[all-commits] [llvm/llvm-project] 7b004a: [CodeGen] Fix -fsanitize=array-bounds for __sized_...

[Dan Liew via All-commits]

  Branch: refs/heads/users/delcypher/fix-or_null_sized_by-codegen-bugs-part-3
  Home:   https://github.com/llvm/llvm-project
  Commit: 7b004a29fdb8d6b43168a06ae86bbbae072a089e
      https://github.com/llvm/llvm-project/commit/7b004a29fdb8d6b43168a06ae86bbbae072a089e
  Author: Dan Liew <dliew at apple.com>
  Date:   2026-09-04 (Fri, 04 Sep 2026)

  Changed paths:
    M clang/lib/CodeGen/CGExpr.cpp
    M clang/test/CodeGen/attr-counted-by-or-null-for-pointers.c
    M clang/test/CodeGen/attr-sized-by-for-pointers.c
    M clang/test/CodeGen/attr-sized-by-or-null-for-pointers.c

  Log Message:
  -----------
  [CodeGen] Fix -fsanitize=array-bounds for __sized_by / _or_null pointers

`EmitCountedByBoundsChecking()` assumed a CountAttributedType is always
a __counted_by pointer. That isn't true; there are four versions of the
attribute:

* `__counted_by`: Already handled correctly.
* `__counted_by_or_null`: Incorrectly handled.
* `__sized_by`: Incorrectly handled.
* `__sized_by_or_null`: Incorrectly handled.

In particular:

* __sized_by / __sized_by_or_null: the loaded bound is a byte count, but the
  element index was compared against it directly, so an access was only
  flagged once the index exceeded the byte count -- missing out-of-bounds
  accesses for a pointee larger than one byte. Convert the loaded byte count
  into an element count by dividing it by the element size (`bound /
  sizeof(element)`) so the check can compare the (element) index directly.
  `counted_by` already counts elements and is unchanged; a void (or otherwise
  zero-/unknown-sized) pointee uses the GNU convention of element size 1, i.e.
  no conversion. Signed division is used for a signed count field so a negative
  byte count stays non-positive and is still rejected by the negative-bounds
  guard in EmitBoundsCheckImpl (unsigned division would turn it into a large
  positive count).

* __counted_by_or_null / __sized_by_or_null: a null pointer describes no
  accessible memory, but the null case was ignored, so an access through a
  null pointer with a non-zero count was not trapped. Treat the bound as 0
  when the pointer is null.

Both adjustments are applied to the loaded bound in
EmitCountedByBoundsChecking before it is handed to EmitBoundsCheckImpl;
the bounds-checking machinery and the runtime handler are left unchanged
and continue to work in terms of the element index. Plain `__counted_by`
and the general array-bounds path are unaffected.

I did try an alternative implementation where the comparison was done
in terms of bytes, but this had several disadvantages:

* It was less correct. Because the element-count implementation uses
  truncating division, a `__sized_by()` whose size is not a multiple of the
  pointee size rounds the bound down, so an access to a partially in-bounds
  object is caught. A byte-level check would instead only verify that the
  first byte of the object is in bounds, which would allow accessing a
  partially in-bounds object.

* When benchmarking (small microbenchmarks), it appeared that the
  division implementation was faster.

* It required changes in `CodeGenFunction::EmitBoundsCheckImpl` as well,
  which made the change more invasive.

Assisted-by: Claude Code

rdar://184139694


  Commit: 7957fc1c11052ea3cd29b6b52097c94033b91ef5
      https://github.com/llvm/llvm-project/commit/7957fc1c11052ea3cd29b6b52097c94033b91ef5
  Author: Dan Liew <dan at su-root.co.uk>
  Date:   2026-09-09 (Wed, 09 Sep 2026)

  Changed paths:
    M clang/lib/CodeGen/CGExpr.cpp
    M clang/test/CodeGen/attr-counted-by-or-null-for-pointers.c
    M clang/test/CodeGen/attr-sized-by-or-null-for-pointers.c

  Log Message:
  -----------
  Add some asserts and fix unnecessary re-emission of member expression
access.


  Commit: 5151d293b0df5c736c65a4eae83080698952dea8
      https://github.com/llvm/llvm-project/commit/5151d293b0df5c736c65a4eae83080698952dea8
  Author: Dan Liew <dan at su-root.co.uk>
  Date:   2026-09-09 (Wed, 09 Sep 2026)

  Changed paths:
    M clang/lib/CodeGen/CGExpr.cpp
    M clang/test/CodeGen/attr-sized-by-for-pointers.c
    M clang/test/CodeGen/attr-sized-by-or-null-for-pointers.c

  Log Message:
  -----------
  Fix division bug where a small count expression type can't represent the
element size


Compare: https://github.com/llvm/llvm-project/compare/9687b66d0541...5151d293b0df

To unsubscribe from these emails, change your notification settings at https://github.com/llvm/llvm-project/settings/notifications