Skip to content

Commit 95693ad

Browse files
committed
Expand detected address sanitizer examples
Instead of just the one example that detected the use-after-free, added a number of new files to detect: - double free - out of bounds on global/heap/stack data - use after free - use after return - use after scope While compiler warnings have improved to detect some of these cases at compile time, they all do still compile. Apart from double-free, all of these programs also execute without issue, highlighting the usefulness of address sanitizer runs.
1 parent bde099d commit 95693ad

File tree

9 files changed

+105
-9
lines changed

9 files changed

+105
-9
lines changed

example/all/CMakeLists.txt

Lines changed: 32 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,8 @@ enable_testing()
3535
# Sanitizers
3636
include(sanitizers)
3737

38-
set_sanitizer_options(address DEFAULT -fsanitize-address-use-after-scope)
38+
set_sanitizer_options(address DEFAULT -fsanitize-address-use-after-scope
39+
-fsanitize-address-use-after-return=runtime)
3940
set_sanitizer_options(leak DEFAULT)
4041
set_sanitizer_options(memory DEFAULT)
4142
set_sanitizer_options(memorywithorigins DEFAULT SANITIZER memory
@@ -65,9 +66,36 @@ target_code_coverage(lsanFail AUTO ALL)
6566
add_test(lsan lsanFail)
6667

6768
# Fails with AddressSanitizer
68-
add_executable(asanFail ../src/asan_fail.cpp)
69-
target_code_coverage(asanFail AUTO ALL)
70-
add_test(asan asanFail)
69+
if(EXAMPLE_USE_SANITIZER STREQUAL "address")
70+
# double-free now has solid detection without sanitizers too
71+
add_executable(asan_double_free ../src/asan/double_free.c)
72+
target_code_coverage(asan_double_free AUTO ALL)
73+
add_test(asan_double_free asan_double_free)
74+
endif()
75+
76+
add_executable(asan_out_of_bounds_global ../src/asan/out_of_bounds_global.c)
77+
target_code_coverage(asan_out_of_bounds_global AUTO ALL)
78+
add_test(asan_out_of_bounds_global asan_out_of_bounds_global)
79+
80+
add_executable(asan_out_of_bounds_heap ../src/asan/out_of_bounds_heap.c)
81+
target_code_coverage(asan_out_of_bounds_heap AUTO ALL)
82+
add_test(asan_out_of_bounds_heap asan_out_of_bounds_heap)
83+
84+
add_executable(asan_out_of_bounds_stack ../src/asan/out_of_bounds_stack.c)
85+
target_code_coverage(asan_out_of_bounds_stack AUTO ALL)
86+
add_test(asan_out_of_bounds_stack asan_out_of_bounds_stack)
87+
88+
add_executable(asan_use_after_free ../src/asan/use_after_free.c)
89+
target_code_coverage(asan_use_after_free AUTO ALL)
90+
add_test(asan_use_after_free asan_use_after_free)
91+
92+
add_executable(asan_use_after_return ../src/asan/use_after_return.c)
93+
target_code_coverage(asan_use_after_return AUTO ALL)
94+
add_test(asan_use_after_return asan_use_after_return)
95+
96+
add_executable(asan_use_after_scope ../src/asan/use_after_scope.c)
97+
target_code_coverage(asan_use_after_scope AUTO ALL)
98+
add_test(asan_use_after_scope asan_use_after_scope)
7199

72100
# Fails with MemorySanitizer
73101
add_executable(msanFail ../src/msan_fail.cpp)

example/src/asan/double_free.c

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
// this is an example of a double-free error
2+
#include <stdlib.h>
3+
4+
int main(int argc, char **argv) {
5+
int *array = (int *)malloc(sizeof(int));
6+
free(array);
7+
free(array); // failure point
8+
return 0;
9+
}
Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
// this is an example of an out-of-bounds error with global data
2+
#include <stdio.h>
3+
4+
int array[1];
5+
6+
int main(int argc, char **argv) {
7+
printf("val: %i\n", array[1]); // failure point
8+
return 0;
9+
}
Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
// this is an example of an out-of-bounds error with heap data
2+
#include <stdio.h>
3+
#include <stdlib.h>
4+
5+
int main(int argc, char **argv) {
6+
int *array = malloc(sizeof(int));
7+
printf("val: %i\n", array[1]); // failure point
8+
free(array);
9+
return 0;
10+
}
Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
// this is an example of an out-of-bounds error with stack data
2+
#include <stdio.h>
3+
4+
int main(int argc, char **argv) {
5+
int array[1];
6+
printf("val: %i\n", array[1]); // failure point
7+
return 0;
8+
}

example/src/asan/use_after_free.c

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
// this is an example of a use-after-free error
2+
#include <stdio.h>
3+
#include <stdlib.h>
4+
5+
int main(int argc, char **argv) {
6+
int *array = malloc(sizeof(int));
7+
free(array);
8+
printf("val: %i\n", *array); // failure point
9+
return 0;
10+
}
Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
// this is an example of a use-after-return error
2+
#include <stdio.h>
3+
4+
int *array;
5+
6+
void setPointerWithEscapedData() {
7+
int internalArray[1];
8+
array = internalArray;
9+
}
10+
11+
int main(int argc, char **argv) {
12+
setPointerWithEscapedData();
13+
printf("val: %i\n", array[0]); // failure point
14+
return 0;
15+
}

example/src/asan/use_after_scope.c

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
// this is an example of a use-after-scope error
2+
#include <stdio.h>
3+
4+
int main(int argc, char **argv) {
5+
int *array;
6+
{
7+
int internalArray[1];
8+
array = internalArray;
9+
}
10+
printf("val: %i\n", array[0]); // failure point
11+
return 0;
12+
}

example/src/asan_fail.cpp

Lines changed: 0 additions & 5 deletions
This file was deleted.

0 commit comments

Comments
 (0)