From 0b805cc75cf2397c9fce9cf47ac728e88fb3185b Mon Sep 17 00:00:00 2001
From: Evgeniy Stepanov <eugeni.stepanov@gmail.com>
Date: Fri, 8 Feb 2013 12:59:42 +0000
Subject: [PATCH] [asan] Fix off-by-one in AddrIsAtRight.

llvm-svn: 174710
---
 compiler-rt/lib/asan/asan_allocator.h              |  2 +-
 .../lib/asan/lit_tests/use-after-free-right.cc     | 46 ++++++++++++++++++++++
 2 files changed, 47 insertions(+), 1 deletion(-)
 create mode 100644 compiler-rt/lib/asan/lit_tests/use-after-free-right.cc

diff --git a/compiler-rt/lib/asan/asan_allocator.h b/compiler-rt/lib/asan/asan_allocator.h
index ac7adc62..9ba2542 100644
--- a/compiler-rt/lib/asan/asan_allocator.h
+++ b/compiler-rt/lib/asan/asan_allocator.h
@@ -71,7 +71,7 @@ class AsanChunkView {
     return false;
   }
   bool AddrIsAtRight(uptr addr, uptr access_size, sptr *offset) {
-    if (addr + access_size >= End()) {
+    if (addr + access_size > End()) {
       *offset = addr - End();
       return true;
     }
diff --git a/compiler-rt/lib/asan/lit_tests/use-after-free-right.cc b/compiler-rt/lib/asan/lit_tests/use-after-free-right.cc
new file mode 100644
index 0000000..f41a859
--- /dev/null
+++ b/compiler-rt/lib/asan/lit_tests/use-after-free-right.cc
@@ -0,0 +1,46 @@
+// RUN: %clangxx_asan -m64 -O0 %s -o %t && %t 2>&1 | %symbolize > %t.out
+// RUN: FileCheck %s < %t.out && FileCheck %s --check-prefix=CHECK-%os < %t.out
+// RUN: %clangxx_asan -m64 -O1 %s -o %t && %t 2>&1 | %symbolize > %t.out
+// RUN: FileCheck %s < %t.out && FileCheck %s --check-prefix=CHECK-%os < %t.out
+// RUN: %clangxx_asan -m64 -O2 %s -o %t && %t 2>&1 | %symbolize > %t.out
+// RUN: FileCheck %s < %t.out && FileCheck %s --check-prefix=CHECK-%os < %t.out
+// RUN: %clangxx_asan -m64 -O3 %s -o %t && %t 2>&1 | %symbolize > %t.out
+// RUN: FileCheck %s < %t.out && FileCheck %s --check-prefix=CHECK-%os < %t.out
+// RUN: %clangxx_asan -m32 -O0 %s -o %t && %t 2>&1 | %symbolize > %t.out
+// RUN: FileCheck %s < %t.out && FileCheck %s --check-prefix=CHECK-%os < %t.out
+// RUN: %clangxx_asan -m32 -O1 %s -o %t && %t 2>&1 | %symbolize > %t.out
+// RUN: FileCheck %s < %t.out && FileCheck %s --check-prefix=CHECK-%os < %t.out
+// RUN: %clangxx_asan -m32 -O2 %s -o %t && %t 2>&1 | %symbolize > %t.out
+// RUN: FileCheck %s < %t.out && FileCheck %s --check-prefix=CHECK-%os < %t.out
+// RUN: %clangxx_asan -m32 -O3 %s -o %t && %t 2>&1 | %symbolize > %t.out
+// RUN: FileCheck %s < %t.out && FileCheck %s --check-prefix=CHECK-%os < %t.out
+
+// Test use-after-free report in the case when access is at the right border of
+//  the allocation.
+
+#include <stdlib.h>
+int main() {
+  volatile char *x = (char*)malloc(sizeof(char));
+  free((void*)x);
+  *x = 42;
+  // CHECK: {{.*ERROR: AddressSanitizer: heap-use-after-free on address}}
+  // CHECK:   {{0x.* at pc 0x.* bp 0x.* sp 0x.*}}
+  // CHECK: {{WRITE of size 1 at 0x.* thread T0}}
+  // CHECK: {{    #0 0x.* in _?main .*use-after-free-right.cc:22}}
+  // CHECK: {{0x.* is located 0 bytes inside of 1-byte region .0x.*,0x.*}}
+  // CHECK: {{freed by thread T0 here:}}
+
+  // CHECK-Linux: {{    #0 0x.* in .*free}}
+  // CHECK-Linux: {{    #1 0x.* in main .*use-after-free-right.cc:21}}
+
+  // CHECK-Darwin: {{    #0 0x.* in _?wrap_free}}
+  // CHECK-Darwin: {{    #1 0x.* in _?main .*use-after-free-right.cc:21}}
+
+  // CHECK: {{previously allocated by thread T0 here:}}
+
+  // CHECK-Linux: {{    #0 0x.* in .*malloc}}
+  // CHECK-Linux: {{    #1 0x.* in main .*use-after-free-right.cc:20}}
+
+  // CHECK-Darwin: {{    #0 0x.* in _?wrap_malloc.*}}
+  // CHECK-Darwin: {{    #1 0x.* in _?main .*use-after-free-right.cc:20}}
+}
-- 
2.7.4