[libcxx-commits] [PATCH] D132769: [2b/3][ASan][libcxx] std::basic_string annotations

[Tacet via Phabricator via libcxx-commits]

AdvenamTacet created this revision.
Herald added a project: All.
AdvenamTacet requested review of this revision.
Herald added a project: libc++.
Herald added a subscriber: libcxx-commits.
Herald added a reviewer: libc++.

This commit is a part of patches extending AddressSanitizer C++
container overflow detection capabilities by adding annotations,
similar to those existing in std::vector, to std::string and
std::deque collections. These changes allow ASan to detect cases
when the instrumented program accesses memory which is internally
allocated by the collection but is still not in-use (accesses
before or after the stored elements for std::deque, or between
the size and capacity bounds for std::string).

Trail of Bits developed this as part of a research project where
we tried to find bugs using the oss-fuzz (using llvm-14 with our
modifications) harnesses. Now, we want to upstream the llvm-16
port of this work.

That commit adds ASan annotations to std::basic_string. Functions
from [1b/3] are necessary to verify if memory may be annotated.

Std::basic_string may be short or long. Short keeps content
inside objects memory, long keeps content in an external buffer.
Those changes correctly annotate both cases.

Long string case is very similar to std::vector, as content is kept
in an external memory block allocated by the object. Memory will be
annotated if and only if a standard allocator is used.

Short string is more tricky and will be only annotated if
`__sanitizer_is_annotable` returns true. Other implementation quirks
are not visible outside the implementation, but
alternate string layout may help with detecting overflows.
There are no false positives.

Alternate string layout is a different std::basic_string layout
(it changes the order of class variables).
It can be enabled by setting the XXX macro during libcxx/libcxxabi
compilation and cannot be changed later (it has to be set for all
libraries/objects compilation, so it is usually pre-chosen by given
project devs/linux distro etc.).

The commit also provides unit tests for std::basic_string ASan
annotatiotations with a new function `is_string_asan_correct`.

Structure of our patches:
[1a/3][ASan][compiler-rt] API for double ended containers
[1b/3][ASan][compiler-rt] API for annotating objects memory
[2a/3][ASan][libcxx] std::deque annotations
[2b/3][ASan][libcxx] std::basic_string annotations
[3/3][ASan] integration test for std::deque and std::basic_string annotations

1a -> 2a -

  \
   --> 3
  /

1b -> 2b -

If you have any questions, please email:

- advenam.tacet at trailofbits.com
- disconnect3d at trailofbits.com


Repository:
  rG LLVM Github Monorepo

https://reviews.llvm.org/D132769

Files:
  libcxx/include/string
  libcxx/test/std/strings/basic.string/string.asan/append.pass.cpp
  libcxx/test/std/strings/basic.string/string.asan/assign.pass.cpp
  libcxx/test/std/strings/basic.string/string.asan/capacity.pass.cpp
  libcxx/test/std/strings/basic.string/string.asan/concatenate.pass.cpp
  libcxx/test/std/strings/basic.string/string.asan/constructor.pass.cpp
  libcxx/test/std/strings/basic.string/string.asan/erase.pass.cpp
  libcxx/test/std/strings/basic.string/string.asan/insert.pass.cpp
  libcxx/test/std/strings/basic.string/string.asan/nostd_allocator.pass.cpp
  libcxx/test/std/strings/basic.string/string.asan/packed.pass.cpp
  libcxx/test/std/strings/basic.string/string.asan/push_pop_back.pass.cpp
  libcxx/test/std/strings/basic.string/string.asan/replace.pass.cpp
  libcxx/test/std/strings/basic.string/string.asan/substr.pass.cpp
  libcxx/test/std/strings/basic.string/string.asan/swap.pass.cpp
  libcxx/test/support/asan_testing.h

-------------- next part --------------
A non-text attachment was scrubbed...
Name: D132769.456050.patch
Type: text/x-patch
Size: 129536 bytes
Desc: not available
URL: <http://lists.llvm.org/pipermail/libcxx-commits/attachments/20220826/b6e238b7/attachment-0001.bin>