[thirdparty/gcc.git] / gcc / c-family / c-ubsan.c

/* UndefinedBehaviorSanitizer, undefined behavior detector.
   Copyright (C) 2013-2017 Free Software Foundation, Inc.
   Contributed by Marek Polacek <polacek@redhat.com>

This file is part of GCC.

GCC is free software; you can redistribute it and/or modify it under
the terms of the GNU General Public License as published by the Free
Software Foundation; either version 3, or (at your option) any later
version.

GCC is distributed in the hope that it will be useful, but WITHOUT ANY
WARRANTY; without even the implied warranty of MERCHANTABILITY or
FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
for more details.

You should have received a copy of the GNU General Public License
along with GCC; see the file COPYING3.  If not see
<http://www.gnu.org/licenses/>.  */

#include "config.h"
#include "system.h"
#include "coretypes.h"
#include "tm.h"
#include "c-family/c-common.h"
#include "ubsan.h"
#include "c-family/c-ubsan.h"
#include "asan.h"
#include "stor-layout.h"
#include "builtins.h"
#include "gimplify.h"

/* Instrument division by zero and INT_MIN / -1.  If not instrumenting,
   return NULL_TREE.  */

tree
ubsan_instrument_division (location_t loc, tree op0, tree op1)
{
  tree t, tt;
  tree type = TREE_TYPE (op0);

  /* At this point both operands should have the same type,
     because they are already converted to RESULT_TYPE.
     Use TYPE_MAIN_VARIANT since typedefs can confuse us.  */
  gcc_assert (TYPE_MAIN_VARIANT (TREE_TYPE (op0))
	      == TYPE_MAIN_VARIANT (TREE_TYPE (op1)));

  op0 = unshare_expr (op0);
  op1 = unshare_expr (op1);

  if (TREE_CODE (type) == INTEGER_TYPE
      && (flag_sanitize & SANITIZE_DIVIDE))
    t = fold_build2 (EQ_EXPR, boolean_type_node,
		     op1, build_int_cst (type, 0));
  else if (TREE_CODE (type) == REAL_TYPE
	   && (flag_sanitize & SANITIZE_FLOAT_DIVIDE))
    t = fold_build2 (EQ_EXPR, boolean_type_node,
		     op1, build_real (type, dconst0));
  else
    return NULL_TREE;

  /* We check INT_MIN / -1 only for signed types.  */
  if (TREE_CODE (type) == INTEGER_TYPE
      && (flag_sanitize & SANITIZE_DIVIDE)
      && !TYPE_UNSIGNED (type))
    {
      tree x;
      tt = fold_build2 (EQ_EXPR, boolean_type_node, unshare_expr (op1),
			build_int_cst (type, -1));
      x = fold_build2 (EQ_EXPR, boolean_type_node, op0,
		       TYPE_MIN_VALUE (type));
      x = fold_build2 (TRUTH_AND_EXPR, boolean_type_node, x, tt);
      t = fold_build2 (TRUTH_OR_EXPR, boolean_type_node, t, x);
    }

  /* If the condition was folded to 0, no need to instrument
     this expression.  */
  if (integer_zerop (t))
    return NULL_TREE;

  /* In case we have a SAVE_EXPR in a conditional context, we need to
     make sure it gets evaluated before the condition.  */
  t = fold_build2 (COMPOUND_EXPR, TREE_TYPE (t), unshare_expr (op0), t);
  t = fold_build2 (COMPOUND_EXPR, TREE_TYPE (t), unshare_expr (op1), t);
  if (flag_sanitize_undefined_trap_on_error)
    tt = build_call_expr_loc (loc, builtin_decl_explicit (BUILT_IN_TRAP), 0);
  else
    {
      tree data = ubsan_create_data ("__ubsan_overflow_data", 1, &loc,
				     ubsan_type_descriptor (type), NULL_TREE,
				     NULL_TREE);
      data = build_fold_addr_expr_loc (loc, data);
      enum built_in_function bcode
	= (flag_sanitize_recover & SANITIZE_DIVIDE)
	  ? BUILT_IN_UBSAN_HANDLE_DIVREM_OVERFLOW
	  : BUILT_IN_UBSAN_HANDLE_DIVREM_OVERFLOW_ABORT;
      tt = builtin_decl_explicit (bcode);
      op0 = unshare_expr (op0);
      op1 = unshare_expr (op1);
      tt = build_call_expr_loc (loc, tt, 3, data, ubsan_encode_value (op0),
				ubsan_encode_value (op1));
    }
  t = fold_build3 (COND_EXPR, void_type_node, t, tt, void_node);

  return t;
}

/* Instrument left and right shifts.  */

tree
ubsan_instrument_shift (location_t loc, enum tree_code code,
			tree op0, tree op1)
{
  tree t, tt = NULL_TREE;
  tree type0 = TREE_TYPE (op0);
  tree type1 = TREE_TYPE (op1);
  if (!INTEGRAL_TYPE_P (type0))
    return NULL_TREE;

  tree op1_utype = unsigned_type_for (type1);
  HOST_WIDE_INT op0_prec = TYPE_PRECISION (type0);
  tree uprecm1 = build_int_cst (op1_utype, op0_prec - 1);

  op0 = unshare_expr (op0);
  op1 = unshare_expr (op1);

  t = fold_convert_loc (loc, op1_utype, op1);
  t = fold_build2 (GT_EXPR, boolean_type_node, t, uprecm1);

  /* If this is not a signed operation, don't perform overflow checks.
     Also punt on bit-fields.  */
  if (TYPE_OVERFLOW_WRAPS (type0)
      || GET_MODE_BITSIZE (TYPE_MODE (type0)) != TYPE_PRECISION (type0)
      || (flag_sanitize & SANITIZE_SHIFT_BASE) == 0)
    ;

