1 //===-- ubsan_handlers_cxx.cc ---------------------------------------------===//
2 //
3 // This file is distributed under the University of Illinois Open Source
4 // License. See LICENSE.TXT for details.
5 //
6 //===----------------------------------------------------------------------===//
7 //
8 // Error logging entry points for the UBSan runtime, which are only used for C++
9 // compilations. This file is permitted to use language features which require
10 // linking against a C++ ABI library.
11 //
12 //===----------------------------------------------------------------------===//
13
14 #include "ubsan_platform.h"
15 #if CAN_SANITIZE_UB
16 #include "ubsan_handlers.h"
17 #include "ubsan_handlers_cxx.h"
18 #include "ubsan_diag.h"
19 #include "ubsan_type_hash.h"
20
21 #include "sanitizer_common/sanitizer_common.h"
22 #include "sanitizer_common/sanitizer_suppressions.h"
23
24 using namespace __sanitizer;
25 using namespace __ubsan;
26
27 namespace __ubsan {
28 extern const char *TypeCheckKinds[];
29 }
30
31 // Returns true if UBSan has printed an error report.
HandleDynamicTypeCacheMiss(DynamicTypeCacheMissData * Data,ValueHandle Pointer,ValueHandle Hash,ReportOptions Opts)32 static bool HandleDynamicTypeCacheMiss(
33 DynamicTypeCacheMissData *Data, ValueHandle Pointer, ValueHandle Hash,
34 ReportOptions Opts) {
35 if (checkDynamicType((void*)Pointer, Data->TypeInfo, Hash))
36 // Just a cache miss. The type matches after all.
37 return false;
38
39 // Check if error report should be suppressed.
40 DynamicTypeInfo DTI = getDynamicTypeInfoFromObject((void*)Pointer);
41 if (DTI.isValid() && IsVptrCheckSuppressed(DTI.getMostDerivedTypeName()))
42 return false;
43
44 SourceLocation Loc = Data->Loc.acquire();
45 ErrorType ET = ErrorType::DynamicTypeMismatch;
46 if (ignoreReport(Loc, Opts, ET))
47 return false;
48
49 ScopedReport R(Opts, Loc, ET);
50
51 Diag(Loc, DL_Error,
52 "%0 address %1 which does not point to an object of type %2")
53 << TypeCheckKinds[Data->TypeCheckKind] << (void*)Pointer << Data->Type;
54
55 // If possible, say what type it actually points to.
56 if (!DTI.isValid()) {
57 if (DTI.getOffset() < -VptrMaxOffsetToTop || DTI.getOffset() > VptrMaxOffsetToTop) {
58 Diag(Pointer, DL_Note, "object has a possibly invalid vptr: abs(offset to top) too big")
59 << TypeName(DTI.getMostDerivedTypeName())
60 << Range(Pointer, Pointer + sizeof(uptr), "possibly invalid vptr");
61 } else {
62 Diag(Pointer, DL_Note, "object has invalid vptr")
63 << TypeName(DTI.getMostDerivedTypeName())
64 << Range(Pointer, Pointer + sizeof(uptr), "invalid vptr");
65 }
66 } else if (!DTI.getOffset())
67 Diag(Pointer, DL_Note, "object is of type %0")
68 << TypeName(DTI.getMostDerivedTypeName())
69 << Range(Pointer, Pointer + sizeof(uptr), "vptr for %0");
70 else
71 // FIXME: Find the type at the specified offset, and include that
72 // in the note.
73 Diag(Pointer - DTI.getOffset(), DL_Note,
74 "object is base class subobject at offset %0 within object of type %1")
75 << DTI.getOffset() << TypeName(DTI.getMostDerivedTypeName())
76 << TypeName(DTI.getSubobjectTypeName())
77 << Range(Pointer, Pointer + sizeof(uptr),
78 "vptr for %2 base class of %1");
79 return true;
80 }
81
__ubsan_handle_dynamic_type_cache_miss(DynamicTypeCacheMissData * Data,ValueHandle Pointer,ValueHandle Hash)82 void __ubsan::__ubsan_handle_dynamic_type_cache_miss(
83 DynamicTypeCacheMissData *Data, ValueHandle Pointer, ValueHandle Hash) {
84 GET_REPORT_OPTIONS(false);
85 HandleDynamicTypeCacheMiss(Data, Pointer, Hash, Opts);
86 }
__ubsan_handle_dynamic_type_cache_miss_abort(DynamicTypeCacheMissData * Data,ValueHandle Pointer,ValueHandle Hash)87 void __ubsan::__ubsan_handle_dynamic_type_cache_miss_abort(
88 DynamicTypeCacheMissData *Data, ValueHandle Pointer, ValueHandle Hash) {
89 // Note: -fsanitize=vptr is always recoverable.
90 GET_REPORT_OPTIONS(false);
91 if (HandleDynamicTypeCacheMiss(Data, Pointer, Hash, Opts))
92 Die();
93 }
94
95 namespace __ubsan {
__ubsan_handle_cfi_bad_type(CFICheckFailData * Data,ValueHandle Vtable,bool ValidVtable,ReportOptions Opts)96 void __ubsan_handle_cfi_bad_type(CFICheckFailData *Data, ValueHandle Vtable,
97 bool ValidVtable, ReportOptions Opts) {
98 SourceLocation Loc = Data->Loc.acquire();
99 ErrorType ET = ErrorType::CFIBadType;
100
101 if (ignoreReport(Loc, Opts, ET))
102 return;
103
104 ScopedReport R(Opts, Loc, ET);
105 DynamicTypeInfo DTI = ValidVtable
106 ? getDynamicTypeInfoFromVtable((void *)Vtable)
107 : DynamicTypeInfo(0, 0, 0);
108
109 const char *CheckKindStr;
110 switch (Data->CheckKind) {
111 case CFITCK_VCall:
112 CheckKindStr = "virtual call";
113 break;
114 case CFITCK_NVCall:
115 CheckKindStr = "non-virtual call";
116 break;
117 case CFITCK_DerivedCast:
118 CheckKindStr = "base-to-derived cast";
119 break;
120 case CFITCK_UnrelatedCast:
121 CheckKindStr = "cast to unrelated type";
122 break;
123 case CFITCK_ICall:
124 default:
125 Die();
126 }
127
128 Diag(Loc, DL_Error, "control flow integrity check for type %0 failed during "
129 "%1 (vtable address %2)")
130 << Data->Type << CheckKindStr << (void *)Vtable;
131
132 // If possible, say what type it actually points to.
133 if (!DTI.isValid()) {
134 const char *module = Symbolizer::GetOrInit()->GetModuleNameForPc(Vtable);
135 if (module)
136 Diag(Vtable, DL_Note, "invalid vtable in module %0") << module;
137 else
138 Diag(Vtable, DL_Note, "invalid vtable");
139 } else {
140 Diag(Vtable, DL_Note, "vtable is of type %0")
141 << TypeName(DTI.getMostDerivedTypeName());
142 }
143 }
144 } // namespace __ubsan
145
146 #endif // CAN_SANITIZE_UB
147