1 //===-- msan_test.cc ------------------------------------------------------===//
2 //
3 //                     The LLVM Compiler Infrastructure
4 //
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
7 //
8 //===----------------------------------------------------------------------===//
9 //
10 // This file is a part of MemorySanitizer.
11 //
12 // MemorySanitizer unit tests.
13 //===----------------------------------------------------------------------===//
14 
15 #ifndef MSAN_EXTERNAL_TEST_CONFIG
16 #include "msan_test_config.h"
17 #endif // MSAN_EXTERNAL_TEST_CONFIG
18 
19 #include "sanitizer_common/tests/sanitizer_test_utils.h"
20 
21 #include "sanitizer/allocator_interface.h"
22 #include "sanitizer/msan_interface.h"
23 
24 #if defined(__FreeBSD__)
25 # define _KERNEL  // To declare 'shminfo' structure.
26 # include <sys/shm.h>
27 # undef _KERNEL
28 extern "C" {
29 // <sys/shm.h> doesn't declare these functions in _KERNEL mode.
30 void *shmat(int, const void *, int);
31 int shmget(key_t, size_t, int);
32 int shmctl(int, int, struct shmid_ds *);
33 int shmdt(const void *);
34 }
35 #endif
36 
37 #include <inttypes.h>
38 #include <stdlib.h>
39 #include <stdarg.h>
40 #include <stdio.h>
41 #include <wchar.h>
42 #include <math.h>
43 
44 #include <arpa/inet.h>
45 #include <dlfcn.h>
46 #include <grp.h>
47 #include <unistd.h>
48 #include <link.h>
49 #include <limits.h>
50 #include <sys/time.h>
51 #include <poll.h>
52 #include <sys/types.h>
53 #include <sys/stat.h>
54 #include <fcntl.h>
55 #include <sys/resource.h>
56 #include <sys/ioctl.h>
57 #include <sys/statvfs.h>
58 #include <sys/utsname.h>
59 #include <sys/mman.h>
60 #include <dirent.h>
61 #include <pwd.h>
62 #include <sys/socket.h>
63 #include <netdb.h>
64 #include <wordexp.h>
65 #include <sys/ipc.h>
66 #include <sys/shm.h>
67 
68 #if !defined(__FreeBSD__)
69 # include <malloc.h>
70 # include <sys/sysinfo.h>
71 # include <sys/vfs.h>
72 # include <mntent.h>
73 # include <netinet/ether.h>
74 #else
75 # include <signal.h>
76 # include <netinet/in.h>
77 # include <pthread_np.h>
78 # include <sys/uio.h>
79 # include <sys/mount.h>
80 # include <sys/sysctl.h>
81 # include <net/ethernet.h>
82 # define f_namelen f_namemax  // FreeBSD names this statfs field so.
83 # define cpu_set_t cpuset_t
84 extern "C" {
85 // FreeBSD's <ssp/string.h> defines mempcpy() to be a macro expanding into
86 // a __builtin___mempcpy_chk() call, but since Msan RTL defines it as an
87 // ordinary function, we can declare it here to complete the tests.
88 void *mempcpy(void *dest, const void *src, size_t n);
89 }
90 #endif
91 
92 #if defined(__i386__) || defined(__x86_64__)
93 # include <emmintrin.h>
94 # define MSAN_HAS_M128 1
95 #else
96 # define MSAN_HAS_M128 0
97 #endif
98 
99 #ifdef __AVX2__
100 # include <immintrin.h>
101 #endif
102 
103 // On FreeBSD procfs is not enabled by default.
104 #if defined(__FreeBSD__)
105 # define FILE_TO_READ "/bin/cat"
106 # define DIR_TO_READ "/bin"
107 # define SUBFILE_TO_READ "cat"
108 # define SYMLINK_TO_READ "/usr/bin/tar"
109 # define SUPERUSER_GROUP "wheel"
110 #else
111 # define FILE_TO_READ "/proc/self/stat"
112 # define DIR_TO_READ "/proc/self"
113 # define SUBFILE_TO_READ "stat"
114 # define SYMLINK_TO_READ "/proc/self/exe"
115 # define SUPERUSER_GROUP "root"
116 #endif
117 
GetPageSize()118 static uintptr_t GetPageSize() {
119   return sysconf(_SC_PAGESIZE);
120 }
121 
122 const size_t kMaxPathLength = 4096;
123 
124 typedef unsigned char      U1;
125 typedef unsigned short     U2;  // NOLINT
126 typedef unsigned int       U4;
127 typedef unsigned long long U8;  // NOLINT
128 typedef   signed char      S1;
129 typedef   signed short     S2;  // NOLINT
130 typedef   signed int       S4;
131 typedef   signed long long S8;  // NOLINT
132 #define NOINLINE      __attribute__((noinline))
133 #define INLINE      __attribute__((always_inline))
134 
TrackingOrigins()135 static bool TrackingOrigins() {
136   S8 x;
137   __msan_set_origin(&x, sizeof(x), 0x1234);
138   U4 origin = __msan_get_origin(&x);
139   __msan_set_origin(&x, sizeof(x), 0);
140   return __msan_origin_is_descendant_or_same(origin, 0x1234);
141 }
142 
143 #define EXPECT_ORIGIN(expected, origin) \
144   EXPECT_TRUE(__msan_origin_is_descendant_or_same((origin), (expected)))
145 
146 #define EXPECT_UMR(action) \
147     do {                        \
148       __msan_set_expect_umr(1); \
149       action;                   \
150       __msan_set_expect_umr(0); \
151     } while (0)
152 
153 #define EXPECT_UMR_O(action, origin)                                       \
154   do {                                                                     \
155     __msan_set_expect_umr(1);                                              \
156     action;                                                                \
157     __msan_set_expect_umr(0);                                              \
158     if (TrackingOrigins()) EXPECT_ORIGIN(origin, __msan_get_umr_origin()); \
159   } while (0)
160 
161 #define EXPECT_POISONED(x) ExpectPoisoned(x)
162 
163 template<typename T>
ExpectPoisoned(const T & t)164 void ExpectPoisoned(const T& t) {
165   EXPECT_NE(-1, __msan_test_shadow((void*)&t, sizeof(t)));
166 }
167 
168 #define EXPECT_POISONED_O(x, origin) \
169   ExpectPoisonedWithOrigin(x, origin)
170 
171 template<typename T>
ExpectPoisonedWithOrigin(const T & t,unsigned origin)172 void ExpectPoisonedWithOrigin(const T& t, unsigned origin) {
173   EXPECT_NE(-1, __msan_test_shadow((void*)&t, sizeof(t)));
174   if (TrackingOrigins()) EXPECT_ORIGIN(origin, __msan_get_origin((void *)&t));
175 }
176 
177 #define EXPECT_NOT_POISONED(x) EXPECT_EQ(true, TestForNotPoisoned((x)))
178 
179 template<typename T>
TestForNotPoisoned(const T & t)180 bool TestForNotPoisoned(const T& t) {
181   return __msan_test_shadow((void*)&t, sizeof(t)) == -1;
182 }
183 
184 static U8 poisoned_array[100];
185 template<class T>
GetPoisoned(int i=0,T val=0)186 T *GetPoisoned(int i = 0, T val = 0) {
187   T *res = (T*)&poisoned_array[i];
188   *res = val;
189   __msan_poison(&poisoned_array[i], sizeof(T));
190   return res;
191 }
192 
193 template<class T>
GetPoisonedO(int i,U4 origin,T val=0)194 T *GetPoisonedO(int i, U4 origin, T val = 0) {
195   T *res = (T*)&poisoned_array[i];
196   *res = val;
197   __msan_poison(&poisoned_array[i], sizeof(T));
198   __msan_set_origin(&poisoned_array[i], sizeof(T), origin);
199   return res;
200 }
201 
202 template<typename T>
Poisoned(T v=0,T s=(T)(-1))203 T Poisoned(T v = 0, T s = (T)(-1)) {
204   __msan_partial_poison(&v, &s, sizeof(T));
205   return v;
206 }
207 
ReturnPoisoned()208 template<class T> NOINLINE T ReturnPoisoned() { return *GetPoisoned<T>(); }
209 
210 static volatile int g_one = 1;
211 static volatile int g_zero = 0;
212 static volatile int g_0 = 0;
213 static volatile int g_1 = 1;
214 
215 S4 a_s4[100];
216 S8 a_s8[100];
217 
218 // Check that malloc poisons memory.
219 // A lot of tests below depend on this.
TEST(MemorySanitizerSanity,PoisonInMalloc)220 TEST(MemorySanitizerSanity, PoisonInMalloc) {
221   int *x = (int*)malloc(sizeof(int));
222   EXPECT_POISONED(*x);
223   free(x);
224 }
225 
TEST(MemorySanitizer,NegativeTest1)226 TEST(MemorySanitizer, NegativeTest1) {
227   S4 *x = GetPoisoned<S4>();
228   if (g_one)
229     *x = 0;
230   EXPECT_NOT_POISONED(*x);
231 }
232 
TEST(MemorySanitizer,PositiveTest1)233 TEST(MemorySanitizer, PositiveTest1) {
234   // Load to store.
235   EXPECT_POISONED(*GetPoisoned<S1>());
236   EXPECT_POISONED(*GetPoisoned<S2>());
237   EXPECT_POISONED(*GetPoisoned<S4>());
238   EXPECT_POISONED(*GetPoisoned<S8>());
239 
240   // S->S conversions.
241   EXPECT_POISONED(*GetPoisoned<S1>());
242   EXPECT_POISONED(*GetPoisoned<S1>());
243   EXPECT_POISONED(*GetPoisoned<S1>());
244 
245   EXPECT_POISONED(*GetPoisoned<S2>());
246   EXPECT_POISONED(*GetPoisoned<S2>());
247   EXPECT_POISONED(*GetPoisoned<S2>());
248 
249   EXPECT_POISONED(*GetPoisoned<S4>());
250   EXPECT_POISONED(*GetPoisoned<S4>());
251   EXPECT_POISONED(*GetPoisoned<S4>());
252 
253   EXPECT_POISONED(*GetPoisoned<S8>());
254   EXPECT_POISONED(*GetPoisoned<S8>());
255   EXPECT_POISONED(*GetPoisoned<S8>());
256 
257   // ZExt
258   EXPECT_POISONED(*GetPoisoned<U1>());
259   EXPECT_POISONED(*GetPoisoned<U1>());
260   EXPECT_POISONED(*GetPoisoned<U1>());
261   EXPECT_POISONED(*GetPoisoned<U2>());
262   EXPECT_POISONED(*GetPoisoned<U2>());
263   EXPECT_POISONED(*GetPoisoned<U4>());
264 
265   // Unary ops.
266   EXPECT_POISONED(- *GetPoisoned<S4>());
267 
268   EXPECT_UMR(a_s4[g_zero] = 100 / *GetPoisoned<S4>(0, 1));
269 
270 
271   a_s4[g_zero] = 1 - *GetPoisoned<S4>();
272   a_s4[g_zero] = 1 + *GetPoisoned<S4>();
273 }
274 
TEST(MemorySanitizer,Phi1)275 TEST(MemorySanitizer, Phi1) {
276   S4 c;
277   if (g_one) {
278     c = *GetPoisoned<S4>();
279   } else {
280     break_optimization(0);
281     c = 0;
282   }
283   EXPECT_POISONED(c);
284 }
285 
TEST(MemorySanitizer,Phi2)286 TEST(MemorySanitizer, Phi2) {
287   S4 i = *GetPoisoned<S4>();
288   S4 n = g_one;
289   EXPECT_UMR(for (; i < g_one; i++););
290   EXPECT_POISONED(i);
291 }
292 
Arg1ExpectUMR(S4 a1)293 NOINLINE void Arg1ExpectUMR(S4 a1) { EXPECT_POISONED(a1); }
Arg2ExpectUMR(S4 a1,S4 a2)294 NOINLINE void Arg2ExpectUMR(S4 a1, S4 a2) { EXPECT_POISONED(a2); }
Arg3ExpectUMR(S1 a1,S4 a2,S8 a3)295 NOINLINE void Arg3ExpectUMR(S1 a1, S4 a2, S8 a3) { EXPECT_POISONED(a3); }
296 
TEST(MemorySanitizer,ArgTest)297 TEST(MemorySanitizer, ArgTest) {
298   Arg1ExpectUMR(*GetPoisoned<S4>());
299   Arg2ExpectUMR(0, *GetPoisoned<S4>());
300   Arg3ExpectUMR(0, 1, *GetPoisoned<S8>());
301 }
302 
303 
TEST(MemorySanitizer,CallAndRet)304 TEST(MemorySanitizer, CallAndRet) {
305   ReturnPoisoned<S1>();
306   ReturnPoisoned<S2>();
307   ReturnPoisoned<S4>();
308   ReturnPoisoned<S8>();
309 
310   EXPECT_POISONED(ReturnPoisoned<S1>());
311   EXPECT_POISONED(ReturnPoisoned<S2>());
312   EXPECT_POISONED(ReturnPoisoned<S4>());
313   EXPECT_POISONED(ReturnPoisoned<S8>());
314 }
315 
316 // malloc() in the following test may be optimized to produce a compile-time
317 // undef value. Check that we trap on the volatile assignment anyway.
TEST(MemorySanitizer,DISABLED_MallocNoIdent)318 TEST(MemorySanitizer, DISABLED_MallocNoIdent) {
319   S4 *x = (int*)malloc(sizeof(S4));
320   EXPECT_POISONED(*x);
321   free(x);
322 }
323 
TEST(MemorySanitizer,Malloc)324 TEST(MemorySanitizer, Malloc) {
325   S4 *x = (int*)Ident(malloc(sizeof(S4)));
326   EXPECT_POISONED(*x);
327   free(x);
328 }
329 
TEST(MemorySanitizer,Realloc)330 TEST(MemorySanitizer, Realloc) {
331   S4 *x = (int*)Ident(realloc(0, sizeof(S4)));
332   EXPECT_POISONED(x[0]);
333   x[0] = 1;
334   x = (int*)Ident(realloc(x, 2 * sizeof(S4)));
335   EXPECT_NOT_POISONED(x[0]);  // Ok, was inited before.
336   EXPECT_POISONED(x[1]);
337   x = (int*)Ident(realloc(x, 3 * sizeof(S4)));
338   EXPECT_NOT_POISONED(x[0]);  // Ok, was inited before.
339   EXPECT_POISONED(x[2]);
340   EXPECT_POISONED(x[1]);
341   x[2] = 1;  // Init this here. Check that after realloc it is poisoned again.
342   x = (int*)Ident(realloc(x, 2 * sizeof(S4)));
343   EXPECT_NOT_POISONED(x[0]);  // Ok, was inited before.
344   EXPECT_POISONED(x[1]);
345   x = (int*)Ident(realloc(x, 3 * sizeof(S4)));
346   EXPECT_POISONED(x[1]);
347   EXPECT_POISONED(x[2]);
348   free(x);
349 }
350 
TEST(MemorySanitizer,Calloc)351 TEST(MemorySanitizer, Calloc) {
352   S4 *x = (int*)Ident(calloc(1, sizeof(S4)));
353   EXPECT_NOT_POISONED(*x);  // Should not be poisoned.
354   EXPECT_EQ(0, *x);
355   free(x);
356 }
357 
TEST(MemorySanitizer,CallocReturnsZeroMem)358 TEST(MemorySanitizer, CallocReturnsZeroMem) {
359   size_t sizes[] = {16, 1000, 10000, 100000, 2100000};
360   for (size_t s = 0; s < sizeof(sizes)/sizeof(sizes[0]); s++) {
361     size_t size = sizes[s];
362     for (size_t iter = 0; iter < 5; iter++) {
363       char *x = Ident((char*)calloc(1, size));
364       EXPECT_EQ(x[0], 0);
365       EXPECT_EQ(x[size - 1], 0);
366       EXPECT_EQ(x[size / 2], 0);
367       EXPECT_EQ(x[size / 3], 0);
368       EXPECT_EQ(x[size / 4], 0);
369       memset(x, 0x42, size);
370       free(Ident(x));
371     }
372   }
373 }
374 
TEST(MemorySanitizer,AndOr)375 TEST(MemorySanitizer, AndOr) {
376   U4 *p = GetPoisoned<U4>();
377   // We poison two bytes in the midle of a 4-byte word to make the test
378   // correct regardless of endianness.