  /* For signed x << y, in C99/C11, the following:
     (unsigned) x >> (uprecm1 - y)
     if non-zero, is undefined.  */
  else if (code == LSHIFT_EXPR && flag_isoc99 && cxx_dialect < cxx11)
    {
      tree x = fold_build2 (MINUS_EXPR, op1_utype, uprecm1,
			    fold_convert (op1_utype, unshare_expr (op1)));
      tt = fold_convert_loc (loc, unsigned_type_for (type0), op0);
      tt = fold_build2 (RSHIFT_EXPR, TREE_TYPE (tt), tt, x);
      tt = fold_build2 (NE_EXPR, boolean_type_node, tt,
			build_int_cst (TREE_TYPE (tt), 0));
    }

  /* For signed x << y, in C++11 and later, the following:
     x < 0 || ((unsigned) x >> (uprecm1 - y))
     if > 1, is undefined.  */
  else if (code == LSHIFT_EXPR && cxx_dialect >= cxx11)
    {
      tree x = fold_build2 (MINUS_EXPR, op1_utype, uprecm1,
			    fold_convert (op1_utype, unshare_expr (op1)));
      tt = fold_convert_loc (loc, unsigned_type_for (type0),
			     unshare_expr (op0));
      tt = fold_build2 (RSHIFT_EXPR, TREE_TYPE (tt), tt, x);
      tt = fold_build2 (GT_EXPR, boolean_type_node, tt,
			build_int_cst (TREE_TYPE (tt), 1));
      x = fold_build2 (LT_EXPR, boolean_type_node, unshare_expr (op0),
		       build_int_cst (type0, 0));
      tt = fold_build2 (TRUTH_OR_EXPR, boolean_type_node, x, tt);
    }

  /* If the condition was folded to 0, no need to instrument
     this expression.  */
  if (integer_zerop (t) && (tt == NULL_TREE || integer_zerop (tt)))
    return NULL_TREE;

  /* In case we have a SAVE_EXPR in a conditional context, we need to
     make sure it gets evaluated before the condition.  */
  t = fold_build2 (COMPOUND_EXPR, TREE_TYPE (t), unshare_expr (op0), t);

  enum sanitize_code recover_kind = SANITIZE_SHIFT_EXPONENT;
  tree else_t = void_node;
  if (tt)
    {
      if ((flag_sanitize & SANITIZE_SHIFT_EXPONENT) == 0)
	{
	  t = fold_build1 (TRUTH_NOT_EXPR, boolean_type_node, t);
	  t = fold_build2 (TRUTH_AND_EXPR, boolean_type_node, t, tt);
	  recover_kind = SANITIZE_SHIFT_BASE;
	}
      else
	{
	  if (flag_sanitize_undefined_trap_on_error
	      || ((!(flag_sanitize_recover & SANITIZE_SHIFT_EXPONENT))
		  == (!(flag_sanitize_recover & SANITIZE_SHIFT_BASE))))
	    t = fold_build2 (TRUTH_OR_EXPR, boolean_type_node, t, tt);
	  else
	    else_t = tt;
	}
    }

  if (flag_sanitize_undefined_trap_on_error)
    tt = build_call_expr_loc (loc, builtin_decl_explicit (BUILT_IN_TRAP), 0);
  else
    {
      tree data = ubsan_create_data ("__ubsan_shift_data", 1, &loc,
				     ubsan_type_descriptor (type0),
				     ubsan_type_descriptor (type1), NULL_TREE,
				     NULL_TREE);
      data = build_fold_addr_expr_loc (loc, data);

      enum built_in_function bcode
	= (flag_sanitize_recover & recover_kind)
	  ? BUILT_IN_UBSAN_HANDLE_SHIFT_OUT_OF_BOUNDS
	  : BUILT_IN_UBSAN_HANDLE_SHIFT_OUT_OF_BOUNDS_ABORT;
      tt = builtin_decl_explicit (bcode);
      op0 = unshare_expr (op0);
      op1 = unshare_expr (op1);
      tt = build_call_expr_loc (loc, tt, 3, data, ubsan_encode_value (op0),
				ubsan_encode_value (op1));
      if (else_t != void_node)
	{
	  bcode = (flag_sanitize_recover & SANITIZE_SHIFT_BASE)
		  ? BUILT_IN_UBSAN_HANDLE_SHIFT_OUT_OF_BOUNDS
		  : BUILT_IN_UBSAN_HANDLE_SHIFT_OUT_OF_BOUNDS_ABORT;
	  tree else_tt = builtin_decl_explicit (bcode);
	  op0 = unshare_expr (op0);
	  op1 = unshare_expr (op1);
	  else_tt = build_call_expr_loc (loc, else_tt, 3, data,
					 ubsan_encode_value (op0),
					 ubsan_encode_value (op1));
	  else_t = fold_build3 (COND_EXPR, void_type_node, else_t,
				else_tt, void_node);
	}
    }
  t = fold_build3 (COND_EXPR, void_type_node, t, tt, else_t);

  return t;
}

/* Instrument variable length array bound.  */

tree
ubsan_instrument_vla (location_t loc, tree size)
{
  tree type = TREE_TYPE (size);
  tree t, tt;

  t = fold_build2 (LE_EXPR, boolean_type_node, size, build_int_cst (type, 0));
  if (flag_sanitize_undefined_trap_on_error)
    tt = build_call_expr_loc (loc, builtin_decl_explicit (BUILT_IN_TRAP), 0);
  else
    {
      tree data = ubsan_create_data ("__ubsan_vla_data", 1, &loc,
				     ubsan_type_descriptor (type), NULL_TREE,
				     NULL_TREE);
      data = build_fold_addr_expr_loc (loc, data);
      enum built_in_function bcode
	= (flag_sanitize_recover & SANITIZE_VLA)
	  ? BUILT_IN_UBSAN_HANDLE_VLA_BOUND_NOT_POSITIVE
	  : BUILT_IN_UBSAN_HANDLE_VLA_BOUND_NOT_POSITIVE_ABORT;
      tt = builtin_decl_explicit (bcode);
      tt = build_call_expr_loc (loc, tt, 2, data, ubsan_encode_value (size));
    }
  t = fold_build3 (COND_EXPR, void_type_node, t, tt, void_node);

  return t;
}

/* Instrument missing return in C++ functions returning non-void.  */

tree
ubsan_instrument_return (location_t loc)
{
  if (flag_sanitize_undefined_trap_on_error)
    return build_call_expr_loc (loc, builtin_decl_explicit (BUILT_IN_TRAP), 0);

  tree data = ubsan_create_data ("__ubsan_missing_return_data", 1, &loc,
				 NULL_TREE, NULL_TREE);
  tree t = builtin_decl_explicit (BUILT_IN_UBSAN_HANDLE_MISSING_RETURN);
  return build_call_expr_loc (loc, t, 1, build_fold_addr_expr_loc (loc, data));
}

