1//===-- asan_report.cpp ---------------------------------------------------===//
2//
3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4// See https://llvm.org/LICENSE.txt for license information.
5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6//
7//===----------------------------------------------------------------------===//
8//
9// This file is a part of AddressSanitizer, an address sanity checker.
10//
11// This file contains error reporting code.
12//===----------------------------------------------------------------------===//
13
14#include "asan_report.h"
15
16#include "asan_descriptions.h"
17#include "asan_errors.h"
18#include "asan_flags.h"
19#include "asan_internal.h"
20#include "asan_mapping.h"
21#include "asan_scariness_score.h"
22#include "asan_stack.h"
23#include "asan_thread.h"
24#include "lsan/lsan_common.h"
25#include "sanitizer_common/sanitizer_common.h"
26#include "sanitizer_common/sanitizer_flags.h"
27#include "sanitizer_common/sanitizer_interface_internal.h"
28#include "sanitizer_common/sanitizer_placement_new.h"
29#include "sanitizer_common/sanitizer_report_decorator.h"
30#include "sanitizer_common/sanitizer_stackdepot.h"
31#include "sanitizer_common/sanitizer_symbolizer.h"
32
33namespace __asan {
34
35// -------------------- User-specified callbacks ----------------- {{{1
36static void (*error_report_callback)(const char*);
37using ErrorMessageBuffer = InternalMmapVectorNoCtor<char, true>;
38alignas(
39 alignof(ErrorMessageBuffer)) static char error_message_buffer_placeholder
40 [sizeof(ErrorMessageBuffer)];
41static ErrorMessageBuffer *error_message_buffer = nullptr;
42static Mutex error_message_buf_mutex;
43static const unsigned kAsanBuggyPcPoolSize = 25;
44static __sanitizer::atomic_uintptr_t AsanBuggyPcPool[kAsanBuggyPcPoolSize];
45
46void AppendToErrorMessageBuffer(const char *buffer) {
47 Lock l(&error_message_buf_mutex);
48 if (!error_message_buffer) {
49 error_message_buffer =
50 new (error_message_buffer_placeholder) ErrorMessageBuffer();
51 error_message_buffer->Initialize(initial_capacity: kErrorMessageBufferSize);
52 }
53 uptr error_message_buffer_len = error_message_buffer->size();
54 uptr buffer_len = internal_strlen(s: buffer);
55 error_message_buffer->resize(new_size: error_message_buffer_len + buffer_len);
56 internal_memcpy(dest: error_message_buffer->data() + error_message_buffer_len,
57 src: buffer, n: buffer_len);
58}
59
60// ---------------------- Helper functions ----------------------- {{{1
61
62void PrintMemoryByte(InternalScopedString *str, const char *before, u8 byte,
63 bool in_shadow, const char *after) {
64 Decorator d;
65 str->AppendF(format: "%s%s%x%x%s%s", before,
66 in_shadow ? d.ShadowByte(byte) : d.MemoryByte(), byte >> 4,
67 byte & 15, d.Default(), after);
68}
69
70static void PrintZoneForPointer(uptr ptr, uptr zone_ptr,
71 const char *zone_name) {
72 if (zone_ptr) {
73 if (zone_name) {
74 Printf(format: "malloc_zone_from_ptr(%p) = %p, which is %s\n", (void *)ptr,
75 (void *)zone_ptr, zone_name);
76 } else {
77 Printf(format: "malloc_zone_from_ptr(%p) = %p, which doesn't have a name\n",
78 (void *)ptr, (void *)zone_ptr);
79 }
80 } else {
81 Printf(format: "malloc_zone_from_ptr(%p) = 0\n", (void *)ptr);
82 }
83}
84
85// ---------------------- Address Descriptions ------------------- {{{1
86
87bool ParseFrameDescription(const char *frame_descr,
88 InternalMmapVector<StackVarDescr> *vars) {
89 CHECK(frame_descr);
90 const char *p;
91 // This string is created by the compiler and has the following form:
92 // "n alloc_1 alloc_2 ... alloc_n"
93 // where alloc_i looks like "offset size len ObjectName"
94 // or "offset size len ObjectName:line".
