llvm / llvm/llvm-project

[TySan] Type aliasing violations not detected on returned struct.

Open
#168,577 0 comments 0 reactions 0 assignees View on GitHub
compiler-rt:tysan
Dominant language
LLVM
Stars
40.5k
Forks
18.7k
PR merge metrics
PR metrics pending

Description

Reproducer (C):
```c
struct S {
int a;
float b;
};

struct S returns_s(void) {
struct S x;
x.a = 1;
x.b = 1.0f;
return x;
}

int main(void) {
struct S x = returns_s();

// This should produce an aliasing violation.
float aliased = *((float *) &x.a);
}
```

When compiled with `clang -fsanitize=type`, the sanitizer does not catch the type aliasing violation reading `x.a` through a float pointer. If `x` has its members assigned in main, then the aliasing violation is correctly reported.

Contributor guide

Open the contributing guide

Research direction

Start by compiling the provided C reproducer with clang -fsanitize=type and compare it with the case where the struct members are assigned in main. Trace why the returned struct does not trigger the aliasing violation; done means the returned-struct case reports the violation without regressing the existing case.

Written by the indexing model from the issue text.

Assessment

Tech stack
c
Domain
compilers, testing-qa
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.