]>
Commit | Line | Data |
---|---|---|
de5a5fa1 | 1 | /* UndefinedBehaviorSanitizer, undefined behavior detector. |
8d9254fc | 2 | Copyright (C) 2013-2020 Free Software Foundation, Inc. |
de5a5fa1 MP |
3 | Contributed by Marek Polacek <polacek@redhat.com> |
4 | ||
5 | This file is part of GCC. | |
6 | ||
7 | GCC is free software; you can redistribute it and/or modify it under | |
8 | the terms of the GNU General Public License as published by the Free | |
9 | Software Foundation; either version 3, or (at your option) any later | |
10 | version. | |
11 | ||
12 | GCC is distributed in the hope that it will be useful, but WITHOUT ANY | |
13 | WARRANTY; without even the implied warranty of MERCHANTABILITY or | |
14 | FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License | |
15 | for more details. | |
16 | ||
17 | You should have received a copy of the GNU General Public License | |
18 | along with GCC; see the file COPYING3. If not see | |
19 | <http://www.gnu.org/licenses/>. */ | |
20 | ||
21 | #include "config.h" | |
22 | #include "system.h" | |
23 | #include "coretypes.h" | |
c582198b | 24 | #include "tm.h" |
2adfab87 | 25 | #include "c-family/c-common.h" |
de5a5fa1 | 26 | #include "ubsan.h" |
de5a5fa1 | 27 | #include "c-family/c-ubsan.h" |
944fa280 JJ |
28 | #include "stor-layout.h" |
29 | #include "builtins.h" | |
dc891fe7 | 30 | #include "gimplify.h" |
314e6352 ML |
31 | #include "stringpool.h" |
32 | #include "attribs.h" | |
33 | #include "asan.h" | |
ace83db0 | 34 | #include "langhooks.h" |
de5a5fa1 MP |
35 | |
36 | /* Instrument division by zero and INT_MIN / -1. If not instrumenting, | |
37 | return NULL_TREE. */ | |
38 | ||
39 | tree | |
40 | ubsan_instrument_division (location_t loc, tree op0, tree op1) | |
41 | { | |
42 | tree t, tt; | |
43 | tree type = TREE_TYPE (op0); | |
44 | ||
45 | /* At this point both operands should have the same type, | |
46 | because they are already converted to RESULT_TYPE. | |
47 | Use TYPE_MAIN_VARIANT since typedefs can confuse us. */ | |
ace83db0 JJ |
48 | tree top0 = TYPE_MAIN_VARIANT (type); |
49 | tree top1 = TYPE_MAIN_VARIANT (TREE_TYPE (op1)); | |
50 | gcc_checking_assert (lang_hooks.types_compatible_p (top0, top1)); | |
de5a5fa1 | 51 | |
dc891fe7 MP |
52 | op0 = unshare_expr (op0); |
53 | op1 = unshare_expr (op1); | |
54 | ||
f8ed5150 | 55 | if (TREE_CODE (type) == INTEGER_TYPE |
45b2222a | 56 | && sanitize_flags_p (SANITIZE_DIVIDE)) |
f8ed5150 MP |
57 | t = fold_build2 (EQ_EXPR, boolean_type_node, |
58 | op1, build_int_cst (type, 0)); | |
59 | else if (TREE_CODE (type) == REAL_TYPE | |
45b2222a | 60 | && sanitize_flags_p (SANITIZE_FLOAT_DIVIDE)) |
f8ed5150 MP |
61 | t = fold_build2 (EQ_EXPR, boolean_type_node, |
62 | op1, build_real (type, dconst0)); | |
