<div dir="ltr">I've reverted this change in r224972. It seems to cause false positives:<div><br></div><div><div>$ cat tmp/ubsan/ex.cc</div><div>class Base {</div><div> int a;</div><div>public:</div><div> virtual void set(int val) { a = val; }</div><div>};</div><div><br></div><div>class Derived : virtual public Base {</div><div> int b;</div><div>};</div><div><br></div><div>void foo(Base *b) {</div><div> b->set(2);</div><div>}</div><div><br></div><div>int main() {</div><div> Derived d;</div><div> foo(&d);</div><div> return 0;</div><div>}</div></div><div><br></div><div>$ ./bin/clang++ -fsanitize=vptr tmp/ubsan/ex.cc && ./a.out <br></div><div><div>tmp/ubsan/ex.cc:4:31: runtime error: member access within address 0x7fff49db8238 which does not point to an object of type 'Base'</div><div>0x7fff49db8228: note: object is base class subobject at offset 16 within object of type 'Derived'</div><div> ff 7f 00 00 a0 fa 41 00 00 00 00 00 40 ab 41 00 00 00 00 00 b8 fa 41 00 00 00 00 00 30 83 db 49</div><div> ^ ~~~~~~~~~~~~~~~~~~~~~~~</div><div> vptr for '<unknown>' base class of 'Derived'</div><div> #0 0x41ab25 in Base::set(int) (a.out+0x41ab25)</div><div> #1 0x41a906 in foo(Base*) (a.out+0x41a906)</div><div> #2 0x41a9e9 in main (a.out+0x41a9e9)</div><div> #3 0x7fb8d2062ec4 in __libc_start_main /build/buildd/eglibc-2.19/csu/libc-start.c:287</div><div> #4 0x401e88 in _start (a.out+0x401e88)</div></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Thu, Nov 6, 2014 at 12:55 AM, David Majnemer <span dir="ltr"><<a href="mailto:david.majnemer@gmail.com" target="_blank">david.majnemer@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Author: majnemer<br>
Date: Thu Nov 6 02:55:23 2014<br>
New Revision: 221445<br>
<br>
URL: <a href="http://llvm.org/viewvc/llvm-project?rev=221445&view=rev" target="_blank">http://llvm.org/viewvc/llvm-project?rev=221445&view=rev</a><br>
Log:<br>
UBSan: Teach isDerivedFromAtOffset and findBaseAtOffset about vbases<br>
<br>
When the __virtual_mask is set, __offset_flags >> __offset_shift yields<br>
an offset into the vtable. Dereferencing this vtable slot gets us the<br>
vbase offset.<br>
<br>
Adjust a test case to verify that this, in fact, works.<br>
<br>
Differential Revision: <a href="http://reviews.llvm.org/D6074" target="_blank">http://reviews.llvm.org/D6074</a><br>
<br>
Modified:<br>
compiler-rt/trunk/lib/ubsan/ubsan_type_hash.cc<br>
compiler-rt/trunk/test/ubsan/TestCases/TypeCheck/vptr.cpp<br>
<br>
Modified: compiler-rt/trunk/lib/ubsan/ubsan_type_hash.cc<br>
URL: <a href="http://llvm.org/viewvc/llvm-project/compiler-rt/trunk/lib/ubsan/ubsan_type_hash.cc?rev=221445&r1=221444&r2=221445&view=diff" target="_blank">http://llvm.org/viewvc/llvm-project/compiler-rt/trunk/lib/ubsan/ubsan_type_hash.cc?rev=221445&r1=221444&r2=221445&view=diff</a><br>
==============================================================================<br>
--- compiler-rt/trunk/lib/ubsan/ubsan_type_hash.cc (original)<br>
+++ compiler-rt/trunk/lib/ubsan/ubsan_type_hash.cc Thu Nov 6 02:55:23 2014<br>
@@ -115,7 +115,8 @@ __ubsan::__ubsan_vptr_type_cache[__ubsan<br>
<br>
/// \brief Determine whether \p Derived has a \p Base base class subobject at<br>
/// offset \p Offset.<br>
-static bool isDerivedFromAtOffset(const abi::__class_type_info *Derived,<br>
+static bool isDerivedFromAtOffset(sptr Object,<br>
+ const abi::__class_type_info *Derived,<br>
const abi::__class_type_info *Base,<br>
sptr Offset) {<br>
if (Derived->__type_name == Base->__type_name)<br>
@@ -123,7 +124,7 @@ static bool isDerivedFromAtOffset(const<br>
<br>
if (const abi::__si_class_type_info *SI =<br>
dynamic_cast<const abi::__si_class_type_info*>(Derived))<br>
- return isDerivedFromAtOffset(SI->__base_type, Base, Offset);<br>
+ return isDerivedFromAtOffset(Object, SI->__base_type, Base, Offset);<br>
<br>
const abi::__vmi_class_type_info *VTI =<br>
dynamic_cast<const abi::__vmi_class_type_info*>(Derived);<br>
@@ -138,13 +139,13 @@ static bool isDerivedFromAtOffset(const<br>
sptr OffsetHere = VTI->base_info[base].__offset_flags >><br>
abi::__base_class_type_info::__offset_shift;<br>
if (VTI->base_info[base].__offset_flags &<br>
- abi::__base_class_type_info::__virtual_mask)<br>
- // For now, just punt on virtual bases and say 'yes'.<br>
- // FIXME: OffsetHere is the offset in the vtable of the virtual base<br>
- // offset. Read the vbase offset out of the vtable and use it.<br>
- return true;<br>