379   ((U1*)p)[1] = 0;
380   ((U1*)p)[2] = 0xff;
381   EXPECT_NOT_POISONED(*p & 0x00ffff00);
382   EXPECT_NOT_POISONED(*p & 0x00ff0000);
383   EXPECT_NOT_POISONED(*p & 0x0000ff00);
384   EXPECT_POISONED(*p & 0xff000000);
385   EXPECT_POISONED(*p & 0x000000ff);
386   EXPECT_POISONED(*p & 0x0000ffff);
387   EXPECT_POISONED(*p & 0xffff0000);
388 
389   EXPECT_NOT_POISONED(*p | 0xff0000ff);
390   EXPECT_NOT_POISONED(*p | 0xff00ffff);
391   EXPECT_NOT_POISONED(*p | 0xffff00ff);
392   EXPECT_POISONED(*p | 0xff000000);
393   EXPECT_POISONED(*p | 0x000000ff);
394   EXPECT_POISONED(*p | 0x0000ffff);
395   EXPECT_POISONED(*p | 0xffff0000);
396 
397   EXPECT_POISONED(*GetPoisoned<bool>() & *GetPoisoned<bool>());
398 }
399 
400 template<class T>
applyNot(T value,T shadow)401 static bool applyNot(T value, T shadow) {
402   __msan_partial_poison(&value, &shadow, sizeof(T));
403   return !value;
404 }
405 
TEST(MemorySanitizer,Not)406 TEST(MemorySanitizer, Not) {
407   EXPECT_NOT_POISONED(applyNot<U4>(0x0, 0x0));
408   EXPECT_NOT_POISONED(applyNot<U4>(0xFFFFFFFF, 0x0));
409   EXPECT_POISONED(applyNot<U4>(0xFFFFFFFF, 0xFFFFFFFF));
410   EXPECT_NOT_POISONED(applyNot<U4>(0xFF000000, 0x0FFFFFFF));
411   EXPECT_NOT_POISONED(applyNot<U4>(0xFF000000, 0x00FFFFFF));
412   EXPECT_NOT_POISONED(applyNot<U4>(0xFF000000, 0x0000FFFF));
413   EXPECT_NOT_POISONED(applyNot<U4>(0xFF000000, 0x00000000));
414   EXPECT_POISONED(applyNot<U4>(0xFF000000, 0xFF000000));
415   EXPECT_NOT_POISONED(applyNot<U4>(0xFF800000, 0xFF000000));
416   EXPECT_POISONED(applyNot<U4>(0x00008000, 0x00008000));
417 
418   EXPECT_NOT_POISONED(applyNot<U1>(0x0, 0x0));
419   EXPECT_NOT_POISONED(applyNot<U1>(0xFF, 0xFE));
420   EXPECT_NOT_POISONED(applyNot<U1>(0xFF, 0x0));
421   EXPECT_POISONED(applyNot<U1>(0xFF, 0xFF));
422 
423   EXPECT_POISONED(applyNot<void*>((void*)0xFFFFFF, (void*)(-1)));
424   EXPECT_NOT_POISONED(applyNot<void*>((void*)0xFFFFFF, (void*)(-2)));
425 }
426 
TEST(MemorySanitizer,Shift)427 TEST(MemorySanitizer, Shift) {
428   U4 *up = GetPoisoned<U4>();
429   ((U1*)up)[0] = 0;
430   ((U1*)up)[3] = 0xff;
431   EXPECT_NOT_POISONED(*up >> 30);
432   EXPECT_NOT_POISONED(*up >> 24);
433   EXPECT_POISONED(*up >> 23);
434   EXPECT_POISONED(*up >> 10);
435 
436   EXPECT_NOT_POISONED(*up << 30);
437   EXPECT_NOT_POISONED(*up << 24);
438   EXPECT_POISONED(*up << 23);
439   EXPECT_POISONED(*up << 10);
440 
441   S4 *sp = (S4*)up;
442   EXPECT_NOT_POISONED(*sp >> 30);
443   EXPECT_NOT_POISONED(*sp >> 24);
444   EXPECT_POISONED(*sp >> 23);
445   EXPECT_POISONED(*sp >> 10);
446 
447   sp = GetPoisoned<S4>();
448   ((S1*)sp)[1] = 0;
449   ((S1*)sp)[2] = 0;
450   EXPECT_POISONED(*sp >> 31);
451 
452   EXPECT_POISONED(100 >> *GetPoisoned<S4>());
453   EXPECT_POISONED(100U >> *GetPoisoned<S4>());
454 }
455 
GetPoisonedZero()456 NOINLINE static int GetPoisonedZero() {
457   int *zero = new int;
458   *zero = 0;
459   __msan_poison(zero, sizeof(*zero));
460   int res = *zero;
461   delete zero;
462   return res;
463 }
464 
TEST(MemorySanitizer,LoadFromDirtyAddress)465 TEST(MemorySanitizer, LoadFromDirtyAddress) {
466   int *a = new int;
467   *a = 0;
468   EXPECT_UMR(break_optimization((void*)(U8)a[GetPoisonedZero()]));
469   delete a;
470 }
471 
TEST(MemorySanitizer,StoreToDirtyAddress)472 TEST(MemorySanitizer, StoreToDirtyAddress) {
473   int *a = new int;
474   EXPECT_UMR(a[GetPoisonedZero()] = 0);
475   break_optimization(a);
476   delete a;
477 }
478 
479 
StackTestFunc()480 NOINLINE void StackTestFunc() {
481   S4 p4;
482   S4 ok4 = 1;
483   S2 p2;
484   S2 ok2 = 1;
485   S1 p1;
486   S1 ok1 = 1;
487   break_optimization(&p4);
488   break_optimization(&ok4);
489   break_optimization(&p2);
490   break_optimization(&ok2);
491   break_optimization(&p1);
492   break_optimization(&ok1);
493 
494   EXPECT_POISONED(p4);
495   EXPECT_POISONED(p2);
496   EXPECT_POISONED(p1);
497   EXPECT_NOT_POISONED(ok1);
498   EXPECT_NOT_POISONED(ok2);
499   EXPECT_NOT_POISONED(ok4);
500 }
501 
TEST(MemorySanitizer,StackTest)502 TEST(MemorySanitizer, StackTest) {
503   StackTestFunc();
504 }
505 
StackStressFunc()506 NOINLINE void StackStressFunc() {
507   int foo[10000];
508   break_optimization(foo);
509 }
510 
TEST(MemorySanitizer,DISABLED_StackStressTest)511 TEST(MemorySanitizer, DISABLED_StackStressTest) {
512   for (int i = 0; i < 1000000; i++)
513     StackStressFunc();
514 }
515 
516 template<class T>
TestFloatingPoint()517 void TestFloatingPoint() {
518   static volatile T v;
519   static T g[100];
520   break_optimization(&g);
521   T *x = GetPoisoned<T>();
522   T *y = GetPoisoned<T>(1);
523   EXPECT_POISONED(*x);
524   EXPECT_POISONED((long long)*x);
525   EXPECT_POISONED((int)*x);
526   g[0] = *x;
527   g[1] = *x + *y;
528   g[2] = *x - *y;
529   g[3] = *x * *y;
530 }
531 
TEST(MemorySanitizer,FloatingPointTest)532 TEST(MemorySanitizer, FloatingPointTest) {
533   TestFloatingPoint<float>();
534   TestFloatingPoint<double>();
535 }
536 
TEST(MemorySanitizer,DynMem)537 TEST(MemorySanitizer, DynMem) {
538   S4 x = 0;
539   S4 *y = GetPoisoned<S4>();
540   memcpy(y, &x, g_one * sizeof(S4));
541   EXPECT_NOT_POISONED(*y);
542 }
543 
544 static char *DynRetTestStr;
545 
TEST(MemorySanitizer,DynRet)546 TEST(MemorySanitizer, DynRet) {
547   ReturnPoisoned<S8>();
548   EXPECT_NOT_POISONED(atoi("0"));
549 }
550 
TEST(MemorySanitizer,DynRet1)551 TEST(MemorySanitizer, DynRet1) {
552   ReturnPoisoned<S8>();
553 }
554 
555 struct LargeStruct {
556   S4 x[10];
557 };
558 
559 NOINLINE
LargeRetTest()560 LargeStruct LargeRetTest() {
561   LargeStruct res;
562   res.x[0] = *GetPoisoned<S4>();
563   res.x[1] = *GetPoisoned<S4>();
564   res.x[2] = *GetPoisoned<S4>();
565   res.x[3] = *GetPoisoned<S4>();
566   res.x[4] = *GetPoisoned<S4>();
567   res.x[5] = *GetPoisoned<S4>();
568   res.x[6] = *GetPoisoned<S4>();
569   res.x[7] = *GetPoisoned<S4>();
570   res.x[8] = *GetPoisoned<S4>();
571   res.x[9] = *GetPoisoned<S4>();
572   return res;
573 }
574 
TEST(MemorySanitizer,strcmp)575 TEST(MemorySanitizer, strcmp) {
576   char s1[10];
577   char s2[10];
578   strncpy(s1, "foo", 10);
579   s2[0] = 'f';
580   s2[1] = 'n';
581   EXPECT_GT(strcmp(s1, s2), 0);
582   s2[1] = 'o';
583   int res;
584   EXPECT_UMR(res = strcmp(s1, s2));
585   EXPECT_NOT_POISONED(res);
586   EXPECT_EQ(strncmp(s1, s2, 1), 0);
587 }
588 
TEST(MemorySanitizer,LargeRet)589 TEST(MemorySanitizer, LargeRet) {
590   LargeStruct a = LargeRetTest();
591   EXPECT_POISONED(a.x[0]);
592   EXPECT_POISONED(a.x[9]);
593 }
594 
TEST(MemorySanitizer,strerror)595 TEST(MemorySanitizer, strerror) {
596   char *buf = strerror(EINVAL);
597   EXPECT_NOT_POISONED(strlen(buf));
598   buf = strerror(123456);
599   EXPECT_NOT_POISONED(strlen(buf));
600 }
601 
TEST(MemorySanitizer,strerror_r)602 TEST(MemorySanitizer, strerror_r) {
603   errno = 0;
604   char buf[1000];
605   char *res = (char*) (size_t) strerror_r(EINVAL, buf, sizeof(buf));
606   ASSERT_EQ(0, errno);
607   if (!res) res = buf; // POSIX version success.
608   EXPECT_NOT_POISONED(strlen(res));
609 }
610 
TEST(MemorySanitizer,fread)611 TEST(MemorySanitizer, fread) {
612   char *x = new char[32];
613   FILE *f = fopen(FILE_TO_READ, "r");
614   ASSERT_TRUE(f != NULL);
615   fread(x, 1, 32, f);
616   EXPECT_NOT_POISONED(x[0]);
617   EXPECT_NOT_POISONED(x[16]);
618   EXPECT_NOT_POISONED(x[31]);
619   fclose(f);
620   delete[] x;
621 }
622 
TEST(MemorySanitizer,read)623 TEST(MemorySanitizer, read) {
624   char *x = new char[32];
625   int fd = open(FILE_TO_READ, O_RDONLY);
626   ASSERT_GT(fd, 0);
627   int sz = read(fd, x, 32);
628   ASSERT_EQ(sz, 32);
629   EXPECT_NOT_POISONED(x[0]);
630   EXPECT_NOT_POISONED(x[16]);
631   EXPECT_NOT_POISONED(x[31]);
632   close(fd);
633   delete[] x;
634 }
635 
TEST(MemorySanitizer,pread)636 TEST(MemorySanitizer, pread) {
637   char *x = new char[32];
638   int fd = open(FILE_TO_READ, O_RDONLY);
639   ASSERT_GT(fd, 0);
640   int sz = pread(fd, x, 32, 0);
641   ASSERT_EQ(sz, 32);
642   EXPECT_NOT_POISONED(x[0]);
643   EXPECT_NOT_POISONED(x[16]);
644   EXPECT_NOT_POISONED(x[31]);
645   close(fd);
646   delete[] x;
647 }
648 
TEST(MemorySanitizer,readv)649 TEST(MemorySanitizer, readv) {
650   char buf[2011];
651   struct iovec iov[2];
652   iov[0].iov_base = buf + 1;
653   iov[0].iov_len = 5;
654   iov[1].iov_base = buf + 10;
655   iov[1].iov_len = 2000;
656   int fd = open(FILE_TO_READ, O_RDONLY);
657   ASSERT_GT(fd, 0);
658   int sz = readv(fd, iov, 2);
659   ASSERT_GE(sz, 0);
660   ASSERT_LE(sz, 5 + 2000);
661   ASSERT_GT((size_t)sz, iov[0].iov_len);
662   EXPECT_POISONED(buf[0]);
663   EXPECT_NOT_POISONED(buf[1]);
664   EXPECT_NOT_POISONED(buf[5]);
665   EXPECT_POISONED(buf[6]);
666   EXPECT_POISONED(buf[9]);
667   EXPECT_NOT_POISONED(buf[10]);
668   EXPECT_NOT_POISONED(buf[10 + (sz - 1) - 5]);
669   EXPECT_POISONED(buf[11 + (sz - 1) - 5]);
670   close(fd);
671 }
672 
TEST(MemorySanitizer,preadv)673 TEST(MemorySanitizer, preadv) {
674   char buf[2011];
675   struct iovec iov[2];
676   iov[0].iov_base = buf + 1;
677   iov[0].iov_len = 5;
678   iov[1].iov_base = buf + 10;
679   iov[1].iov_len = 2000;
680   int fd = open(FILE_TO_READ, O_RDONLY);
681   ASSERT_GT(fd, 0);
682   int sz = preadv(fd, iov, 2, 3);
683   ASSERT_GE(sz, 0);
684   ASSERT_LE(sz, 5 + 2000);
685   ASSERT_GT((size_t)sz, iov[0].iov_len);
686   EXPECT_POISONED(buf[0]);
687   EXPECT_NOT_POISONED(buf[1]);
688   EXPECT_NOT_POISONED(buf[5]);
689   EXPECT_POISONED(buf[6]);
690   EXPECT_POISONED(buf[9]);
691   EXPECT_NOT_POISONED(buf[10]);
692   EXPECT_NOT_POISONED(buf[10 + (sz - 1) - 5]);
693   EXPECT_POISONED(buf[11 + (sz - 1) - 5]);
694   close(fd);
695 }
696 
697 // FIXME: fails now.
TEST(MemorySanitizer,DISABLED_ioctl)698 TEST(MemorySanitizer, DISABLED_ioctl) {
699   struct winsize ws;
700   EXPECT_EQ(ioctl(2, TIOCGWINSZ, &ws), 0);
701   EXPECT_NOT_POISONED(ws.ws_col);
702 }
703 
TEST(MemorySanitizer,readlink)704 TEST(MemorySanitizer, readlink) {
705   char *x = new char[1000];
706   readlink(SYMLINK_TO_READ, x, 1000);
707   EXPECT_NOT_POISONED(x[0]);
708   delete [] x;
709 }
710 
TEST(MemorySanitizer,stat)711 TEST(MemorySanitizer, stat) {
712   struct stat* st = new struct stat;
713   int res = stat(FILE_TO_READ, st);
714   ASSERT_EQ(0, res);
715   EXPECT_NOT_POISONED(st->st_dev);
716   EXPECT_NOT_POISONED(st->st_mode);
717   EXPECT_NOT_POISONED(st->st_size);
718 }
719 
TEST(MemorySanitizer,fstatat)720 TEST(MemorySanitizer, fstatat) {
721   struct stat* st = new struct stat;
722   int dirfd = open(DIR_TO_READ, O_RDONLY);
723   ASSERT_GT(dirfd, 0);
724   int res = fstatat(dirfd, SUBFILE_TO_READ, st, 0);
725   ASSERT_EQ(0, res);
726   EXPECT_NOT_POISONED(st->st_dev);
727   EXPECT_NOT_POISONED(st->st_mode);
728   EXPECT_NOT_POISONED(st->st_size);
729   close(dirfd);
730 }
731 
TEST(MemorySanitizer,statfs)732 TEST(MemorySanitizer, statfs) {
733   struct statfs st;
734   int res = statfs("/", &st);
735   ASSERT_EQ(0, res);
736   EXPECT_NOT_POISONED(st.f_type);
737   EXPECT_NOT_POISONED(st.f_bfree);
738   EXPECT_NOT_POISONED(st.f_namelen);
739 }
740 
TEST(MemorySanitizer,statvfs)741 TEST(MemorySanitizer, statvfs) {
742   struct statvfs st;
743   int res = statvfs("/", &st);
744   ASSERT_EQ(0, res);
745   EXPECT_NOT_POISONED(st.f_bsize);
746   EXPECT_NOT_POISONED(st.f_blocks);
747   EXPECT_NOT_POISONED(st.f_bfree);
748   EXPECT_NOT_POISONED(st.f_namemax);
749 }
750 
TEST(MemorySanitizer,fstatvfs)751 TEST(MemorySanitizer, fstatvfs) {
752   struct statvfs st;
753   int fd = open("/", O_RDONLY | O_DIRECTORY);
754   int res = fstatvfs(fd, &st);
755   ASSERT_EQ(0, res);
756   EXPECT_NOT_POISONED(st.f_bsize);
757   EXPECT_NOT_POISONED(st.f_blocks);
758   EXPECT_NOT_POISONED(st.f_bfree);
759   EXPECT_NOT_POISONED(st.f_namemax);
760   close(fd);
761 }
762 
TEST(MemorySanitizer,pipe)763 TEST(MemorySanitizer, pipe) {
764   int* pipefd = new int[2];
765   int res = pipe(pipefd);
766   ASSERT_EQ(0, res);
767   EXPECT_NOT_POISONED(pipefd[0]);
768   EXPECT_NOT_POISONED(pipefd[1]);
769   close(pipefd[0]);
770   close(pipefd[1]);
771 }
772 
TEST(MemorySanitizer,pipe2)773 TEST(MemorySanitizer, pipe2) {
774   int* pipefd = new int[2];
775   int res = pipe2(pipefd, O_NONBLOCK);
776   ASSERT_EQ(0, res);
777   EXPECT_NOT_POISONED(pipefd[0]);
778   EXPECT_NOT_POISONED(pipefd[1]);
779   close(pipefd[0]);
780   close(pipefd[1]);
781 }
782 
TEST(MemorySanitizer,socketpair)783 TEST(MemorySanitizer, socketpair) {
784   int sv[2];
785   int res = socketpair(AF_UNIX, SOCK_STREAM, 0, sv);
786   ASSERT_EQ(0, res);
787   EXPECT_NOT_POISONED(sv[0]);
788   EXPECT_NOT_POISONED(sv[1]);
789   close(sv[0]);
790   close(sv[1]);
791 }
792 
TEST(MemorySanitizer,poll)793 TEST(MemorySanitizer, poll) {
794   int* pipefd = new int[2];
795   int res = pipe(pipefd);
796   ASSERT_EQ(0, res);
797 
798   char data = 42;
799   res = write(pipefd[1], &data, 1);
800   ASSERT_EQ(1, res);
801 
802   pollfd fds[2];
803   fds[0].fd = pipefd[0];
804   fds[0].events = POLLIN;
805   fds[1].fd = pipefd[1];
806   fds[1].events = POLLIN;
807   res = poll(fds, 2, 500);
808   ASSERT_EQ(1, res);
809   EXPECT_NOT_POISONED(fds[0].revents);
810   EXPECT_NOT_POISONED(fds[1].revents);
811 
812   close(pipefd[0]);
813   close(pipefd[1]);
814 }
815 
816 // There is no ppoll() on FreeBSD.
817 #if !defined (__FreeBSD__)
TEST(MemorySanitizer,ppoll)818 TEST(MemorySanitizer, ppoll) {
819   int* pipefd = new int[2];
820   int res = pipe(pipefd);
821   ASSERT_EQ(0, res);
822 
823   char data = 42;
824   res = write(pipefd[1], &data, 1);
825   ASSERT_EQ(1, res);
826 
827   pollfd fds[2];
828   fds[0].fd = pipefd[0];
829   fds[0].events = POLLIN;
830   fds[1].fd = pipefd[1];
831   fds[1].events = POLLIN;
832   sigset_t ss;
833   sigemptyset(&ss);
834   res = ppoll(fds, 2, NULL, &ss);
835   ASSERT_EQ(1, res);
836   EXPECT_NOT_POISONED(fds[0].revents);
837   EXPECT_NOT_POISONED(fds[1].revents);
838 
839   close(pipefd[0]);
840   close(pipefd[1]);
841 }
842 #endif
843 
TEST(MemorySanitizer,poll_positive)844 TEST(MemorySanitizer, poll_positive) {
845   int* pipefd = new int[2];
846   int res = pipe(pipefd);
847   ASSERT_EQ(0, res);
848 
849   pollfd fds[2];
850   fds[0].fd = pipefd[0];
851   fds[0].events = POLLIN;
852   // fds[1].fd uninitialized
853   fds[1].events = POLLIN;
854   EXPECT_UMR(poll(fds, 2, 0));
855 
856   close(pipefd[0]);
857   close(pipefd[1]);
858 }
859 
TEST(MemorySanitizer,bind_getsockname)860 TEST(MemorySanitizer, bind_getsockname) {
861   int sock = socket(AF_UNIX, SOCK_STREAM, 0);
862 
863   struct sockaddr_in sai;
864   memset(&sai, 0, sizeof(sai));
865   sai.sin_family = AF_UNIX;
866   int res = bind(sock, (struct sockaddr *)&sai, sizeof(sai));
867 
868   ASSERT_EQ(0, res);
869   char buf[200];
870   socklen_t addrlen;
871   EXPECT_UMR(getsockname(sock, (struct sockaddr *)&buf, &addrlen));
872 
873   addrlen = sizeof(buf);
874   res = getsockname(sock, (struct sockaddr *)&buf, &addrlen);
875   EXPECT_NOT_POISONED(addrlen);
876   EXPECT_NOT_POISONED(buf[0]);
877   EXPECT_NOT_POISONED(buf[addrlen - 1]);
878   EXPECT_POISONED(buf[addrlen]);
879   close(sock);
880 }
881 
TEST(MemorySanitizer,accept)882 TEST(MemorySanitizer, accept) {
883   int listen_socket = socket(AF_INET, SOCK_STREAM, 0);
884   ASSERT_LT(0, listen_socket);
885 
886   struct sockaddr_in sai;
887   memset(&sai, 0, sizeof(sai));
888   sai.sin_family = AF_INET;
889   sai.sin_port = 0;
890   sai.sin_addr.s_addr = htonl(INADDR_LOOPBACK);
891   int res = bind(listen_socket, (struct sockaddr *)&sai, sizeof(sai));
892   ASSERT_EQ(0, res);
893 
894   res = listen(listen_socket, 1);
895   ASSERT_EQ(0, res);
896 
897   socklen_t sz = sizeof(sai);
898   res = getsockname(listen_socket, (struct sockaddr *)&sai, &sz);
899   ASSERT_EQ(0, res);
900   ASSERT_EQ(sizeof(sai), sz);
901 
902   int connect_socket = socket(AF_INET, SOCK_STREAM, 0);
903   ASSERT_LT(0, connect_socket);
904   res = fcntl(connect_socket, F_SETFL, O_NONBLOCK);
905   ASSERT_EQ(0, res);
906   res = connect(connect_socket, (struct sockaddr *)&sai, sizeof(sai));
907   // On FreeBSD this connection completes immediately.
