1 /* UndefinedBehaviorSanitizer, undefined behavior detector.
2 Copyright (C) 2013-2016 Free Software Foundation, Inc.
3 Contributed by Marek Polacek <polacek@redhat.com>
5 This file is part of GCC.
7 GCC is free software; you can redistribute it and/or modify it under
8 the terms of the GNU General Public License as published by the Free
9 Software Foundation; either version 3, or (at your option) any later
12 GCC is distributed in the hope that it will be useful, but WITHOUT ANY
13 WARRANTY; without even the implied warranty of MERCHANTABILITY or
14 FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
17 You should have received a copy of the GNU General Public License
18 along with GCC; see the file COPYING3. If not see
19 <http://www.gnu.org/licenses/>. */
23 #include "coretypes.h"
25 #include "c-family/c-common.h"
27 #include "c-family/c-ubsan.h"
29 #include "stor-layout.h"
33 /* Instrument division by zero and INT_MIN / -1. If not instrumenting,
37 ubsan_instrument_division (location_t loc
, tree op0
, tree op1
)
40 tree type
= TREE_TYPE (op0
);
42 /* At this point both operands should have the same type,
43 because they are already converted to RESULT_TYPE.
44 Use TYPE_MAIN_VARIANT since typedefs can confuse us. */
45 gcc_assert (TYPE_MAIN_VARIANT (TREE_TYPE (op0
))
46 == TYPE_MAIN_VARIANT (TREE_TYPE (op1
)));
48 op0
= unshare_expr (op0
);
49 op1
= unshare_expr (op1
);
51 if (TREE_CODE (type
) == INTEGER_TYPE
52 && (flag_sanitize
& SANITIZE_DIVIDE
))
53 t
= fold_build2 (EQ_EXPR
, boolean_type_node
,
54 op1
, build_int_cst (type
, 0));
55 else if (TREE_CODE (type
) == REAL_TYPE
56 && (flag_sanitize
& SANITIZE_FLOAT_DIVIDE
))
57 t
= fold_build2 (EQ_EXPR
, boolean_type_node
,
58 op1
, build_real (type
, dconst0
));
62 /* We check INT_MIN / -1 only for signed types. */
63 if (TREE_CODE (type
) == INTEGER_TYPE
64 && (flag_sanitize
& SANITIZE_DIVIDE
)
65 && !TYPE_UNSIGNED (type
))
68 tt
= fold_build2 (EQ_EXPR
, boolean_type_node
, unshare_expr (op1
),
69 build_int_cst (type
, -1));
70 x
= fold_build2 (EQ_EXPR
, boolean_type_node
, op0
,
71 TYPE_MIN_VALUE (type
));
72 x
= fold_build2 (TRUTH_AND_EXPR
, boolean_type_node
, x
, tt
);
73 t
= fold_build2 (TRUTH_OR_EXPR
, boolean_type_node
, t
, x
);
76 /* If the condition was folded to 0, no need to instrument
78 if (integer_zerop (t
))
81 /* In case we have a SAVE_EXPR in a conditional context, we need to
82 make sure it gets evaluated before the condition. */
83 t
= fold_build2 (COMPOUND_EXPR
, TREE_TYPE (t
), unshare_expr (op0
), t
);
84 t
= fold_build2 (COMPOUND_EXPR
, TREE_TYPE (t
), unshare_expr (op1
), t
);
85 if (flag_sanitize_undefined_trap_on_error
)
86 tt
= build_call_expr_loc (loc
, builtin_decl_explicit (BUILT_IN_TRAP
), 0);
89 tree data
= ubsan_create_data ("__ubsan_overflow_data", 1, &loc
,