63 | else | |
de5a5fa1 MP |
64 | return NULL_TREE; |
65 | ||
de5a5fa1 | 66 | /* We check INT_MIN / -1 only for signed types. */ |
f8ed5150 | 67 | if (TREE_CODE (type) == INTEGER_TYPE |
45b2222a | 68 | && sanitize_flags_p (SANITIZE_DIVIDE) |
f8ed5150 | 69 | && !TYPE_UNSIGNED (type)) |
de5a5fa1 MP |
70 | { |
71 | tree x; | |
5a5062b8 | 72 | tt = fold_build2 (EQ_EXPR, boolean_type_node, unshare_expr (op1), |
de5a5fa1 MP |
73 | build_int_cst (type, -1)); |
74 | x = fold_build2 (EQ_EXPR, boolean_type_node, op0, | |
75 | TYPE_MIN_VALUE (type)); | |
76 | x = fold_build2 (TRUTH_AND_EXPR, boolean_type_node, x, tt); | |
77 | t = fold_build2 (TRUTH_OR_EXPR, boolean_type_node, t, x); | |
78 | } | |
79 | ||
b56e9788 MP |
80 | /* If the condition was folded to 0, no need to instrument |
81 | this expression. */ | |
82 | if (integer_zerop (t)) | |
83 | return NULL_TREE; | |
84 | ||
de5a5fa1 | 85 | /* In case we have a SAVE_EXPR in a conditional context, we need to |
974348ee | 86 | make sure it gets evaluated before the condition. */ |
5a5062b8 | 87 | t = fold_build2 (COMPOUND_EXPR, TREE_TYPE (t), unshare_expr (op0), t); |
15dbc1a6 | 88 | t = fold_build2 (COMPOUND_EXPR, TREE_TYPE (t), unshare_expr (op1), t); |
1c33c9b7 JJ |
89 | if (flag_sanitize_undefined_trap_on_error) |
90 | tt = build_call_expr_loc (loc, builtin_decl_explicit (BUILT_IN_TRAP), 0); | |
91 | else | |
92 | { | |
570a11fe JJ |
93 | tree data = ubsan_create_data ("__ubsan_overflow_data", 1, &loc, |
94 | ubsan_type_descriptor (type), NULL_TREE, | |
95 | NULL_TREE); | |
1c33c9b7 JJ |
96 | data = build_fold_addr_expr_loc (loc, data); |
97 | enum built_in_function bcode | |
d95a2703 | 98 | = (flag_sanitize_recover & SANITIZE_DIVIDE) |
1c33c9b7 JJ |
99 | ? BUILT_IN_UBSAN_HANDLE_DIVREM_OVERFLOW |
100 | : BUILT_IN_UBSAN_HANDLE_DIVREM_OVERFLOW_ABORT; | |
101 | tt = builtin_decl_explicit (bcode); | |
5a5062b8 MP |
102 | op0 = unshare_expr (op0); |
103 | op1 = unshare_expr (op1); | |
1c33c9b7 JJ |
104 | tt = build_call_expr_loc (loc, tt, 3, data, ubsan_encode_value (op0), |
105 | ubsan_encode_value (op1)); | |
106 | } | |
632f2871 | 107 | t = fold_build3 (COND_EXPR, void_type_node, t, tt, void_node); |
de5a5fa1 MP |
108 | |
109 | return t; | |
110 | } | |
111 | ||
b906f4ca | 112 | /* Instrument left and right shifts. */ |
de5a5fa1 MP |
113 | |
114 | tree | |
115 | ubsan_instrument_shift (location_t loc, enum tree_code code, | |
116 | tree op0, tree op1) | |
117 | { | |
118 | tree t, tt = NULL_TREE; | |
119 | tree type0 = TREE_TYPE (op0); | |
120 | tree type1 = TREE_TYPE (op1); | |
04a32443 JJ |
121 | if (!INTEGRAL_TYPE_P (type0)) |
122 | return NULL_TREE; | |
123 | ||
de5a5fa1 MP |
124 | tree op1_utype = unsigned_type_for (type1); |
125 | HOST_WIDE_INT op0_prec = TYPE_PRECISION (type0); | |
