[compiler-rt] 8f64a48 - [sanitizer_common] Don't crash in fopen64 interceptor when path is NULL (#211468)

[via llvm-commits]

Author: Ian.han
Date: 2026-07-23T10:50:20-07:00
New Revision: 8f64a4806ffbf577a91390750c2701de2c6496af

URL: https://github.com/llvm/llvm-project/commit/8f64a4806ffbf577a91390750c2701de2c6496af
DIFF: https://github.com/llvm/llvm-project/commit/8f64a4806ffbf577a91390750c2701de2c6496af.diff

LOG: [sanitizer_common] Don't crash in fopen64 interceptor when path is NULL (#211468)

`fopen` was fixed to tolerate a NULL `path` in 2015 (1d1be3dd8822), and
`freopen`/`freopen64` carry the same `if (path)` guard. `fopen64` was
missed, so `fopen64(NULL, mode)` dereferences NULL inside the
interceptor and crashes under sanitizers, even though real `fopen64`
would just return NULL/EFAULT.

Add the missing `if (path)` guard, plus a regression test mirroring
`fopen_nullptr.c`. Since `fopen64` is only intercepted on glibc
(`SANITIZER_INTERCEPT_FOPEN64`), the test is placed under `Linux/` and
gated with `// REQUIRES: glibc`.

Added: 
    compiler-rt/test/sanitizer_common/TestCases/Linux/fopen64_nullptr.c

Modified: 
    compiler-rt/lib/sanitizer_common/sanitizer_common_interceptors.inc

Removed: 
    


################################################################################
diff  --git a/compiler-rt/lib/sanitizer_common/sanitizer_common_interceptors.inc b/compiler-rt/lib/sanitizer_common/sanitizer_common_interceptors.inc
index caf5a039263f0..cdb79f6e06eea 100644
--- a/compiler-rt/lib/sanitizer_common/sanitizer_common_interceptors.inc
+++ b/compiler-rt/lib/sanitizer_common/sanitizer_common_interceptors.inc
@@ -6404,7 +6404,8 @@ INTERCEPTOR(int, flopenat, int dirfd, const char *path, int flags, ...) {
 INTERCEPTOR(__sanitizer_FILE *, fopen64, const char *path, const char *mode) {
   void *ctx;
   COMMON_INTERCEPTOR_ENTER(ctx, fopen64, path, mode);
-  COMMON_INTERCEPTOR_READ_RANGE(ctx, path, internal_strlen(path) + 1);
+  if (path)
+    COMMON_INTERCEPTOR_READ_RANGE(ctx, path, internal_strlen(path) + 1);
   COMMON_INTERCEPTOR_READ_RANGE(ctx, mode, internal_strlen(mode) + 1);
   __sanitizer_FILE *res = REAL(fopen64)(path, mode);
   COMMON_INTERCEPTOR_FILE_OPEN(ctx, res, path);

diff  --git a/compiler-rt/test/sanitizer_common/TestCases/Linux/fopen64_nullptr.c b/compiler-rt/test/sanitizer_common/TestCases/Linux/fopen64_nullptr.c
new file mode 100644
index 0000000000000..0736d5c00a913
--- /dev/null
+++ b/compiler-rt/test/sanitizer_common/TestCases/Linux/fopen64_nullptr.c
@@ -0,0 +1,10 @@
+// Check that fopen64(NULL, "r") is ok.
+// RUN: %clang -O2 %s -o %t && %run %t
+// REQUIRES: glibc
+
+#define _LARGEFILE64_SOURCE 1
+
+#include <stdio.h>
+const char *fn = NULL;
+FILE *f;
+int main() { f = fopen64(fn, "r"); }