llvm / llvm/llvm-project

UBSan CHECK failed at -O0 but reports invalid bool value at -O2/-O3

Open
#215,798 0 comments 1 reaction 0 assignees View on GitHub
compiler-rt:ubsan
Dominant language
LLVM
Stars
40.5k
Forks
18.7k
PR merge metrics
PR metrics pending

Description

I found a difference in Clang trunk when compiling the following C program with -fsanitize=bool,enum on x86-64.
Reproducer: https://godbolt.org/z/9q5b5xYsT

```c
#define bool _Bool
enum A { B = -3, C = 2 } a;
bool b;

enum A foo (bool *p)
{
*p = b;
return a;
}

int main ()
{
char c = 4;
int d = 9;
__builtin_memcpy (&b, &c, -1);
bool e;
foo (&e);
return 0;
}
```

With -O2/3, the program runs successfully :

```
:15:3: warning: 'memcpy' reading 18446744073709551615 bytes from a region of size 1 [-Wstringop-overread]
15 | __builtin_memcpy (&b, &c, -1);
| ^
:15:3: warning: 'memcpy' will always overflow; destination buffer has size 1, but size argument is 18446744073709551615 [-Wfortify-source]
2 warnings generated.
ASM generation compiler returned: 0
:15:3: warning: 'memcpy' reading 18446744073709551615 bytes from a region of size 1 [-Wstringop-overread]
15 | __builtin_memcpy (&b, &c, -1);
| ^
:15:3: warning: 'memcpy' will always overflow; destination buffer has size 1, but size argument is 18446744073709551615 [-Wfortify-source]
2 warnings generated.
Execution build compiler returned: 0
Program returned: 0
/app/example.c:7:8: runtime error: load of value 4, which is not a valid value for type 'bool'
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /app/example.c:7:8
```

However, without optimization (-O0) :
```
:15:3: warning: 'memcpy' reading 18446744073709551615 bytes from a region of size 1 [-Wstringop-overread]
15 | __builtin_memcpy (&b, &c, -1);
| ^
:15:3: warning: 'memcpy' will always overflow; destination buffer has size 1, but size argument is 18446744073709551615 [-Wfortify-source]
2 warnings generated.
ASM generation compiler returned: 0
:15:3: warning: 'memcpy' reading 18446744073709551615 bytes from a region of size 1 [-Wstringop-overread]
15 | __builtin_memcpy (&b, &c, -1);
| ^
:15:3: warning: 'memcpy' will always overflow; destination buffer has size 1, but size argument is 18446744073709551615 [-Wfortify-source]
2 warnings generated.
Execution build compiler returned: 0
Program returned: 1
UndefinedBehaviorSanitizer: CHECK failed: ubsan_diag.cpp:424 "((nullptr)) == ((suppression_ctx))" (0x0, 0x55783d62bdc0) (tid=1)
```

This testcase was generated by a fuzzer.

Contributor guide

Open the contributing guide

Research direction

Start with the Godbolt reproducer and run it with -fsanitize=bool,enum at -O0 and -O2/-O3. Compare the invalid-bool diagnostic at foo and the UBSan CHECK failure reported from ubsan_diag.cpp:424; done means the sanitizer handles this testcase without an internal CHECK failure and reports the invalid value consistently.

Written by the indexing model from the issue text.

Assessment

Tech stack
c
Domain
compilers
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.