126 | tree uprecm1 = build_int_cst (op1_utype, op0_prec - 1); | |
de5a5fa1 | 127 | |
dc891fe7 MP |
128 | op0 = unshare_expr (op0); |
129 | op1 = unshare_expr (op1); | |
130 | ||
de5a5fa1 MP |
131 | t = fold_convert_loc (loc, op1_utype, op1); |
132 | t = fold_build2 (GT_EXPR, boolean_type_node, t, uprecm1); | |
133 | ||
b3007644 PB |
134 | /* If this is not a signed operation, don't perform overflow checks. |
135 | Also punt on bit-fields. */ | |
04a32443 | 136 | if (TYPE_OVERFLOW_WRAPS (type0) |
73a699ae RS |
137 | || maybe_ne (GET_MODE_BITSIZE (TYPE_MODE (type0)), |
138 | TYPE_PRECISION (type0)) | |
8ee09943 JJ |
139 | || !sanitize_flags_p (SANITIZE_SHIFT_BASE) |
140 | /* In C++2a and later, shifts are well defined except when | |
141 | the second operand is not within bounds. */ | |
142 | || cxx_dialect >= cxx2a) | |
b3007644 PB |
143 | ; |
144 | ||
de5a5fa1 | 145 | /* For signed x << y, in C99/C11, the following: |
59d7607a | 146 | (unsigned) x >> (uprecm1 - y) |
de5a5fa1 | 147 | if non-zero, is undefined. */ |
b3007644 | 148 | else if (code == LSHIFT_EXPR && flag_isoc99 && cxx_dialect < cxx11) |
de5a5fa1 | 149 | { |
541e35a6 | 150 | tree x = fold_build2 (MINUS_EXPR, op1_utype, uprecm1, |
5a5062b8 | 151 | fold_convert (op1_utype, unshare_expr (op1))); |
de5a5fa1 MP |
152 | tt = fold_convert_loc (loc, unsigned_type_for (type0), op0); |
153 | tt = fold_build2 (RSHIFT_EXPR, TREE_TYPE (tt), tt, x); | |
154 | tt = fold_build2 (NE_EXPR, boolean_type_node, tt, | |
155 | build_int_cst (TREE_TYPE (tt), 0)); | |
156 | } | |
157 | ||
e4276ba5 | 158 | /* For signed x << y, in C++11 and later, the following: |
59d7607a | 159 | x < 0 || ((unsigned) x >> (uprecm1 - y)) |
de5a5fa1 | 160 | if > 1, is undefined. */ |
b3007644 | 161 | else if (code == LSHIFT_EXPR && cxx_dialect >= cxx11) |
de5a5fa1 | 162 | { |
6a4da643 | 163 | tree x = fold_build2 (MINUS_EXPR, op1_utype, uprecm1, |
5a5062b8 MP |
164 | fold_convert (op1_utype, unshare_expr (op1))); |
165 | tt = fold_convert_loc (loc, unsigned_type_for (type0), | |
166 | unshare_expr (op0)); | |
de5a5fa1 MP |
167 | tt = fold_build2 (RSHIFT_EXPR, TREE_TYPE (tt), tt, x); |
168 | tt = fold_build2 (GT_EXPR, boolean_type_node, tt, | |
169 | build_int_cst (TREE_TYPE (tt), 1)); | |
5a5062b8 | 170 | x = fold_build2 (LT_EXPR, boolean_type_node, unshare_expr (op0), |
de5a5fa1 MP |
171 | build_int_cst (type0, 0)); |
172 | tt = fold_build2 (TRUTH_OR_EXPR, boolean_type_node, x, tt); | |
173 | } | |
174 | ||
b56e9788 MP |
175 | /* If the condition was folded to 0, no need to instrument |
176 | this expression. */ | |
177 | if (integer_zerop (t) && (tt == NULL_TREE || integer_zerop (tt))) | |
178 | return NULL_TREE; | |
179 | ||