908   if (res != 0) {
909     ASSERT_EQ(-1, res);
910     ASSERT_EQ(EINPROGRESS, errno);
911   }
912 
913   __msan_poison(&sai, sizeof(sai));
914   int new_sock = accept(listen_socket, (struct sockaddr *)&sai, &sz);
915   ASSERT_LT(0, new_sock);
916   ASSERT_EQ(sizeof(sai), sz);
917   EXPECT_NOT_POISONED(sai);
918 
919   __msan_poison(&sai, sizeof(sai));
920   res = getpeername(new_sock, (struct sockaddr *)&sai, &sz);
921   ASSERT_EQ(0, res);
922   ASSERT_EQ(sizeof(sai), sz);
923   EXPECT_NOT_POISONED(sai);
924 
925   close(new_sock);
926   close(connect_socket);
927   close(listen_socket);
928 }
929 
TEST(MemorySanitizer,getaddrinfo)930 TEST(MemorySanitizer, getaddrinfo) {
931   struct addrinfo *ai;
932   struct addrinfo hints;
933   memset(&hints, 0, sizeof(hints));
934   hints.ai_family = AF_INET;
935   int res = getaddrinfo("localhost", NULL, &hints, &ai);
936   ASSERT_EQ(0, res);
937   EXPECT_NOT_POISONED(*ai);
938   ASSERT_EQ(sizeof(sockaddr_in), ai->ai_addrlen);
939   EXPECT_NOT_POISONED(*(sockaddr_in*)ai->ai_addr);
940 }
941 
TEST(MemorySanitizer,getnameinfo)942 TEST(MemorySanitizer, getnameinfo) {
943   struct sockaddr_in sai;
944   memset(&sai, 0, sizeof(sai));
945   sai.sin_family = AF_INET;
946   sai.sin_port = 80;
947   sai.sin_addr.s_addr = htonl(INADDR_LOOPBACK);
948   char host[500];
949   char serv[500];
950   int res = getnameinfo((struct sockaddr *)&sai, sizeof(sai), host,
951                         sizeof(host), serv, sizeof(serv), 0);
952   ASSERT_EQ(0, res);
953   EXPECT_NOT_POISONED(host[0]);
954   EXPECT_POISONED(host[sizeof(host) - 1]);
955 
956   ASSERT_NE(0U, strlen(host));
957   EXPECT_NOT_POISONED(serv[0]);
958   EXPECT_POISONED(serv[sizeof(serv) - 1]);
959   ASSERT_NE(0U, strlen(serv));
960 }
961 
962 #define EXPECT_HOSTENT_NOT_POISONED(he)        \
963   do {                                         \
964     EXPECT_NOT_POISONED(*(he));                \
965     ASSERT_NE((void *) 0, (he)->h_name);       \
966     ASSERT_NE((void *) 0, (he)->h_aliases);    \
967     ASSERT_NE((void *) 0, (he)->h_addr_list);  \
968     EXPECT_NOT_POISONED(strlen((he)->h_name)); \
969     char **p = (he)->h_aliases;                \
970     while (*p) {                               \
971       EXPECT_NOT_POISONED(strlen(*p));         \
972       ++p;                                     \
973     }                                          \
974     char **q = (he)->h_addr_list;              \
975     while (*q) {                               \
976       EXPECT_NOT_POISONED(*q[0]);              \
977       ++q;                                     \
978     }                                          \
979     EXPECT_NOT_POISONED(*q);                   \
980   } while (0)
981 
TEST(MemorySanitizer,gethostent)982 TEST(MemorySanitizer, gethostent) {
983   struct hostent *he = gethostent();
984   ASSERT_NE((void *)NULL, he);
985   EXPECT_HOSTENT_NOT_POISONED(he);
986 }
987 
988 #ifndef MSAN_TEST_DISABLE_GETHOSTBYNAME
989 
TEST(MemorySanitizer,gethostbyname)990 TEST(MemorySanitizer, gethostbyname) {
991   struct hostent *he = gethostbyname("localhost");
992   ASSERT_NE((void *)NULL, he);
993   EXPECT_HOSTENT_NOT_POISONED(he);
994 }
995 
996 #endif // MSAN_TEST_DISABLE_GETHOSTBYNAME
997 
TEST(MemorySanitizer,recvmsg)998 TEST(MemorySanitizer, recvmsg) {
999   int server_socket = socket(AF_INET, SOCK_DGRAM, 0);
1000   ASSERT_LT(0, server_socket);
1001 
1002   struct sockaddr_in sai;
1003   memset(&sai, 0, sizeof(sai));
1004   sai.sin_family = AF_INET;
1005   sai.sin_port = 0;
1006   sai.sin_addr.s_addr = htonl(INADDR_LOOPBACK);
1007   int res = bind(server_socket, (struct sockaddr *)&sai, sizeof(sai));
1008   ASSERT_EQ(0, res);
1009 
1010   socklen_t sz = sizeof(sai);
1011   res = getsockname(server_socket, (struct sockaddr *)&sai, &sz);
1012   ASSERT_EQ(0, res);
1013   ASSERT_EQ(sizeof(sai), sz);
1014 
1015 
1016   int client_socket = socket(AF_INET, SOCK_DGRAM, 0);
1017   ASSERT_LT(0, client_socket);
1018 
1019   struct sockaddr_in client_sai;
1020   memset(&client_sai, 0, sizeof(client_sai));
1021   client_sai.sin_family = AF_INET;
1022   client_sai.sin_port = 0;
1023   client_sai.sin_addr.s_addr = htonl(INADDR_LOOPBACK);
1024   res = bind(client_socket, (struct sockaddr *)&client_sai, sizeof(client_sai));
1025   ASSERT_EQ(0, res);
1026 
1027   sz = sizeof(client_sai);
1028   res = getsockname(client_socket, (struct sockaddr *)&client_sai, &sz);
1029   ASSERT_EQ(0, res);
1030   ASSERT_EQ(sizeof(client_sai), sz);
1031 
1032   const char *s = "message text";
1033   struct iovec iov;
1034   iov.iov_base = (void *)s;
1035   iov.iov_len = strlen(s) + 1;
1036   struct msghdr msg;
1037   memset(&msg, 0, sizeof(msg));
1038   msg.msg_name = &sai;
1039   msg.msg_namelen = sizeof(sai);
1040   msg.msg_iov = &iov;
1041   msg.msg_iovlen = 1;
1042   res = sendmsg(client_socket, &msg, 0);
1043   ASSERT_LT(0, res);
1044 
1045 
1046   char buf[1000];
1047   struct iovec recv_iov;
1048   recv_iov.iov_base = (void *)&buf;
1049   recv_iov.iov_len = sizeof(buf);
1050   struct sockaddr_in recv_sai;
1051   struct msghdr recv_msg;
1052   memset(&recv_msg, 0, sizeof(recv_msg));
1053   recv_msg.msg_name = &recv_sai;
1054   recv_msg.msg_namelen = sizeof(recv_sai);
1055   recv_msg.msg_iov = &recv_iov;
1056   recv_msg.msg_iovlen = 1;
1057   res = recvmsg(server_socket, &recv_msg, 0);
1058   ASSERT_LT(0, res);
1059 
1060   ASSERT_EQ(sizeof(recv_sai), recv_msg.msg_namelen);
1061   EXPECT_NOT_POISONED(*(struct sockaddr_in *)recv_msg.msg_name);
1062   EXPECT_STREQ(s, buf);
1063 
1064   close(server_socket);
1065   close(client_socket);
1066 }
1067 
TEST(MemorySanitizer,gethostbyname2)1068 TEST(MemorySanitizer, gethostbyname2) {
1069   struct hostent *he = gethostbyname2("localhost", AF_INET);
1070   ASSERT_NE((void *)NULL, he);
1071   EXPECT_HOSTENT_NOT_POISONED(he);
1072 }
1073 
TEST(MemorySanitizer,gethostbyaddr)1074 TEST(MemorySanitizer, gethostbyaddr) {
1075   in_addr_t addr = inet_addr("127.0.0.1");
1076   EXPECT_NOT_POISONED(addr);
1077   struct hostent *he = gethostbyaddr(&addr, sizeof(addr), AF_INET);
1078   ASSERT_NE((void *)NULL, he);
1079   EXPECT_HOSTENT_NOT_POISONED(he);
1080 }
1081 
TEST(MemorySanitizer,gethostent_r)1082 TEST(MemorySanitizer, gethostent_r) {
1083   char buf[2000];
1084   struct hostent he;
1085   struct hostent *result;
1086   int err;
1087   int res = gethostent_r(&he, buf, sizeof(buf), &result, &err);
1088   ASSERT_EQ(0, res);
1089   EXPECT_NOT_POISONED(result);
1090   ASSERT_NE((void *)NULL, result);
1091   EXPECT_HOSTENT_NOT_POISONED(result);
1092   EXPECT_NOT_POISONED(err);
1093 }
1094 
TEST(MemorySanitizer,gethostbyname_r)1095 TEST(MemorySanitizer, gethostbyname_r) {
1096   char buf[2000];
1097   struct hostent he;
1098   struct hostent *result;
1099   int err;
1100   int res = gethostbyname_r("localhost", &he, buf, sizeof(buf), &result, &err);
1101   ASSERT_EQ(0, res);
1102   EXPECT_NOT_POISONED(result);
1103   ASSERT_NE((void *)NULL, result);
1104   EXPECT_HOSTENT_NOT_POISONED(result);
1105   EXPECT_NOT_POISONED(err);
1106 }
1107 
TEST(MemorySanitizer,gethostbyname_r_bad_host_name)1108 TEST(MemorySanitizer, gethostbyname_r_bad_host_name) {
1109   char buf[2000];
1110   struct hostent he;
1111   struct hostent *result;
1112   int err;
1113   int res = gethostbyname_r("bad-host-name", &he, buf, sizeof(buf), &result, &err);
1114   ASSERT_EQ((struct hostent *)0, result);
1115   EXPECT_NOT_POISONED(err);
1116 }
1117 
TEST(MemorySanitizer,gethostbyname_r_erange)1118 TEST(MemorySanitizer, gethostbyname_r_erange) {
1119   char buf[5];
1120   struct hostent he;
1121   struct hostent *result;
1122   int err;
1123   gethostbyname_r("localhost", &he, buf, sizeof(buf), &result, &err);
1124   ASSERT_EQ(ERANGE, errno);
1125   EXPECT_NOT_POISONED(err);
1126 }
1127 
TEST(MemorySanitizer,gethostbyname2_r)1128 TEST(MemorySanitizer, gethostbyname2_r) {
1129   char buf[2000];
1130   struct hostent he;
1131   struct hostent *result;
1132   int err;
1133   int res = gethostbyname2_r("localhost", AF_INET, &he, buf, sizeof(buf),
1134                              &result, &err);
1135   ASSERT_EQ(0, res);
1136   EXPECT_NOT_POISONED(result);
1137   ASSERT_NE((void *)NULL, result);
1138   EXPECT_HOSTENT_NOT_POISONED(result);
1139   EXPECT_NOT_POISONED(err);
1140 }
1141 
TEST(MemorySanitizer,gethostbyaddr_r)1142 TEST(MemorySanitizer, gethostbyaddr_r) {
1143   char buf[2000];
1144   struct hostent he;
1145   struct hostent *result;
1146   int err;
1147   in_addr_t addr = inet_addr("127.0.0.1");
1148   EXPECT_NOT_POISONED(addr);
1149   int res = gethostbyaddr_r(&addr, sizeof(addr), AF_INET, &he, buf, sizeof(buf),
1150                             &result, &err);
1151   ASSERT_EQ(0, res);
1152   EXPECT_NOT_POISONED(result);
1153   ASSERT_NE((void *)NULL, result);
1154   EXPECT_HOSTENT_NOT_POISONED(result);
1155   EXPECT_NOT_POISONED(err);
1156 }
1157 
TEST(MemorySanitizer,getsockopt)1158 TEST(MemorySanitizer, getsockopt) {
1159   int sock = socket(AF_UNIX, SOCK_STREAM, 0);
1160   struct linger l[2];
1161   socklen_t sz = sizeof(l[0]);
1162   int res = getsockopt(sock, SOL_SOCKET, SO_LINGER, &l[0], &sz);
1163   ASSERT_EQ(0, res);
1164   ASSERT_EQ(sizeof(l[0]), sz);
1165   EXPECT_NOT_POISONED(l[0]);
1166   EXPECT_POISONED(*(char *)(l + 1));
1167 }
1168 
TEST(MemorySanitizer,getcwd)1169 TEST(MemorySanitizer, getcwd) {
1170   char path[PATH_MAX + 1];
1171   char* res = getcwd(path, sizeof(path));
1172   ASSERT_TRUE(res != NULL);
1173   EXPECT_NOT_POISONED(path[0]);
1174 }
1175 
TEST(MemorySanitizer,getcwd_gnu)1176 TEST(MemorySanitizer, getcwd_gnu) {
1177   char* res = getcwd(NULL, 0);
1178   ASSERT_TRUE(res != NULL);
1179   EXPECT_NOT_POISONED(res[0]);
1180   free(res);
1181 }
1182 
1183 // There's no get_current_dir_name() on FreeBSD.
1184 #if !defined(__FreeBSD__)
TEST(MemorySanitizer,get_current_dir_name)1185 TEST(MemorySanitizer, get_current_dir_name) {
1186   char* res = get_current_dir_name();
1187   ASSERT_TRUE(res != NULL);
1188   EXPECT_NOT_POISONED(res[0]);
1189   free(res);
1190 }
1191 #endif
1192 
TEST(MemorySanitizer,shmctl)1193 TEST(MemorySanitizer, shmctl) {
1194   int id = shmget(IPC_PRIVATE, 4096, 0644 | IPC_CREAT);
1195   ASSERT_GT(id, -1);
1196 
1197   struct shmid_ds ds;
1198   int res = shmctl(id, IPC_STAT, &ds);
1199   ASSERT_GT(res, -1);
1200   EXPECT_NOT_POISONED(ds);
1201 
1202   // FreeBSD does not support shmctl(IPC_INFO) and shmctl(SHM_INFO).
1203 #if !defined(__FreeBSD__)
1204   struct shminfo si;
1205   res = shmctl(id, IPC_INFO, (struct shmid_ds *)&si);
1206   ASSERT_GT(res, -1);
1207   EXPECT_NOT_POISONED(si);
1208 
1209   struct shm_info s_i;
1210   res = shmctl(id, SHM_INFO, (struct shmid_ds *)&s_i);
1211   ASSERT_GT(res, -1);
1212   EXPECT_NOT_POISONED(s_i);
1213 #endif
1214 
1215   res = shmctl(id, IPC_RMID, 0);
1216   ASSERT_GT(res, -1);
1217 }
1218 
TEST(MemorySanitizer,shmat)1219 TEST(MemorySanitizer, shmat) {
1220   const int kShmSize = 4096;
1221   void *mapping_start = mmap(NULL, kShmSize + SHMLBA, PROT_READ | PROT_WRITE,
1222                              MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
1223   ASSERT_NE(MAP_FAILED, mapping_start);
1224 
1225   void *p = (void *)(((unsigned long)mapping_start + SHMLBA - 1) / SHMLBA * SHMLBA);
1226   // p is now SHMLBA-aligned;
1227 
1228   ((char *)p)[10] = *GetPoisoned<U1>();
1229   ((char *)p)[kShmSize - 1] = *GetPoisoned<U1>();
1230 
1231   int res = munmap(mapping_start, kShmSize + SHMLBA);
1232   ASSERT_EQ(0, res);
1233 
1234   int id = shmget(IPC_PRIVATE, kShmSize, 0644 | IPC_CREAT);
1235   ASSERT_GT(id, -1);
1236 
1237   void *q = shmat(id, p, 0);
1238   ASSERT_EQ(p, q);
1239 
1240   EXPECT_NOT_POISONED(((char *)q)[0]);
1241   EXPECT_NOT_POISONED(((char *)q)[10]);
1242   EXPECT_NOT_POISONED(((char *)q)[kShmSize - 1]);
1243 
1244   res = shmdt(q);
1245   ASSERT_EQ(0, res);
1246 
1247   res = shmctl(id, IPC_RMID, 0);
1248   ASSERT_GT(res, -1);
1249 }
1250 
1251 // There's no random_r() on FreeBSD.
1252 #if !defined(__FreeBSD__)
TEST(MemorySanitizer,random_r)1253 TEST(MemorySanitizer, random_r) {
1254   int32_t x;
1255   char z[64];
1256   memset(z, 0, sizeof(z));
1257 
1258   struct random_data buf;
1259   memset(&buf, 0, sizeof(buf));
1260 
1261   int res = initstate_r(0, z, sizeof(z), &buf);
1262   ASSERT_EQ(0, res);
1263 
1264   res = random_r(&buf, &x);
1265   ASSERT_EQ(0, res);
1266   EXPECT_NOT_POISONED(x);
1267 }
1268 #endif
1269 
TEST(MemorySanitizer,confstr)1270 TEST(MemorySanitizer, confstr) {
1271   char buf[3];
1272   size_t res = confstr(_CS_PATH, buf, sizeof(buf));
1273   ASSERT_GT(res, sizeof(buf));
1274   EXPECT_NOT_POISONED(buf[0]);
1275   EXPECT_NOT_POISONED(buf[sizeof(buf) - 1]);
1276 
1277   char buf2[1000];
1278   res = confstr(_CS_PATH, buf2, sizeof(buf2));
1279   ASSERT_LT(res, sizeof(buf2));
1280   EXPECT_NOT_POISONED(buf2[0]);
1281   EXPECT_NOT_POISONED(buf2[res - 1]);
1282   EXPECT_POISONED(buf2[res]);
1283   ASSERT_EQ(res, strlen(buf2) + 1);
1284 }
1285 
TEST(MemorySanitizer,opendir)1286 TEST(MemorySanitizer, opendir) {
1287   DIR *dir = opendir(".");
1288   closedir(dir);
1289 
1290   char name[10] = ".";
1291   __msan_poison(name, sizeof(name));
1292   EXPECT_UMR(dir = opendir(name));
1293   closedir(dir);
1294 }
1295 
TEST(MemorySanitizer,readdir)1296 TEST(MemorySanitizer, readdir) {
1297   DIR *dir = opendir(".");
1298   struct dirent *d = readdir(dir);
1299   ASSERT_TRUE(d != NULL);
1300   EXPECT_NOT_POISONED(d->d_name[0]);
1301   closedir(dir);
1302 }
1303 
TEST(MemorySanitizer,readdir_r)1304 TEST(MemorySanitizer, readdir_r) {
1305   DIR *dir = opendir(".");
1306   struct dirent d;
1307   struct dirent *pd;
1308   int res = readdir_r(dir, &d, &pd);
1309   ASSERT_EQ(0, res);
1310   EXPECT_NOT_POISONED(pd);
1311   EXPECT_NOT_POISONED(d.d_name[0]);
1312   closedir(dir);
1313 }
1314 
TEST(MemorySanitizer,realpath)1315 TEST(MemorySanitizer, realpath) {
1316   const char* relpath = ".";
1317   char path[PATH_MAX + 1];
1318   char* res = realpath(relpath, path);
1319   ASSERT_TRUE(res != NULL);
1320   EXPECT_NOT_POISONED(path[0]);
1321 }
1322 
TEST(MemorySanitizer,realpath_null)1323 TEST(MemorySanitizer, realpath_null) {
1324   const char* relpath = ".";
1325   char* res = realpath(relpath, NULL);
1326   printf("%d, %s\n", errno, strerror(errno));
1327   ASSERT_TRUE(res != NULL);
1328   EXPECT_NOT_POISONED(res[0]);
1329   free(res);
1330 }
1331 
1332 // There's no canonicalize_file_name() on FreeBSD.