90 ubsan_type_descriptor (type
), NULL_TREE
,
92 data
= build_fold_addr_expr_loc (loc
, data
);
93 enum built_in_function bcode
94 = (flag_sanitize_recover
& SANITIZE_DIVIDE
)
95 ? BUILT_IN_UBSAN_HANDLE_DIVREM_OVERFLOW
96 : BUILT_IN_UBSAN_HANDLE_DIVREM_OVERFLOW_ABORT
;
97 tt
= builtin_decl_explicit (bcode
);
98 op0
= unshare_expr (op0
);
99 op1
= unshare_expr (op1
);
100 tt
= build_call_expr_loc (loc
, tt
, 3, data
, ubsan_encode_value (op0
),
101 ubsan_encode_value (op1
));
103 t
= fold_build3 (COND_EXPR
, void_type_node
, t
, tt
, void_node
);
108 /* Instrument left and right shifts. */
111 ubsan_instrument_shift (location_t loc
, enum tree_code code
,
114 tree t
, tt
= NULL_TREE
;
115 tree type0
= TREE_TYPE (op0
);
116 tree type1
= TREE_TYPE (op1
);
117 tree op1_utype
= unsigned_type_for (type1
);
118 HOST_WIDE_INT op0_prec
= TYPE_PRECISION (type0
);
119 tree uprecm1
= build_int_cst (op1_utype
, op0_prec
- 1);
121 op0
= unshare_expr (op0
);
122 op1
= unshare_expr (op1
);
124 t
= fold_convert_loc (loc
, op1_utype
, op1
);
125 t
= fold_build2 (GT_EXPR
, boolean_type_node
, t
, uprecm1
);
127 /* If this is not a signed operation, don't perform overflow checks.
128 Also punt on bit-fields. */
129 if (!INTEGRAL_TYPE_P (type0
)
130 || TYPE_OVERFLOW_WRAPS (type0
)
131 || GET_MODE_BITSIZE (TYPE_MODE (type0
)) != TYPE_PRECISION (type0
))
134 /* For signed x << y, in C99/C11, the following:
135 (unsigned) x >> (uprecm1 - y)
136 if non-zero, is undefined. */
137 else if (code
== LSHIFT_EXPR
&& flag_isoc99
&& cxx_dialect
< cxx11
)
139 tree x
= fold_build2 (MINUS_EXPR
, op1_utype
, uprecm1
,
140 fold_convert (op1_utype
, unshare_expr (op1
)));
141 tt
= fold_convert_loc (loc
, unsigned_type_for (type0
), op0
);
142 tt
= fold_build2 (RSHIFT_EXPR
, TREE_TYPE (tt
), tt
, x
);
143 tt
= fold_build2 (NE_EXPR
, boolean_type_node
, tt
,
144 build_int_cst (TREE_TYPE (tt
), 0));
147 /* For signed x << y, in C++11 and later, the following:
148 x < 0 || ((unsigned) x >> (uprecm1 - y))
149 if > 1, is undefined. */
150 else if (code
== LSHIFT_EXPR
&& cxx_dialect
>= cxx11
)
152 tree x
= fold_build2 (MINUS_EXPR
, op1_utype
, uprecm1
,
153 fold_convert (op1_utype
, unshare_expr (op1
)));
154 tt
= fold_convert_loc (loc
, unsigned_type_for (type0
),
156 tt
= fold_build2 (RSHIFT_EXPR
, TREE_TYPE (tt
), tt
, x
);
157 tt
= fold_build2 (GT_EXPR
, boolean_type_node
, tt
,
158 build_int_cst (TREE_TYPE (tt
), 1));
159 x
= fold_build2 (LT_EXPR
, boolean_type_node
, unshare_expr (op0
),
160 build_int_cst (type0
, 0));
161 tt
= fold_build2 (TRUTH_OR_EXPR
, boolean_type_node
, x
, tt
);
164 /* If the condition was folded to 0, no need to instrument
166 if (integer_zerop (t
) && (tt
== NULL_TREE
|| integer_zerop (tt
)))
169 /* In case we have a SAVE_EXPR in a conditional context, we need to