95 uptr n_objects = (uptr)internal_simple_strtoll(nptr: frame_descr, endptr: &p, base: 10);
96 if (n_objects == 0)
97 return false;
98
99 for (uptr i = 0; i < n_objects; i++) {
100 uptr beg = (uptr)internal_simple_strtoll(nptr: p, endptr: &p, base: 10);
101 uptr size = (uptr)internal_simple_strtoll(nptr: p, endptr: &p, base: 10);
102 uptr len = (uptr)internal_simple_strtoll(nptr: p, endptr: &p, base: 10);
103 if (beg == 0 || size == 0 || *p != ' ') {
104 return false;
105 }
106 p++;
107 char *colon_pos = internal_strchr(s: p, c: ':');
108 uptr line = 0;
109 uptr name_len = len;
110 if (colon_pos != nullptr && colon_pos < p + len) {
111 name_len = colon_pos - p;
112 line = (uptr)internal_simple_strtoll(nptr: colon_pos + 1, endptr: nullptr, base: 10);
113 }
114 StackVarDescr var = {.beg: beg, .size: size, .name_pos: p, .name_len: name_len, .line: line};
115 vars->push_back(element: var);
116 p += len;
117 }
118
119 return true;
120}
121
122// -------------------- Different kinds of reports ----------------- {{{1
123
124// Use ScopedInErrorReport to run common actions just before and
125// immediately after printing error report.
126class ScopedInErrorReport {
127 public:
128 explicit ScopedInErrorReport(bool fatal = false)
129 : halt_on_error_(fatal || flags()->halt_on_error) {
130 // Deadlock Prevention Between ASan and LSan
131 //
132 // Background:
133 // - The `dl_iterate_phdr` function requires holding libdl's internal lock
134 // (Lock A).
135 // - LSan acquires the ASan thread registry lock (Lock B) *after* calling
136 // `dl_iterate_phdr`.
137 //
138 // Problem Scenario:
139 // When ASan attempts to call `dl_iterate_phdr` while holding Lock B (e.g.,
140 // during error reporting via `ErrorDescription::Print`), a circular lock
141 // dependency may occur:
142 // 1. Thread 1: Holds Lock B → Requests Lock A (via dl_iterate_phdr)
143 // 2. Thread 2: Holds Lock A → Requests Lock B (via LSan operations)
144 //
145 // Solution:
146 // Proactively load all required modules before acquiring Lock B.
147 // This ensures:
148 // 1. Any `dl_iterate_phdr` calls during module loading complete before
149 // locking.
150 // 2. Subsequent error reporting avoids nested lock acquisition patterns.
151 // 3. Eliminates the lock order inversion risk between libdl and ASan's
152 // thread registry.
153#if CAN_SANITIZE_LEAKS && (SANITIZER_LINUX || SANITIZER_NETBSD)
154 Symbolizer::GetOrInit()->GetRefreshedListOfModules();
155#endif
156
157 // Make sure the registry and sanitizer report mutexes are locked while
158 // we're printing an error report.
159 // We can lock them only here to avoid self-deadlock in case of
160 // recursive reports.
161 asanThreadRegistry().Lock();
162 Printf(
163 format: "=================================================================\n");
164 }
165
166 ~ScopedInErrorReport() {
167 if (halt_on_error_ && !__sanitizer_acquire_crash_state()) {
168 asanThreadRegistry().Unlock();
169 return;
170 }
171 ASAN_ON_ERROR();
172 if (current_error_.IsValid()) current_error_.Print();
173
174 // Make sure the current thread is announced.
175 DescribeThread(t: GetCurrentThread());
176 // We may want to grab this lock again when printing stats.
177 asanThreadRegistry().Unlock();
178 // Print memory stats.
179 if (flags()->print_stats)
180 __asan_print_accumulated_stats();
181
182 if (common_flags()->print_cmdline)
183 PrintCmdline();
184
185 if (common_flags()->print_module_map == 2)
186 DumpProcessMap();
187
188 // Copy the message buffer so that we could start logging without holding a
189 // lock that gets acquired during printing.