1333 #if !defined(__FreeBSD__)
TEST(MemorySanitizer,canonicalize_file_name)1334 TEST(MemorySanitizer, canonicalize_file_name) {
1335   const char* relpath = ".";
1336   char* res = canonicalize_file_name(relpath);
1337   ASSERT_TRUE(res != NULL);
1338   EXPECT_NOT_POISONED(res[0]);
1339   free(res);
1340 }
1341 #endif
1342 
1343 extern char **environ;
1344 
TEST(MemorySanitizer,setenv)1345 TEST(MemorySanitizer, setenv) {
1346   setenv("AAA", "BBB", 1);
1347   for (char **envp = environ; *envp; ++envp) {
1348     EXPECT_NOT_POISONED(*envp);
1349     EXPECT_NOT_POISONED(*envp[0]);
1350   }
1351 }
1352 
TEST(MemorySanitizer,putenv)1353 TEST(MemorySanitizer, putenv) {
1354   char s[] = "AAA=BBB";
1355   putenv(s);
1356   for (char **envp = environ; *envp; ++envp) {
1357     EXPECT_NOT_POISONED(*envp);
1358     EXPECT_NOT_POISONED(*envp[0]);
1359   }
1360 }
1361 
TEST(MemorySanitizer,memcpy)1362 TEST(MemorySanitizer, memcpy) {
1363   char* x = new char[2];
1364   char* y = new char[2];
1365   x[0] = 1;
1366   x[1] = *GetPoisoned<char>();
1367   memcpy(y, x, 2);
1368   EXPECT_NOT_POISONED(y[0]);
1369   EXPECT_POISONED(y[1]);
1370 }
1371 
TestUnalignedMemcpy(unsigned left,unsigned right,bool src_is_aligned,bool src_is_poisoned,bool dst_is_poisoned)1372 void TestUnalignedMemcpy(unsigned left, unsigned right, bool src_is_aligned,
1373                          bool src_is_poisoned, bool dst_is_poisoned) {
1374   fprintf(stderr, "%s(%d, %d, %d, %d, %d)\n", __func__, left, right,
1375           src_is_aligned, src_is_poisoned, dst_is_poisoned);
1376 
1377   const unsigned sz = 20;
1378   U4 dst_origin, src_origin;
1379   char *dst = (char *)malloc(sz);
1380   if (dst_is_poisoned)
1381     dst_origin = __msan_get_origin(dst);
1382   else
1383     memset(dst, 0, sz);
1384 
1385   char *src = (char *)malloc(sz);
1386   if (src_is_poisoned)
1387     src_origin = __msan_get_origin(src);
1388   else
1389     memset(src, 0, sz);
1390 
1391   memcpy(dst + left, src_is_aligned ? src + left : src, sz - left - right);
1392 
1393   for (unsigned i = 0; i < (left & (~3U)); ++i)
1394     if (dst_is_poisoned)
1395       EXPECT_POISONED_O(dst[i], dst_origin);
1396     else
1397       EXPECT_NOT_POISONED(dst[i]);
1398 
1399   for (unsigned i = 0; i < (right & (~3U)); ++i)
1400     if (dst_is_poisoned)
1401       EXPECT_POISONED_O(dst[sz - i - 1], dst_origin);
1402     else
1403       EXPECT_NOT_POISONED(dst[sz - i - 1]);
1404 
1405   for (unsigned i = left; i < sz - right; ++i)
1406     if (src_is_poisoned)
1407       EXPECT_POISONED_O(dst[i], src_origin);
1408     else
1409       EXPECT_NOT_POISONED(dst[i]);
1410 
1411   free(dst);
1412   free(src);
1413 }
1414 
TEST(MemorySanitizer,memcpy_unaligned)1415 TEST(MemorySanitizer, memcpy_unaligned) {
1416   for (int i = 0; i < 10; ++i)
1417     for (int j = 0; j < 10; ++j)
1418       for (int aligned = 0; aligned < 2; ++aligned)
1419         for (int srcp = 0; srcp < 2; ++srcp)
1420           for (int dstp = 0; dstp < 2; ++dstp)
1421             TestUnalignedMemcpy(i, j, aligned, srcp, dstp);
1422 }
1423 
TEST(MemorySanitizer,memmove)1424 TEST(MemorySanitizer, memmove) {
1425   char* x = new char[2];
1426   char* y = new char[2];
1427   x[0] = 1;
1428   x[1] = *GetPoisoned<char>();
1429   memmove(y, x, 2);
1430   EXPECT_NOT_POISONED(y[0]);
1431   EXPECT_POISONED(y[1]);
1432 }
1433 
TEST(MemorySanitizer,memccpy_nomatch)1434 TEST(MemorySanitizer, memccpy_nomatch) {
1435   char* x = new char[5];
1436   char* y = new char[5];
1437   strcpy(x, "abc");
1438   memccpy(y, x, 'd', 4);
1439   EXPECT_NOT_POISONED(y[0]);
1440   EXPECT_NOT_POISONED(y[1]);
1441   EXPECT_NOT_POISONED(y[2]);
1442   EXPECT_NOT_POISONED(y[3]);
1443   EXPECT_POISONED(y[4]);
1444   delete[] x;
1445   delete[] y;
1446 }
1447 
TEST(MemorySanitizer,memccpy_match)1448 TEST(MemorySanitizer, memccpy_match) {
1449   char* x = new char[5];
1450   char* y = new char[5];
1451   strcpy(x, "abc");
1452   memccpy(y, x, 'b', 4);
1453   EXPECT_NOT_POISONED(y[0]);
1454   EXPECT_NOT_POISONED(y[1]);
1455   EXPECT_POISONED(y[2]);
1456   EXPECT_POISONED(y[3]);
1457   EXPECT_POISONED(y[4]);
1458   delete[] x;
1459   delete[] y;
1460 }
1461 
TEST(MemorySanitizer,memccpy_nomatch_positive)1462 TEST(MemorySanitizer, memccpy_nomatch_positive) {
1463   char* x = new char[5];
1464   char* y = new char[5];
1465   strcpy(x, "abc");
1466   EXPECT_UMR(memccpy(y, x, 'd', 5));
1467   delete[] x;
1468   delete[] y;
1469 }
1470 
TEST(MemorySanitizer,memccpy_match_positive)1471 TEST(MemorySanitizer, memccpy_match_positive) {
1472   char* x = new char[5];
1473   char* y = new char[5];
1474   x[0] = 'a';
1475   x[2] = 'b';
1476   EXPECT_UMR(memccpy(y, x, 'b', 5));
1477   delete[] x;
1478   delete[] y;
1479 }
1480 
TEST(MemorySanitizer,bcopy)1481 TEST(MemorySanitizer, bcopy) {
1482   char* x = new char[2];
1483   char* y = new char[2];
1484   x[0] = 1;
1485   x[1] = *GetPoisoned<char>();
1486   bcopy(x, y, 2);
1487   EXPECT_NOT_POISONED(y[0]);
1488   EXPECT_POISONED(y[1]);
1489 }
1490 
TEST(MemorySanitizer,strdup)1491 TEST(MemorySanitizer, strdup) {
1492   char buf[4] = "abc";
1493   __msan_poison(buf + 2, sizeof(*buf));
1494   char *x = strdup(buf);
1495   EXPECT_NOT_POISONED(x[0]);
1496   EXPECT_NOT_POISONED(x[1]);
1497   EXPECT_POISONED(x[2]);
1498   EXPECT_NOT_POISONED(x[3]);
1499   free(x);
1500 }
1501 
TEST(MemorySanitizer,strndup)1502 TEST(MemorySanitizer, strndup) {
1503   char buf[4] = "abc";
1504   __msan_poison(buf + 2, sizeof(*buf));
1505   char *x = strndup(buf, 3);
1506   EXPECT_NOT_POISONED(x[0]);
1507   EXPECT_NOT_POISONED(x[1]);
1508   EXPECT_POISONED(x[2]);
1509   EXPECT_NOT_POISONED(x[3]);
1510   free(x);
1511 }
1512 
TEST(MemorySanitizer,strndup_short)1513 TEST(MemorySanitizer, strndup_short) {
1514   char buf[4] = "abc";
1515   __msan_poison(buf + 1, sizeof(*buf));
1516   __msan_poison(buf + 2, sizeof(*buf));
1517   char *x = strndup(buf, 2);
1518   EXPECT_NOT_POISONED(x[0]);
1519   EXPECT_POISONED(x[1]);
1520   EXPECT_NOT_POISONED(x[2]);
1521   free(x);
1522 }
1523 
1524 
1525 template<class T, int size>
TestOverlapMemmove()1526 void TestOverlapMemmove() {
1527   T *x = new T[size];
1528   ASSERT_GE(size, 3);
1529   x[2] = 0;
1530   memmove(x, x + 1, (size - 1) * sizeof(T));
1531   EXPECT_NOT_POISONED(x[1]);
1532   EXPECT_POISONED(x[0]);
1533   EXPECT_POISONED(x[2]);
1534   delete [] x;
1535 }
1536 
TEST(MemorySanitizer,overlap_memmove)1537 TEST(MemorySanitizer, overlap_memmove) {
1538   TestOverlapMemmove<U1, 10>();
1539   TestOverlapMemmove<U1, 1000>();
1540   TestOverlapMemmove<U8, 4>();
1541   TestOverlapMemmove<U8, 1000>();
1542 }
1543 
TEST(MemorySanitizer,strcpy)1544 TEST(MemorySanitizer, strcpy) {  // NOLINT
1545   char* x = new char[3];
1546   char* y = new char[3];
1547   x[0] = 'a';
1548   x[1] = *GetPoisoned<char>(1, 1);
1549   x[2] = 0;
1550   strcpy(y, x);  // NOLINT
1551   EXPECT_NOT_POISONED(y[0]);
1552   EXPECT_POISONED(y[1]);
1553   EXPECT_NOT_POISONED(y[2]);
1554 }
1555 
TEST(MemorySanitizer,strncpy)1556 TEST(MemorySanitizer, strncpy) {  // NOLINT
1557   char* x = new char[3];
1558   char* y = new char[5];
1559   x[0] = 'a';
1560   x[1] = *GetPoisoned<char>(1, 1);
1561   x[2] = '\0';
1562   strncpy(y, x, 4);  // NOLINT
1563   EXPECT_NOT_POISONED(y[0]);
1564   EXPECT_POISONED(y[1]);
1565   EXPECT_NOT_POISONED(y[2]);
1566   EXPECT_NOT_POISONED(y[3]);
1567   EXPECT_POISONED(y[4]);
1568 }
1569 
TEST(MemorySanitizer,stpcpy)1570 TEST(MemorySanitizer, stpcpy) {  // NOLINT
1571   char* x = new char[3];
1572   char* y = new char[3];
1573   x[0] = 'a';
1574   x[1] = *GetPoisoned<char>(1, 1);
1575   x[2] = 0;
1576   char *res = stpcpy(y, x);  // NOLINT
1577   ASSERT_EQ(res, y + 2);
1578   EXPECT_NOT_POISONED(y[0]);
1579   EXPECT_POISONED(y[1]);
1580   EXPECT_NOT_POISONED(y[2]);
1581 }
1582 
TEST(MemorySanitizer,strcat)1583 TEST(MemorySanitizer, strcat) {  // NOLINT
1584   char a[10];
1585   char b[] = "def";
1586   strcpy(a, "abc");
1587   __msan_poison(b + 1, 1);
1588   strcat(a, b);
1589   EXPECT_NOT_POISONED(a[3]);
1590   EXPECT_POISONED(a[4]);
1591   EXPECT_NOT_POISONED(a[5]);
1592   EXPECT_NOT_POISONED(a[6]);
1593   EXPECT_POISONED(a[7]);
1594 }
1595 
TEST(MemorySanitizer,strncat)1596 TEST(MemorySanitizer, strncat) {  // NOLINT
1597   char a[10];
1598   char b[] = "def";
1599   strcpy(a, "abc");
1600   __msan_poison(b + 1, 1);
1601   strncat(a, b, 5);
1602   EXPECT_NOT_POISONED(a[3]);
1603   EXPECT_POISONED(a[4]);
1604   EXPECT_NOT_POISONED(a[5]);
1605   EXPECT_NOT_POISONED(a[6]);
1606   EXPECT_POISONED(a[7]);
1607 }
1608 
TEST(MemorySanitizer,strncat_overflow)1609 TEST(MemorySanitizer, strncat_overflow) {  // NOLINT
1610   char a[10];
1611   char b[] = "def";
1612   strcpy(a, "abc");
1613   __msan_poison(b + 1, 1);
1614   strncat(a, b, 2);
1615   EXPECT_NOT_POISONED(a[3]);
1616   EXPECT_POISONED(a[4]);
1617   EXPECT_NOT_POISONED(a[5]);
1618   EXPECT_POISONED(a[6]);
1619   EXPECT_POISONED(a[7]);
1620 }
1621 
1622 #define TEST_STRTO_INT(func_name, char_type, str_prefix) \
1623   TEST(MemorySanitizer, func_name) {                     \
1624     char_type *e;                                        \
1625     EXPECT_EQ(1U, func_name(str_prefix##"1", &e, 10));   \
1626     EXPECT_NOT_POISONED((S8)e);                          \
1627   }
1628 
1629 #define TEST_STRTO_FLOAT(func_name, char_type, str_prefix) \
1630   TEST(MemorySanitizer, func_name) {                       \
1631     char_type *e;                                          \
1632     EXPECT_NE(0, func_name(str_prefix##"1.5", &e));        \
1633     EXPECT_NOT_POISONED((S8)e);                            \
1634   }
1635 
1636 #define TEST_STRTO_FLOAT_LOC(func_name, char_type, str_prefix)   \
1637   TEST(MemorySanitizer, func_name) {                             \
1638     locale_t loc = newlocale(LC_NUMERIC_MASK, "C", (locale_t)0); \
1639     char_type *e;                                                \
1640     EXPECT_NE(0, func_name(str_prefix##"1.5", &e, loc));         \
1641     EXPECT_NOT_POISONED((S8)e);                                  \
1642     freelocale(loc);                                             \
1643   }
1644 
1645 #define TEST_STRTO_INT_LOC(func_name, char_type, str_prefix)     \
1646   TEST(MemorySanitizer, func_name) {                             \
1647     locale_t loc = newlocale(LC_NUMERIC_MASK, "C", (locale_t)0); \
1648     char_type *e;                                                \
1649     ASSERT_EQ(1U, func_name(str_prefix##"1", &e, 10, loc));      \
1650     EXPECT_NOT_POISONED((S8)e);                                  \
1651     freelocale(loc);                                             \
1652   }
1653 
1654 TEST_STRTO_INT(strtol, char, )
1655 TEST_STRTO_INT(strtoll, char, )
1656 TEST_STRTO_INT(strtoul, char, )
1657 TEST_STRTO_INT(strtoull, char, )
1658 
1659 TEST_STRTO_FLOAT(strtof, char, )
1660 TEST_STRTO_FLOAT(strtod, char, )
1661 TEST_STRTO_FLOAT(strtold, char, )
1662 
1663 TEST_STRTO_FLOAT_LOC(strtof_l, char, )
1664 TEST_STRTO_FLOAT_LOC(strtod_l, char, )
1665 TEST_STRTO_FLOAT_LOC(strtold_l, char, )
1666 
1667 TEST_STRTO_INT_LOC(strtol_l, char, )
1668 TEST_STRTO_INT_LOC(strtoll_l, char, )
1669 TEST_STRTO_INT_LOC(strtoul_l, char, )
1670 TEST_STRTO_INT_LOC(strtoull_l, char, )
1671 
TEST_STRTO_INT(wcstol,wchar_t,L)1672 TEST_STRTO_INT(wcstol, wchar_t, L)
1673 TEST_STRTO_INT(wcstoll, wchar_t, L)
1674 TEST_STRTO_INT(wcstoul, wchar_t, L)
1675 TEST_STRTO_INT(wcstoull, wchar_t, L)
1676 
1677 TEST_STRTO_FLOAT(wcstof, wchar_t, L)
1678 TEST_STRTO_FLOAT(wcstod, wchar_t, L)
1679 TEST_STRTO_FLOAT(wcstold, wchar_t, L)
1680 
1681 TEST_STRTO_FLOAT_LOC(wcstof_l, wchar_t, L)
1682 TEST_STRTO_FLOAT_LOC(wcstod_l, wchar_t, L)
1683 TEST_STRTO_FLOAT_LOC(wcstold_l, wchar_t, L)
1684 
1685 TEST_STRTO_INT_LOC(wcstol_l, wchar_t, L)
1686 TEST_STRTO_INT_LOC(wcstoll_l, wchar_t, L)
1687 TEST_STRTO_INT_LOC(wcstoul_l, wchar_t, L)
1688 TEST_STRTO_INT_LOC(wcstoull_l, wchar_t, L)
1689 
1690 
1691 TEST(MemorySanitizer, strtoimax) {
1692   char *e;
1693   ASSERT_EQ(1, strtoimax("1", &e, 10));
1694   EXPECT_NOT_POISONED((S8) e);
1695 }
1696 
TEST(MemorySanitizer,strtoumax)1697 TEST(MemorySanitizer, strtoumax) {
1698   char *e;
1699   ASSERT_EQ(1U, strtoumax("1", &e, 10));
1700   EXPECT_NOT_POISONED((S8) e);
1701 }
1702 
1703 #ifdef __GLIBC__
1704 extern "C" float __strtof_l(const char *nptr, char **endptr, locale_t loc);
1705 TEST_STRTO_FLOAT_LOC(__strtof_l, char, )
1706 extern "C" double __strtod_l(const char *nptr, char **endptr, locale_t loc);
1707 TEST_STRTO_FLOAT_LOC(__strtod_l, char, )
1708 extern "C" long double __strtold_l(const char *nptr, char **endptr,
1709                                    locale_t loc);
1710 TEST_STRTO_FLOAT_LOC(__strtold_l, char, )
1711 
1712 extern "C" float __wcstof_l(const wchar_t *nptr, wchar_t **endptr, locale_t loc);
1713 TEST_STRTO_FLOAT_LOC(__wcstof_l, wchar_t, L)
1714 extern "C" double __wcstod_l(const wchar_t *nptr, wchar_t **endptr, locale_t loc);
1715 TEST_STRTO_FLOAT_LOC(__wcstod_l, wchar_t, L)
1716 extern "C" long double __wcstold_l(const wchar_t *nptr, wchar_t **endptr,
1717                                    locale_t loc);
TEST_STRTO_FLOAT_LOC(__wcstold_l,wchar_t,L)1718 TEST_STRTO_FLOAT_LOC(__wcstold_l, wchar_t, L)
1719 #endif  // __GLIBC__
1720 
1721 TEST(MemorySanitizer, modf) {
1722   double x, y;
1723   x = modf(2.1, &y);
1724   EXPECT_NOT_POISONED(y);
1725 }
1726 
TEST(MemorySanitizer,modff)1727 TEST(MemorySanitizer, modff) {
1728   float x, y;
1729   x = modff(2.1, &y);
1730   EXPECT_NOT_POISONED(y);
1731 }
1732 
TEST(MemorySanitizer,modfl)1733 TEST(MemorySanitizer, modfl) {
1734   long double x, y;
1735   x = modfl(2.1, &y);
1736   EXPECT_NOT_POISONED(y);
1737 }
1738 
1739 // There's no sincos() on FreeBSD.
1740 #if !defined(__FreeBSD__)
TEST(MemorySanitizer,sincos)1741 TEST(MemorySanitizer, sincos) {
1742   double s, c;
1743   sincos(0.2, &s, &c);
1744   EXPECT_NOT_POISONED(s);
1745   EXPECT_NOT_POISONED(c);
1746 }
1747 #endif
1748 
1749 // There's no sincosf() on FreeBSD.
1750 #if !defined(__FreeBSD__)
TEST(MemorySanitizer,sincosf)1751 TEST(MemorySanitizer, sincosf) {
1752   float s, c;
1753   sincosf(0.2, &s, &c);
1754   EXPECT_NOT_POISONED(s);
1755   EXPECT_NOT_POISONED(c);
1756 }
1757 #endif
1758 
1759 // There's no sincosl() on FreeBSD.
1760 #if !defined(__FreeBSD__)
TEST(MemorySanitizer,sincosl)1761 TEST(MemorySanitizer, sincosl) {
1762   long double s, c;
1763   sincosl(0.2, &s, &c);
1764   EXPECT_NOT_POISONED(s);
1765   EXPECT_NOT_POISONED(c);
1766 }
1767 #endif
1768 
TEST(MemorySanitizer,remquo)1769 TEST(MemorySanitizer, remquo) {
1770   int quo;
1771   double res = remquo(29.0, 3.0, &quo);
1772   ASSERT_NE(0.0, res);
1773   EXPECT_NOT_POISONED(quo);
1774 }
1775 
TEST(MemorySanitizer,remquof)1776 TEST(MemorySanitizer, remquof) {
1777   int quo;
1778   float res = remquof(29.0, 3.0, &quo);
1779   ASSERT_NE(0.0, res);
1780   EXPECT_NOT_POISONED(quo);
1781 }
1782 
TEST(MemorySanitizer,remquol)1783 TEST(MemorySanitizer, remquol) {
1784   int quo;
1785   long double res = remquof(29.0, 3.0, &quo);
1786   ASSERT_NE(0.0, res);
1787   EXPECT_NOT_POISONED(quo);
1788 }
1789 
TEST(MemorySanitizer,lgamma)1790 TEST(MemorySanitizer, lgamma) {
1791   double res = lgamma(1.1);
1792   ASSERT_NE(0.0, res);
1793   EXPECT_NOT_POISONED(signgam);
1794 }
1795 
TEST(MemorySanitizer,lgammaf)1796 TEST(MemorySanitizer, lgammaf) {
1797   float res = lgammaf(1.1);
1798   ASSERT_NE(0.0, res);
1799   EXPECT_NOT_POISONED(signgam);
1800 }
1801 
TEST(MemorySanitizer,lgammal)1802 TEST(MemorySanitizer, lgammal) {
1803   long double res = lgammal(1.1);
1804   ASSERT_NE(0.0, res);
1805   EXPECT_NOT_POISONED(signgam);
1806 }
1807 
TEST(MemorySanitizer,lgamma_r)1808 TEST(MemorySanitizer, lgamma_r) {
1809   int sgn;
1810   double res = lgamma_r(1.1, &sgn);
1811   ASSERT_NE(0.0, res);
1812   EXPECT_NOT_POISONED(sgn);
1813 }
1814 
TEST(MemorySanitizer,lgammaf_r)1815 TEST(MemorySanitizer, lgammaf_r) {
1816   int sgn;
1817   float res = lgammaf_r(1.1, &sgn);
1818   ASSERT_NE(0.0, res);
1819   EXPECT_NOT_POISONED(sgn);
1820 }
1821 
1822 // There's no lgammal_r() on FreeBSD.
