Sanitization of __builtin_memcpy in functions marked no_sanitize_address
- Dominant language
- LLVM
- Stars
- 40.5k
- Forks
- 18.7k
- PR merge metrics
- PR metrics pending
Description
Is it intentional that `__builtin_memcpy` is sanitized when called from a function marked with `no_sanitize_address`?
```c
#include
__attribute__((no_sanitize("address")))
void* memcpy_no_sanitize_address(void* dst, void const* src, size_t size)
{
return __builtin_memcpy(dst, src, size);
}
int main()
{
long long x = 0;
__asan_poison_memory_region(&x, sizeof(x));
long long y = 1;
memcpy_no_sanitize_address(&y, &x, sizeof(x));
__asan_unpoison_memory_region(&x, sizeof(x));
return y;
}
```
Live reproducer on Compiler Explorer: https://godbolt.org/z/axvbMEYKE
And if it is intended, is there any support for explicitly unsanitized `memcpy` and others?
Contributor guide
Research direction
Start by running the C reproducer from the issue in Compiler Explorer and observing how __builtin_memcpy behaves inside no_sanitize_address. Trace the compiler's sanitizer handling for this builtin and compare it with the function attribute semantics. Done means establishing whether the behavior is intentional and, if not, identifying the regression coverage and support needed for explicitly unsanitized memory operations.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c
- Domain
- compilers, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100