/* Instrument array bounds for ARRAY_REFs.  We create special builtin,
   that gets expanded in the sanopt pass, and make an array dimension
   of it.  ARRAY is the array, *INDEX is an index to the array.
   Return NULL_TREE if no instrumentation is emitted.
   IGNORE_OFF_BY_ONE is true if the ARRAY_REF is inside a ADDR_EXPR.  */

tree
ubsan_instrument_bounds (location_t loc, tree array, tree *index,
			 bool ignore_off_by_one)
{
  tree type = TREE_TYPE (array);
  tree domain = TYPE_DOMAIN (type);

  if (domain == NULL_TREE || TYPE_MAX_VALUE (domain) == NULL_TREE)
    return NULL_TREE;

  tree bound = TYPE_MAX_VALUE (domain);
  if (ignore_off_by_one)
    bound = fold_build2 (PLUS_EXPR, TREE_TYPE (bound), bound,
			 build_int_cst (TREE_TYPE (bound), 1));

  /* Detect flexible array members and suchlike, unless
     -fsanitize=bounds-strict.  */
  tree base = get_base_address (array);
  if ((flag_sanitize & SANITIZE_BOUNDS_STRICT) == 0
      && TREE_CODE (array) == COMPONENT_REF
      && base && (INDIRECT_REF_P (base) || TREE_CODE (base) == MEM_REF))
    {
      tree next = NULL_TREE;
      tree cref = array;

      /* Walk all structs/unions.  */
      while (TREE_CODE (cref) == COMPONENT_REF)
	{
	  if (TREE_CODE (TREE_TYPE (TREE_OPERAND (cref, 0))) == RECORD_TYPE)
	    for (next = DECL_CHAIN (TREE_OPERAND (cref, 1));
		 next && TREE_CODE (next) != FIELD_DECL;
		 next = DECL_CHAIN (next))
	      ;
	  if (next)
	    /* Not a last element.  Instrument it.  */
	    break;
	  /* Ok, this is the last field of the structure/union.  But the
	     aggregate containing the field must be the last field too,
	     recursively.  */
	  cref = TREE_OPERAND (cref, 0);
	}
      if (!next)
	/* Don't instrument this flexible array member-like array in non-strict
	   -fsanitize=bounds mode.  */
        return NULL_TREE;
    }

  /* Don't emit instrumentation in the most common cases.  */
  tree idx = NULL_TREE;
  if (TREE_CODE (*index) == INTEGER_CST)
    idx = *index;
  else if (TREE_CODE (*index) == BIT_AND_EXPR
	   && TREE_CODE (TREE_OPERAND (*index, 1)) == INTEGER_CST)
    idx = TREE_OPERAND (*index, 1);
  if (idx
      && TREE_CODE (bound) == INTEGER_CST
      && tree_int_cst_sgn (idx) >= 0
      && tree_int_cst_le (idx, bound))
    return NULL_TREE;

  *index = save_expr (*index);
  /* Create a "(T *) 0" tree node to describe the array type.  */
  tree zero_with_type = build_int_cst (build_pointer_type (type), 0);
  return build_call_expr_internal_loc (loc, IFN_UBSAN_BOUNDS,
				       void_type_node, 3, zero_with_type,
				       *index, bound);
}

/* Return true iff T is an array that was instrumented by SANITIZE_BOUNDS.  */

bool
ubsan_array_ref_instrumented_p (const_tree t)
{
  if (TREE_CODE (t) != ARRAY_REF)
    return false;

  tree op1 = TREE_OPERAND (t, 1);
  return TREE_CODE (op1) == COMPOUND_EXPR
	 && TREE_CODE (TREE_OPERAND (op1, 0)) == CALL_EXPR
	 && CALL_EXPR_FN (TREE_OPERAND (op1, 0)) == NULL_TREE
	 && CALL_EXPR_IFN (TREE_OPERAND (op1, 0)) == IFN_UBSAN_BOUNDS;
}

/* Instrument an ARRAY_REF, if it hasn't already been instrumented.
   IGNORE_OFF_BY_ONE is true if the ARRAY_REF is inside a ADDR_EXPR.  */

void
ubsan_maybe_instrument_array_ref (tree *expr_p, bool ignore_off_by_one)
{
  if (!ubsan_array_ref_instrumented_p (*expr_p)
      && do_ubsan_in_current_function ())
    {
      tree op0 = TREE_OPERAND (*expr_p, 0);
      tree op1 = TREE_OPERAND (*expr_p, 1);
      tree e = ubsan_instrument_bounds (EXPR_LOCATION (*expr_p), op0, &op1,
					ignore_off_by_one);
      if (e != NULL_TREE)
	{
	  tree t = copy_node (*expr_p);
	  TREE_OPERAND (t, 1) = build2 (COMPOUND_EXPR, TREE_TYPE (op1),
					e, op1);
	  *expr_p = t;
	}
    }
}

static tree
ubsan_maybe_instrument_reference_or_call (location_t loc, tree op, tree ptype,
					  enum ubsan_null_ckind ckind)
{
  if (!do_ubsan_in_current_function ())
    return NULL_TREE;

  tree type = TREE_TYPE (ptype);
  tree orig_op = op;
  bool instrument = false;
  unsigned int mina = 0;