1823 #if !defined(__FreeBSD__)
TEST(MemorySanitizer,lgammal_r)1824 TEST(MemorySanitizer, lgammal_r) {
1825   int sgn;
1826   long double res = lgammal_r(1.1, &sgn);
1827   ASSERT_NE(0.0, res);
1828   EXPECT_NOT_POISONED(sgn);
1829 }
1830 #endif
1831 
1832 // There's no drand48_r() on FreeBSD.
1833 #if !defined(__FreeBSD__)
TEST(MemorySanitizer,drand48_r)1834 TEST(MemorySanitizer, drand48_r) {
1835   struct drand48_data buf;
1836   srand48_r(0, &buf);
1837   double d;
1838   drand48_r(&buf, &d);
1839   EXPECT_NOT_POISONED(d);
1840 }
1841 #endif
1842 
1843 // There's no lrand48_r() on FreeBSD.
1844 #if !defined(__FreeBSD__)
TEST(MemorySanitizer,lrand48_r)1845 TEST(MemorySanitizer, lrand48_r) {
1846   struct drand48_data buf;
1847   srand48_r(0, &buf);
1848   long d;
1849   lrand48_r(&buf, &d);
1850   EXPECT_NOT_POISONED(d);
1851 }
1852 #endif
1853 
TEST(MemorySanitizer,sprintf)1854 TEST(MemorySanitizer, sprintf) {  // NOLINT
1855   char buff[10];
1856   break_optimization(buff);
1857   EXPECT_POISONED(buff[0]);
1858   int res = sprintf(buff, "%d", 1234567);  // NOLINT
1859   ASSERT_EQ(res, 7);
1860   ASSERT_EQ(buff[0], '1');
1861   ASSERT_EQ(buff[1], '2');
1862   ASSERT_EQ(buff[2], '3');
1863   ASSERT_EQ(buff[6], '7');
1864   ASSERT_EQ(buff[7], 0);
1865   EXPECT_POISONED(buff[8]);
1866 }
1867 
TEST(MemorySanitizer,snprintf)1868 TEST(MemorySanitizer, snprintf) {
1869   char buff[10];
1870   break_optimization(buff);
1871   EXPECT_POISONED(buff[0]);
1872   int res = snprintf(buff, sizeof(buff), "%d", 1234567);
1873   ASSERT_EQ(res, 7);
1874   ASSERT_EQ(buff[0], '1');
1875   ASSERT_EQ(buff[1], '2');
1876   ASSERT_EQ(buff[2], '3');
1877   ASSERT_EQ(buff[6], '7');
1878   ASSERT_EQ(buff[7], 0);
1879   EXPECT_POISONED(buff[8]);
1880 }
1881 
TEST(MemorySanitizer,swprintf)1882 TEST(MemorySanitizer, swprintf) {
1883   wchar_t buff[10];
1884   ASSERT_EQ(4U, sizeof(wchar_t));
1885   break_optimization(buff);
1886   EXPECT_POISONED(buff[0]);
1887   int res = swprintf(buff, 9, L"%d", 1234567);
1888   ASSERT_EQ(res, 7);
1889   ASSERT_EQ(buff[0], '1');
1890   ASSERT_EQ(buff[1], '2');
1891   ASSERT_EQ(buff[2], '3');
1892   ASSERT_EQ(buff[6], '7');
1893   ASSERT_EQ(buff[7], L'\0');
1894   EXPECT_POISONED(buff[8]);
1895 }
1896 
TEST(MemorySanitizer,asprintf)1897 TEST(MemorySanitizer, asprintf) {  // NOLINT
1898   char *pbuf;
1899   EXPECT_POISONED(pbuf);
1900   int res = asprintf(&pbuf, "%d", 1234567);  // NOLINT
1901   ASSERT_EQ(res, 7);
1902   EXPECT_NOT_POISONED(pbuf);
1903   ASSERT_EQ(pbuf[0], '1');
1904   ASSERT_EQ(pbuf[1], '2');
1905   ASSERT_EQ(pbuf[2], '3');
1906   ASSERT_EQ(pbuf[6], '7');
1907   ASSERT_EQ(pbuf[7], 0);
1908   free(pbuf);
1909 }
1910 
TEST(MemorySanitizer,mbstowcs)1911 TEST(MemorySanitizer, mbstowcs) {
1912   const char *x = "abc";
1913   wchar_t buff[10];
1914   int res = mbstowcs(buff, x, 2);
1915   EXPECT_EQ(2, res);
1916   EXPECT_EQ(L'a', buff[0]);
1917   EXPECT_EQ(L'b', buff[1]);
1918   EXPECT_POISONED(buff[2]);
1919   res = mbstowcs(buff, x, 10);
1920   EXPECT_EQ(3, res);
1921   EXPECT_NOT_POISONED(buff[3]);
1922 }
1923 
TEST(MemorySanitizer,wcstombs)1924 TEST(MemorySanitizer, wcstombs) {
1925   const wchar_t *x = L"abc";
1926   char buff[10];
1927   int res = wcstombs(buff, x, 4);
1928   EXPECT_EQ(res, 3);
1929   EXPECT_EQ(buff[0], 'a');
1930   EXPECT_EQ(buff[1], 'b');
1931   EXPECT_EQ(buff[2], 'c');
1932 }
1933 
TEST(MemorySanitizer,wcsrtombs)1934 TEST(MemorySanitizer, wcsrtombs) {
1935   const wchar_t *x = L"abc";
1936   const wchar_t *p = x;
1937   char buff[10];
1938   mbstate_t mbs;
1939   memset(&mbs, 0, sizeof(mbs));
1940   int res = wcsrtombs(buff, &p, 4, &mbs);
1941   EXPECT_EQ(res, 3);
1942   EXPECT_EQ(buff[0], 'a');
1943   EXPECT_EQ(buff[1], 'b');
1944   EXPECT_EQ(buff[2], 'c');
1945   EXPECT_EQ(buff[3], '\0');
1946   EXPECT_POISONED(buff[4]);
1947 }
1948 
TEST(MemorySanitizer,wcsnrtombs)1949 TEST(MemorySanitizer, wcsnrtombs) {
1950   const wchar_t *x = L"abc";
1951   const wchar_t *p = x;
1952   char buff[10];
1953   mbstate_t mbs;
1954   memset(&mbs, 0, sizeof(mbs));
1955   int res = wcsnrtombs(buff, &p, 2, 4, &mbs);
1956   EXPECT_EQ(res, 2);
1957   EXPECT_EQ(buff[0], 'a');
1958   EXPECT_EQ(buff[1], 'b');
1959   EXPECT_POISONED(buff[2]);
1960 }
1961 
TEST(MemorySanitizer,wcrtomb)1962 TEST(MemorySanitizer, wcrtomb) {
1963   wchar_t x = L'a';
1964   char buff[10];
1965   mbstate_t mbs;
1966   memset(&mbs, 0, sizeof(mbs));
1967   size_t res = wcrtomb(buff, x, &mbs);
1968   EXPECT_EQ(res, (size_t)1);
1969   EXPECT_EQ(buff[0], 'a');
1970 }
1971 
TEST(MemorySanitizer,wmemset)1972 TEST(MemorySanitizer, wmemset) {
1973     wchar_t x[25];
1974     break_optimization(x);
1975     EXPECT_POISONED(x[0]);
1976     wmemset(x, L'A', 10);
1977     EXPECT_EQ(x[0], L'A');
1978     EXPECT_EQ(x[9], L'A');
1979     EXPECT_POISONED(x[10]);
1980 }
1981 
TEST(MemorySanitizer,mbtowc)1982 TEST(MemorySanitizer, mbtowc) {
1983   const char *x = "abc";
1984   wchar_t wx;
1985   int res = mbtowc(&wx, x, 3);
1986   EXPECT_GT(res, 0);
1987   EXPECT_NOT_POISONED(wx);
1988 }
1989 
TEST(MemorySanitizer,mbrtowc)1990 TEST(MemorySanitizer, mbrtowc) {
1991   const char *x = "abc";
1992   wchar_t wx;
1993   mbstate_t mbs;
1994   memset(&mbs, 0, sizeof(mbs));
1995   int res = mbrtowc(&wx, x, 3, &mbs);
1996   EXPECT_GT(res, 0);
1997   EXPECT_NOT_POISONED(wx);
1998 }
1999 
TEST(MemorySanitizer,wcsftime)2000 TEST(MemorySanitizer, wcsftime) {
2001   wchar_t x[100];
2002   time_t t = time(NULL);
2003   struct tm tms;
2004   struct tm *tmres = localtime_r(&t, &tms);
2005   ASSERT_NE((void *)0, tmres);
2006   size_t res = wcsftime(x, sizeof(x) / sizeof(x[0]), L"%Y-%m-%d", tmres);
2007   EXPECT_GT(res, 0UL);
2008   EXPECT_EQ(res, wcslen(x));
2009 }
2010 
TEST(MemorySanitizer,gettimeofday)2011 TEST(MemorySanitizer, gettimeofday) {
2012   struct timeval tv;
2013   struct timezone tz;
2014   break_optimization(&tv);
2015   break_optimization(&tz);
2016   ASSERT_EQ(16U, sizeof(tv));
2017   ASSERT_EQ(8U, sizeof(tz));
2018   EXPECT_POISONED(tv.tv_sec);
2019   EXPECT_POISONED(tv.tv_usec);
2020   EXPECT_POISONED(tz.tz_minuteswest);
2021   EXPECT_POISONED(tz.tz_dsttime);
2022   ASSERT_EQ(0, gettimeofday(&tv, &tz));
2023   EXPECT_NOT_POISONED(tv.tv_sec);
2024   EXPECT_NOT_POISONED(tv.tv_usec);
2025   EXPECT_NOT_POISONED(tz.tz_minuteswest);
2026   EXPECT_NOT_POISONED(tz.tz_dsttime);
2027 }
2028 
TEST(MemorySanitizer,clock_gettime)2029 TEST(MemorySanitizer, clock_gettime) {
2030   struct timespec tp;
2031   EXPECT_POISONED(tp.tv_sec);
2032   EXPECT_POISONED(tp.tv_nsec);
2033   ASSERT_EQ(0, clock_gettime(CLOCK_REALTIME, &tp));
2034   EXPECT_NOT_POISONED(tp.tv_sec);
2035   EXPECT_NOT_POISONED(tp.tv_nsec);
2036 }
2037 
TEST(MemorySanitizer,clock_getres)2038 TEST(MemorySanitizer, clock_getres) {
2039   struct timespec tp;
2040   EXPECT_POISONED(tp.tv_sec);
2041   EXPECT_POISONED(tp.tv_nsec);
2042   ASSERT_EQ(0, clock_getres(CLOCK_REALTIME, 0));
2043   EXPECT_POISONED(tp.tv_sec);
2044   EXPECT_POISONED(tp.tv_nsec);
2045   ASSERT_EQ(0, clock_getres(CLOCK_REALTIME, &tp));
2046   EXPECT_NOT_POISONED(tp.tv_sec);
2047   EXPECT_NOT_POISONED(tp.tv_nsec);
2048 }
2049 
TEST(MemorySanitizer,getitimer)2050 TEST(MemorySanitizer, getitimer) {
2051   struct itimerval it1, it2;
2052   int res;
2053   EXPECT_POISONED(it1.it_interval.tv_sec);
2054   EXPECT_POISONED(it1.it_interval.tv_usec);
2055   EXPECT_POISONED(it1.it_value.tv_sec);
2056   EXPECT_POISONED(it1.it_value.tv_usec);
2057   res = getitimer(ITIMER_VIRTUAL, &it1);
2058   ASSERT_EQ(0, res);
2059   EXPECT_NOT_POISONED(it1.it_interval.tv_sec);
2060   EXPECT_NOT_POISONED(it1.it_interval.tv_usec);
2061   EXPECT_NOT_POISONED(it1.it_value.tv_sec);
2062   EXPECT_NOT_POISONED(it1.it_value.tv_usec);
2063 
2064   it1.it_interval.tv_sec = it1.it_value.tv_sec = 10000;
2065   it1.it_interval.tv_usec = it1.it_value.tv_usec = 0;
2066 
2067   res = setitimer(ITIMER_VIRTUAL, &it1, &it2);
2068   ASSERT_EQ(0, res);
2069   EXPECT_NOT_POISONED(it2.it_interval.tv_sec);
2070   EXPECT_NOT_POISONED(it2.it_interval.tv_usec);
2071   EXPECT_NOT_POISONED(it2.it_value.tv_sec);
2072   EXPECT_NOT_POISONED(it2.it_value.tv_usec);
2073 
2074   // Check that old_value can be 0, and disable the timer.
2075   memset(&it1, 0, sizeof(it1));
2076   res = setitimer(ITIMER_VIRTUAL, &it1, 0);
2077   ASSERT_EQ(0, res);
2078 }
2079 
TEST(MemorySanitizer,setitimer_null)2080 TEST(MemorySanitizer, setitimer_null) {
2081   setitimer(ITIMER_VIRTUAL, 0, 0);
2082   // Not testing the return value, since it the behaviour seems to differ
2083   // between libc implementations and POSIX.
2084   // Should never crash, though.
2085 }
2086 
TEST(MemorySanitizer,time)2087 TEST(MemorySanitizer, time) {
2088   time_t t;
2089   EXPECT_POISONED(t);
2090   time_t t2 = time(&t);
2091   ASSERT_NE(t2, (time_t)-1);
2092   EXPECT_NOT_POISONED(t);
2093 }
2094 
TEST(MemorySanitizer,strptime)2095 TEST(MemorySanitizer, strptime) {
2096   struct tm time;
2097   char *p = strptime("11/1/2013-05:39", "%m/%d/%Y-%H:%M", &time);
2098   ASSERT_TRUE(p != NULL);
2099   EXPECT_NOT_POISONED(time.tm_sec);
2100   EXPECT_NOT_POISONED(time.tm_hour);
2101   EXPECT_NOT_POISONED(time.tm_year);
2102 }
2103 
TEST(MemorySanitizer,localtime)2104 TEST(MemorySanitizer, localtime) {
2105   time_t t = 123;
2106   struct tm *time = localtime(&t);
2107   ASSERT_TRUE(time != NULL);
2108   EXPECT_NOT_POISONED(time->tm_sec);
2109   EXPECT_NOT_POISONED(time->tm_hour);
2110   EXPECT_NOT_POISONED(time->tm_year);
2111   EXPECT_NOT_POISONED(time->tm_isdst);
2112   EXPECT_NE(0U, strlen(time->tm_zone));
2113 }
2114 
TEST(MemorySanitizer,localtime_r)2115 TEST(MemorySanitizer, localtime_r) {
2116   time_t t = 123;
2117   struct tm time;
2118   struct tm *res = localtime_r(&t, &time);
2119   ASSERT_TRUE(res != NULL);
2120   EXPECT_NOT_POISONED(time.tm_sec);
2121   EXPECT_NOT_POISONED(time.tm_hour);
2122   EXPECT_NOT_POISONED(time.tm_year);
2123   EXPECT_NOT_POISONED(time.tm_isdst);
2124   EXPECT_NE(0U, strlen(time.tm_zone));
2125 }
2126 
2127 // There's no getmntent() on FreeBSD.
2128 #if !defined(__FreeBSD__)
TEST(MemorySanitizer,getmntent)2129 TEST(MemorySanitizer, getmntent) {
2130   FILE *fp = setmntent("/etc/fstab", "r");
2131   struct mntent *mnt = getmntent(fp);
2132   ASSERT_TRUE(mnt != NULL);
2133   ASSERT_NE(0U, strlen(mnt->mnt_fsname));
2134   ASSERT_NE(0U, strlen(mnt->mnt_dir));
2135   ASSERT_NE(0U, strlen(mnt->mnt_type));
2136   ASSERT_NE(0U, strlen(mnt->mnt_opts));
2137   EXPECT_NOT_POISONED(mnt->mnt_freq);
2138   EXPECT_NOT_POISONED(mnt->mnt_passno);
2139   fclose(fp);
2140 }
2141 #endif
2142 
2143 // There's no getmntent_r() on FreeBSD.
2144 #if !defined(__FreeBSD__)
TEST(MemorySanitizer,getmntent_r)2145 TEST(MemorySanitizer, getmntent_r) {
2146   FILE *fp = setmntent("/etc/fstab", "r");
2147   struct mntent mntbuf;
2148   char buf[1000];
2149   struct mntent *mnt = getmntent_r(fp, &mntbuf, buf, sizeof(buf));
2150   ASSERT_TRUE(mnt != NULL);
2151   ASSERT_NE(0U, strlen(mnt->mnt_fsname));
2152   ASSERT_NE(0U, strlen(mnt->mnt_dir));
2153   ASSERT_NE(0U, strlen(mnt->mnt_type));
2154   ASSERT_NE(0U, strlen(mnt->mnt_opts));
2155   EXPECT_NOT_POISONED(mnt->mnt_freq);
2156   EXPECT_NOT_POISONED(mnt->mnt_passno);
2157   fclose(fp);
2158 }
2159 #endif
2160 
TEST(MemorySanitizer,ether)2161 TEST(MemorySanitizer, ether) {
2162   const char *asc = "11:22:33:44:55:66";
2163   struct ether_addr *paddr = ether_aton(asc);
2164   EXPECT_NOT_POISONED(*paddr);
2165 
2166   struct ether_addr addr;
2167   paddr = ether_aton_r(asc, &addr);
2168   ASSERT_EQ(paddr, &addr);
2169   EXPECT_NOT_POISONED(addr);
2170 
2171   char *s = ether_ntoa(&addr);
2172   ASSERT_NE(0U, strlen(s));
2173 
2174   char buf[100];
2175   s = ether_ntoa_r(&addr, buf);
2176   ASSERT_EQ(s, buf);
2177   ASSERT_NE(0U, strlen(buf));
2178 }
2179 
TEST(MemorySanitizer,mmap)2180 TEST(MemorySanitizer, mmap) {
2181   const int size = 4096;
2182   void *p1, *p2;
2183   p1 = mmap(0, size, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANON, -1, 0);
2184   __msan_poison(p1, size);
2185   munmap(p1, size);
2186   for (int i = 0; i < 1000; i++) {
2187     p2 = mmap(0, size, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANON, -1, 0);
2188     if (p2 == p1)
2189       break;
2190     else
2191       munmap(p2, size);
2192   }
2193   if (p1 == p2) {
2194     EXPECT_NOT_POISONED(*(char*)p2);
2195     munmap(p2, size);
2196   }
2197 }
2198 
2199 // There's no fcvt() on FreeBSD.
2200 #if !defined(__FreeBSD__)
2201 // FIXME: enable and add ecvt.
2202 // FIXME: check why msandr does nt handle fcvt.
TEST(MemorySanitizer,fcvt)2203 TEST(MemorySanitizer, fcvt) {
2204   int a, b;
2205   break_optimization(&a);
2206   break_optimization(&b);
2207   EXPECT_POISONED(a);
2208   EXPECT_POISONED(b);
2209   char *str = fcvt(12345.6789, 10, &a, &b);
2210   EXPECT_NOT_POISONED(a);
2211   EXPECT_NOT_POISONED(b);
2212   ASSERT_NE(nullptr, str);
2213   EXPECT_NOT_POISONED(str[0]);
2214   ASSERT_NE(0U, strlen(str));
2215 }
2216 #endif
2217 
2218 // There's no fcvt_long() on FreeBSD.
