
107
__ubsan_handle_cfi_bad_type(CFIBadTypeData * Data,ValueHandle Vtable)108 void __ubsan::__ubsan_handle_cfi_bad_type(CFIBadTypeData *Data,
109 ValueHandle Vtable) {
110 GET_REPORT_OPTIONS(false);
111 HandleCFIBadType(Data, Vtable, Opts);
112 }
113
__ubsan_handle_cfi_bad_type_abort(CFIBadTypeData * Data,ValueHandle Vtable)114 void __ubsan::__ubsan_handle_cfi_bad_type_abort(CFIBadTypeData *Data,
115 ValueHandle Vtable) {
116 GET_REPORT_OPTIONS(true);
117 HandleCFIBadType(Data, Vtable, Opts);
118 }
119
120 #endif // CAN_SANITIZE_UB
121