llvm / llvm/llvm-project

Sanitization of __builtin_memcpy in functions marked no_sanitize_address

Open
#200,553 0 comments 0 reactions 0 assignees View on GitHub
compiler-rt:asan
Dominant language
LLVM
Stars
40.5k
Forks
18.7k
PR merge metrics
PR metrics pending

Description

Is it intentional that `__builtin_memcpy` is sanitized when called from a function marked with `no_sanitize_address`?

```c
#include

__attribute__((no_sanitize("address")))
void* memcpy_no_sanitize_address(void* dst, void const* src, size_t size)
{
return __builtin_memcpy(dst, src, size);
}

int main()
{
long long x = 0;
__asan_poison_memory_region(&x, sizeof(x));

long long y = 1;
memcpy_no_sanitize_address(&y, &x, sizeof(x));

__asan_unpoison_memory_region(&x, sizeof(x));

return y;
}
```

Live reproducer on Compiler Explorer: https://godbolt.org/z/axvbMEYKE

And if it is intended, is there any support for explicitly unsanitized `memcpy` and others?

Contributor guide

Open the contributing guide

Research direction

Start by running the C reproducer from the issue in Compiler Explorer and observing how __builtin_memcpy behaves inside no_sanitize_address. Trace the compiler's sanitizer handling for this builtin and compare it with the function attribute semantics. Done means establishing whether the behavior is intentional and, if not, identifying the regression coverage and support needed for explicitly unsanitized memory operations.

Written by the indexing model from the issue text.

Assessment

Tech stack
c
Domain
compilers, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.