190 InternalScopedString buffer_copy;
191 {
192 Lock l(&error_message_buf_mutex);
193 error_message_buffer->push_back(element: '\0');
194 buffer_copy.Append(str: error_message_buffer->data());
195 // Clear error_message_buffer so that if we find other errors
196 // we don't re-log this error.
197 error_message_buffer->clear();
198 }
199
200 LogFullErrorReport(buffer: buffer_copy.data());
201
202 if (error_report_callback) {
203 error_report_callback(buffer_copy.data());
204 }
205
206 if (halt_on_error_ && common_flags()->abort_on_error) {
207 // On Android the message is truncated to 512 characters.
208 // FIXME: implement "compact" error format, possibly without, or with
209 // highly compressed stack traces?
210 // FIXME: or just use the summary line as abort message?
211 SetAbortMessage(buffer_copy.data());
212 }
213
214 // In halt_on_error = false mode, reset the current error object (before
215 // unlocking).
216 if (!halt_on_error_)
217 internal_memset(s: &current_error_, c: 0, n: sizeof(current_error_));
218
219 if (halt_on_error_) {
220 Report(format: "ABORTING\n");
221 Die();
222 }
223 }
224
225 void ReportError(const ErrorDescription &description) {
226 // Can only report one error per ScopedInErrorReport.
227 CHECK_EQ(current_error_.kind, kErrorKindInvalid);
228 internal_memcpy(dest: &current_error_, src: &description, n: sizeof(current_error_));
229 }
230
231 static ErrorDescription &CurrentError() {
232 return current_error_;
233 }
234
235 private:
236 ScopedErrorReportLock error_report_lock_;
237 // Error currently being reported. This enables the destructor to interact
238 // with the debugger and point it to an error description.
239 static ErrorDescription current_error_;
240 bool halt_on_error_;
241};
242
243ErrorDescription ScopedInErrorReport::current_error_(LINKER_INITIALIZED);
244
245void ReportDeadlySignal(const SignalContext &sig) {
246 ScopedInErrorReport in_report(/*fatal*/ true);
247 ErrorDeadlySignal error(GetCurrentTidOrInvalid(), sig);
248 in_report.ReportError(description: error);
249}
250
251void ReportDoubleFree(uptr addr, BufferedStackTrace *free_stack) {
252 ScopedInErrorReport in_report;
253 ErrorDoubleFree error(GetCurrentTidOrInvalid(), free_stack, addr);
254 in_report.ReportError(description: error);
255}
256
257void ReportNewDeleteTypeMismatch(uptr addr, uptr delete_size,
258 uptr delete_alignment,
259 BufferedStackTrace *free_stack) {
260 ScopedInErrorReport in_report;
261 ErrorNewDeleteTypeMismatch error(GetCurrentTidOrInvalid(), free_stack, addr,
262 delete_size, delete_alignment);
263 in_report.ReportError(description: error);
264}
265
266void ReportFreeSizeMismatch(uptr addr, uptr delete_size, uptr delete_alignment,
267 BufferedStackTrace* free_stack) {
268 ScopedInErrorReport in_report;
269 ErrorFreeSizeMismatch error(GetCurrentTidOrInvalid(), free_stack, addr,
270 delete_size, delete_alignment);
271 in_report.ReportError(description: error);
272}
273
274void ReportFreeNotMalloced(uptr addr, BufferedStackTrace *free_stack) {
275 ScopedInErrorReport in_report;
276 ErrorFreeNotMalloced error(GetCurrentTidOrInvalid(), free_stack, addr);
277 in_report.ReportError(description: error);
278}
279
280void ReportAllocTypeMismatch(uptr addr, BufferedStackTrace *free_stack,
281 AllocType alloc_type,
282 AllocType dealloc_type) {
283 ScopedInErrorReport in_report;
284 ErrorAllocTypeMismatch error(GetCurrentTidOrInvalid(), free_stack, addr,
285 alloc_type, dealloc_type);
286 in_report.ReportError(description: error);
287}
288