2219 #if !defined(__FreeBSD__)
TEST(MemorySanitizer,fcvt_long)2220 TEST(MemorySanitizer, fcvt_long) {
2221   int a, b;
2222   break_optimization(&a);
2223   break_optimization(&b);
2224   EXPECT_POISONED(a);
2225   EXPECT_POISONED(b);
2226   char *str = fcvt(111111112345.6789, 10, &a, &b);
2227   EXPECT_NOT_POISONED(a);
2228   EXPECT_NOT_POISONED(b);
2229   ASSERT_NE(nullptr, str);
2230   EXPECT_NOT_POISONED(str[0]);
2231   ASSERT_NE(0U, strlen(str));
2232 }
2233 #endif
2234 
TEST(MemorySanitizer,memchr)2235 TEST(MemorySanitizer, memchr) {
2236   char x[10];
2237   break_optimization(x);
2238   EXPECT_POISONED(x[0]);
2239   x[2] = '2';
2240   void *res;
2241   EXPECT_UMR(res = memchr(x, '2', 10));
2242   EXPECT_NOT_POISONED(res);
2243   x[0] = '0';
2244   x[1] = '1';
2245   res = memchr(x, '2', 10);
2246   EXPECT_EQ(&x[2], res);
2247   EXPECT_UMR(res = memchr(x, '3', 10));
2248   EXPECT_NOT_POISONED(res);
2249 }
2250 
TEST(MemorySanitizer,memrchr)2251 TEST(MemorySanitizer, memrchr) {
2252   char x[10];
2253   break_optimization(x);
2254   EXPECT_POISONED(x[0]);
2255   x[9] = '9';
2256   void *res;
2257   EXPECT_UMR(res = memrchr(x, '9', 10));
2258   EXPECT_NOT_POISONED(res);
2259   x[0] = '0';
2260   x[1] = '1';
2261   res = memrchr(x, '0', 2);
2262   EXPECT_EQ(&x[0], res);
2263   EXPECT_UMR(res = memrchr(x, '7', 10));
2264   EXPECT_NOT_POISONED(res);
2265 }
2266 
TEST(MemorySanitizer,frexp)2267 TEST(MemorySanitizer, frexp) {
2268   int x;
2269   x = *GetPoisoned<int>();
2270   double r = frexp(1.1, &x);
2271   EXPECT_NOT_POISONED(r);
2272   EXPECT_NOT_POISONED(x);
2273 
2274   x = *GetPoisoned<int>();
2275   float rf = frexpf(1.1, &x);
2276   EXPECT_NOT_POISONED(rf);
2277   EXPECT_NOT_POISONED(x);
2278 
2279   x = *GetPoisoned<int>();
2280   double rl = frexpl(1.1, &x);
2281   EXPECT_NOT_POISONED(rl);
2282   EXPECT_NOT_POISONED(x);
2283 }
2284 
2285 namespace {
2286 
2287 static int cnt;
2288 
SigactionHandler(int signo,siginfo_t * si,void * uc)2289 void SigactionHandler(int signo, siginfo_t* si, void* uc) {
2290   ASSERT_EQ(signo, SIGPROF);
2291   ASSERT_TRUE(si != NULL);
2292   EXPECT_NOT_POISONED(si->si_errno);
2293   EXPECT_NOT_POISONED(si->si_pid);
2294 #if __linux__
2295 # if defined(__x86_64__)
2296   EXPECT_NOT_POISONED(((ucontext_t*)uc)->uc_mcontext.gregs[REG_RIP]);
2297 # elif defined(__i386__)
2298   EXPECT_NOT_POISONED(((ucontext_t*)uc)->uc_mcontext.gregs[REG_EIP]);
2299 # endif
2300 #endif
2301   ++cnt;
2302 }
2303 
TEST(MemorySanitizer,sigaction)2304 TEST(MemorySanitizer, sigaction) {
2305   struct sigaction act = {};
2306   struct sigaction oldact = {};
2307   struct sigaction origact = {};
2308 
2309   sigaction(SIGPROF, 0, &origact);
2310 
2311   act.sa_flags |= SA_SIGINFO;
2312   act.sa_sigaction = &SigactionHandler;
2313   sigaction(SIGPROF, &act, 0);
2314 
2315   kill(getpid(), SIGPROF);
2316 
2317   act.sa_flags &= ~SA_SIGINFO;
2318   act.sa_handler = SIG_DFL;
2319   sigaction(SIGPROF, &act, 0);
2320 
2321   act.sa_flags &= ~SA_SIGINFO;
2322   act.sa_handler = SIG_IGN;
2323   sigaction(SIGPROF, &act, &oldact);
2324   EXPECT_FALSE(oldact.sa_flags & SA_SIGINFO);
2325   EXPECT_EQ(SIG_DFL, oldact.sa_handler);
2326   kill(getpid(), SIGPROF);
2327 
2328   act.sa_flags |= SA_SIGINFO;
2329   act.sa_sigaction = &SigactionHandler;
2330   sigaction(SIGPROF, &act, &oldact);
2331   EXPECT_FALSE(oldact.sa_flags & SA_SIGINFO);
2332   EXPECT_EQ(SIG_IGN, oldact.sa_handler);
2333   kill(getpid(), SIGPROF);
2334 
2335   act.sa_flags &= ~SA_SIGINFO;
2336   act.sa_handler = SIG_DFL;
2337   sigaction(SIGPROF, &act, &oldact);
2338   EXPECT_TRUE(oldact.sa_flags & SA_SIGINFO);
2339   EXPECT_EQ(&SigactionHandler, oldact.sa_sigaction);
2340   EXPECT_EQ(2, cnt);
2341 
2342   sigaction(SIGPROF, &origact, 0);
2343 }
2344 
2345 } // namespace
2346 
2347 
TEST(MemorySanitizer,sigemptyset)2348 TEST(MemorySanitizer, sigemptyset) {
2349   sigset_t s;
2350   EXPECT_POISONED(s);
2351   int res = sigemptyset(&s);
2352   ASSERT_EQ(0, res);
2353   EXPECT_NOT_POISONED(s);
2354 }
2355 
TEST(MemorySanitizer,sigfillset)2356 TEST(MemorySanitizer, sigfillset) {
2357   sigset_t s;
2358   EXPECT_POISONED(s);
2359   int res = sigfillset(&s);
2360   ASSERT_EQ(0, res);
2361   EXPECT_NOT_POISONED(s);
2362 }
2363 
TEST(MemorySanitizer,sigpending)2364 TEST(MemorySanitizer, sigpending) {
2365   sigset_t s;
2366   EXPECT_POISONED(s);
2367   int res = sigpending(&s);
2368   ASSERT_EQ(0, res);
2369   EXPECT_NOT_POISONED(s);
2370 }
2371 
TEST(MemorySanitizer,sigprocmask)2372 TEST(MemorySanitizer, sigprocmask) {
2373   sigset_t s;
2374   EXPECT_POISONED(s);
2375   int res = sigprocmask(SIG_BLOCK, 0, &s);
2376   ASSERT_EQ(0, res);
2377   EXPECT_NOT_POISONED(s);
2378 }
2379 
2380 struct StructWithDtor {
2381   ~StructWithDtor();
2382 };
2383 
~StructWithDtor()2384 NOINLINE StructWithDtor::~StructWithDtor() {
2385   break_optimization(0);
2386 }
2387 
TEST(MemorySanitizer,Invoke)2388 TEST(MemorySanitizer, Invoke) {
2389   StructWithDtor s;  // Will cause the calls to become invokes.
2390   EXPECT_NOT_POISONED(0);
2391   EXPECT_POISONED(*GetPoisoned<int>());
2392   EXPECT_NOT_POISONED(0);
2393   EXPECT_POISONED(*GetPoisoned<int>());
2394   EXPECT_POISONED(ReturnPoisoned<S4>());
2395 }
2396 
TEST(MemorySanitizer,ptrtoint)2397 TEST(MemorySanitizer, ptrtoint) {
2398   // Test that shadow is propagated through pointer-to-integer conversion.
2399   unsigned char c = 0;
2400   __msan_poison(&c, 1);
2401   uintptr_t u = (uintptr_t)c << 8;
2402   EXPECT_NOT_POISONED(u & 0xFF00FF);
2403   EXPECT_POISONED(u & 0xFF00);
2404 
2405   break_optimization(&u);
2406   void* p = (void*)u;
2407 
2408   break_optimization(&p);
2409   EXPECT_POISONED(p);
2410   EXPECT_NOT_POISONED(((uintptr_t)p) & 0xFF00FF);
2411   EXPECT_POISONED(((uintptr_t)p) & 0xFF00);
2412 }
2413 
vaargsfn2(int guard,...)2414 static void vaargsfn2(int guard, ...) {
2415   va_list vl;
2416   va_start(vl, guard);
2417   EXPECT_NOT_POISONED(va_arg(vl, int));
2418   EXPECT_NOT_POISONED(va_arg(vl, int));
2419   EXPECT_NOT_POISONED(va_arg(vl, int));
2420   EXPECT_POISONED(va_arg(vl, double));
2421   va_end(vl);
2422 }
2423 
vaargsfn(int guard,...)2424 static void vaargsfn(int guard, ...) {
2425   va_list vl;
2426   va_start(vl, guard);
2427   EXPECT_NOT_POISONED(va_arg(vl, int));
2428   EXPECT_POISONED(va_arg(vl, int));
2429   // The following call will overwrite __msan_param_tls.
2430   // Checks after it test that arg shadow was somehow saved across the call.
2431   vaargsfn2(1, 2, 3, 4, *GetPoisoned<double>());
2432   EXPECT_NOT_POISONED(va_arg(vl, int));
2433   EXPECT_POISONED(va_arg(vl, int));
2434   va_end(vl);
2435 }
2436 
TEST(MemorySanitizer,VAArgTest)2437 TEST(MemorySanitizer, VAArgTest) {
2438   int* x = GetPoisoned<int>();
2439   int* y = GetPoisoned<int>(4);
2440   vaargsfn(1, 13, *x, 42, *y);
2441 }
2442 
vaargsfn_many(int guard,...)2443 static void vaargsfn_many(int guard, ...) {
2444   va_list vl;
2445   va_start(vl, guard);
2446   EXPECT_NOT_POISONED(va_arg(vl, int));
2447   EXPECT_POISONED(va_arg(vl, int));
2448   EXPECT_NOT_POISONED(va_arg(vl, int));
2449   EXPECT_NOT_POISONED(va_arg(vl, int));
2450   EXPECT_NOT_POISONED(va_arg(vl, int));
2451   EXPECT_NOT_POISONED(va_arg(vl, int));
2452   EXPECT_NOT_POISONED(va_arg(vl, int));
2453   EXPECT_NOT_POISONED(va_arg(vl, int));
2454   EXPECT_NOT_POISONED(va_arg(vl, int));
2455   EXPECT_POISONED(va_arg(vl, int));
2456   va_end(vl);
2457 }
2458 
TEST(MemorySanitizer,VAArgManyTest)2459 TEST(MemorySanitizer, VAArgManyTest) {
2460   int* x = GetPoisoned<int>();
2461   int* y = GetPoisoned<int>(4);
2462   vaargsfn_many(1, 2, *x, 3, 4, 5, 6, 7, 8, 9, *y);
2463 }
2464 
vaargsfn_manyfix(int g1,int g2,int g3,int g4,int g5,int g6,int g7,int g8,int g9,...)2465 static void vaargsfn_manyfix(int g1, int g2, int g3, int g4, int g5, int g6, int g7, int g8, int g9, ...) {
2466   va_list vl;
2467   va_start(vl, g9);
2468   EXPECT_NOT_POISONED(va_arg(vl, int));
2469   EXPECT_POISONED(va_arg(vl, int));
2470   va_end(vl);
2471 }
2472 
TEST(MemorySanitizer,VAArgManyFixTest)2473 TEST(MemorySanitizer, VAArgManyFixTest) {
2474   int* x = GetPoisoned<int>();
2475   int* y = GetPoisoned<int>();
2476   vaargsfn_manyfix(1, *x, 3, 4, 5, 6, 7, 8, 9, 10, *y);
2477 }
2478 
vaargsfn_pass2(va_list vl)2479 static void vaargsfn_pass2(va_list vl) {
2480   EXPECT_NOT_POISONED(va_arg(vl, int));
2481   EXPECT_NOT_POISONED(va_arg(vl, int));
2482   EXPECT_POISONED(va_arg(vl, int));
2483 }
2484 
vaargsfn_pass(int guard,...)2485 static void vaargsfn_pass(int guard, ...) {
2486   va_list vl;
2487   va_start(vl, guard);
2488   EXPECT_POISONED(va_arg(vl, int));
2489   vaargsfn_pass2(vl);
2490   va_end(vl);
2491 }
2492 
TEST(MemorySanitizer,VAArgPass)2493 TEST(MemorySanitizer, VAArgPass) {
2494   int* x = GetPoisoned<int>();
2495   int* y = GetPoisoned<int>(4);
2496   vaargsfn_pass(1, *x, 2, 3, *y);
2497 }
2498 
vaargsfn_copy2(va_list vl)2499 static void vaargsfn_copy2(va_list vl) {
2500   EXPECT_NOT_POISONED(va_arg(vl, int));
2501   EXPECT_POISONED(va_arg(vl, int));
2502 }
2503 
vaargsfn_copy(int guard,...)2504 static void vaargsfn_copy(int guard, ...) {
2505   va_list vl;
2506   va_start(vl, guard);
2507   EXPECT_NOT_POISONED(va_arg(vl, int));
2508   EXPECT_POISONED(va_arg(vl, int));
2509   va_list vl2;
2510   va_copy(vl2, vl);
2511   vaargsfn_copy2(vl2);
2512   EXPECT_NOT_POISONED(va_arg(vl, int));
2513   EXPECT_POISONED(va_arg(vl, int));
2514   va_end(vl);
2515 }
2516 
TEST(MemorySanitizer,VAArgCopy)2517 TEST(MemorySanitizer, VAArgCopy) {
2518   int* x = GetPoisoned<int>();
2519   int* y = GetPoisoned<int>(4);
2520   vaargsfn_copy(1, 2, *x, 3, *y);
2521 }
2522 
vaargsfn_ptr(int guard,...)2523 static void vaargsfn_ptr(int guard, ...) {
2524   va_list vl;
2525   va_start(vl, guard);
2526   EXPECT_NOT_POISONED(va_arg(vl, int*));
2527   EXPECT_POISONED(va_arg(vl, int*));
2528   EXPECT_NOT_POISONED(va_arg(vl, int*));
2529   EXPECT_POISONED(va_arg(vl, double*));
2530   va_end(vl);
2531 }
2532 
TEST(MemorySanitizer,VAArgPtr)2533 TEST(MemorySanitizer, VAArgPtr) {
2534   int** x = GetPoisoned<int*>();
2535   double** y = GetPoisoned<double*>(8);
2536   int z;
2537   vaargsfn_ptr(1, &z, *x, &z, *y);
2538 }
2539 
vaargsfn_overflow(int guard,...)2540 static void vaargsfn_overflow(int guard, ...) {
2541   va_list vl;
2542   va_start(vl, guard);
2543   EXPECT_NOT_POISONED(va_arg(vl, int));
2544   EXPECT_NOT_POISONED(va_arg(vl, int));
2545   EXPECT_POISONED(va_arg(vl, int));
2546   EXPECT_NOT_POISONED(va_arg(vl, int));
2547   EXPECT_NOT_POISONED(va_arg(vl, int));
2548   EXPECT_NOT_POISONED(va_arg(vl, int));
2549 
2550   EXPECT_NOT_POISONED(va_arg(vl, double));
2551   EXPECT_NOT_POISONED(va_arg(vl, double));
2552   EXPECT_NOT_POISONED(va_arg(vl, double));
2553   EXPECT_POISONED(va_arg(vl, double));
2554   EXPECT_NOT_POISONED(va_arg(vl, double));
2555   EXPECT_POISONED(va_arg(vl, int*));
2556   EXPECT_NOT_POISONED(va_arg(vl, double));
2557   EXPECT_NOT_POISONED(va_arg(vl, double));
2558 
2559   EXPECT_POISONED(va_arg(vl, int));
2560   EXPECT_POISONED(va_arg(vl, double));
2561   EXPECT_POISONED(va_arg(vl, int*));
2562 
2563   EXPECT_NOT_POISONED(va_arg(vl, int));
2564   EXPECT_NOT_POISONED(va_arg(vl, double));
2565   EXPECT_NOT_POISONED(va_arg(vl, int*));
2566 
2567   EXPECT_POISONED(va_arg(vl, int));
2568   EXPECT_POISONED(va_arg(vl, double));
2569   EXPECT_POISONED(va_arg(vl, int*));
2570 
2571   va_end(vl);
2572 }
2573 
TEST(MemorySanitizer,VAArgOverflow)2574 TEST(MemorySanitizer, VAArgOverflow) {
2575   int* x = GetPoisoned<int>();
2576   double* y = GetPoisoned<double>(8);
2577   int** p = GetPoisoned<int*>(16);
2578   int z;
2579   vaargsfn_overflow(1,
2580       1, 2, *x, 4, 5, 6,
2581       1.1, 2.2, 3.3, *y, 5.5, *p, 7.7, 8.8,
2582       // the following args will overflow for sure
2583       *x, *y, *p,
2584       7, 9.9, &z,
2585       *x, *y, *p);
2586 }
2587 
vaargsfn_tlsoverwrite2(int guard,...)2588 static void vaargsfn_tlsoverwrite2(int guard, ...) {
2589   va_list vl;
2590   va_start(vl, guard);
2591   for (int i = 0; i < 20; ++i)
2592     EXPECT_NOT_POISONED(va_arg(vl, int));
2593   va_end(vl);
2594 }
2595 
vaargsfn_tlsoverwrite(int guard,...)2596 static void vaargsfn_tlsoverwrite(int guard, ...) {
2597   // This call will overwrite TLS contents unless it's backed up somewhere.
2598   vaargsfn_tlsoverwrite2(2,
2599       42, 42, 42, 42, 42,
2600       42, 42, 42, 42, 42,
2601       42, 42, 42, 42, 42,
2602       42, 42, 42, 42, 42); // 20x
2603   va_list vl;
2604   va_start(vl, guard);
2605   for (int i = 0; i < 20; ++i)
2606     EXPECT_POISONED(va_arg(vl, int));
2607   va_end(vl);
2608 }
2609 
TEST(MemorySanitizer,VAArgTLSOverwrite)2610 TEST(MemorySanitizer, VAArgTLSOverwrite) {
2611   int* x = GetPoisoned<int>();
2612   vaargsfn_tlsoverwrite(1,
2613       *x, *x, *x, *x, *x,
2614       *x, *x, *x, *x, *x,
2615       *x, *x, *x, *x, *x,
2616       *x, *x, *x, *x, *x); // 20x
2617 
2618 }
2619 
2620 struct StructByVal {
2621   int a, b, c, d, e, f;
2622 };
2623 
vaargsfn_structbyval(int guard,...)2624 static void vaargsfn_structbyval(int guard, ...) {
2625   va_list vl;
2626   va_start(vl, guard);
2627   {
2628     StructByVal s = va_arg(vl, StructByVal);
2629     EXPECT_NOT_POISONED(s.a);
2630     EXPECT_POISONED(s.b);
2631     EXPECT_NOT_POISONED(s.c);
2632     EXPECT_POISONED(s.d);
2633     EXPECT_NOT_POISONED(s.e);
2634     EXPECT_POISONED(s.f);
2635   }
2636   {
2637     StructByVal s = va_arg(vl, StructByVal);
2638     EXPECT_NOT_POISONED(s.a);
2639     EXPECT_POISONED(s.b);
2640     EXPECT_NOT_POISONED(s.c);
2641     EXPECT_POISONED(s.d);
2642     EXPECT_NOT_POISONED(s.e);
2643     EXPECT_POISONED(s.f);
2644   }
2645   va_end(vl);
2646 }
2647 
TEST(MemorySanitizer,VAArgStructByVal)2648 TEST(MemorySanitizer, VAArgStructByVal) {
2649   StructByVal s;
2650   s.a = 1;
2651   s.b = *GetPoisoned<int>();
2652   s.c = 2;
2653   s.d = *GetPoisoned<int>();
2654   s.e = 3;
2655   s.f = *GetPoisoned<int>();
2656   vaargsfn_structbyval(0, s, s);
2657 }
2658 
StructByValTestFunc(struct StructByVal s)2659 NOINLINE void StructByValTestFunc(struct StructByVal s) {
2660   EXPECT_NOT_POISONED(s.a);
2661   EXPECT_POISONED(s.b);
2662   EXPECT_NOT_POISONED(s.c);
2663   EXPECT_POISONED(s.d);
2664   EXPECT_NOT_POISONED(s.e);
2665   EXPECT_POISONED(s.f);
2666 }
2667 
StructByValTestFunc1(struct StructByVal s)2668 NOINLINE void StructByValTestFunc1(struct StructByVal s) {
2669   StructByValTestFunc(s);
2670 }
2671 
StructByValTestFunc2(int z,struct StructByVal s)2672 NOINLINE void StructByValTestFunc2(int z, struct StructByVal s) {
2673   StructByValTestFunc(s);
2674 }
2675 
TEST(MemorySanitizer,StructByVal)2676 TEST(MemorySanitizer, StructByVal) {
2677   // Large aggregates are passed as "byval" pointer argument in LLVM.