  if (flag_sanitize & SANITIZE_ALIGNMENT)
    {
      mina = min_align_of_type (type);
      if (mina <= 1)
	mina = 0;
    }
  while ((TREE_CODE (op) == NOP_EXPR
	  || TREE_CODE (op) == NON_LVALUE_EXPR)
	 && TREE_CODE (TREE_TYPE (op)) == POINTER_TYPE)
    op = TREE_OPERAND (op, 0);
  if (TREE_CODE (op) == NOP_EXPR
      && TREE_CODE (TREE_TYPE (op)) == REFERENCE_TYPE)
    {
      if (mina && mina > min_align_of_type (TREE_TYPE (TREE_TYPE (op))))
	instrument = true;
    }
  else
    {
      if ((flag_sanitize & SANITIZE_NULL) && TREE_CODE (op) == ADDR_EXPR)
	{
	  bool strict_overflow_p = false;
	  /* tree_single_nonzero_warnv_p will not return true for non-weak
	     non-automatic decls with -fno-delete-null-pointer-checks,
	     which is disabled during -fsanitize=null.  We don't want to
	     instrument those, just weak vars though.  */
	  int save_flag_delete_null_pointer_checks
	    = flag_delete_null_pointer_checks;
	  flag_delete_null_pointer_checks = 1;
	  if (!tree_single_nonzero_warnv_p (op, &strict_overflow_p)
	      || strict_overflow_p)
	    instrument = true;
	  flag_delete_null_pointer_checks
	    = save_flag_delete_null_pointer_checks;
	}
      else if (flag_sanitize & SANITIZE_NULL)
	instrument = true;
      if (mina && mina > 1)
	{
	  if (!POINTER_TYPE_P (TREE_TYPE (op))
	      || mina > get_pointer_alignment (op) / BITS_PER_UNIT)
	    instrument = true;
	}
    }
  if (!instrument)
    return NULL_TREE;
  op = save_expr (orig_op);
  gcc_assert (POINTER_TYPE_P (ptype));
  if (TREE_CODE (ptype) == REFERENCE_TYPE)
    ptype = build_pointer_type (TREE_TYPE (ptype));
  tree kind = build_int_cst (ptype, ckind);
  tree align = build_int_cst (pointer_sized_int_node, mina);
  tree call
    = build_call_expr_internal_loc (loc, IFN_UBSAN_NULL, void_type_node,
				    3, op, kind, align);
  TREE_SIDE_EFFECTS (call) = 1;
  return fold_build2 (COMPOUND_EXPR, TREE_TYPE (op), call, op);
}

/* Instrument a NOP_EXPR to REFERENCE_TYPE if needed.  */

void
ubsan_maybe_instrument_reference (tree stmt)
{
  tree op = TREE_OPERAND (stmt, 0);
  op = ubsan_maybe_instrument_reference_or_call (EXPR_LOCATION (stmt), op,
						 TREE_TYPE (stmt),
						 UBSAN_REF_BINDING);
  if (op)
    TREE_OPERAND (stmt, 0) = op;
}