289void ReportMallocUsableSizeNotOwned(uptr addr, BufferedStackTrace *stack) {
290 ScopedInErrorReport in_report;
291 ErrorMallocUsableSizeNotOwned error(GetCurrentTidOrInvalid(), stack, addr);
292 in_report.ReportError(description: error);
293}
294
295void ReportSanitizerGetAllocatedSizeNotOwned(uptr addr,
296 BufferedStackTrace *stack) {
297 ScopedInErrorReport in_report;
298 ErrorSanitizerGetAllocatedSizeNotOwned error(GetCurrentTidOrInvalid(), stack,
299 addr);
300 in_report.ReportError(description: error);
301}
302
303void ReportCallocOverflow(uptr count, uptr size, BufferedStackTrace *stack) {
304 ScopedInErrorReport in_report(/*fatal*/ true);
305 ErrorCallocOverflow error(GetCurrentTidOrInvalid(), stack, count, size);
306 in_report.ReportError(description: error);
307}
308
309void ReportReallocArrayOverflow(uptr count, uptr size,
310 BufferedStackTrace *stack) {
311 ScopedInErrorReport in_report(/*fatal*/ true);
312 ErrorReallocArrayOverflow error(GetCurrentTidOrInvalid(), stack, count, size);
313 in_report.ReportError(description: error);
314}
315
316void ReportPvallocOverflow(uptr size, BufferedStackTrace *stack) {
317 ScopedInErrorReport in_report(/*fatal*/ true);
318 ErrorPvallocOverflow error(GetCurrentTidOrInvalid(), stack, size);
319 in_report.ReportError(description: error);
320}
321
322void ReportInvalidAllocationAlignment(uptr alignment,
323 BufferedStackTrace *stack) {
324 ScopedInErrorReport in_report(/*fatal*/ true);
325 ErrorInvalidAllocationAlignment error(GetCurrentTidOrInvalid(), stack,
326 alignment);
327 in_report.ReportError(description: error);
328}
329
330void ReportInvalidAlignedAllocAlignment(uptr size, uptr alignment,
331 BufferedStackTrace *stack) {
332 ScopedInErrorReport in_report(/*fatal*/ true);
333 ErrorInvalidAlignedAllocAlignment error(GetCurrentTidOrInvalid(), stack,
334 size, alignment);
335 in_report.ReportError(description: error);
336}
337
338void ReportInvalidPosixMemalignAlignment(uptr alignment,
339 BufferedStackTrace *stack) {
340 ScopedInErrorReport in_report(/*fatal*/ true);
341 ErrorInvalidPosixMemalignAlignment error(GetCurrentTidOrInvalid(), stack,
342 alignment);
343 in_report.ReportError(description: error);
344}
345
346void ReportAllocationSizeTooBig(uptr user_size, uptr total_size, uptr max_size,
347 BufferedStackTrace *stack) {
348 ScopedInErrorReport in_report(/*fatal*/ true);
349 ErrorAllocationSizeTooBig error(GetCurrentTidOrInvalid(), stack, user_size,
350 total_size, max_size);
351 in_report.ReportError(description: error);
352}
353
354void ReportRssLimitExceeded(BufferedStackTrace *stack) {
355 ScopedInErrorReport in_report(/*fatal*/ true);
356 ErrorRssLimitExceeded error(GetCurrentTidOrInvalid(), stack);
357 in_report.ReportError(description: error);
358}
359
360void ReportOutOfMemory(uptr requested_size, BufferedStackTrace *stack) {
361 ScopedInErrorReport in_report(/*fatal*/ true);
362 ErrorOutOfMemory error(GetCurrentTidOrInvalid(), stack, requested_size);
363 in_report.ReportError(description: error);
364}
365
366void ReportStringFunctionMemoryRangesOverlap(const char *function,
367 const char *offset1, uptr length1,
368 const char *offset2, uptr length2,
369 BufferedStackTrace *stack) {
370 ScopedInErrorReport in_report;
371 ErrorStringFunctionMemoryRangesOverlap error(
372 GetCurrentTidOrInvalid(), stack, (uptr)offset1, length1, (uptr)offset2,
373 length2, function);
374 in_report.ReportError(description: error);
375}
376
377void ReportStringFunctionSizeOverflow(uptr offset, uptr size, bool is_write,
378 BufferedStackTrace* stack) {
