chipsalliance / chipsalliance/Surelog

Undefined behavior shift in CompileHelper.cpp

Open
#3,376 11 comments 0 reactions 0 assignees View on GitHub
Dominant language
C++
Stars
475
Forks
90
Avg merge
1h 39m
Merged PRs (30d)
37

Description

Testing with [undefined behavior sanitizer]( https://clang.llvm.org/docs/UndefinedBehaviorSanitizer.html) finds that in [CompileHelper.cpp:4044](https://github.com/chipsalliance/Surelog/blob/c79ec59d49c79fcb2f557fa5391972993fa5d3c8/src/DesignCompile/CompileHelper.cpp#L4044) an invalid shift is used. Shifting outside the width of an integer is UB

This can be seen with `ArianeElab`, `ArianeElab2`, `HierPathOverride` and `LargeHexCast`
```
src/DesignCompile/CompileHelper.cpp:4044:42: runtime error: shift exponent 1023 is too large for 32-bit type 'int'
#0 0x55e69b64f7ed in SURELOG::CompileHelper::expandPatternAssignment(UHDM::typespec const*, UHDM::expr*, SURELOG::DesignComponent*, SURELOG::CompileDesign*, SURELOG::ValuedComponentI*) src/DesignCompile/CompileHelper.cpp:4044:42
#1 0x55e69b757342 in SURELOG::NetlistElaboration::elab_parameters_(SURELOG::ModuleInstance*, bool) src/DesignCompile/NetlistElaboration.cpp:228:32
#2 0x55e69b755c3b in SURELOG::NetlistElaboration::elaborate_(SURELOG::ModuleInstance*, bool) src/DesignCompile/NetlistElaboration.cpp:497:3
#3 0x55e69b7558ba in SURELOG::NetlistElaboration::elaborateInstance(SURELOG::ModuleInstance*) src/DesignCompile/NetlistElaboration.cpp:112:10
#4 0x55e69b79224e in SURELOG::DesignElaboration::elaborateInstance_(SURELOG::FileContent const*, SURELOG::NodeId, SURELOG::NodeId, SURELOG::ModuleInstanceFactory*, SURELOG::ModuleInstance*, SURELOG::Config*, std::__u::vector>&) src/DesignCompile/DesignElaboration.cpp:896:12
#5 0x55e69b799d56 in SURELOG::DesignElaboration::elaborateInstance_(SURELOG::FileContent const*, SURELOG::NodeId, SURELOG::NodeId, SURELOG::ModuleInstanceFactory*, SURELOG::ModuleInstance*, SURELOG::Config*, std::__u::vector>&) src/DesignCompile/DesignElaboration.cpp:1707:15
#6 0x55e69b78bd9d in SURELOG::DesignElaboration::elaborateModule_(std::__u::basic_string, std::__u::allocator> const&, SURELOG::FileContent const*, bool) src/DesignCompile/DesignElaboration.cpp:549:11
#7 0x55e69b77ecae in elaborateAllModules_ src/DesignCompile/DesignElaboration.cpp:477:10
#8 0x55e69b77ecae in SURELOG::DesignElaboration::elaborate() src/DesignCompile/DesignElaboration.cpp:76:3
#9 0x55e69b721897 in SURELOG::CompileDesign::elaboration_() src/DesignCompile/CompileDesign.cpp:368:13
#10 0x55e69b72166f in SURELOG::CompileDesign::elaborate() src/DesignCompile/CompileDesign.cpp:272:11
#11 0x55e69b59e7f0 in SURELOG::Compiler::compile() src/SourceCompile/Compiler.cpp:1047:24
#12 0x55e69b500f54 in SURELOG::start_compiler(SURELOG::CommandLineParser*) src/API/Surelog.cpp:33:31
#13 0x55e69b4faa32 in executeCompilation(int, char const**, bool, bool, SURELOG::ErrorContainer::Stats*) src/main.cpp:92:36
#14 0x55e69b4fd73c in main src/main.cpp:323:21
```

Besides fixing this: it would probably make sense to set up `asan`, `msan` and `ubsan` tests in the CI.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start at src/DesignCompile/CompileHelper.cpp:4044 and reproduce the undefined shift with UBSan using ArianeElab, ArianeElab2, HierPathOverride, or LargeHexCast. Read the expansion call from src/DesignCompile/NetlistElaboration.cpp:228 and verify that the invalid shift is eliminated without changing elaboration behavior. The issue also proposes ASan, MSan, and UBSan CI coverage, but no CI files or test entry points are named.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
ci-cd, compilers, testing-qa
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.