de5a5fa1 | 180 | /* In case we have a SAVE_EXPR in a conditional context, we need to |
974348ee | 181 | make sure it gets evaluated before the condition. */ |
5a5062b8 | 182 | t = fold_build2 (COMPOUND_EXPR, TREE_TYPE (t), unshare_expr (op0), t); |
3ee0fb02 | 183 | t = fold_build2 (COMPOUND_EXPR, TREE_TYPE (t), unshare_expr (op1), t); |
2e955d50 JJ |
184 | |
185 | enum sanitize_code recover_kind = SANITIZE_SHIFT_EXPONENT; | |
186 | tree else_t = void_node; | |
187 | if (tt) | |
188 | { | |
45b2222a | 189 | if (!sanitize_flags_p (SANITIZE_SHIFT_EXPONENT)) |
2e955d50 JJ |
190 | { |
191 | t = fold_build1 (TRUTH_NOT_EXPR, boolean_type_node, t); | |
192 | t = fold_build2 (TRUTH_AND_EXPR, boolean_type_node, t, tt); | |
193 | recover_kind = SANITIZE_SHIFT_BASE; | |
194 | } | |
195 | else | |
196 | { | |
197 | if (flag_sanitize_undefined_trap_on_error | |
198 | || ((!(flag_sanitize_recover & SANITIZE_SHIFT_EXPONENT)) | |
199 | == (!(flag_sanitize_recover & SANITIZE_SHIFT_BASE)))) | |
200 | t = fold_build2 (TRUTH_OR_EXPR, boolean_type_node, t, tt); | |
201 | else | |
202 | else_t = tt; | |
203 | } | |
204 | } | |
1c33c9b7 JJ |
205 | |
206 | if (flag_sanitize_undefined_trap_on_error) | |
207 | tt = build_call_expr_loc (loc, builtin_decl_explicit (BUILT_IN_TRAP), 0); | |
208 | else | |
209 | { | |
570a11fe | 210 | tree data = ubsan_create_data ("__ubsan_shift_data", 1, &loc, |
0e37a2f3 | 211 | ubsan_type_descriptor (type0), |
570a11fe JJ |
212 | ubsan_type_descriptor (type1), NULL_TREE, |
213 | NULL_TREE); | |
1c33c9b7 JJ |
214 | data = build_fold_addr_expr_loc (loc, data); |
215 | ||
216 | enum built_in_function bcode | |
2e955d50 | 217 | = (flag_sanitize_recover & recover_kind) |
1c33c9b7 JJ |
218 | ? BUILT_IN_UBSAN_HANDLE_SHIFT_OUT_OF_BOUNDS |
219 | : BUILT_IN_UBSAN_HANDLE_SHIFT_OUT_OF_BOUNDS_ABORT; | |
220 | tt = builtin_decl_explicit (bcode); | |
5a5062b8 MP |
221 | op0 = unshare_expr (op0); |
222 | op1 = unshare_expr (op1); | |
1c33c9b7 JJ |
223 | tt = build_call_expr_loc (loc, tt, 3, data, ubsan_encode_value (op0), |
224 | ubsan_encode_value (op1)); | |
2e955d50 JJ |
225 | if (else_t != void_node) |
226 | { | |
227 | bcode = (flag_sanitize_recover & SANITIZE_SHIFT_BASE) | |
228 | ? BUILT_IN_UBSAN_HANDLE_SHIFT_OUT_OF_BOUNDS | |
229 | : BUILT_IN_UBSAN_HANDLE_SHIFT_OUT_OF_BOUNDS_ABORT; | |
230 | tree else_tt = builtin_decl_explicit (bcode); | |
231 | op0 = unshare_expr (op0); | |
232 | op1 = unshare_expr (op1); | |
233 | else_tt = build_call_expr_loc (loc, else_tt, 3, data, | |
234 | ubsan_encode_value (op0), | |
235 | ubsan_encode_value (op1)); | |
236 | else_t = fold_build3 (COND_EXPR, void_type_node, else_t, | |
237 | else_tt, void_node); | |
238 | } | |
1c33c9b7 | 239 | } |
2e955d50 | 240 | t = fold_build3 (COND_EXPR, void_type_node, t, tt, else_t); |
