[clang] [clang][bytecode] Check builtin_memchr() for one-past-end pointers (PR #174187)

[Timm Baeder via cfe-commits]

Timm =?utf-8?q?Bäder?= <tbaeder at redhat.com>
Message-ID: <llvm.org/llvm/llvm-project/pull/174187 at github.com>
In-Reply-To:


https://github.com/tbaederr created https://github.com/llvm/llvm-project/pull/174187

We can't read from them and this fails later.

Fixes https://github.com/llvm/llvm-project/issues/173942

>From cecb72441ee0e2886deb8f058d7a59f770430fb1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Timm=20B=C3=A4der?= <tbaeder at redhat.com>
Date: Fri, 2 Jan 2026 09:10:48 +0100
Subject: [PATCH 1/2] [clang][bytecode] Check builtin_memcpy() for non-block
 pointers

This pretty hard to produce in C++ but easy in C.

Fixes #171609
---
 clang/lib/AST/ByteCode/InterpBuiltin.cpp | 15 +++++++++++++--
 clang/test/AST/ByteCode/builtins.c       |  1 +
 2 files changed, 14 insertions(+), 2 deletions(-)

diff --git a/clang/lib/AST/ByteCode/InterpBuiltin.cpp b/clang/lib/AST/ByteCode/InterpBuiltin.cpp
index 57d5f0ae6eed3..65101174247d1 100644
--- a/clang/lib/AST/ByteCode/InterpBuiltin.cpp
+++ b/clang/lib/AST/ByteCode/InterpBuiltin.cpp
@@ -64,6 +64,18 @@ static APSInt popToAPSInt(InterpState &S, QualType T) {
   return popToAPSInt(S.Stk, *S.getContext().classify(T));
 }
 
+/// Check for common reasons a pointer can't be read from, which
+/// are usually not diagnosed in a builtin function.
+static bool isReadable(const Pointer &P) {
+  if (P.isDummy())
+    return false;
+  if (!P.isBlockPointer())
+    return false;
+  if (!P.isLive())
+    return false;
+  return true;
+}
+
 /// Pushes \p Val on the stack as the type given by \p QT.
 static void pushInteger(InterpState &S, const APSInt &Val, QualType QT) {
   assert(QT->isSignedIntegerOrEnumerationType() ||
@@ -1794,8 +1806,7 @@ static bool interp__builtin_memcpy(InterpState &S, CodePtr OpPC,
     return false;
   }
 
-  // Can't read from dummy pointers.
-  if (DestPtr.isDummy() || SrcPtr.isDummy())
+  if (!isReadable(DestPtr) || !isReadable(SrcPtr))
     return false;
 
   if (DestPtr.getType()->isIncompleteType()) {
diff --git a/clang/test/AST/ByteCode/builtins.c b/clang/test/AST/ByteCode/builtins.c
index a51260cd3431f..5be5455ab8813 100644
--- a/clang/test/AST/ByteCode/builtins.c
+++ b/clang/test/AST/ByteCode/builtins.c
@@ -17,3 +17,4 @@ int structStrlen(void) {
   return 1;
 }
 
+void f() { __builtin_memcpy(f, f, 1); }

>From c5959f99134048776518030054bfbe9cceaa1c18 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Timm=20B=C3=A4der?= <tbaeder at redhat.com>
Date: Fri, 2 Jan 2026 09:29:56 +0100
Subject: [PATCH 2/2] [clang][bytecode] Check builtin_memchr() for one-past-end
 pointers

We can't read from them and this fails later.

Fixes #173942
---
 clang/lib/AST/ByteCode/InterpBuiltin.cpp      | 5 +++++
 clang/test/AST/ByteCode/builtin-functions.cpp | 4 ++++
 2 files changed, 9 insertions(+)

diff --git a/clang/lib/AST/ByteCode/InterpBuiltin.cpp b/clang/lib/AST/ByteCode/InterpBuiltin.cpp
index 65101174247d1..065870c5c0ab5 100644
--- a/clang/lib/AST/ByteCode/InterpBuiltin.cpp
+++ b/clang/lib/AST/ByteCode/InterpBuiltin.cpp
@@ -73,6 +73,8 @@ static bool isReadable(const Pointer &P) {
     return false;
   if (!P.isLive())
     return false;
+  if (P.isOnePastEnd())
+    return false;
   return true;
 }
 
@@ -2089,6 +2091,9 @@ static bool interp__builtin_memchr(InterpState &S, CodePtr OpPC,
     return false;
   }
 
+  if (!isReadable(Ptr))
+    return false;
+
   if (ID == Builtin::BIstrchr || ID == Builtin::BI__builtin_strchr) {
     int64_t DesiredTrunc;
     if (S.getASTContext().CharTy->isSignedIntegerType())
diff --git a/clang/test/AST/ByteCode/builtin-functions.cpp b/clang/test/AST/ByteCode/builtin-functions.cpp
index 3076b5239ebbe..3cde5a2b42e3d 100644
--- a/clang/test/AST/ByteCode/builtin-functions.cpp
+++ b/clang/test/AST/ByteCode/builtin-functions.cpp
@@ -1649,6 +1649,10 @@ namespace Memchr {
     return __builtin_char_memchr(c + 1, 'f', 1) == nullptr;
   }
   static_assert(f());
+
+
+  extern const char char_memchr_arg[0l];
+  char *memchr_result = __builtin_char_memchr(char_memchr_arg, 123, 32);
 }
 
 namespace Strchr {