170 make sure it gets evaluated before the condition. */
171 t
= fold_build2 (COMPOUND_EXPR
, TREE_TYPE (t
), unshare_expr (op0
), t
);
172 t
= fold_build2 (TRUTH_OR_EXPR
, boolean_type_node
, t
,
173 tt
? tt
: integer_zero_node
);
175 if (flag_sanitize_undefined_trap_on_error
)
176 tt
= build_call_expr_loc (loc
, builtin_decl_explicit (BUILT_IN_TRAP
), 0);
179 tree data
= ubsan_create_data ("__ubsan_shift_data", 1, &loc
,
180 ubsan_type_descriptor (type0
),
181 ubsan_type_descriptor (type1
), NULL_TREE
,
183 data
= build_fold_addr_expr_loc (loc
, data
);
185 enum built_in_function bcode
186 = (flag_sanitize_recover
& SANITIZE_SHIFT
)
187 ? BUILT_IN_UBSAN_HANDLE_SHIFT_OUT_OF_BOUNDS
188 : BUILT_IN_UBSAN_HANDLE_SHIFT_OUT_OF_BOUNDS_ABORT
;
189 tt
= builtin_decl_explicit (bcode
);
190 op0
= unshare_expr (op0
);
191 op1
= unshare_expr (op1
);
192 tt
= build_call_expr_loc (loc
, tt
, 3, data
, ubsan_encode_value (op0
),
193 ubsan_encode_value (op1
));
195 t
= fold_build3 (COND_EXPR
, void_type_node
, t
, tt
, void_node
);
200 /* Instrument variable length array bound. */
203 ubsan_instrument_vla (location_t loc
, tree size
)
205 tree type
= TREE_TYPE (size
);
208 t
= fold_build2 (LE_EXPR
, boolean_type_node
, size
, build_int_cst (type
, 0));
209 if (flag_sanitize_undefined_trap_on_error
)
210 tt
= build_call_expr_loc (loc
, builtin_decl_explicit (BUILT_IN_TRAP
), 0);
213 tree data
= ubsan_create_data ("__ubsan_vla_data", 1, &loc
,
214 ubsan_type_descriptor (type
), NULL_TREE
,
216 data
= build_fold_addr_expr_loc (loc
, data
);
217 enum built_in_function bcode
218 = (flag_sanitize_recover
& SANITIZE_VLA
)
219 ? BUILT_IN_UBSAN_HANDLE_VLA_BOUND_NOT_POSITIVE
220 : BUILT_IN_UBSAN_HANDLE_VLA_BOUND_NOT_POSITIVE_ABORT
;
221 tt
= builtin_decl_explicit (bcode
);
222 tt
= build_call_expr_loc (loc
, tt
, 2, data
, ubsan_encode_value (size
));
224 t
= fold_build3 (COND_EXPR
, void_type_node
, t
, tt
, void_node
);
229 /* Instrument missing return in C++ functions returning non-void. */
232 ubsan_instrument_return (location_t loc
)
234 if (flag_sanitize_undefined_trap_on_error
)
235 return build_call_expr_loc (loc
, builtin_decl_explicit (BUILT_IN_TRAP
), 0);
236 /* It is possible that PCH zapped table with definitions of sanitizer
237 builtins. Reinitialize them if needed. */
238 initialize_sanitizer_builtins ();
240 tree data
= ubsan_create_data ("__ubsan_missing_return_data", 1, &loc
,
241 NULL_TREE
, NULL_TREE
);
242 tree t
= builtin_decl_explicit (BUILT_IN_UBSAN_HANDLE_MISSING_RETURN
);
243 return build_call_expr_loc (loc
, t
, 1, build_fold_addr_expr_loc (loc
, data
));
246 /* Instrument array bounds for ARRAY_REFs. We create special builtin,
247 that gets expanded in the sanopt pass, and make an array dimension
248 of it. ARRAY is the array, *INDEX is an index to the array.