379 ScopedInErrorReport in_report;
380 ErrorStringFunctionSizeOverflow error(GetCurrentTidOrInvalid(), stack, offset,
381 size, is_write);
382 in_report.ReportError(description: error);
383}
384
385void ReportBadParamsToAnnotateContiguousContainer(uptr beg, uptr end,
386 uptr old_mid, uptr new_mid,
387 BufferedStackTrace *stack) {
388 ScopedInErrorReport in_report;
389 ErrorBadParamsToAnnotateContiguousContainer error(
390 GetCurrentTidOrInvalid(), stack, beg, end, old_mid, new_mid);
391 in_report.ReportError(description: error);
392}
393
394void ReportBadParamsToAnnotateDoubleEndedContiguousContainer(
395 uptr storage_beg, uptr storage_end, uptr old_container_beg,
396 uptr old_container_end, uptr new_container_beg, uptr new_container_end,
397 BufferedStackTrace *stack) {
398 ScopedInErrorReport in_report;
399 ErrorBadParamsToAnnotateDoubleEndedContiguousContainer error(
400 GetCurrentTidOrInvalid(), stack, storage_beg, storage_end,
401 old_container_beg, old_container_end, new_container_beg,
402 new_container_end);
403 in_report.ReportError(description: error);
404}
405
406void ReportODRViolation(const __asan_global *g1, u32 stack_id1,
407 const __asan_global *g2, u32 stack_id2) {
408 ScopedInErrorReport in_report;
409 ErrorODRViolation error(GetCurrentTidOrInvalid(), g1, stack_id1, g2,
410 stack_id2);
411 in_report.ReportError(description: error);
412}
413
414// ----------------------- CheckForInvalidPointerPair ----------- {{{1
415static NOINLINE void ReportInvalidPointerPair(uptr pc, uptr bp, uptr sp,
416 uptr a1, uptr a2) {
417 ScopedInErrorReport in_report;
418 ErrorInvalidPointerPair error(GetCurrentTidOrInvalid(), pc, bp, sp, a1, a2);
419 in_report.ReportError(description: error);
420}
421
422static bool IsInvalidPointerPair(uptr a1, uptr a2) {
423 if (a1 == a2)
424 return false;
425
426 // 256B in shadow memory can be iterated quite fast
427 static const uptr kMaxOffset = 2048;
428
429 uptr left = a1 < a2 ? a1 : a2;
430 uptr right = a1 < a2 ? a2 : a1;
431 uptr offset = right - left;
432 if (offset <= kMaxOffset)
433 return __asan_region_is_poisoned(beg: left, size: offset);
434
435 AsanThread *t = GetCurrentThread();
436
437 // check whether left is a stack memory pointer
438 if (uptr shadow_offset1 = t->GetStackVariableShadowStart(addr: left)) {
439 uptr shadow_offset2 = t->GetStackVariableShadowStart(addr: right);
440 return shadow_offset2 == 0 || shadow_offset1 != shadow_offset2;
441 }
442
443 // check whether left is a heap memory address
444 HeapAddressDescription hdesc1, hdesc2;
445 if (GetHeapAddressInformation(addr: left, access_size: 0, descr: &hdesc1) &&
446 hdesc1.chunk_access.access_type == kAccessTypeInside)
447 return !GetHeapAddressInformation(addr: right, access_size: 0, descr: &hdesc2) ||
448 hdesc2.chunk_access.access_type != kAccessTypeInside ||
449 hdesc1.chunk_access.chunk_begin != hdesc2.chunk_access.chunk_begin;
450
451 // check whether left is an address of a global variable
452 GlobalAddressDescription gdesc1, gdesc2;
453 if (GetGlobalAddressInformation(addr: left, access_size: 0, descr: &gdesc1))
454 return !GetGlobalAddressInformation(addr: right - 1, access_size: 0, descr: &gdesc2) ||
455 !gdesc1.PointsInsideTheSameVariable(other: gdesc2);
456
457 if (t->GetStackVariableShadowStart(addr: right) ||
458 GetHeapAddressInformation(addr: right, access_size: 0, descr: &hdesc2) ||
459 GetGlobalAddressInformation(addr: right - 1, access_size: 0, descr: &gdesc2))
460 return true;
461
462 // At this point we know nothing about both a1 and a2 addresses.
