[asan] use-after-scope not detected for VLAs
- Dominant language
- LLVM
- Stars
- 40.5k
- Forks
- 18.7k
- PR merge metrics
- PR metrics pending
Description
use-after-scope checks do not seem to apply to arrays that have length defined by a variable, even if that variable is marked 'const'.
```
char sub_func_uas(unsigned long idx) {
const unsigned long UAS_SIZE = 1024;
volatile char* uas_addr = 0;
{
char uas[UAS_SIZE];
__builtin_memset(&uas, 0xBA, sizeof(uas));
uas_addr = uas;
}
return uas_addr[idx];
}
int main(void) {
sub_func_uas((volatile int)512);
return 0;
}
```
Using clang 21.1.0:
`
clang -O2 -DUSE_VAR -fsanitize=address -fsanitize-address-use-after-scope
`
It seems to use to work until this change was made in LLVM12
https://github.com/llvm/llvm-project/commit/dfaa4321a6664064eee405382d51d70715c38c0b / https://github.com/llvm/llvm-project/commit/552c6c232872 / https://reviews.llvm.org/D89523
It may or may not share the same root cause as https://github.com/llvm/llvm-project/issues/42978 ?
Contributor guide
Assessment
This issue has not been assessed yet.