[llvm-bugs] [Bug 28663] New: sspstrong and sspreq use generate incorrect frame layout with alloca and VLAs

[via llvm-bugs]

https://llvm.org/bugs/show_bug.cgi?id=28663

            Bug ID: 28663
           Summary: sspstrong and sspreq use generate incorrect frame
                    layout with alloca and VLAs
           Product: libraries
           Version: trunk
          Hardware: All
                OS: All
            Status: NEW
          Severity: normal
          Priority: P
         Component: Common Code Generator Code
          Assignee: unassignedbugs at nondot.org
          Reporter: danielmicay at gmail.com
                CC: llvm-bugs at lists.llvm.org
    Classification: Unclassified

Created attachment 16793
  --> https://llvm.org/bugs/attachment.cgi?id=16793&action=edit
[PATCH] stop short-circuiting the SSP code for sspstrong

The StackProtector::RequiresStackProtector method is supposed to add layout
information for alloca instructions that need to be protected by the canary.
This is supposed to protect normal local variables (including function
pointers, etc.) from linear overflows.

However, this method contains an early return for sspstrong and sspreq in the
code for handling calls to alloca and variable length arrays (not regular
arrays, with the IR Clang generates):

          // SSP-Strong: Enable protectors for any call to alloca, regardless
          // of size.
          if (Strong)
            return true;

The method has special handling for sspstrong/sspreq following this early
return, but it's not being used. It ends up returning early, resulting in the
function being protected with a canary but without marking the arrays it's
trying to protect (not only the alloca/VLA triggering the issue) so they get
treated as normal local variables.

I've attached a patch removing this early return.

Example of how the code output changes (at -O0):

#include <string.h>
#include <alloca.h>

int foo(char *bar) {
    char *buf = alloca(20);
    strcpy(buf, bar);
    return strlen(buf);
}

--- old_x86.s    2016-07-22 08:44:37.534862251 -0400
+++ new_x86.s    2016-07-22 08:44:18.778486803 -0400
@@ -17,12 +17,12 @@
     subq    $48, %rsp
     movq    %fs:40, %rax
     movq    %rax, -8(%rbp)
-    movq    %rdi, -24(%rbp)
-    leaq    -44(%rbp), %rdi
-    movq    %rdi, -16(%rbp)
-    movq    -24(%rbp), %rsi
+    movq    %rdi, -48(%rbp)
+    leaq    -28(%rbp), %rdi
+    movq    %rdi, -40(%rbp)
+    movq    -48(%rbp), %rsi
     callq    strcpy
-    movq    -16(%rbp), %rdi
+    movq    -40(%rbp), %rdi
     callq    strlen
     movq    %fs:40, %rcx
     cmpq    -8(%rbp), %rcx

-- 
You are receiving this mail because:
You are on the CC list for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.llvm.org/pipermail/llvm-bugs/attachments/20160722/b546e07d/attachment-0001.html>