<html>
<head>
<base href="https://bugs.llvm.org/">
</head>
<body><table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>Bug ID</th>
<td><a class="bz_bug_link
bz_status_NEW "
title="NEW - StackProtector - stack violation not caught"
href="https://bugs.llvm.org/show_bug.cgi?id=43308">43308</a>
</td>
</tr>
<tr>
<th>Summary</th>
<td>StackProtector - stack violation not caught
</td>
</tr>
<tr>
<th>Product</th>
<td>libraries
</td>
</tr>
<tr>
<th>Version</th>
<td>trunk
</td>
</tr>
<tr>
<th>Hardware</th>
<td>PC
</td>
</tr>
<tr>
<th>OS</th>
<td>Windows NT
</td>
</tr>
<tr>
<th>Status</th>
<td>NEW
</td>
</tr>
<tr>
<th>Severity</th>
<td>enhancement
</td>
</tr>
<tr>
<th>Priority</th>
<td>P
</td>
</tr>
<tr>
<th>Component</th>
<td>Common Code Generator Code
</td>
</tr>
<tr>
<th>Assignee</th>
<td>unassignedbugs@nondot.org
</td>
</tr>
<tr>
<th>Reporter</th>
<td>rob.lougher@gmail.com
</td>
</tr>
<tr>
<th>CC</th>
<td>llvm-bugs@lists.llvm.org
</td>
</tr></table>
<p>
<div>
<pre>The following simple program corrupts the stack:
================= ssp.c ==================
#include <string.h>
__attribute__((__noinline__))
void bar(int *p) {
memset(p, 0, 100);
}
int main() {
int i;
bar(&i);
}
==========================================
If this is compiled at -O0 with strong protection the violation is caught:
$ clang ssp.c -o ssp -O0 -fstack-protector-strong
$ ./ssp
*** stack smashing detected ***: <unknown> terminated
Aborted (core dumped)
However, if it is compiled at -O1 or above, no violation is detected and the
program crashes with a SIGSEGV (return to addresss 0):
$ clang ssp.c -o ssp -O1 -fstack-protector-strong
$ ./ssp
Segmentation fault (core dumped)
The regression was introduced by commit r363169, which changed the stack
protector to use PointerMayBeCaptured.
This routine is inappropriate for SSP use, as protection is needed in cases
where a pointer is not captured.
If we look at the IR for the above program, we see that the pointer parameter
to bar() is marked as "nocapture" (i.e. it does not outlive the call). This
means that although it is used to corrupt the stack, after r363169 main() is no
longer considered to need a stack check.
define dso_local void @bar(i32* nocapture %p) local_unnamed_addr #0 {
entry:
%0 = bitcast i32* %p to i8*
tail call void @llvm.memset.p0i8.i64(i8* align 4 dereferenceable(100) %0, i8
0, i64 100, i1 false)
ret void
}
define dso_local i32 @main() local_unnamed_addr #2 {
entry:
%i = alloca i32, align 4
%0 = bitcast i32* %i to i8*
call void @llvm.lifetime.start.p0i8(i64 4, i8* nonnull %0) #3
call void @bar(i32* nonnull %i)
call void @llvm.lifetime.end.p0i8(i64 4, i8* nonnull %0) #3
ret i32 0
}</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are on the CC list for the bug.</li>
</ul>
</body>
</html>