/* Instrument a CALL_EXPR to a method if needed.  */

void
ubsan_maybe_instrument_member_call (tree stmt, bool is_ctor)
{
  if (call_expr_nargs (stmt) == 0)
    return;
  tree op = CALL_EXPR_ARG (stmt, 0);
  if (op == error_mark_node
      || !POINTER_TYPE_P (TREE_TYPE (op)))
    return;
  op = ubsan_maybe_instrument_reference_or_call (EXPR_LOCATION (stmt), op,
						 TREE_TYPE (op),
						 is_ctor ? UBSAN_CTOR_CALL
						 : UBSAN_MEMBER_CALL);
  if (op)
    CALL_EXPR_ARG (stmt, 0) = op;
}
Commit	Line	Data
de5a5fa1	1	/* UndefinedBehaviorSanitizer, undefined behavior detector.
cbe34bb5	2	Copyright (C) 2013-2017 Free Software Foundation, Inc.
de5a5fa1 MP	3	Contributed by Marek Polacek <polacek@redhat.com>
	4
	5	This file is part of GCC.
	6
	7	GCC is free software; you can redistribute it and/or modify it under
	8	the terms of the GNU General Public License as published by the Free
	9	Software Foundation; either version 3, or (at your option) any later
	10	version.
	11
	12	GCC is distributed in the hope that it will be useful, but WITHOUT ANY
	13	WARRANTY; without even the implied warranty of MERCHANTABILITY or
	14	FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
	15	for more details.
	16
	17	You should have received a copy of the GNU General Public License
	18	along with GCC; see the file COPYING3. If not see
	19	<http://www.gnu.org/licenses/>. */
	20
	21	#include "config.h"
	22	#include "system.h"
	23	#include "coretypes.h"
c582198b	24	#include "tm.h"
2adfab87	25	#include "c-family/c-common.h"
de5a5fa1	26	#include "ubsan.h"
de5a5fa1	27	#include "c-family/c-ubsan.h"
6525783a	28	#include "asan.h"
944fa280 JJ	29	#include "stor-layout.h"
944fa280 JJ	30	#include "builtins.h"
dc891fe7	31	#include "gimplify.h"
de5a5fa1 MP	32
	33	/* Instrument division by zero and INT_MIN / -1. If not instrumenting,
	34	return NULL_TREE. */
	35
	36	tree
	37	ubsan_instrument_division (location_t loc, tree op0, tree op1)
	38	{
	39	tree t, tt;
	40	tree type = TREE_TYPE (op0);
	41
	42	/* At this point both operands should have the same type,
	43	because they are already converted to RESULT_TYPE.
	44	Use TYPE_MAIN_VARIANT since typedefs can confuse us. */
	45	gcc_assert (TYPE_MAIN_VARIANT (TREE_TYPE (op0))
	46	== TYPE_MAIN_VARIANT (TREE_TYPE (op1)));
	47
dc891fe7 MP	48	op0 = unshare_expr (op0);
	49	op1 = unshare_expr (op1);
	50
f8ed5150 MP	51	if (TREE_CODE (type) == INTEGER_TYPE
	52	&& (flag_sanitize & SANITIZE_DIVIDE))
	53	t = fold_build2 (EQ_EXPR, boolean_type_node,
	54	op1, build_int_cst (type, 0));
	55	else if (TREE_CODE (type) == REAL_TYPE
	56	&& (flag_sanitize & SANITIZE_FLOAT_DIVIDE))
	57	t = fold_build2 (EQ_EXPR, boolean_type_node,
	58	op1, build_real (type, dconst0));
	59	else
de5a5fa1 MP	60	return NULL_TREE;
de5a5fa1 MP	61
de5a5fa1	62	/* We check INT_MIN / -1 only for signed types. */
f8ed5150 MP	63	if (TREE_CODE (type) == INTEGER_TYPE
	64	&& (flag_sanitize & SANITIZE_DIVIDE)
	65	&& !TYPE_UNSIGNED (type))
de5a5fa1 MP	66	{
de5a5fa1 MP	67	tree x;
5a5062b8	68	tt = fold_build2 (EQ_EXPR, boolean_type_node, unshare_expr (op1),
de5a5fa1 MP	69	build_int_cst (type, -1));
	70	x = fold_build2 (EQ_EXPR, boolean_type_node, op0,
	71	TYPE_MIN_VALUE (type));
	72	x = fold_build2 (TRUTH_AND_EXPR, boolean_type_node, x, tt);
	73	t = fold_build2 (TRUTH_OR_EXPR, boolean_type_node, t, x);
	74	}
	75
b56e9788 MP	76	/* If the condition was folded to 0, no need to instrument
	77	this expression. */
	78	if (integer_zerop (t))
	79	return NULL_TREE;
	80
de5a5fa1	81	/* In case we have a SAVE_EXPR in a conditional context, we need to
974348ee	82	make sure it gets evaluated before the condition. */
5a5062b8	83	t = fold_build2 (COMPOUND_EXPR, TREE_TYPE (t), unshare_expr (op0), t);
15dbc1a6	84	t = fold_build2 (COMPOUND_EXPR, TREE_TYPE (t), unshare_expr (op1), t);
1c33c9b7 JJ	85	if (flag_sanitize_undefined_trap_on_error)
	86	tt = build_call_expr_loc (loc, builtin_decl_explicit (BUILT_IN_TRAP), 0);
	87	else
	88	{
570a11fe JJ	89	tree data = ubsan_create_data ("__ubsan_overflow_data", 1, &loc,
	90	ubsan_type_descriptor (type), NULL_TREE,
	91	NULL_TREE);
1c33c9b7 JJ	92	data = build_fold_addr_expr_loc (loc, data);
1c33c9b7 JJ	93	enum built_in_function bcode
d95a2703	94	= (flag_sanitize_recover & SANITIZE_DIVIDE)
1c33c9b7 JJ	95	? BUILT_IN_UBSAN_HANDLE_DIVREM_OVERFLOW
	96	: BUILT_IN_UBSAN_HANDLE_DIVREM_OVERFLOW_ABORT;
	97	tt = builtin_decl_explicit (bcode);
5a5062b8 MP	98	op0 = unshare_expr (op0);
5a5062b8 MP	99	op1 = unshare_expr (op1);
1c33c9b7 JJ	100	tt = build_call_expr_loc (loc, tt, 3, data, ubsan_encode_value (op0),
	101	ubsan_encode_value (op1));
	102	}
632f2871	103	t = fold_build3 (COND_EXPR, void_type_node, t, tt, void_node);
de5a5fa1 MP	104
	105	return t;
	106	}
	107
b906f4ca	108	/* Instrument left and right shifts. */
de5a5fa1 MP	109