de5a5fa1 MP |
241 | |
242 | return t; | |
243 | } | |
b906f4ca MP |
244 | |
245 | /* Instrument variable length array bound. */ | |
246 | ||
247 | tree | |
248 | ubsan_instrument_vla (location_t loc, tree size) | |
249 | { | |
250 | tree type = TREE_TYPE (size); | |
251 | tree t, tt; | |
252 | ||
253 | t = fold_build2 (LE_EXPR, boolean_type_node, size, build_int_cst (type, 0)); | |
1c33c9b7 JJ |
254 | if (flag_sanitize_undefined_trap_on_error) |
255 | tt = build_call_expr_loc (loc, builtin_decl_explicit (BUILT_IN_TRAP), 0); | |
256 | else | |
257 | { | |
570a11fe JJ |
258 | tree data = ubsan_create_data ("__ubsan_vla_data", 1, &loc, |
259 | ubsan_type_descriptor (type), NULL_TREE, | |
260 | NULL_TREE); | |
1c33c9b7 JJ |
261 | data = build_fold_addr_expr_loc (loc, data); |
262 | enum built_in_function bcode | |
d95a2703 | 263 | = (flag_sanitize_recover & SANITIZE_VLA) |
1c33c9b7 JJ |
264 | ? BUILT_IN_UBSAN_HANDLE_VLA_BOUND_NOT_POSITIVE |
265 | : BUILT_IN_UBSAN_HANDLE_VLA_BOUND_NOT_POSITIVE_ABORT; | |
266 | tt = builtin_decl_explicit (bcode); | |
267 | tt = build_call_expr_loc (loc, tt, 2, data, ubsan_encode_value (size)); | |
268 | } | |
632f2871 | 269 | t = fold_build3 (COND_EXPR, void_type_node, t, tt, void_node); |
b906f4ca MP |
270 | |
271 | return t; | |
272 | } | |
0a508bb6 JJ |
273 | |
274 | /* Instrument missing return in C++ functions returning non-void. */ | |
275 | ||
276 | tree | |
277 | ubsan_instrument_return (location_t loc) | |
278 | { | |
1c33c9b7 JJ |
279 | if (flag_sanitize_undefined_trap_on_error) |
280 | return build_call_expr_loc (loc, builtin_decl_explicit (BUILT_IN_TRAP), 0); | |
6525783a | 281 | |
570a11fe JJ |
282 | tree data = ubsan_create_data ("__ubsan_missing_return_data", 1, &loc, |
283 | NULL_TREE, NULL_TREE); | |
0a508bb6 JJ |
284 | tree t = builtin_decl_explicit (BUILT_IN_UBSAN_HANDLE_MISSING_RETURN); |
285 | return build_call_expr_loc (loc, t, 1, build_fold_addr_expr_loc (loc, data)); | |
286 | } | |
0e37a2f3 MP |
287 | |
288 | /* Instrument array bounds for ARRAY_REFs. We create special builtin, | |
289 | that gets expanded in the sanopt pass, and make an array dimension | |
290 | of it. ARRAY is the array, *INDEX is an index to the array. | |
291 | Return NULL_TREE if no instrumentation is emitted. | |
292 | IGNORE_OFF_BY_ONE is true if the ARRAY_REF is inside a ADDR_EXPR. */ | |
293 | ||
294 | tree | |
295 | ubsan_instrument_bounds (location_t loc, tree array, tree *index, | |
296 | bool ignore_off_by_one) | |
297 | { | |
298 | tree type = TREE_TYPE (array); | |
299 | tree domain = TYPE_DOMAIN (type); | |
300 | ||
4d661eaa | 301 | if (domain == NULL_TREE || TYPE_MAX_VALUE (domain) == NULL_TREE) |
0e37a2f3 MP |
302 | return NULL_TREE; |
303 | ||
