[PATCH] D102592: [sanitizer] Caught global buffer underflow for first variable

[Zhiwei Chen via Phabricator via llvm-commits]

condy created this revision.
condy added reviewers: MaskRay, condy.
Herald added a subscriber: hiraditya.
condy requested review of this revision.
Herald added a project: LLVM.
Herald added a subscriber: llvm-commits.

There is no left redzone for global variables, so the underflow for the first variable couldn't be caught. This patch creates a zero-sized array before the first variable so that the underflow of it could be observable.


Repository:
  rG LLVM Github Monorepo

https://reviews.llvm.org/D102592

Files:
  llvm/lib/Transforms/Instrumentation/AddressSanitizer.cpp


Index: llvm/lib/Transforms/Instrumentation/AddressSanitizer.cpp
===================================================================
--- llvm/lib/Transforms/Instrumentation/AddressSanitizer.cpp
+++ llvm/lib/Transforms/Instrumentation/AddressSanitizer.cpp
@@ -2372,6 +2372,18 @@
     return false;
   }
 
+  // Create a global zero-sized array precedence before GlobalsToChange[0] so
+  // that the underflow of the it could be observable.
+  ArrayType *ZeroSizedArrayTy = ArrayType::get(IRB.getInt8Ty(), 0);
+  GlobalVariable *UnderflowObserverGV = new GlobalVariable(
+      M, ZeroSizedArrayTy, /*isConstant*/ false, GlobalVariable::PrivateLinkage,
+      ConstantArray::get(ZeroSizedArrayTy, {}), kAsanGenPrefix,
+      GlobalsToChange[0]);
+  GlobalsToChange.insert(GlobalsToChange.begin(), UnderflowObserverGV);
+
+  // Update size as we insert a dummy one.
+  n = GlobalsToChange.size();
+
   auto &DL = M.getDataLayout();
 
   // A global is described by a structure


-------------- next part --------------
A non-text attachment was scrubbed...
Name: D102592.345743.patch
Type: text/x-patch
Size: 973 bytes
Desc: not available
URL: <http://lists.llvm.org/pipermail/llvm-commits/attachments/20210517/d2d0ed69/attachment.bin>