	110	tree
	111	ubsan_instrument_shift (location_t loc, enum tree_code code,
	112	tree op0, tree op1)
	113	{
	114	tree t, tt = NULL_TREE;
	115	tree type0 = TREE_TYPE (op0);
	116	tree type1 = TREE_TYPE (op1);
04a32443 JJ	117	if (!INTEGRAL_TYPE_P (type0))
	118	return NULL_TREE;
	119
de5a5fa1 MP	120	tree op1_utype = unsigned_type_for (type1);
	121	HOST_WIDE_INT op0_prec = TYPE_PRECISION (type0);
	122	tree uprecm1 = build_int_cst (op1_utype, op0_prec - 1);
de5a5fa1	123
dc891fe7 MP	124	op0 = unshare_expr (op0);
	125	op1 = unshare_expr (op1);
	126
de5a5fa1 MP	127	t = fold_convert_loc (loc, op1_utype, op1);
	128	t = fold_build2 (GT_EXPR, boolean_type_node, t, uprecm1);
	129
b3007644 PB	130	/* If this is not a signed operation, don't perform overflow checks.
b3007644 PB	131	Also punt on bit-fields. */
04a32443	132	if (TYPE_OVERFLOW_WRAPS (type0)
2e955d50 JJ	133	\|\| GET_MODE_BITSIZE (TYPE_MODE (type0)) != TYPE_PRECISION (type0)
2e955d50 JJ	134	\|\| (flag_sanitize & SANITIZE_SHIFT_BASE) == 0)
b3007644 PB	135	;
b3007644 PB	136
de5a5fa1	137	/* For signed x << y, in C99/C11, the following:
59d7607a	138	(unsigned) x >> (uprecm1 - y)
de5a5fa1	139	if non-zero, is undefined. */
b3007644	140	else if (code == LSHIFT_EXPR && flag_isoc99 && cxx_dialect < cxx11)
de5a5fa1	141	{
541e35a6	142	tree x = fold_build2 (MINUS_EXPR, op1_utype, uprecm1,
5a5062b8	143	fold_convert (op1_utype, unshare_expr (op1)));
de5a5fa1 MP	144	tt = fold_convert_loc (loc, unsigned_type_for (type0), op0);
	145	tt = fold_build2 (RSHIFT_EXPR, TREE_TYPE (tt), tt, x);
	146	tt = fold_build2 (NE_EXPR, boolean_type_node, tt,
	147	build_int_cst (TREE_TYPE (tt), 0));
	148	}
	149
e4276ba5	150	/* For signed x << y, in C++11 and later, the following:
59d7607a	151	x < 0 \|\| ((unsigned) x >> (uprecm1 - y))
de5a5fa1	152	if > 1, is undefined. */
b3007644	153	else if (code == LSHIFT_EXPR && cxx_dialect >= cxx11)
de5a5fa1	154	{
6a4da643	155	tree x = fold_build2 (MINUS_EXPR, op1_utype, uprecm1,
5a5062b8 MP	156	fold_convert (op1_utype, unshare_expr (op1)));
	157	tt = fold_convert_loc (loc, unsigned_type_for (type0),
	158	unshare_expr (op0));
de5a5fa1 MP	159	tt = fold_build2 (RSHIFT_EXPR, TREE_TYPE (tt), tt, x);
	160	tt = fold_build2 (GT_EXPR, boolean_type_node, tt,
	161	build_int_cst (TREE_TYPE (tt), 1));
5a5062b8	162	x = fold_build2 (LT_EXPR, boolean_type_node, unshare_expr (op0),
de5a5fa1 MP	163	build_int_cst (type0, 0));
	164	tt = fold_build2 (TRUTH_OR_EXPR, boolean_type_node, x, tt);
	165	}
	166
b56e9788 MP	167	/* If the condition was folded to 0, no need to instrument
	168	this expression. */
	169	if (integer_zerop (t) && (tt == NULL_TREE \|\| integer_zerop (tt)))
	170	return NULL_TREE;
	171
de5a5fa1	172	/* In case we have a SAVE_EXPR in a conditional context, we need to
974348ee	173	make sure it gets evaluated before the condition. */
5a5062b8	174	t = fold_build2 (COMPOUND_EXPR, TREE_TYPE (t), unshare_expr (op0), t);
2e955d50 JJ	175
	176	enum sanitize_code recover_kind = SANITIZE_SHIFT_EXPONENT;
	177	tree else_t = void_node;
	178	if (tt)
	179	{
	180	if ((flag_sanitize & SANITIZE_SHIFT_EXPONENT) == 0)
	181	{
	182	t = fold_build1 (TRUTH_NOT_EXPR, boolean_type_node, t);
	183	t = fold_build2 (TRUTH_AND_EXPR, boolean_type_node, t, tt);
	184	recover_kind = SANITIZE_SHIFT_BASE;
	185	}
	186	else
	187	{
	188	if (flag_sanitize_undefined_trap_on_error
	189	\|\| ((!(flag_sanitize_recover & SANITIZE_SHIFT_EXPONENT))
	190	== (!(flag_sanitize_recover & SANITIZE_SHIFT_BASE))))
	191	t = fold_build2 (TRUTH_OR_EXPR, boolean_type_node, t, tt);
	192	else
	193	else_t = tt;
	194	}
	195	}
1c33c9b7 JJ	196
	197	if (flag_sanitize_undefined_trap_on_error)
	198	tt = build_call_expr_loc (loc, builtin_decl_explicit (BUILT_IN_TRAP), 0);
	199	else
	200	{
570a11fe	201	tree data = ubsan_create_data ("__ubsan_shift_data", 1, &loc,
0e37a2f3	202	ubsan_type_descriptor (type0),
570a11fe JJ	203	ubsan_type_descriptor (type1), NULL_TREE,
570a11fe JJ	204	NULL_TREE);
1c33c9b7 JJ	205	data = build_fold_addr_expr_loc (loc, data);
	206
	207	enum built_in_function bcode
2e955d50	208	= (flag_sanitize_recover & recover_kind)
1c33c9b7 JJ	209	? BUILT_IN_UBSAN_HANDLE_SHIFT_OUT_OF_BOUNDS
	210	: BUILT_IN_UBSAN_HANDLE_SHIFT_OUT_OF_BOUNDS_ABORT;
	211	tt = builtin_decl_explicit (bcode);
5a5062b8 MP	212	op0 = unshare_expr (op0);
5a5062b8 MP	213	op1 = unshare_expr (op1);
1c33c9b7 JJ	214	tt = build_call_expr_loc (loc, tt, 3, data, ubsan_encode_value (op0),
1c33c9b7 JJ	215	ubsan_encode_value (op1));
2e955d50 JJ	216	if (else_t != void_node)
	217	{
	218	bcode = (flag_sanitize_recover & SANITIZE_SHIFT_BASE)
	219	? BUILT_IN_UBSAN_HANDLE_SHIFT_OUT_OF_BOUNDS
	220	: BUILT_IN_UBSAN_HANDLE_SHIFT_OUT_OF_BOUNDS_ABORT;
	221	tree else_tt = builtin_decl_explicit (bcode);
	222	op0 = unshare_expr (op0);
	223	op1 = unshare_expr (op1);