249 Return NULL_TREE if no instrumentation is emitted.
250 IGNORE_OFF_BY_ONE is true if the ARRAY_REF is inside a ADDR_EXPR. */
253 ubsan_instrument_bounds (location_t loc
, tree array
, tree
*index
,
254 bool ignore_off_by_one
)
256 tree type
= TREE_TYPE (array
);
257 tree domain
= TYPE_DOMAIN (type
);
259 if (domain
== NULL_TREE
|| TYPE_MAX_VALUE (domain
) == NULL_TREE
)
262 tree bound
= TYPE_MAX_VALUE (domain
);
263 if (ignore_off_by_one
)
264 bound
= fold_build2 (PLUS_EXPR
, TREE_TYPE (bound
), bound
,
265 build_int_cst (TREE_TYPE (bound
), 1));
267 /* Detect flexible array members and suchlike, unless
268 -fsanitize=bounds-strict. */
269 tree base
= get_base_address (array
);
270 if ((flag_sanitize
& SANITIZE_BOUNDS_STRICT
) == 0
271 && TREE_CODE (array
) == COMPONENT_REF
272 && base
&& (INDIRECT_REF_P (base
) || TREE_CODE (base
) == MEM_REF
))
274 tree next
= NULL_TREE
;
277 /* Walk all structs/unions. */
278 while (TREE_CODE (cref
) == COMPONENT_REF
)
280 if (TREE_CODE (TREE_TYPE (TREE_OPERAND (cref
, 0))) == RECORD_TYPE
)
281 for (next
= DECL_CHAIN (TREE_OPERAND (cref
, 1));
282 next
&& TREE_CODE (next
) != FIELD_DECL
;
283 next
= DECL_CHAIN (next
))
286 /* Not a last element. Instrument it. */
288 /* Ok, this is the last field of the structure/union. But the
289 aggregate containing the field must be the last field too,
291 cref
= TREE_OPERAND (cref
, 0);
294 /* Don't instrument this flexible array member-like array in non-strict
295 -fsanitize=bounds mode. */
299 /* Don't emit instrumentation in the most common cases. */
300 tree idx
= NULL_TREE
;
301 if (TREE_CODE (*index
) == INTEGER_CST
)
303 else if (TREE_CODE (*index
) == BIT_AND_EXPR
304 && TREE_CODE (TREE_OPERAND (*index
, 1)) == INTEGER_CST
)
305 idx
= TREE_OPERAND (*index
, 1);
307 && TREE_CODE (bound
) == INTEGER_CST
308 && tree_int_cst_sgn (idx
) >= 0
309 && tree_int_cst_le (idx
, bound
))
312 *index
= save_expr (*index
);
313 /* Create a "(T *) 0" tree node to describe the array type. */
314 tree zero_with_type
= build_int_cst (build_pointer_type (type
), 0);
315 return build_call_expr_internal_loc (loc
, IFN_UBSAN_BOUNDS
,
316 void_type_node
, 3, zero_with_type
,
320 /* Return true iff T is an array that was instrumented by SANITIZE_BOUNDS. */
323 ubsan_array_ref_instrumented_p (const_tree t
)
325 if (TREE_CODE (t
) != ARRAY_REF
)
328 tree op1
= TREE_OPERAND (t
, 1);
329 return TREE_CODE (op1
) == COMPOUND_EXPR
330 && TREE_CODE (TREE_OPERAND (op1
, 0)) == CALL_EXPR
331 && CALL_EXPR_FN (TREE_OPERAND (op1
, 0)) == NULL_TREE
332 && CALL_EXPR_IFN (TREE_OPERAND (op1
, 0)) == IFN_UBSAN_BOUNDS
;
335 /* Instrument an ARRAY_REF, if it hasn't already been instrumented.