463 return false;
464}
465
466static inline void CheckForInvalidPointerPair(void *p1, void *p2) {
467 switch (flags()->detect_invalid_pointer_pairs) {
468 case 0:
469 return;
470 case 1:
471 if (p1 == nullptr || p2 == nullptr)
472 return;
473 break;
474 }
475
476 uptr a1 = reinterpret_cast<uptr>(p1);
477 uptr a2 = reinterpret_cast<uptr>(p2);
478
479 if (IsInvalidPointerPair(a1, a2)) {
480 GET_CALLER_PC_BP_SP;
481 ReportInvalidPointerPair(pc, bp, sp, a1, a2);
482 }
483}
484// ----------------------- Mac-specific reports ----------------- {{{1
485
486void ReportMacMzReallocUnknown(uptr addr, uptr zone_ptr, const char *zone_name,
487 BufferedStackTrace *stack) {
488 ScopedInErrorReport in_report;
489 Printf(
490 format: "mz_realloc(%p) -- attempting to realloc unallocated memory.\n"
491 "This is an unrecoverable problem, exiting now.\n",
492 (void *)addr);
493 PrintZoneForPointer(ptr: addr, zone_ptr, zone_name);
494 stack->Print();
495 DescribeAddressIfHeap(addr);
496}
497
498// -------------- SuppressErrorReport -------------- {{{1
499// Avoid error reports duplicating for ASan recover mode.
500static bool SuppressErrorReport(uptr pc) {
501 if (!common_flags()->suppress_equal_pcs) return false;
502 for (unsigned i = 0; i < kAsanBuggyPcPoolSize; i++) {
503 uptr cmp = atomic_load_relaxed(a: &AsanBuggyPcPool[i]);
504 if (cmp == 0 && atomic_compare_exchange_strong(a: &AsanBuggyPcPool[i], cmp: &cmp,
505 xchg: pc, mo: memory_order_relaxed))
506 return false;
507 if (cmp == pc) return true;
508 }
509 Die();
510}
511
512void ReportGenericError(uptr pc, uptr bp, uptr sp, uptr addr, bool is_write,
513 uptr access_size, u32 exp, bool fatal) {
514 if (__asan_test_only_reported_buggy_pointer) {
515 *__asan_test_only_reported_buggy_pointer = addr;
516 return;
517 }
518 if (!fatal && SuppressErrorReport(pc)) return;
519 ENABLE_FRAME_POINTER;
520
521 // Optimization experiments.
522 // The experiments can be used to evaluate potential optimizations that remove
523 // instrumentation (assess false negatives). Instead of completely removing
524 // some instrumentation, compiler can emit special calls into runtime
525 // (e.g. __asan_report_exp_load1 instead of __asan_report_load1) and pass
526 // mask of experiments (exp).
527 // The reaction to a non-zero value of exp is to be defined.
528 (void)exp;
529
530 ScopedInErrorReport in_report(fatal);
531 ErrorGeneric error(GetCurrentTidOrInvalid(), pc, bp, sp, addr, is_write,
532 access_size);
533 in_report.ReportError(description: error);
534}
535
536} // namespace __asan
537
538// --------------------------- Interface --------------------- {{{1
539using namespace __asan;
540
541void __asan_report_error(uptr pc, uptr bp, uptr sp, uptr addr, int is_write,
542 uptr access_size, u32 exp) {
543 ENABLE_FRAME_POINTER;
544 bool fatal = flags()->halt_on_error;
545 ReportGenericError(pc, bp, sp, addr, is_write, access_size, exp, fatal);
546}
547
548void NOINLINE __asan_set_error_report_callback(void (*callback)(const char*)) {
549 Lock l(&error_message_buf_mutex);
550 error_report_callback = callback;
551}
552
553void __asan_describe_address(uptr addr) {
554 // Thread registry must be locked while we're describing an address.