	224	else_tt = build_call_expr_loc (loc, else_tt, 3, data,
	225	ubsan_encode_value (op0),
	226	ubsan_encode_value (op1));
	227	else_t = fold_build3 (COND_EXPR, void_type_node, else_t,
	228	else_tt, void_node);
	229	}
1c33c9b7	230	}
2e955d50	231	t = fold_build3 (COND_EXPR, void_type_node, t, tt, else_t);
de5a5fa1 MP	232
	233	return t;
	234	}
b906f4ca MP	235
	236	/* Instrument variable length array bound. */
	237
	238	tree
	239	ubsan_instrument_vla (location_t loc, tree size)
	240	{
	241	tree type = TREE_TYPE (size);
	242	tree t, tt;
	243
	244	t = fold_build2 (LE_EXPR, boolean_type_node, size, build_int_cst (type, 0));
1c33c9b7 JJ	245	if (flag_sanitize_undefined_trap_on_error)
	246	tt = build_call_expr_loc (loc, builtin_decl_explicit (BUILT_IN_TRAP), 0);
	247	else
	248	{
570a11fe JJ	249	tree data = ubsan_create_data ("__ubsan_vla_data", 1, &loc,
	250	ubsan_type_descriptor (type), NULL_TREE,
	251	NULL_TREE);
1c33c9b7 JJ	252	data = build_fold_addr_expr_loc (loc, data);
1c33c9b7 JJ	253	enum built_in_function bcode
d95a2703	254	= (flag_sanitize_recover & SANITIZE_VLA)
1c33c9b7 JJ	255	? BUILT_IN_UBSAN_HANDLE_VLA_BOUND_NOT_POSITIVE
	256	: BUILT_IN_UBSAN_HANDLE_VLA_BOUND_NOT_POSITIVE_ABORT;
	257	tt = builtin_decl_explicit (bcode);
	258	tt = build_call_expr_loc (loc, tt, 2, data, ubsan_encode_value (size));
	259	}
632f2871	260	t = fold_build3 (COND_EXPR, void_type_node, t, tt, void_node);
b906f4ca MP	261
	262	return t;
	263	}
0a508bb6 JJ	264
	265	/* Instrument missing return in C++ functions returning non-void. */
	266
	267	tree
	268	ubsan_instrument_return (location_t loc)
	269	{
1c33c9b7 JJ	270	if (flag_sanitize_undefined_trap_on_error)
1c33c9b7 JJ	271	return build_call_expr_loc (loc, builtin_decl_explicit (BUILT_IN_TRAP), 0);
6525783a	272
570a11fe JJ	273	tree data = ubsan_create_data ("__ubsan_missing_return_data", 1, &loc,
570a11fe JJ	274	NULL_TREE, NULL_TREE);
0a508bb6 JJ	275	tree t = builtin_decl_explicit (BUILT_IN_UBSAN_HANDLE_MISSING_RETURN);
	276	return build_call_expr_loc (loc, t, 1, build_fold_addr_expr_loc (loc, data));
	277	}
0e37a2f3 MP	278
	279	/* Instrument array bounds for ARRAY_REFs. We create special builtin,
	280	that gets expanded in the sanopt pass, and make an array dimension
	281	of it. ARRAY is the array, *INDEX is an index to the array.
	282	Return NULL_TREE if no instrumentation is emitted.
	283	IGNORE_OFF_BY_ONE is true if the ARRAY_REF is inside a ADDR_EXPR. */
	284
	285	tree
	286	ubsan_instrument_bounds (location_t loc, tree array, tree *index,
	287	bool ignore_off_by_one)
	288	{
	289	tree type = TREE_TYPE (array);
	290	tree domain = TYPE_DOMAIN (type);
	291
4d661eaa	292	if (domain == NULL_TREE \|\| TYPE_MAX_VALUE (domain) == NULL_TREE)
0e37a2f3 MP	293	return NULL_TREE;
	294
	295	tree bound = TYPE_MAX_VALUE (domain);
	296	if (ignore_off_by_one)
	297	bound = fold_build2 (PLUS_EXPR, TREE_TYPE (bound), bound,
	298	build_int_cst (TREE_TYPE (bound), 1));
	299
e0f0d3b9 MP	300	/* Detect flexible array members and suchlike, unless
e0f0d3b9 MP	301	-fsanitize=bounds-strict. */
0e37a2f3	302	tree base = get_base_address (array);
e0f0d3b9 MP	303	if ((flag_sanitize & SANITIZE_BOUNDS_STRICT) == 0
e0f0d3b9 MP	304	&& TREE_CODE (array) == COMPONENT_REF
22d03525	305	&& base && (INDIRECT_REF_P (base) \|\| TREE_CODE (base) == MEM_REF))
0e37a2f3 MP	306	{
	307	tree next = NULL_TREE;
	308	tree cref = array;
	309
	310	/* Walk all structs/unions. */
	311	while (TREE_CODE (cref) == COMPONENT_REF)
	312	{
	313	if (TREE_CODE (TREE_TYPE (TREE_OPERAND (cref, 0))) == RECORD_TYPE)
	314	for (next = DECL_CHAIN (TREE_OPERAND (cref, 1));
	315	next && TREE_CODE (next) != FIELD_DECL;
	316	next = DECL_CHAIN (next))
	317	;
	318	if (next)
	319	/* Not a last element. Instrument it. */
	320	break;
	321	/* Ok, this is the last field of the structure/union. But the
	322	aggregate containing the field must be the last field too,
	323	recursively. */
	324	cref = TREE_OPERAND (cref, 0);
	325	}
	326	if (!next)
	327	/* Don't instrument this flexible array member-like array in non-strict
	328	-fsanitize=bounds mode. */
	329	return NULL_TREE;
	330	}
	331
570a11fe JJ	332	/* Don't emit instrumentation in the most common cases. */
	333	tree idx = NULL_TREE;
	334	if (TREE_CODE (*index) == INTEGER_CST)
	335	idx = *index;
	336	else if (TREE_CODE (*index) == BIT_AND_EXPR
	337	&& TREE_CODE (TREE_OPERAND (*index, 1)) == INTEGER_CST)
	338	idx = TREE_OPERAND (*index, 1);
	339	if (idx
	340	&& TREE_CODE (bound) == INTEGER_CST
	341	&& tree_int_cst_sgn (idx) >= 0
	342	&& tree_int_cst_le (idx, bound))
	343	return NULL_TREE;
	344
0e37a2f3 MP	345	index = save_expr (index);
	346	/* Create a "(T ) 0" tree node to describe the array type. /
	347	tree zero_with_type = build_int_cst (build_pointer_type (type), 0);