304 | tree bound = TYPE_MAX_VALUE (domain); | |
305 | if (ignore_off_by_one) | |
306 | bound = fold_build2 (PLUS_EXPR, TREE_TYPE (bound), bound, | |
307 | build_int_cst (TREE_TYPE (bound), 1)); | |
308 | ||
e0f0d3b9 MP |
309 | /* Detect flexible array members and suchlike, unless |
310 | -fsanitize=bounds-strict. */ | |
0e37a2f3 | 311 | tree base = get_base_address (array); |
45b2222a | 312 | if (!sanitize_flags_p (SANITIZE_BOUNDS_STRICT) |
e0f0d3b9 | 313 | && TREE_CODE (array) == COMPONENT_REF |
22d03525 | 314 | && base && (INDIRECT_REF_P (base) || TREE_CODE (base) == MEM_REF)) |
0e37a2f3 MP |
315 | { |
316 | tree next = NULL_TREE; | |
317 | tree cref = array; | |
318 | ||
319 | /* Walk all structs/unions. */ | |
320 | while (TREE_CODE (cref) == COMPONENT_REF) | |
321 | { | |
322 | if (TREE_CODE (TREE_TYPE (TREE_OPERAND (cref, 0))) == RECORD_TYPE) | |
323 | for (next = DECL_CHAIN (TREE_OPERAND (cref, 1)); | |
324 | next && TREE_CODE (next) != FIELD_DECL; | |
325 | next = DECL_CHAIN (next)) | |
326 | ; | |
327 | if (next) | |
328 | /* Not a last element. Instrument it. */ | |
329 | break; | |
330 | /* Ok, this is the last field of the structure/union. But the | |
331 | aggregate containing the field must be the last field too, | |
332 | recursively. */ | |
333 | cref = TREE_OPERAND (cref, 0); | |
334 | } | |
335 | if (!next) | |
336 | /* Don't instrument this flexible array member-like array in non-strict | |
337 | -fsanitize=bounds mode. */ | |
338 | return NULL_TREE; | |
339 | } | |
340 | ||
570a11fe JJ |
341 | /* Don't emit instrumentation in the most common cases. */ |
342 | tree idx = NULL_TREE; | |
343 | if (TREE_CODE (*index) == INTEGER_CST) | |
344 | idx = *index; | |
345 | else if (TREE_CODE (*index) == BIT_AND_EXPR | |
346 | && TREE_CODE (TREE_OPERAND (*index, 1)) == INTEGER_CST) | |
347 | idx = TREE_OPERAND (*index, 1); | |
348 | if (idx | |
349 | && TREE_CODE (bound) == INTEGER_CST | |
350 | && tree_int_cst_sgn (idx) >= 0 | |
351 | && tree_int_cst_le (idx, bound)) | |
352 | return NULL_TREE; | |
353 | ||
0e37a2f3 MP |
354 | *index = save_expr (*index); |
355 | /* Create a "(T *) 0" tree node to describe the array type. */ | |
356 | tree zero_with_type = build_int_cst (build_pointer_type (type), 0); | |
357 | return build_call_expr_internal_loc (loc, IFN_UBSAN_BOUNDS, | |
358 | void_type_node, 3, zero_with_type, | |
359 | *index, bound); | |
360 | } | |
361 | ||
362 | /* Return true iff T is an array that was instrumented by SANITIZE_BOUNDS. */ | |
363 | ||
364 | bool | |
365 | ubsan_array_ref_instrumented_p (const_tree t) | |
366 | { | |
367 | if (TREE_CODE (t) != ARRAY_REF) | |
368 | return false; | |
369 | ||
370 | tree op1 = TREE_OPERAND (t, 1); | |
371 | return TREE_CODE (op1) == COMPOUND_EXPR | |