555 asanThreadRegistry().Lock();
556 PrintAddressDescription(addr, access_size: 1, bug_type: "");
557 asanThreadRegistry().Unlock();
558}
559
560int __asan_report_present() {
561 return ScopedInErrorReport::CurrentError().kind != kErrorKindInvalid;
562}
563
564uptr __asan_get_report_pc() {
565 if (ScopedInErrorReport::CurrentError().kind == kErrorKindGeneric)
566 return ScopedInErrorReport::CurrentError().Generic.pc;
567 return 0;
568}
569
570uptr __asan_get_report_bp() {
571 if (ScopedInErrorReport::CurrentError().kind == kErrorKindGeneric)
572 return ScopedInErrorReport::CurrentError().Generic.bp;
573 return 0;
574}
575
576uptr __asan_get_report_sp() {
577 if (ScopedInErrorReport::CurrentError().kind == kErrorKindGeneric)
578 return ScopedInErrorReport::CurrentError().Generic.sp;
579 return 0;
580}
581
582uptr __asan_get_report_address() {
583 ErrorDescription &err = ScopedInErrorReport::CurrentError();
584 if (err.kind == kErrorKindGeneric)
585 return err.Generic.addr_description.Address();
586 else if (err.kind == kErrorKindDoubleFree)
587 return err.DoubleFree.addr_description.addr;
588 return 0;
589}
590
591int __asan_get_report_access_type() {
592 if (ScopedInErrorReport::CurrentError().kind == kErrorKindGeneric)
593 return ScopedInErrorReport::CurrentError().Generic.is_write;
594 return 0;
595}
596
597uptr __asan_get_report_access_size() {
598 if (ScopedInErrorReport::CurrentError().kind == kErrorKindGeneric)
599 return ScopedInErrorReport::CurrentError().Generic.access_size;
600 return 0;
601}
602
603int __asan_get_report_src_address(uptr* out_addr, uptr* out_size) {
604 ErrorDescription& err = ScopedInErrorReport::CurrentError();
605 if (err.kind == kErrorKindGeneric && !err.Generic.is_write) {
606 if (out_addr)
607 *out_addr = err.Generic.addr_description.Address();
608 if (out_size)
609 *out_size = err.Generic.access_size;
610 return 1;
611 }
612 if (err.kind == kErrorKindStringFunctionMemoryRangesOverlap) {
613 if (out_addr)
614 *out_addr =
615 err.StringFunctionMemoryRangesOverlap.addr2_description.Address();
616 if (out_size)
617 *out_size = err.StringFunctionMemoryRangesOverlap.length2;
618 return 1;
619 }
620 if (err.kind == kErrorKindStringFunctionSizeOverflow &&
621 !err.StringFunctionSizeOverflow.is_write) {
622 if (out_addr)
623 *out_addr = err.StringFunctionSizeOverflow.addr_description.Address();
624 if (out_size)
625 *out_size = err.StringFunctionSizeOverflow.size;
626 return 1;
627 }
628 if (err.kind == kErrorKindMallocUsableSizeNotOwned) {
629 if (out_addr)
630 *out_addr = err.MallocUsableSizeNotOwned.addr_description.Address();
631 if (out_size)
632 *out_size = 0;
633 return 1;
634 }
635 if (err.kind == kErrorKindSanitizerGetAllocatedSizeNotOwned) {
636 if (out_addr)
637 *out_addr =
638 err.SanitizerGetAllocatedSizeNotOwned.addr_description.Address();
639 if (out_size)
640 *out_size = 0;
641 return 1;
642 }
643 return 0;
644}
645
646int __asan_get_report_dest_address(uptr* out_addr, uptr* out_size) {
647 ErrorDescription& err = ScopedInErrorReport::CurrentError();
648 if (err.kind == kErrorKindGeneric && err.Generic.is_write) {
649 if (out_addr)
650 *out_addr = err.Generic.addr_description.Address();
651 if (out_size)
652 *out_size = err.Generic.access_size;
653 return 1;
654 }
655 if (err.kind == kErrorKindStringFunctionMemoryRangesOverlap) {
