[compiler-rt] r174710 - [asan] Fix off-by-one in AddrIsAtRight.

[Evgeniy Stepanov]

Author: eugenis
Date: Fri Feb  8 06:59:42 2013
New Revision: 174710

URL: http://llvm.org/viewvc/llvm-project?rev=174710&view=rev
Log:
[asan] Fix off-by-one in AddrIsAtRight.

Added:
    compiler-rt/trunk/lib/asan/lit_tests/use-after-free-right.cc   (with props)
Modified:
    compiler-rt/trunk/lib/asan/asan_allocator.h

Modified: compiler-rt/trunk/lib/asan/asan_allocator.h
URL: http://llvm.org/viewvc/llvm-project/compiler-rt/trunk/lib/asan/asan_allocator.h?rev=174710&r1=174709&r2=174710&view=diff
==============================================================================
--- compiler-rt/trunk/lib/asan/asan_allocator.h (original)
+++ compiler-rt/trunk/lib/asan/asan_allocator.h Fri Feb  8 06:59:42 2013
@@ -71,7 +71,7 @@ class AsanChunkView {
     return false;
   }
   bool AddrIsAtRight(uptr addr, uptr access_size, sptr *offset) {
-    if (addr + access_size >= End()) {
+    if (addr + access_size > End()) {
       *offset = addr - End();
       return true;
     }

Added: compiler-rt/trunk/lib/asan/lit_tests/use-after-free-right.cc
URL: http://llvm.org/viewvc/llvm-project/compiler-rt/trunk/lib/asan/lit_tests/use-after-free-right.cc?rev=174710&view=auto
==============================================================================
--- compiler-rt/trunk/lib/asan/lit_tests/use-after-free-right.cc (added)
+++ compiler-rt/trunk/lib/asan/lit_tests/use-after-free-right.cc Fri Feb  8 06:59:42 2013
@@ -0,0 +1,46 @@
+// RUN: %clangxx_asan -m64 -O0 %s -o %t && %t 2>&1 | %symbolize > %t.out
+// RUN: FileCheck %s < %t.out && FileCheck %s --check-prefix=CHECK-%os < %t.out
+// RUN: %clangxx_asan -m64 -O1 %s -o %t && %t 2>&1 | %symbolize > %t.out
+// RUN: FileCheck %s < %t.out && FileCheck %s --check-prefix=CHECK-%os < %t.out
+// RUN: %clangxx_asan -m64 -O2 %s -o %t && %t 2>&1 | %symbolize > %t.out
+// RUN: FileCheck %s < %t.out && FileCheck %s --check-prefix=CHECK-%os < %t.out
+// RUN: %clangxx_asan -m64 -O3 %s -o %t && %t 2>&1 | %symbolize > %t.out
+// RUN: FileCheck %s < %t.out && FileCheck %s --check-prefix=CHECK-%os < %t.out
+// RUN: %clangxx_asan -m32 -O0 %s -o %t && %t 2>&1 | %symbolize > %t.out
+// RUN: FileCheck %s < %t.out && FileCheck %s --check-prefix=CHECK-%os < %t.out
+// RUN: %clangxx_asan -m32 -O1 %s -o %t && %t 2>&1 | %symbolize > %t.out
+// RUN: FileCheck %s < %t.out && FileCheck %s --check-prefix=CHECK-%os < %t.out
+// RUN: %clangxx_asan -m32 -O2 %s -o %t && %t 2>&1 | %symbolize > %t.out
+// RUN: FileCheck %s < %t.out && FileCheck %s --check-prefix=CHECK-%os < %t.out
+// RUN: %clangxx_asan -m32 -O3 %s -o %t && %t 2>&1 | %symbolize > %t.out
+// RUN: FileCheck %s < %t.out && FileCheck %s --check-prefix=CHECK-%os < %t.out
+
+// Test use-after-free report in the case when access is at the right border of
+//  the allocation.
+
+#include <stdlib.h>
+int main() {
+  volatile char *x = (char*)malloc(sizeof(char));
+  free((void*)x);
+  *x = 42;
+  // CHECK: {{.*ERROR: AddressSanitizer: heap-use-after-free on address}}
+  // CHECK:   {{0x.* at pc 0x.* bp 0x.* sp 0x.*}}
+  // CHECK: {{WRITE of size 1 at 0x.* thread T0}}
+  // CHECK: {{    #0 0x.* in _?main .*use-after-free-right.cc:22}}
+  // CHECK: {{0x.* is located 0 bytes inside of 1-byte region .0x.*,0x.*}}
+  // CHECK: {{freed by thread T0 here:}}
+
+  // CHECK-Linux: {{    #0 0x.* in .*free}}
+  // CHECK-Linux: {{    #1 0x.* in main .*use-after-free-right.cc:21}}
+
+  // CHECK-Darwin: {{    #0 0x.* in _?wrap_free}}
+  // CHECK-Darwin: {{    #1 0x.* in _?main .*use-after-free-right.cc:21}}
+
+  // CHECK: {{previously allocated by thread T0 here:}}
+
+  // CHECK-Linux: {{    #0 0x.* in .*malloc}}
+  // CHECK-Linux: {{    #1 0x.* in main .*use-after-free-right.cc:20}}
+
+  // CHECK-Darwin: {{    #0 0x.* in _?wrap_malloc.*}}
+  // CHECK-Darwin: {{    #1 0x.* in _?main .*use-after-free-right.cc:20}}
+}

Propchange: compiler-rt/trunk/lib/asan/lit_tests/use-after-free-right.cc
------------------------------------------------------------------------------
    svn:eol-style = LF