2678   struct StructByVal s;
2679   s.a = 1;
2680   s.b = *GetPoisoned<int>();
2681   s.c = 2;
2682   s.d = *GetPoisoned<int>();
2683   s.e = 3;
2684   s.f = *GetPoisoned<int>();
2685   StructByValTestFunc(s);
2686   StructByValTestFunc1(s);
2687   StructByValTestFunc2(0, s);
2688 }
2689 
2690 
2691 #if MSAN_HAS_M128
m128Eq(__m128i * a,__m128i * b)2692 NOINLINE __m128i m128Eq(__m128i *a, __m128i *b) { return _mm_cmpeq_epi16(*a, *b); }
m128Lt(__m128i * a,__m128i * b)2693 NOINLINE __m128i m128Lt(__m128i *a, __m128i *b) { return _mm_cmplt_epi16(*a, *b); }
TEST(MemorySanitizer,m128)2694 TEST(MemorySanitizer, m128) {
2695   __m128i a = _mm_set1_epi16(0x1234);
2696   __m128i b = _mm_set1_epi16(0x7890);
2697   EXPECT_NOT_POISONED(m128Eq(&a, &b));
2698   EXPECT_NOT_POISONED(m128Lt(&a, &b));
2699 }
2700 // FIXME: add more tests for __m128i.
2701 #endif  // MSAN_HAS_M128
2702 
2703 // We should not complain when copying this poisoned hole.
2704 struct StructWithHole {
2705   U4  a;
2706   // 4-byte hole.
2707   U8  b;
2708 };
2709 
ReturnStructWithHole()2710 NOINLINE StructWithHole ReturnStructWithHole() {
2711   StructWithHole res;
2712   __msan_poison(&res, sizeof(res));
2713   res.a = 1;
2714   res.b = 2;
2715   return res;
2716 }
2717 
TEST(MemorySanitizer,StructWithHole)2718 TEST(MemorySanitizer, StructWithHole) {
2719   StructWithHole a = ReturnStructWithHole();
2720   break_optimization(&a);
2721 }
2722 
2723 template <class T>
ReturnStruct()2724 NOINLINE T ReturnStruct() {
2725   T res;
2726   __msan_poison(&res, sizeof(res));
2727   res.a = 1;
2728   return res;
2729 }
2730 
2731 template <class T>
TestReturnStruct()2732 NOINLINE void TestReturnStruct() {
2733   T s1 = ReturnStruct<T>();
2734   EXPECT_NOT_POISONED(s1.a);
2735   EXPECT_POISONED(s1.b);
2736 }
2737 
2738 struct SSS1 {
2739   int a, b, c;
2740 };
2741 struct SSS2 {
2742   int b, a, c;
2743 };
2744 struct SSS3 {
2745   int b, c, a;
2746 };
2747 struct SSS4 {
2748   int c, b, a;
2749 };
2750 
2751 struct SSS5 {
2752   int a;
2753   float b;
2754 };
2755 struct SSS6 {
2756   int a;
2757   double b;
2758 };
2759 struct SSS7 {
2760   S8 b;
2761   int a;
2762 };
2763 struct SSS8 {
2764   S2 b;
2765   S8 a;
2766 };
2767 
TEST(MemorySanitizer,IntStruct3)2768 TEST(MemorySanitizer, IntStruct3) {
2769   TestReturnStruct<SSS1>();
2770   TestReturnStruct<SSS2>();
2771   TestReturnStruct<SSS3>();
2772   TestReturnStruct<SSS4>();
2773   TestReturnStruct<SSS5>();
2774   TestReturnStruct<SSS6>();
2775   TestReturnStruct<SSS7>();
2776   TestReturnStruct<SSS8>();
2777 }
2778 
2779 struct LongStruct {
2780   U1 a1, b1;
2781   U2 a2, b2;
2782   U4 a4, b4;
2783   U8 a8, b8;
2784 };
2785 
ReturnLongStruct1()2786 NOINLINE LongStruct ReturnLongStruct1() {
2787   LongStruct res;
2788   __msan_poison(&res, sizeof(res));
2789   res.a1 = res.a2 = res.a4 = res.a8 = 111;
2790   // leaves b1, .., b8 poisoned.
2791   return res;
2792 }
2793 
ReturnLongStruct2()2794 NOINLINE LongStruct ReturnLongStruct2() {
2795   LongStruct res;
2796   __msan_poison(&res, sizeof(res));
2797   res.b1 = res.b2 = res.b4 = res.b8 = 111;
2798   // leaves a1, .., a8 poisoned.
2799   return res;
2800 }
2801 
TEST(MemorySanitizer,LongStruct)2802 TEST(MemorySanitizer, LongStruct) {
2803   LongStruct s1 = ReturnLongStruct1();
2804   __msan_print_shadow(&s1, sizeof(s1));
2805   EXPECT_NOT_POISONED(s1.a1);
2806   EXPECT_NOT_POISONED(s1.a2);
2807   EXPECT_NOT_POISONED(s1.a4);
2808   EXPECT_NOT_POISONED(s1.a8);
2809 
2810   EXPECT_POISONED(s1.b1);
2811   EXPECT_POISONED(s1.b2);
2812   EXPECT_POISONED(s1.b4);
2813   EXPECT_POISONED(s1.b8);
2814 
2815   LongStruct s2 = ReturnLongStruct2();
2816   __msan_print_shadow(&s2, sizeof(s2));
2817   EXPECT_NOT_POISONED(s2.b1);
2818   EXPECT_NOT_POISONED(s2.b2);
2819   EXPECT_NOT_POISONED(s2.b4);
2820   EXPECT_NOT_POISONED(s2.b8);
2821 
2822   EXPECT_POISONED(s2.a1);
2823   EXPECT_POISONED(s2.a2);
2824   EXPECT_POISONED(s2.a4);
2825   EXPECT_POISONED(s2.a8);
2826 }
2827 
TEST(MemorySanitizer,getrlimit)2828 TEST(MemorySanitizer, getrlimit) {
2829   struct rlimit limit;
2830   __msan_poison(&limit, sizeof(limit));
2831   int result = getrlimit(RLIMIT_DATA, &limit);
2832   ASSERT_EQ(result, 0);
2833   EXPECT_NOT_POISONED(limit.rlim_cur);
2834   EXPECT_NOT_POISONED(limit.rlim_max);
2835 
2836   struct rlimit limit2;
2837   __msan_poison(&limit2, sizeof(limit2));
2838   result = prlimit(getpid(), RLIMIT_DATA, &limit, &limit2);
2839   ASSERT_EQ(result, 0);
2840   EXPECT_NOT_POISONED(limit2.rlim_cur);
2841   EXPECT_NOT_POISONED(limit2.rlim_max);
2842 
2843   __msan_poison(&limit, sizeof(limit));
2844   result = prlimit(getpid(), RLIMIT_DATA, nullptr, &limit);
2845   ASSERT_EQ(result, 0);
2846   EXPECT_NOT_POISONED(limit.rlim_cur);
2847   EXPECT_NOT_POISONED(limit.rlim_max);
2848 
2849   result = prlimit(getpid(), RLIMIT_DATA, &limit, nullptr);
2850   ASSERT_EQ(result, 0);
2851 }
2852 
TEST(MemorySanitizer,getrusage)2853 TEST(MemorySanitizer, getrusage) {
2854   struct rusage usage;
2855   __msan_poison(&usage, sizeof(usage));
2856   int result = getrusage(RUSAGE_SELF, &usage);
2857   ASSERT_EQ(result, 0);
2858   EXPECT_NOT_POISONED(usage.ru_utime.tv_sec);
2859   EXPECT_NOT_POISONED(usage.ru_utime.tv_usec);
2860   EXPECT_NOT_POISONED(usage.ru_stime.tv_sec);
2861   EXPECT_NOT_POISONED(usage.ru_stime.tv_usec);
2862   EXPECT_NOT_POISONED(usage.ru_maxrss);
2863   EXPECT_NOT_POISONED(usage.ru_minflt);
2864   EXPECT_NOT_POISONED(usage.ru_majflt);
2865   EXPECT_NOT_POISONED(usage.ru_inblock);
2866   EXPECT_NOT_POISONED(usage.ru_oublock);
2867   EXPECT_NOT_POISONED(usage.ru_nvcsw);
2868   EXPECT_NOT_POISONED(usage.ru_nivcsw);
2869 }
2870 
2871 #if defined(__FreeBSD__)
GetProgramPath(char * buf,size_t sz)2872 static void GetProgramPath(char *buf, size_t sz) {
2873   int mib[4] = { CTL_KERN, KERN_PROC, KERN_PROC_PATHNAME, -1 };
2874   int res = sysctl(mib, 4, buf, &sz, NULL, 0);
2875   ASSERT_EQ(0, res);
2876 }
2877 #elif defined(__GLIBC__)
GetProgramPath(char * buf,size_t sz)2878 static void GetProgramPath(char *buf, size_t sz) {
2879   extern char *program_invocation_name;
2880   int res = snprintf(buf, sz, "%s", program_invocation_name);
2881   ASSERT_GE(res, 0);
2882   ASSERT_LT((size_t)res, sz);
2883 }
2884 #else
2885 # error "TODO: port this"
2886 #endif
2887 
dladdr_testfn()2888 static void dladdr_testfn() {}
2889 
TEST(MemorySanitizer,dladdr)2890 TEST(MemorySanitizer, dladdr) {
2891   Dl_info info;
2892   __msan_poison(&info, sizeof(info));
2893   int result = dladdr((const void*)dladdr_testfn, &info);
2894   ASSERT_NE(result, 0);
2895   EXPECT_NOT_POISONED((unsigned long)info.dli_fname);
2896   if (info.dli_fname)
2897     EXPECT_NOT_POISONED(strlen(info.dli_fname));
2898   EXPECT_NOT_POISONED((unsigned long)info.dli_fbase);
2899   EXPECT_NOT_POISONED((unsigned long)info.dli_sname);
2900   if (info.dli_sname)
2901     EXPECT_NOT_POISONED(strlen(info.dli_sname));
2902   EXPECT_NOT_POISONED((unsigned long)info.dli_saddr);
2903 }
2904 
2905 #ifndef MSAN_TEST_DISABLE_DLOPEN
2906 
dl_phdr_callback(struct dl_phdr_info * info,size_t size,void * data)2907 static int dl_phdr_callback(struct dl_phdr_info *info, size_t size, void *data) {
2908   (*(int *)data)++;
2909   EXPECT_NOT_POISONED(info->dlpi_addr);
2910   EXPECT_NOT_POISONED(strlen(info->dlpi_name));
2911   EXPECT_NOT_POISONED(info->dlpi_phnum);
2912   for (int i = 0; i < info->dlpi_phnum; ++i)
2913     EXPECT_NOT_POISONED(info->dlpi_phdr[i]);
2914   return 0;
2915 }
2916 
2917 // Compute the path to our loadable DSO.  We assume it's in the same
2918 // directory.  Only use string routines that we intercept so far to do this.
GetPathToLoadable(char * buf,size_t sz)2919 static void GetPathToLoadable(char *buf, size_t sz) {
2920   char program_path[kMaxPathLength];
2921   GetProgramPath(program_path, sizeof(program_path));
2922 
2923   const char *last_slash = strrchr(program_path, '/');
2924   ASSERT_NE(nullptr, last_slash);
2925   size_t dir_len = (size_t)(last_slash - program_path);
2926 #if defined(__x86_64__)
2927   static const char basename[] = "libmsan_loadable.x86_64.so";
2928 #elif defined(__MIPSEB__) || defined(MIPSEB)
2929   static const char basename[] = "libmsan_loadable.mips64.so";
2930 #elif defined(__mips64)
2931   static const char basename[] = "libmsan_loadable.mips64el.so";
2932 #elif defined(__aarch64__)
2933   static const char basename[] = "libmsan_loadable.aarch64.so";
2934 #elif defined(__powerpc64__) && __BYTE_ORDER__ == __ORDER_BIG_ENDIAN__
2935   static const char basename[] = "libmsan_loadable.powerpc64.so";
2936 #elif defined(__powerpc64__) && __BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__
2937   static const char basename[] = "libmsan_loadable.powerpc64le.so";
2938 #endif
2939   int res = snprintf(buf, sz, "%.*s/%s",
2940                      (int)dir_len, program_path, basename);
2941   ASSERT_GE(res, 0);
2942   ASSERT_LT((size_t)res, sz);
2943 }
2944 
TEST(MemorySanitizer,dl_iterate_phdr)2945 TEST(MemorySanitizer, dl_iterate_phdr) {
2946   char path[kMaxPathLength];
2947   GetPathToLoadable(path, sizeof(path));
2948 
2949   // Having at least one dlopen'ed library in the process makes this more
2950   // entertaining.
2951   void *lib = dlopen(path, RTLD_LAZY);
2952   ASSERT_NE((void*)0, lib);
2953 
2954   int count = 0;
2955   int result = dl_iterate_phdr(dl_phdr_callback, &count);
2956   ASSERT_GT(count, 0);
2957 
2958   dlclose(lib);
2959 }
2960 
TEST(MemorySanitizer,dlopen)2961 TEST(MemorySanitizer, dlopen) {
2962   char path[kMaxPathLength];
2963   GetPathToLoadable(path, sizeof(path));
2964 
2965   // We need to clear shadow for globals when doing dlopen.  In order to test
2966   // this, we have to poison the shadow for the DSO before we load it.  In
2967   // general this is difficult, but the loader tends to reload things in the
2968   // same place, so we open, close, and then reopen.  The global should always
2969   // start out clean after dlopen.
2970   for (int i = 0; i < 2; i++) {
2971     void *lib = dlopen(path, RTLD_LAZY);
2972     if (lib == NULL) {
2973       printf("dlerror: %s\n", dlerror());
2974       ASSERT_TRUE(lib != NULL);
2975     }
2976     void **(*get_dso_global)() = (void **(*)())dlsym(lib, "get_dso_global");
2977     ASSERT_TRUE(get_dso_global != NULL);
2978     void **dso_global = get_dso_global();
2979     EXPECT_NOT_POISONED(*dso_global);
2980     __msan_poison(dso_global, sizeof(*dso_global));
2981     EXPECT_POISONED(*dso_global);
2982     dlclose(lib);
2983   }
2984 }
2985 
2986 // Regression test for a crash in dlopen() interceptor.
TEST(MemorySanitizer,dlopenFailed)2987 TEST(MemorySanitizer, dlopenFailed) {
2988   const char *path = "/libmsan_loadable_does_not_exist.so";
2989   void *lib = dlopen(path, RTLD_LAZY);
2990   ASSERT_TRUE(lib == NULL);
2991 }
2992 
2993 #endif // MSAN_TEST_DISABLE_DLOPEN
2994 
2995 // There's no sched_getaffinity() on FreeBSD.
2996 #if !defined(__FreeBSD__)
TEST(MemorySanitizer,sched_getaffinity)2997 TEST(MemorySanitizer, sched_getaffinity) {
2998   cpu_set_t mask;
2999   int res = sched_getaffinity(getpid(), sizeof(mask), &mask);
3000   ASSERT_EQ(0, res);
3001   EXPECT_NOT_POISONED(mask);
3002 }
3003 #endif
3004 
TEST(MemorySanitizer,scanf)3005 TEST(MemorySanitizer, scanf) {
3006   const char *input = "42 hello";
3007   int* d = new int;
3008   char* s = new char[7];
3009   int res = sscanf(input, "%d %5s", d, s);
3010   printf("res %d\n", res);
3011   ASSERT_EQ(res, 2);
3012   EXPECT_NOT_POISONED(*d);
3013   EXPECT_NOT_POISONED(s[0]);
3014   EXPECT_NOT_POISONED(s[1]);
3015   EXPECT_NOT_POISONED(s[2]);
3016   EXPECT_NOT_POISONED(s[3]);
3017   EXPECT_NOT_POISONED(s[4]);
3018   EXPECT_NOT_POISONED(s[5]);
3019   EXPECT_POISONED(s[6]);
3020   delete[] s;
3021   delete d;
3022 }
3023 
SimpleThread_threadfn(void * data)3024 static void *SimpleThread_threadfn(void* data) {
3025   return new int;
3026 }
3027 
TEST(MemorySanitizer,SimpleThread)3028 TEST(MemorySanitizer, SimpleThread) {
3029   pthread_t t;
3030   void *p;
3031   int res = pthread_create(&t, NULL, SimpleThread_threadfn, NULL);
3032   ASSERT_EQ(0, res);
3033   EXPECT_NOT_POISONED(t);
3034   res = pthread_join(t, &p);
3035   ASSERT_EQ(0, res);
3036   EXPECT_NOT_POISONED(p);
3037   delete (int*)p;
3038 }
3039 
SmallStackThread_threadfn(void * data)3040 static void *SmallStackThread_threadfn(void* data) {
3041   return 0;
3042 }
3043 
3044 #ifdef PTHREAD_STACK_MIN
3045 # define SMALLSTACKSIZE    PTHREAD_STACK_MIN
3046 # define SMALLPRESTACKSIZE PTHREAD_STACK_MIN
3047 #else
3048 # define SMALLSTACKSIZE    64 * 1024
3049 # define SMALLPRESTACKSIZE 16 * 1024
3050 #endif
3051 
TEST(MemorySanitizer,SmallStackThread)3052 TEST(MemorySanitizer, SmallStackThread) {
3053   pthread_attr_t attr;
3054   pthread_t t;
3055   void *p;
3056   int res;
3057   res = pthread_attr_init(&attr);
3058   ASSERT_EQ(0, res);
3059   res = pthread_attr_setstacksize(&attr, SMALLSTACKSIZE);
3060   ASSERT_EQ(0, res);
3061   res = pthread_create(&t, &attr, SmallStackThread_threadfn, NULL);
3062   ASSERT_EQ(0, res);
3063   res = pthread_join(t, &p);
3064   ASSERT_EQ(0, res);
3065   res = pthread_attr_destroy(&attr);
3066   ASSERT_EQ(0, res);
3067 }
3068 
TEST(MemorySanitizer,SmallPreAllocatedStackThread)3069 TEST(MemorySanitizer, SmallPreAllocatedStackThread) {
3070   pthread_attr_t attr;
3071   pthread_t t;
3072   int res;
3073   res = pthread_attr_init(&attr);
3074   ASSERT_EQ(0, res);
3075   void *stack;
3076   const size_t kStackSize = SMALLPRESTACKSIZE;
3077   res = posix_memalign(&stack, 4096, kStackSize);
3078   ASSERT_EQ(0, res);
3079   res = pthread_attr_setstack(&attr, stack, kStackSize);
3080   ASSERT_EQ(0, res);
3081   res = pthread_create(&t, &attr, SmallStackThread_threadfn, NULL);
3082   EXPECT_EQ(0, res);
3083   res = pthread_join(t, NULL);
3084   ASSERT_EQ(0, res);
3085   res = pthread_attr_destroy(&attr);
3086   ASSERT_EQ(0, res);
3087 }
3088 
TEST(MemorySanitizer,pthread_attr_get)3089 TEST(MemorySanitizer, pthread_attr_get) {
3090   pthread_attr_t attr;
3091   int res;
3092   res = pthread_attr_init(&attr);
3093   ASSERT_EQ(0, res);
3094   {
3095     int v;
3096     res = pthread_attr_getdetachstate(&attr, &v);
3097     ASSERT_EQ(0, res);
3098     EXPECT_NOT_POISONED(v);
3099   }
3100   {
3101     size_t v;
3102     res = pthread_attr_getguardsize(&attr, &v);
3103     ASSERT_EQ(0, res);
3104     EXPECT_NOT_POISONED(v);
3105   }
3106   {
3107     struct sched_param v;
3108     res = pthread_attr_getschedparam(&attr, &v);
3109     ASSERT_EQ(0, res);
3110     EXPECT_NOT_POISONED(v);
3111   }
3112   {
3113     int v;
3114     res = pthread_attr_getschedpolicy(&attr, &v);
3115     ASSERT_EQ(0, res);
3116     EXPECT_NOT_POISONED(v);
3117   }
3118   {
3119     int v;
3120     res = pthread_attr_getinheritsched(&attr, &v);
3121     ASSERT_EQ(0, res);
3122     EXPECT_NOT_POISONED(v);
3123   }
3124   {
3125     int v;
3126     res = pthread_attr_getscope(&attr, &v);
3127     ASSERT_EQ(0, res);
3128     EXPECT_NOT_POISONED(v);
3129   }
3130   {
3131     size_t v;
3132     res = pthread_attr_getstacksize(&attr, &v);
3133     ASSERT_EQ(0, res);
3134     EXPECT_NOT_POISONED(v);
3135   }
3136   {
3137     void *v;
3138     size_t w;
3139     res = pthread_attr_getstack(&attr, &v, &w);
3140     ASSERT_EQ(0, res);
3141     EXPECT_NOT_POISONED(v);
3142     EXPECT_NOT_POISONED(w);
3143   }
3144   {
3145     cpu_set_t v;
3146     res = pthread_attr_getaffinity_np(&attr, sizeof(v), &v);
3147     ASSERT_EQ(0, res);
3148     EXPECT_NOT_POISONED(v);
3149   }
3150   res = pthread_attr_destroy(&attr);
3151   ASSERT_EQ(0, res);
3152 }
3153 
TEST(MemorySanitizer,pthread_getschedparam)3154 TEST(MemorySanitizer, pthread_getschedparam) {
3155   int policy;
3156   struct sched_param param;
3157   int res = pthread_getschedparam(pthread_self(), &policy, &param);
3158   ASSERT_EQ(0, res);
3159   EXPECT_NOT_POISONED(policy);
3160   EXPECT_NOT_POISONED(param.sched_priority);
3161 }
3162 
TEST(MemorySanitizer,pthread_key_create)3163 TEST(MemorySanitizer, pthread_key_create) {
3164   pthread_key_t key;
3165   int res = pthread_key_create(&key, NULL);
3166   ASSERT_EQ(0, res);
3167   EXPECT_NOT_POISONED(key);
3168   res = pthread_key_delete(key);
3169   ASSERT_EQ(0, res);
3170 }
3171 
3172 namespace {
3173 struct SignalCondArg {
3174   pthread_cond_t* cond;
3175   pthread_mutex_t* mu;
3176   bool broadcast;
3177 };
3178 
SignalCond(void * param)3179 void *SignalCond(void *param) {
3180   SignalCondArg *arg = reinterpret_cast<SignalCondArg *>(param);
3181   pthread_mutex_lock(arg->mu);
3182   if (arg->broadcast)
3183     pthread_cond_broadcast(arg->cond);
3184   else
3185     pthread_cond_signal(arg->cond);
3186   pthread_mutex_unlock(arg->mu);
3187   return 0;
3188 }
3189 }  // namespace
3190 
TEST(MemorySanitizer,pthread_cond_wait)3191 TEST(MemorySanitizer, pthread_cond_wait) {
3192   pthread_cond_t cond;
3193   pthread_mutex_t mu;
3194   SignalCondArg args = {&cond, &mu, false};
3195   pthread_cond_init(&cond, 0);
3196   pthread_mutex_init(&mu, 0);
3197   pthread_mutex_lock(&mu);
3198 
3199   // signal
3200   pthread_t thr;
3201   pthread_create(&thr, 0, SignalCond, &args);
3202   int res = pthread_cond_wait(&cond, &mu);
3203   ASSERT_EQ(0, res);
3204   pthread_join(thr, 0);
3205 
3206   // broadcast
3207   args.broadcast = true;
3208   pthread_create(&thr, 0, SignalCond, &args);
3209   res = pthread_cond_wait(&cond, &mu);
3210   ASSERT_EQ(0, res);
3211   pthread_join(thr, 0);
3212 
3213   pthread_mutex_unlock(&mu);
3214   pthread_mutex_destroy(&mu);
3215   pthread_cond_destroy(&cond);
3216 }
3217 
TEST(MemorySanitizer,tmpnam)3218 TEST(MemorySanitizer, tmpnam) {
3219   char s[L_tmpnam];
3220   char *res = tmpnam(s);
3221   ASSERT_EQ(s, res);
3222   EXPECT_NOT_POISONED(strlen(res));
3223 }
3224 
TEST(MemorySanitizer,tempnam)3225 TEST(MemorySanitizer, tempnam) {
3226   char *res = tempnam(NULL, "zzz");
3227   EXPECT_NOT_POISONED(strlen(res));
3228   free(res);
3229 }
3230 
TEST(MemorySanitizer,posix_memalign)3231 TEST(MemorySanitizer, posix_memalign) {
3232   void *p;
3233   EXPECT_POISONED(p);
3234   int res = posix_memalign(&p, 4096, 13);
3235   ASSERT_EQ(0, res);
3236   EXPECT_NOT_POISONED(p);
3237   EXPECT_EQ(0U, (uintptr_t)p % 4096);
3238   free(p);
3239 }
3240 
3241 // There's no memalign() on FreeBSD.