372 | && TREE_CODE (TREE_OPERAND (op1, 0)) == CALL_EXPR | |
373 | && CALL_EXPR_FN (TREE_OPERAND (op1, 0)) == NULL_TREE | |
374 | && CALL_EXPR_IFN (TREE_OPERAND (op1, 0)) == IFN_UBSAN_BOUNDS; | |
375 | } | |
376 | ||
377 | /* Instrument an ARRAY_REF, if it hasn't already been instrumented. | |
378 | IGNORE_OFF_BY_ONE is true if the ARRAY_REF is inside a ADDR_EXPR. */ | |
379 | ||
380 | void | |
381 | ubsan_maybe_instrument_array_ref (tree *expr_p, bool ignore_off_by_one) | |
382 | { | |
383 | if (!ubsan_array_ref_instrumented_p (*expr_p) | |
f34ebeb2 ML |
384 | && sanitize_flags_p (SANITIZE_BOUNDS | SANITIZE_BOUNDS_STRICT) |
385 | && current_function_decl != NULL_TREE) | |
0e37a2f3 MP |
386 | { |
387 | tree op0 = TREE_OPERAND (*expr_p, 0); | |
388 | tree op1 = TREE_OPERAND (*expr_p, 1); | |
389 | tree e = ubsan_instrument_bounds (EXPR_LOCATION (*expr_p), op0, &op1, | |
390 | ignore_off_by_one); | |
391 | if (e != NULL_TREE) | |
392 | { | |
393 | tree t = copy_node (*expr_p); | |
394 | TREE_OPERAND (t, 1) = build2 (COMPOUND_EXPR, TREE_TYPE (op1), | |
395 | e, op1); | |
396 | *expr_p = t; | |
397 | } | |
398 | } | |
399 | } | |
944fa280 JJ |
400 | |
401 | static tree | |
c39a5e99 | 402 | ubsan_maybe_instrument_reference_or_call (location_t loc, tree op, tree ptype, |
944fa280 JJ |
403 | enum ubsan_null_ckind ckind) |
404 | { | |
f34ebeb2 ML |
405 | if (!sanitize_flags_p (SANITIZE_ALIGNMENT | SANITIZE_NULL) |
406 | || current_function_decl == NULL_TREE) | |
944fa280 JJ |
407 | return NULL_TREE; |
408 | ||
c39a5e99 JJ |
409 | tree type = TREE_TYPE (ptype); |
410 | tree orig_op = op; | |
411 | bool instrument = false; | |
412 | unsigned int mina = 0; | |
413 | ||
45b2222a | 414 | if (sanitize_flags_p (SANITIZE_ALIGNMENT)) |
944fa280 JJ |
415 | { |
416 | mina = min_align_of_type (type); | |
417 | if (mina <= 1) | |
418 | mina = 0; | |
419 | } | |
420 | while ((TREE_CODE (op) == NOP_EXPR | |
421 | || TREE_CODE (op) == NON_LVALUE_EXPR) | |
422 | && TREE_CODE (TREE_TYPE (op)) == POINTER_TYPE) | |
423 | op = TREE_OPERAND (op, 0); | |
424 | if (TREE_CODE (op) == NOP_EXPR | |
425 | && TREE_CODE (TREE_TYPE (op)) == REFERENCE_TYPE) | |
426 | { | |
427 | if (mina && mina > min_align_of_type (TREE_TYPE (TREE_TYPE (op)))) | |
428 | instrument = true; | |
429 | } | |
430 | else | |
431 | { | |
45b2222a | 432 | if (sanitize_flags_p (SANITIZE_NULL) && TREE_CODE (op) == ADDR_EXPR) |
944fa280 JJ |
433 | { |
434 | bool strict_overflow_p = false; | |
435 | /* tree_single_nonzero_warnv_p will not return true for non-weak | |
436 | non-automatic decls with -fno-delete-null-pointer-checks, | |
437 | which is disabled during -fsanitize=null. We don't want to | |
438 | instrument those, just weak vars though. */ | |
439 | int save_flag_delete_null_pointer_checks | |