656 if (out_addr)
657 *out_addr =
658 err.StringFunctionMemoryRangesOverlap.addr1_description.Address();
659 if (out_size)
660 *out_size = err.StringFunctionMemoryRangesOverlap.length1;
661 return 1;
662 }
663 if (err.kind == kErrorKindStringFunctionSizeOverflow &&
664 err.StringFunctionSizeOverflow.is_write) {
665 if (out_addr)
666 *out_addr = err.StringFunctionSizeOverflow.addr_description.Address();
667 if (out_size)
668 *out_size = err.StringFunctionSizeOverflow.size;
669 return 1;
670 }
671 return 0;
672}
673
674int __asan_get_report_dealloc_address(uptr* out_addr, uptr* out_size) {
675 ErrorDescription& err = ScopedInErrorReport::CurrentError();
676 if (err.kind == kErrorKindDoubleFree) {
677 if (out_addr)
678 *out_addr = err.DoubleFree.addr_description.addr;
679 if (out_size)
680 *out_size = 0;
681 return 1;
682 }
683 if (err.kind == kErrorKindNewDeleteTypeMismatch) {
684 if (out_addr)
685 *out_addr = err.NewDeleteTypeMismatch.addr_description.addr;
686 if (out_size)
687 *out_size = err.NewDeleteTypeMismatch.delete_size;
688 return 1;
689 }
690 if (err.kind == kErrorKindFreeNotMalloced) {
691 if (out_addr)
692 *out_addr = err.FreeNotMalloced.addr_description.Address();
693 if (out_size)
694 *out_size = 0;
695 return 1;
696 }
697 if (err.kind == kErrorKindAllocTypeMismatch) {
698 if (out_addr)
699 *out_addr = err.AllocTypeMismatch.addr_description.Address();
700 if (out_size)
701 *out_size = 0;
702 return 1;
703 }
704 return 0;
705}
706
707int __asan_get_report_first_address(uptr* out_addr, uptr* out_size) {
708 ErrorDescription& err = ScopedInErrorReport::CurrentError();
709 if (err.kind == kErrorKindInvalidPointerPair) {
710 if (out_addr)
711 *out_addr = err.InvalidPointerPair.addr1_description.Address();
712 if (out_size)
713 *out_size = 0;
714 return 1;
715 }
716 if (err.kind == kErrorKindODRViolation) {
717 if (out_addr)
718 *out_addr = err.ODRViolation.global1.beg;
719 if (out_size)
720 *out_size = 0;
721 return 1;
722 }
723 return 0;
724}
725
726int __asan_get_report_second_address(uptr* out_addr, uptr* out_size) {
727 ErrorDescription& err = ScopedInErrorReport::CurrentError();
728 if (err.kind == kErrorKindInvalidPointerPair) {
729 if (out_addr)
730 *out_addr = err.InvalidPointerPair.addr2_description.Address();
731 if (out_size)
732 *out_size = 0;
733 return 1;
734 }
735 if (err.kind == kErrorKindODRViolation) {
736 if (out_addr)
737 *out_addr = err.ODRViolation.global2.beg;
738 if (out_size)
739 *out_size = 0;
740 return 1;
741 }
742 return 0;
743}
744
745const char *__asan_get_report_description() {
746 if (ScopedInErrorReport::CurrentError().kind == kErrorKindGeneric)
747 return ScopedInErrorReport::CurrentError().Generic.bug_descr;
748 return ScopedInErrorReport::CurrentError().Base.scariness.GetDescription();
749}
750
751extern "C" {
752SANITIZER_INTERFACE_ATTRIBUTE
753void __sanitizer_ptr_sub(void *a, void *b) {
754 CheckForInvalidPointerPair(p1: a, p2: b);
755}
756SANITIZER_INTERFACE_ATTRIBUTE
757void __sanitizer_ptr_cmp(void *a, void *b) {
758 CheckForInvalidPointerPair(p1: a, p2: b);
759}
760} // extern "C"
761
762// Provide default implementation of __asan_on_error that does nothing
763// and may be overridden by user.
764SANITIZER_INTERFACE_WEAK_DEF(void, __asan_on_error, void) {}
765