- if (isDerivedFromAtOffset(VTI->base_info[base].__base_type,<br>
- Base, Offset - OffsetHere))<br>
+ abi::__base_class_type_info::__virtual_mask) {<br>
+ sptr VTable = *reinterpret_cast<const sptr *>(Object);<br>
+ OffsetHere = *reinterpret_cast<const sptr *>(VTable + OffsetHere);<br>
+ }<br>
+ if (isDerivedFromAtOffset(Object + OffsetHere,<br>
+ VTI->base_info[base].__base_type, Base,<br>
+ Offset - OffsetHere))<br>
return true;<br>
}<br>
<br>
@@ -153,14 +154,15 @@ static bool isDerivedFromAtOffset(const<br>
<br>
/// \brief Find the derived-most dynamic base class of \p Derived at offset<br>
/// \p Offset.<br>
-static const abi::__class_type_info *findBaseAtOffset(<br>
- const abi::__class_type_info *Derived, sptr Offset) {<br>
+static const abi::__class_type_info *<br>
+findBaseAtOffset(sptr Object, const abi::__class_type_info *Derived,<br>
+ sptr Offset) {<br>
if (!Offset)<br>
return Derived;<br>
<br>
if (const abi::__si_class_type_info *SI =<br>
dynamic_cast<const abi::__si_class_type_info*>(Derived))<br>
- return findBaseAtOffset(SI->__base_type, Offset);<br>
+ return findBaseAtOffset(Object, SI->__base_type, Offset);<br>
<br>
const abi::__vmi_class_type_info *VTI =<br>
dynamic_cast<const abi::__vmi_class_type_info*>(Derived);<br>
@@ -172,12 +174,13 @@ static const abi::__class_type_info *fin<br>
sptr OffsetHere = VTI->base_info[base].__offset_flags >><br>
abi::__base_class_type_info::__offset_shift;<br>
if (VTI->base_info[base].__offset_flags &<br>
- abi::__base_class_type_info::__virtual_mask)<br>
- // FIXME: Can't handle virtual bases yet.<br>
- continue;<br>
- if (const abi::__class_type_info *Base =<br>
- findBaseAtOffset(VTI->base_info[base].__base_type,<br>
- Offset - OffsetHere))<br>
+ abi::__base_class_type_info::__virtual_mask) {<br>
+ sptr VTable = *reinterpret_cast<const sptr *>(Object);<br>
+ OffsetHere = *reinterpret_cast<const sptr *>(VTable + OffsetHere);<br>
+ }<br>
+ if (const abi::__class_type_info *Base = findBaseAtOffset(<br>
+ Object + OffsetHere, VTI->base_info[base].__base_type,<br>
+ Offset - OffsetHere))<br>
return Base;<br>
}<br>
<br>
@@ -229,7 +232,8 @@ bool __ubsan::checkDynamicType(void *Obj<br>
return false;<br>
<br>
abi::__class_type_info *Base = (abi::__class_type_info*)Type;<br>
- if (!isDerivedFromAtOffset(Derived, Base, -Vtable->Offset))<br>
+ if (!isDerivedFromAtOffset(reinterpret_cast<sptr>(Object), Derived, Base,<br>
+ -Vtable->Offset))<br>
return false;<br>
<br>
// Success. Cache this result.<br>
@@ -243,8 +247,9 @@ __ubsan::DynamicTypeInfo __ubsan::getDyn<br>
if (!Vtable)<br>
return DynamicTypeInfo(0, 0, 0);<br>
const abi::__class_type_info *ObjectType = findBaseAtOffset(<br>
- static_cast<const abi::__class_type_info*>(Vtable->TypeInfo),<br>
- -Vtable->Offset);<br>
+ reinterpret_cast<sptr>(Object),<br>
+ static_cast<const abi::__class_type_info *>(Vtable->TypeInfo),<br>
+ -Vtable->Offset);<br>
return DynamicTypeInfo(Vtable->TypeInfo->__type_name, -Vtable->Offset,<br>
ObjectType ? ObjectType->__type_name : "<unknown>");<br>
}<br>
<br>
Modified: compiler-rt/trunk/test/ubsan/TestCases/TypeCheck/vptr.cpp<br>
URL: <a href="http://llvm.org/viewvc/llvm-project/compiler-rt/trunk/test/ubsan/TestCases/TypeCheck/vptr.cpp?rev=221445&r1=221444&r2=221445&view=diff" target="_blank">http://llvm.org/viewvc/llvm-project/compiler-rt/trunk/test/ubsan/TestCases/TypeCheck/vptr.cpp?rev=221445&r1=221444&r2=221445&view=diff</a><br>
==============================================================================<br>
--- compiler-rt/trunk/test/ubsan/TestCases/TypeCheck/vptr.cpp (original)<br>
+++ compiler-rt/trunk/test/ubsan/TestCases/TypeCheck/vptr.cpp Thu Nov 6 02:55:23 2014<br>
@@ -48,7 +48,8 @@ struct T : S {<br>
virtual int v() { return 1; }<br>
};<br>
<br>
-struct U : S, T { virtual int v() { return 2; } };<br>
+struct X {};<br>
+struct U : S, T, virtual X { virtual int v() { return 2; } };<br>
<br>
struct V : S {};<br>
<br>
<br>
<br>
_______________________________________________<br>
llvm-commits mailing list<br>
<a href="mailto:llvm-commits@cs.uiuc.edu">llvm-commits@cs.uiuc.edu</a><br>
<a href="http://lists.cs.uiuc.edu/mailman/listinfo/llvm-commits" target="_blank">http://lists.cs.uiuc.edu/mailman/listinfo/llvm-commits</a><br>
</blockquote></div><br><br clear="all"><div><br></div>-- <br><div class="gmail_signature"><div dir="ltr">Alexey Samsonov<br><a href="mailto:vonosmas@gmail.com" target="_blank">vonosmas@gmail.com</a></div></div>
</div>