440 | = flag_delete_null_pointer_checks; | |
441 | flag_delete_null_pointer_checks = 1; | |
442 | if (!tree_single_nonzero_warnv_p (op, &strict_overflow_p) | |
443 | || strict_overflow_p) | |
444 | instrument = true; | |
445 | flag_delete_null_pointer_checks | |
446 | = save_flag_delete_null_pointer_checks; | |
447 | } | |
45b2222a | 448 | else if (sanitize_flags_p (SANITIZE_NULL)) |
944fa280 | 449 | instrument = true; |
c39a5e99 JJ |
450 | if (mina && mina > 1) |
451 | { | |
452 | if (!POINTER_TYPE_P (TREE_TYPE (op)) | |
453 | || mina > get_pointer_alignment (op) / BITS_PER_UNIT) | |
454 | instrument = true; | |
455 | } | |
944fa280 JJ |
456 | } |
457 | if (!instrument) | |
458 | return NULL_TREE; | |
459 | op = save_expr (orig_op); | |
c39a5e99 JJ |
460 | gcc_assert (POINTER_TYPE_P (ptype)); |
461 | if (TREE_CODE (ptype) == REFERENCE_TYPE) | |
462 | ptype = build_pointer_type (TREE_TYPE (ptype)); | |
463 | tree kind = build_int_cst (ptype, ckind); | |
944fa280 JJ |
464 | tree align = build_int_cst (pointer_sized_int_node, mina); |
465 | tree call | |
466 | = build_call_expr_internal_loc (loc, IFN_UBSAN_NULL, void_type_node, | |
467 | 3, op, kind, align); | |
468 | TREE_SIDE_EFFECTS (call) = 1; | |
469 | return fold_build2 (COMPOUND_EXPR, TREE_TYPE (op), call, op); | |
470 | } | |
471 | ||
6f3af356 JJ |
472 | /* Instrument a NOP_EXPR to REFERENCE_TYPE or INTEGER_CST with REFERENCE_TYPE |
473 | type if needed. */ | |
944fa280 JJ |
474 | |
475 | void | |
6f3af356 | 476 | ubsan_maybe_instrument_reference (tree *stmt_p) |
944fa280 | 477 | { |
6f3af356 JJ |
478 | tree stmt = *stmt_p; |
479 | tree op = stmt; | |
480 | if (TREE_CODE (stmt) == NOP_EXPR) | |
481 | op = TREE_OPERAND (stmt, 0); | |
944fa280 | 482 | op = ubsan_maybe_instrument_reference_or_call (EXPR_LOCATION (stmt), op, |
c39a5e99 | 483 | TREE_TYPE (stmt), |
944fa280 JJ |
484 | UBSAN_REF_BINDING); |
485 | if (op) | |
6f3af356 JJ |
486 | { |
487 | if (TREE_CODE (stmt) == NOP_EXPR) | |
488 | TREE_OPERAND (stmt, 0) = op; | |
489 | else | |
490 | *stmt_p = op; | |
491 | } | |
944fa280 JJ |
492 | } |
493 | ||
494 | /* Instrument a CALL_EXPR to a method if needed. */ | |
495 | ||
496 | void | |
497 | ubsan_maybe_instrument_member_call (tree stmt, bool is_ctor) | |
498 | { | |
499 | if (call_expr_nargs (stmt) == 0) | |
500 | return; | |
501 | tree op = CALL_EXPR_ARG (stmt, 0); | |
502 | if (op == error_mark_node | |
503 | || !POINTER_TYPE_P (TREE_TYPE (op))) | |
504 | return; | |
505 | op = ubsan_maybe_instrument_reference_or_call (EXPR_LOCATION (stmt), op, | |
c39a5e99 | 506 | TREE_TYPE (op), |
944fa280 JJ |
507 | is_ctor ? UBSAN_CTOR_CALL |
508 | : UBSAN_MEMBER_CALL); | |
509 | if (op) | |
510 | CALL_EXPR_ARG (stmt, 0) = op; | |
511 | } |