re PR sanitizer/80797 (-fsanitize=null doesn't instrument &s->x)

	PR sanitizer/80797
	* ubsan.c (instrument_null): Unwrap ADDR_EXPRs.
	(pass_ubsan::execute): Call gimple_assign_single_p instead of
	gimple_assign_load_p.

	* c-c++-common/ubsan/null-12.c: New test.

From-SVN: r248179

diff --git a/gcc/ChangeLog b/gcc/ChangeLog
index f9a1430..f839cb0 100644 (file)
--- a/gcc/ChangeLog
+++ b/gcc/ChangeLog
@@ -1,3 +1,10 @@
+2017-05-18  Marek Polacek  <polacek@redhat.com>
+
+       PR sanitizer/80797
+       * ubsan.c (instrument_null): Unwrap ADDR_EXPRs.
+       (pass_ubsan::execute): Call gimple_assign_single_p instead of
+       gimple_assign_load_p.
+
 2017-05-17  Segher Boessenkool  <segher@kernel.crashing.org>
 
        PR middle-end/80692

diff --git a/gcc/testsuite/ChangeLog b/gcc/testsuite/ChangeLog
index 7b38a52..d5ea15c 100644 (file)
--- a/gcc/testsuite/ChangeLog
+++ b/gcc/testsuite/ChangeLog
@@ -1,3 +1,8 @@
+2017-05-18  Marek Polacek  <polacek@redhat.com>
+
+       PR sanitizer/80797
+       * c-c++-common/ubsan/null-12.c: New test.
+
 2017-05-17  Segher Boessenkool  <segher@kernel.crashing.org>
 
        PR middle-end/80692

diff --git a/gcc/testsuite/c-c++-common/ubsan/null-12.c b/gcc/testsuite/c-c++-common/ubsan/null-12.c
new file mode 100644 (file)
index 0000000..3478dc1
--- /dev/null
+++ b/gcc/testsuite/c-c++-common/ubsan/null-12.c
@@ -0,0 +1,42 @@
+/* PR sanitizer/80797 */
+/* { dg-do run } */
+/* { dg-options "-fsanitize=undefined" } */
+
+struct S
+{
+  int i;
+};
+
+struct R
+{
+  struct T {
+    int i;
+  } *t;
+} r;
+
+int
+main ()
+{
+  struct S *s = 0;
+  struct S *s2[1] = { };
+
+  int *v1 = &s->i;
+  int *v2 = &(*s).i;
+  int *v3 = &s2[0]->i;
+  int *v4 = &s->i + 1;
+  int *v5 = &r.t->i;
+
+  asm ("" : : "r" (&v1) : "memory");
+  asm ("" : : "r" (&v2) : "memory");
+  asm ("" : : "r" (&v3) : "memory");
+  asm ("" : : "r" (&v4) : "memory");
+  asm ("" : : "r" (&v5) : "memory");
+
+  return 0;
+}
+
+/* { dg-output "member access within null pointer of type 'struct S'\[^\n\r]*(\n|\r\n|\r)" } */
+/* { dg-output "\[^\n\r]*member access within null pointer of type 'struct S'\[^\n\r]*(\n|\r\n|\r)" } */
+/* { dg-output "\[^\n\r]*member access within null pointer of type 'struct S'\[^\n\r]*(\n|\r\n|\r)" } */
+/* { dg-output "\[^\n\r]*member access within null pointer of type 'struct S'\[^\n\r]*(\n|\r\n|\r)" } */
+/* { dg-output "\[^\n\r]*member access within null pointer of type 'struct T'" } */

diff --git a/gcc/ubsan.c b/gcc/ubsan.c
index 4159cc5..a4808d2 100644 (file)
--- a/gcc/ubsan.c
+++ b/gcc/ubsan.c
@@ -1208,6 +1208,9 @@ instrument_null (gimple_stmt_iterator gsi, bool is_lhs)
 {
   gimple *stmt = gsi_stmt (gsi);
   tree t = is_lhs ? gimple_get_lhs (stmt) : gimple_assign_rhs1 (stmt);
+  /* Handle also e.g. &s->i.  */
+  if (TREE_CODE (t) == ADDR_EXPR)
+    t = TREE_OPERAND (t, 0);
   tree base = get_base_address (t);
   const enum tree_code code = TREE_CODE (base);
   if (code == MEM_REF
@@ -1998,7 +2001,7 @@ pass_ubsan::execute (function *fun)
            {
              if (gimple_store_p (stmt))
                instrument_null (gsi, true);
-             if (gimple_assign_load_p (stmt))
+             if (gimple_assign_single_p (stmt))
                instrument_null (gsi, false);
            }