[compiler-rt] [sanitizer_common] Don't crash in fopen64 interceptor when path is NULL (PR #211468)

[via llvm-commits]

https://github.com/han-ian updated https://github.com/llvm/llvm-project/pull/211468

>From 5dd953bd9e45b17f7e779fff393a5322bb0db345 Mon Sep 17 00:00:00 2001
From: han-ian <jackinwhat at gmail.com>
Date: Thu, 23 Jul 2026 14:08:30 +0800
Subject: [PATCH] [sanitizer_common] Don't crash in fopen64 interceptor when
 path is NULL

The fopen interceptor was fixed to tolerate a NULL path back in 2015
(1d1be3dd8822, "[asan] fix fopen interceptor to not crash if path is
NULL"), guarding the COMMON_INTERCEPTOR_READ_RANGE call with `if (path)`.
The freopen/freopen64 interceptors have the same guard, but fopen64 was
missed: it unconditionally calls internal_strlen(path), so fopen64(NULL,
mode) dereferences NULL inside the interceptor and crashes before the
real fopen64 (which would just return NULL with errno=EFAULT) is ever
reached.

Add the same `if (path)` guard to the fopen64 interceptor and a
regression test mirroring the existing fopen_nullptr.c. Since fopen64 is
only intercepted on glibc (SANITIZER_INTERCEPT_FOPEN64), the test is
placed under TestCases/Linux/ and gated with `// REQUIRES: glibc`.
---
 .../sanitizer_common/sanitizer_common_interceptors.inc   | 2 +-
 .../sanitizer_common/TestCases/Linux/fopen64_nullptr.c   | 9 +++++++++
 2 files changed, 10 insertions(+), 1 deletion(-)
 create mode 100644 compiler-rt/test/sanitizer_common/TestCases/Linux/fopen64_nullptr.c

diff --git a/compiler-rt/lib/sanitizer_common/sanitizer_common_interceptors.inc b/compiler-rt/lib/sanitizer_common/sanitizer_common_interceptors.inc
index caf5a039263f0..394f09ec09d47 100644
--- a/compiler-rt/lib/sanitizer_common/sanitizer_common_interceptors.inc
+++ b/compiler-rt/lib/sanitizer_common/sanitizer_common_interceptors.inc
@@ -6404,7 +6404,7 @@ INTERCEPTOR(int, flopenat, int dirfd, const char *path, int flags, ...) {
 INTERCEPTOR(__sanitizer_FILE *, fopen64, const char *path, const char *mode) {
   void *ctx;
   COMMON_INTERCEPTOR_ENTER(ctx, fopen64, path, mode);
-  COMMON_INTERCEPTOR_READ_RANGE(ctx, path, internal_strlen(path) + 1);
+  if (path) COMMON_INTERCEPTOR_READ_RANGE(ctx, path, internal_strlen(path) + 1);
   COMMON_INTERCEPTOR_READ_RANGE(ctx, mode, internal_strlen(mode) + 1);
   __sanitizer_FILE *res = REAL(fopen64)(path, mode);
   COMMON_INTERCEPTOR_FILE_OPEN(ctx, res, path);
diff --git a/compiler-rt/test/sanitizer_common/TestCases/Linux/fopen64_nullptr.c b/compiler-rt/test/sanitizer_common/TestCases/Linux/fopen64_nullptr.c
new file mode 100644
index 0000000000000..43ac98bb98a66
--- /dev/null
+++ b/compiler-rt/test/sanitizer_common/TestCases/Linux/fopen64_nullptr.c
@@ -0,0 +1,9 @@
+// Check that fopen64(NULL, "r") is ok.
+// RUN: %clang -O2 %s -o %t && %run %t
+
+#define _LARGEFILE64_SOURCE 1
+
+#include <stdio.h>
+const char *fn = NULL;
+FILE *f;
+int main() { f = fopen64(fn, "r"); }