336 IGNORE_OFF_BY_ONE is true if the ARRAY_REF is inside a ADDR_EXPR. */
339 ubsan_maybe_instrument_array_ref (tree
*expr_p
, bool ignore_off_by_one
)
341 if (!ubsan_array_ref_instrumented_p (*expr_p
)
342 && do_ubsan_in_current_function ())
344 tree op0
= TREE_OPERAND (*expr_p
, 0);
345 tree op1
= TREE_OPERAND (*expr_p
, 1);
346 tree e
= ubsan_instrument_bounds (EXPR_LOCATION (*expr_p
), op0
, &op1
,
350 tree t
= copy_node (*expr_p
);
351 TREE_OPERAND (t
, 1) = build2 (COMPOUND_EXPR
, TREE_TYPE (op1
),
359 ubsan_maybe_instrument_reference_or_call (location_t loc
, tree op
, tree ptype
,
360 enum ubsan_null_ckind ckind
)
362 if (!do_ubsan_in_current_function ())
365 tree type
= TREE_TYPE (ptype
);
367 bool instrument
= false;
368 unsigned int mina
= 0;
370 if (flag_sanitize
& SANITIZE_ALIGNMENT
)
372 mina
= min_align_of_type (type
);
376 while ((TREE_CODE (op
) == NOP_EXPR
377 || TREE_CODE (op
) == NON_LVALUE_EXPR
)
378 && TREE_CODE (TREE_TYPE (op
)) == POINTER_TYPE
)
379 op
= TREE_OPERAND (op
, 0);
380 if (TREE_CODE (op
) == NOP_EXPR
381 && TREE_CODE (TREE_TYPE (op
)) == REFERENCE_TYPE
)
383 if (mina
&& mina
> min_align_of_type (TREE_TYPE (TREE_TYPE (op
))))
388 if ((flag_sanitize
& SANITIZE_NULL
) && TREE_CODE (op
) == ADDR_EXPR
)
390 bool strict_overflow_p
= false;
391 /* tree_single_nonzero_warnv_p will not return true for non-weak
392 non-automatic decls with -fno-delete-null-pointer-checks,
393 which is disabled during -fsanitize=null. We don't want to
394 instrument those, just weak vars though. */
395 int save_flag_delete_null_pointer_checks
396 = flag_delete_null_pointer_checks
;
397 flag_delete_null_pointer_checks
= 1;
398 if (!tree_single_nonzero_warnv_p (op
, &strict_overflow_p
)
399 || strict_overflow_p
)
401 flag_delete_null_pointer_checks
402 = save_flag_delete_null_pointer_checks
;
404 else if (flag_sanitize
& SANITIZE_NULL
)
406 if (mina
&& mina
> 1)
408 if (!POINTER_TYPE_P (TREE_TYPE (op
))
409 || mina
> get_pointer_alignment (op
) / BITS_PER_UNIT
)
415 op
= save_expr (orig_op
);
416 gcc_assert (POINTER_TYPE_P (ptype
));
417 if (TREE_CODE (ptype
) == REFERENCE_TYPE
)
418 ptype
= build_pointer_type (TREE_TYPE (ptype
));
419 tree kind
= build_int_cst (ptype
, ckind
);
420 tree align
= build_int_cst (pointer_sized_int_node
, mina
);
422 = build_call_expr_internal_loc (loc
, IFN_UBSAN_NULL
, void_type_node
,
424 TREE_SIDE_EFFECTS (call
) = 1;
425 return fold_build2 (COMPOUND_EXPR
, TREE_TYPE (op
), call
, op
);
428 /* Instrument a NOP_EXPR to REFERENCE_TYPE if needed. */
431 ubsan_maybe_instrument_reference (tree stmt
)
433 tree op
= TREE_OPERAND (stmt
, 0);
434 op
= ubsan_maybe_instrument_reference_or_call (EXPR_LOCATION (stmt
), op
,
438 TREE_OPERAND (stmt
, 0) = op
;
441 /* Instrument a CALL_EXPR to a method if needed. */
444 ubsan_maybe_instrument_member_call (tree stmt
, bool is_ctor
)
446 if (call_expr_nargs (stmt
) == 0)
448 tree op
= CALL_EXPR_ARG (stmt
, 0);
449 if (op
== error_mark_node
450 || !POINTER_TYPE_P (TREE_TYPE (op
)))
452 op
= ubsan_maybe_instrument_reference_or_call (EXPR_LOCATION (stmt
), op
,
454 is_ctor
? UBSAN_CTOR_CALL
455 : UBSAN_MEMBER_CALL
);
457 CALL_EXPR_ARG (stmt
, 0) = op
;