	348	return build_call_expr_internal_loc (loc, IFN_UBSAN_BOUNDS,
	349	void_type_node, 3, zero_with_type,
	350	*index, bound);
	351	}
	352
	353	/* Return true iff T is an array that was instrumented by SANITIZE_BOUNDS. */
	354
	355	bool
	356	ubsan_array_ref_instrumented_p (const_tree t)
	357	{
	358	if (TREE_CODE (t) != ARRAY_REF)
	359	return false;
	360
	361	tree op1 = TREE_OPERAND (t, 1);
	362	return TREE_CODE (op1) == COMPOUND_EXPR
	363	&& TREE_CODE (TREE_OPERAND (op1, 0)) == CALL_EXPR
	364	&& CALL_EXPR_FN (TREE_OPERAND (op1, 0)) == NULL_TREE
	365	&& CALL_EXPR_IFN (TREE_OPERAND (op1, 0)) == IFN_UBSAN_BOUNDS;
	366	}
	367
	368	/* Instrument an ARRAY_REF, if it hasn't already been instrumented.
	369	IGNORE_OFF_BY_ONE is true if the ARRAY_REF is inside a ADDR_EXPR. */
	370
	371	void
	372	ubsan_maybe_instrument_array_ref (tree *expr_p, bool ignore_off_by_one)
	373	{
	374	if (!ubsan_array_ref_instrumented_p (*expr_p)
f5481fc4	375	&& do_ubsan_in_current_function ())
0e37a2f3 MP	376	{
	377	tree op0 = TREE_OPERAND (*expr_p, 0);
	378	tree op1 = TREE_OPERAND (*expr_p, 1);
	379	tree e = ubsan_instrument_bounds (EXPR_LOCATION (*expr_p), op0, &op1,
	380	ignore_off_by_one);
	381	if (e != NULL_TREE)
	382	{
	383	tree t = copy_node (*expr_p);
	384	TREE_OPERAND (t, 1) = build2 (COMPOUND_EXPR, TREE_TYPE (op1),
	385	e, op1);
	386	*expr_p = t;
	387	}
	388	}
	389	}
944fa280 JJ	390
944fa280 JJ	391	static tree
c39a5e99	392	ubsan_maybe_instrument_reference_or_call (location_t loc, tree op, tree ptype,
944fa280 JJ	393	enum ubsan_null_ckind ckind)
944fa280 JJ	394	{
f5481fc4	395	if (!do_ubsan_in_current_function ())
944fa280 JJ	396	return NULL_TREE;
944fa280 JJ	397
c39a5e99 JJ	398	tree type = TREE_TYPE (ptype);
	399	tree orig_op = op;
	400	bool instrument = false;
	401	unsigned int mina = 0;
	402
944fa280 JJ	403	if (flag_sanitize & SANITIZE_ALIGNMENT)
	404	{
	405	mina = min_align_of_type (type);
	406	if (mina <= 1)
	407	mina = 0;
	408	}
	409	while ((TREE_CODE (op) == NOP_EXPR
	410	\|\| TREE_CODE (op) == NON_LVALUE_EXPR)
	411	&& TREE_CODE (TREE_TYPE (op)) == POINTER_TYPE)
	412	op = TREE_OPERAND (op, 0);
	413	if (TREE_CODE (op) == NOP_EXPR
	414	&& TREE_CODE (TREE_TYPE (op)) == REFERENCE_TYPE)
	415	{
	416	if (mina && mina > min_align_of_type (TREE_TYPE (TREE_TYPE (op))))
	417	instrument = true;
	418	}
	419	else
	420	{
	421	if ((flag_sanitize & SANITIZE_NULL) && TREE_CODE (op) == ADDR_EXPR)
	422	{
	423	bool strict_overflow_p = false;
	424	/* tree_single_nonzero_warnv_p will not return true for non-weak
	425	non-automatic decls with -fno-delete-null-pointer-checks,
	426	which is disabled during -fsanitize=null. We don't want to
	427	instrument those, just weak vars though. */
	428	int save_flag_delete_null_pointer_checks
	429	= flag_delete_null_pointer_checks;
	430	flag_delete_null_pointer_checks = 1;
	431	if (!tree_single_nonzero_warnv_p (op, &strict_overflow_p)
	432	\|\| strict_overflow_p)
	433	instrument = true;
	434	flag_delete_null_pointer_checks
	435	= save_flag_delete_null_pointer_checks;
	436	}
	437	else if (flag_sanitize & SANITIZE_NULL)
	438	instrument = true;
c39a5e99 JJ	439	if (mina && mina > 1)
	440	{
	441	if (!POINTER_TYPE_P (TREE_TYPE (op))
	442	\|\| mina > get_pointer_alignment (op) / BITS_PER_UNIT)
	443	instrument = true;
	444	}
944fa280 JJ	445	}
	446	if (!instrument)
	447	return NULL_TREE;
	448	op = save_expr (orig_op);
c39a5e99 JJ	449	gcc_assert (POINTER_TYPE_P (ptype));
	450	if (TREE_CODE (ptype) == REFERENCE_TYPE)
	451	ptype = build_pointer_type (TREE_TYPE (ptype));
	452	tree kind = build_int_cst (ptype, ckind);
944fa280 JJ	453	tree align = build_int_cst (pointer_sized_int_node, mina);
	454	tree call
	455	= build_call_expr_internal_loc (loc, IFN_UBSAN_NULL, void_type_node,
	456	3, op, kind, align);
	457	TREE_SIDE_EFFECTS (call) = 1;
	458	return fold_build2 (COMPOUND_EXPR, TREE_TYPE (op), call, op);
	459	}
	460
	461	/* Instrument a NOP_EXPR to REFERENCE_TYPE if needed. */
	462
	463	void
	464	ubsan_maybe_instrument_reference (tree stmt)
	465	{
	466	tree op = TREE_OPERAND (stmt, 0);
	467	op = ubsan_maybe_instrument_reference_or_call (EXPR_LOCATION (stmt), op,
c39a5e99	468	TREE_TYPE (stmt),
944fa280 JJ	469	UBSAN_REF_BINDING);
	470	if (op)
	471	TREE_OPERAND (stmt, 0) = op;
	472	}
	473
	474	/* Instrument a CALL_EXPR to a method if needed. */
	475
	476	void
	477	ubsan_maybe_instrument_member_call (tree stmt, bool is_ctor)
	478	{
	479	if (call_expr_nargs (stmt) == 0)
	480	return;
	481	tree op = CALL_EXPR_ARG (stmt, 0);
	482	if (op == error_mark_node
	483	\|\| !POINTER_TYPE_P (TREE_TYPE (op)))
	484	return;
	485	op = ubsan_maybe_instrument_reference_or_call (EXPR_LOCATION (stmt), op,
c39a5e99	486	TREE_TYPE (op),
944fa280 JJ	487	is_ctor ? UBSAN_CTOR_CALL
	488	: UBSAN_MEMBER_CALL);
	489	if (op)
	490	CALL_EXPR_ARG (stmt, 0) = op;
	491	}