3242 #if !defined(__FreeBSD__)
TEST(MemorySanitizer,memalign)3243 TEST(MemorySanitizer, memalign) {
3244   void *p = memalign(4096, 13);
3245   EXPECT_EQ(0U, (uintptr_t)p % 4096);
3246   free(p);
3247 }
3248 #endif
3249 
TEST(MemorySanitizer,valloc)3250 TEST(MemorySanitizer, valloc) {
3251   void *a = valloc(100);
3252   uintptr_t PageSize = GetPageSize();
3253   EXPECT_EQ(0U, (uintptr_t)a % PageSize);
3254   free(a);
3255 }
3256 
3257 // There's no pvalloc() on FreeBSD.
3258 #if !defined(__FreeBSD__)
TEST(MemorySanitizer,pvalloc)3259 TEST(MemorySanitizer, pvalloc) {
3260   uintptr_t PageSize = GetPageSize();
3261   void *p = pvalloc(PageSize + 100);
3262   EXPECT_EQ(0U, (uintptr_t)p % PageSize);
3263   EXPECT_EQ(2 * PageSize, __sanitizer_get_allocated_size(p));
3264   free(p);
3265 
3266   p = pvalloc(0);  // pvalloc(0) should allocate at least one page.
3267   EXPECT_EQ(0U, (uintptr_t)p % PageSize);
3268   EXPECT_EQ(PageSize, __sanitizer_get_allocated_size(p));
3269   free(p);
3270 }
3271 #endif
3272 
TEST(MemorySanitizer,inet_pton)3273 TEST(MemorySanitizer, inet_pton) {
3274   const char *s = "1:0:0:0:0:0:0:8";
3275   unsigned char buf[sizeof(struct in6_addr)];
3276   int res = inet_pton(AF_INET6, s, buf);
3277   ASSERT_EQ(1, res);
3278   EXPECT_NOT_POISONED(buf[0]);
3279   EXPECT_NOT_POISONED(buf[sizeof(struct in6_addr) - 1]);
3280 
3281   char s_out[INET6_ADDRSTRLEN];
3282   EXPECT_POISONED(s_out[3]);
3283   const char *q = inet_ntop(AF_INET6, buf, s_out, INET6_ADDRSTRLEN);
3284   ASSERT_NE((void*)0, q);
3285   EXPECT_NOT_POISONED(s_out[3]);
3286 }
3287 
TEST(MemorySanitizer,inet_aton)3288 TEST(MemorySanitizer, inet_aton) {
3289   const char *s = "127.0.0.1";
3290   struct in_addr in[2];
3291   int res = inet_aton(s, in);
3292   ASSERT_NE(0, res);
3293   EXPECT_NOT_POISONED(in[0]);
3294   EXPECT_POISONED(*(char *)(in + 1));
3295 }
3296 
TEST(MemorySanitizer,uname)3297 TEST(MemorySanitizer, uname) {
3298   struct utsname u;
3299   int res = uname(&u);
3300   ASSERT_EQ(0, res);
3301   EXPECT_NOT_POISONED(strlen(u.sysname));
3302   EXPECT_NOT_POISONED(strlen(u.nodename));
3303   EXPECT_NOT_POISONED(strlen(u.release));
3304   EXPECT_NOT_POISONED(strlen(u.version));
3305   EXPECT_NOT_POISONED(strlen(u.machine));
3306 }
3307 
TEST(MemorySanitizer,gethostname)3308 TEST(MemorySanitizer, gethostname) {
3309   char buf[100];
3310   int res = gethostname(buf, 100);
3311   ASSERT_EQ(0, res);
3312   EXPECT_NOT_POISONED(strlen(buf));
3313 }
3314 
3315 // There's no sysinfo() on FreeBSD.
3316 #if !defined(__FreeBSD__)
TEST(MemorySanitizer,sysinfo)3317 TEST(MemorySanitizer, sysinfo) {
3318   struct sysinfo info;
3319   int res = sysinfo(&info);
3320   ASSERT_EQ(0, res);
3321   EXPECT_NOT_POISONED(info);
3322 }
3323 #endif
3324 
TEST(MemorySanitizer,getpwuid)3325 TEST(MemorySanitizer, getpwuid) {
3326   struct passwd *p = getpwuid(0); // root
3327   ASSERT_TRUE(p != NULL);
3328   EXPECT_NOT_POISONED(p->pw_name);
3329   ASSERT_TRUE(p->pw_name != NULL);
3330   EXPECT_NOT_POISONED(p->pw_name[0]);
3331   EXPECT_NOT_POISONED(p->pw_uid);
3332   ASSERT_EQ(0U, p->pw_uid);
3333 }
3334 
TEST(MemorySanitizer,getpwuid_r)3335 TEST(MemorySanitizer, getpwuid_r) {
3336   struct passwd pwd;
3337   struct passwd *pwdres;
3338   char buf[10000];
3339   int res = getpwuid_r(0, &pwd, buf, sizeof(buf), &pwdres);
3340   ASSERT_EQ(0, res);
3341   EXPECT_NOT_POISONED(pwd.pw_name);
3342   ASSERT_TRUE(pwd.pw_name != NULL);
3343   EXPECT_NOT_POISONED(pwd.pw_name[0]);
3344   EXPECT_NOT_POISONED(pwd.pw_uid);
3345   ASSERT_EQ(0U, pwd.pw_uid);
3346   EXPECT_NOT_POISONED(pwdres);
3347 }
3348 
TEST(MemorySanitizer,getpwnam_r)3349 TEST(MemorySanitizer, getpwnam_r) {
3350   struct passwd pwd;
3351   struct passwd *pwdres;
3352   char buf[10000];
3353   int res = getpwnam_r("root", &pwd, buf, sizeof(buf), &pwdres);
3354   ASSERT_EQ(0, res);
3355   EXPECT_NOT_POISONED(pwd.pw_name);
3356   ASSERT_TRUE(pwd.pw_name != NULL);
3357   EXPECT_NOT_POISONED(pwd.pw_name[0]);
3358   EXPECT_NOT_POISONED(pwd.pw_uid);
3359   ASSERT_EQ(0U, pwd.pw_uid);
3360   EXPECT_NOT_POISONED(pwdres);
3361 }
3362 
TEST(MemorySanitizer,getpwnam_r_positive)3363 TEST(MemorySanitizer, getpwnam_r_positive) {
3364   struct passwd pwd;
3365   struct passwd *pwdres;
3366   char s[5];
3367   strncpy(s, "abcd", 5);
3368   __msan_poison(s, 5);
3369   char buf[10000];
3370   int res;
3371   EXPECT_UMR(res = getpwnam_r(s, &pwd, buf, sizeof(buf), &pwdres));
3372 }
3373 
TEST(MemorySanitizer,getgrnam_r)3374 TEST(MemorySanitizer, getgrnam_r) {
3375   struct group grp;
3376   struct group *grpres;
3377   char buf[10000];
3378   int res = getgrnam_r(SUPERUSER_GROUP, &grp, buf, sizeof(buf), &grpres);
3379   ASSERT_EQ(0, res);
3380   // Note that getgrnam_r() returns 0 if the matching group is not found.
3381   ASSERT_NE(nullptr, grpres);
3382   EXPECT_NOT_POISONED(grp.gr_name);
3383   ASSERT_TRUE(grp.gr_name != NULL);
3384   EXPECT_NOT_POISONED(grp.gr_name[0]);
3385   EXPECT_NOT_POISONED(grp.gr_gid);
3386   EXPECT_NOT_POISONED(grpres);
3387 }
3388 
TEST(MemorySanitizer,getpwent)3389 TEST(MemorySanitizer, getpwent) {
3390   setpwent();
3391   struct passwd *p = getpwent();
3392   ASSERT_TRUE(p != NULL);
3393   EXPECT_NOT_POISONED(p->pw_name);
3394   ASSERT_TRUE(p->pw_name != NULL);
3395   EXPECT_NOT_POISONED(p->pw_name[0]);
3396   EXPECT_NOT_POISONED(p->pw_uid);
3397 }
3398 
TEST(MemorySanitizer,getpwent_r)3399 TEST(MemorySanitizer, getpwent_r) {
3400   struct passwd pwd;
3401   struct passwd *pwdres;
3402   char buf[10000];
3403   setpwent();
3404   int res = getpwent_r(&pwd, buf, sizeof(buf), &pwdres);
3405   ASSERT_EQ(0, res);
3406   EXPECT_NOT_POISONED(pwd.pw_name);
3407   ASSERT_TRUE(pwd.pw_name != NULL);
3408   EXPECT_NOT_POISONED(pwd.pw_name[0]);
3409   EXPECT_NOT_POISONED(pwd.pw_uid);
3410   EXPECT_NOT_POISONED(pwdres);
3411 }
3412 
3413 // There's no fgetpwent() on FreeBSD.
3414 #if !defined(__FreeBSD__)
TEST(MemorySanitizer,fgetpwent)3415 TEST(MemorySanitizer, fgetpwent) {
3416   FILE *fp = fopen("/etc/passwd", "r");
3417   struct passwd *p = fgetpwent(fp);
3418   ASSERT_TRUE(p != NULL);
3419   EXPECT_NOT_POISONED(p->pw_name);
3420   ASSERT_TRUE(p->pw_name != NULL);
3421   EXPECT_NOT_POISONED(p->pw_name[0]);
3422   EXPECT_NOT_POISONED(p->pw_uid);
3423   fclose(fp);
3424 }
3425 #endif
3426 
TEST(MemorySanitizer,getgrent)3427 TEST(MemorySanitizer, getgrent) {
3428   setgrent();
3429   struct group *p = getgrent();
3430   ASSERT_TRUE(p != NULL);
3431   EXPECT_NOT_POISONED(p->gr_name);
3432   ASSERT_TRUE(p->gr_name != NULL);
3433   EXPECT_NOT_POISONED(p->gr_name[0]);
3434   EXPECT_NOT_POISONED(p->gr_gid);
3435 }
3436 
3437 // There's no fgetgrent() on FreeBSD.
3438 #if !defined(__FreeBSD__)
TEST(MemorySanitizer,fgetgrent)3439 TEST(MemorySanitizer, fgetgrent) {
3440   FILE *fp = fopen("/etc/group", "r");
3441   struct group *grp = fgetgrent(fp);
3442   ASSERT_TRUE(grp != NULL);
3443   EXPECT_NOT_POISONED(grp->gr_name);
3444   ASSERT_TRUE(grp->gr_name != NULL);
3445   EXPECT_NOT_POISONED(grp->gr_name[0]);
3446   EXPECT_NOT_POISONED(grp->gr_gid);
3447   for (char **p = grp->gr_mem; *p; ++p) {
3448     EXPECT_NOT_POISONED((*p)[0]);
3449     EXPECT_TRUE(strlen(*p) > 0);
3450   }
3451   fclose(fp);
3452 }
3453 #endif
3454 
TEST(MemorySanitizer,getgrent_r)3455 TEST(MemorySanitizer, getgrent_r) {
3456   struct group grp;
3457   struct group *grpres;
3458   char buf[10000];
3459   setgrent();
3460   int res = getgrent_r(&grp, buf, sizeof(buf), &grpres);
3461   ASSERT_EQ(0, res);
3462   EXPECT_NOT_POISONED(grp.gr_name);
3463   ASSERT_TRUE(grp.gr_name != NULL);
3464   EXPECT_NOT_POISONED(grp.gr_name[0]);
3465   EXPECT_NOT_POISONED(grp.gr_gid);
3466   EXPECT_NOT_POISONED(grpres);
3467 }
3468 
3469 // There's no fgetgrent_r() on FreeBSD.
3470 #if !defined(__FreeBSD__)
TEST(MemorySanitizer,fgetgrent_r)3471 TEST(MemorySanitizer, fgetgrent_r) {
3472   FILE *fp = fopen("/etc/group", "r");
3473   struct group grp;
3474   struct group *grpres;
3475   char buf[10000];
3476   setgrent();
3477   int res = fgetgrent_r(fp, &grp, buf, sizeof(buf), &grpres);
3478   ASSERT_EQ(0, res);
3479   EXPECT_NOT_POISONED(grp.gr_name);
3480   ASSERT_TRUE(grp.gr_name != NULL);
3481   EXPECT_NOT_POISONED(grp.gr_name[0]);
3482   EXPECT_NOT_POISONED(grp.gr_gid);
3483   EXPECT_NOT_POISONED(grpres);
3484   fclose(fp);
3485 }
3486 #endif
3487 
TEST(MemorySanitizer,getgroups)3488 TEST(MemorySanitizer, getgroups) {
3489   int n = getgroups(0, 0);
3490   gid_t *gids = new gid_t[n];
3491   int res = getgroups(n, gids);
3492   ASSERT_EQ(n, res);
3493   for (int i = 0; i < n; ++i)
3494     EXPECT_NOT_POISONED(gids[i]);
3495 }
3496 
TEST(MemorySanitizer,wordexp)3497 TEST(MemorySanitizer, wordexp) {
3498   wordexp_t w;
3499   int res = wordexp("a b c", &w, 0);
3500   ASSERT_EQ(0, res);
3501   ASSERT_EQ(3U, w.we_wordc);
3502   ASSERT_STREQ("a", w.we_wordv[0]);
3503   ASSERT_STREQ("b", w.we_wordv[1]);
3504   ASSERT_STREQ("c", w.we_wordv[2]);
3505 }
3506 
3507 template<class T>
applySlt(T value,T shadow)3508 static bool applySlt(T value, T shadow) {
3509   __msan_partial_poison(&value, &shadow, sizeof(T));
3510   volatile bool zzz = true;
3511   // This "|| zzz" trick somehow makes LLVM emit "icmp slt" instead of
3512   // a shift-and-trunc to get at the highest bit.
3513   volatile bool v = value < 0 || zzz;
3514   return v;
3515 }
3516 
TEST(MemorySanitizer,SignedCompareWithZero)3517 TEST(MemorySanitizer, SignedCompareWithZero) {
3518   EXPECT_NOT_POISONED(applySlt<S4>(0xF, 0xF));
3519   EXPECT_NOT_POISONED(applySlt<S4>(0xF, 0xFF));
3520   EXPECT_NOT_POISONED(applySlt<S4>(0xF, 0xFFFFFF));
3521   EXPECT_NOT_POISONED(applySlt<S4>(0xF, 0x7FFFFFF));
3522   EXPECT_UMR(applySlt<S4>(0xF, 0x80FFFFFF));
3523   EXPECT_UMR(applySlt<S4>(0xF, 0xFFFFFFFF));
3524 }
3525 
3526 template <class T, class S>
poisoned(T Va,S Sa)3527 static T poisoned(T Va, S Sa) {
3528   char SIZE_CHECK1[(ssize_t)sizeof(T) - (ssize_t)sizeof(S)];
3529   char SIZE_CHECK2[(ssize_t)sizeof(S) - (ssize_t)sizeof(T)];
3530   T a;
3531   a = Va;
3532   __msan_partial_poison(&a, &Sa, sizeof(T));
3533   return a;
3534 }
3535 
TEST(MemorySanitizer,ICmpRelational)3536 TEST(MemorySanitizer, ICmpRelational) {
3537   EXPECT_NOT_POISONED(poisoned(0, 0) < poisoned(0, 0));
3538   EXPECT_NOT_POISONED(poisoned(0U, 0) < poisoned(0U, 0));
3539   EXPECT_NOT_POISONED(poisoned(0LL, 0LLU) < poisoned(0LL, 0LLU));
3540   EXPECT_NOT_POISONED(poisoned(0LLU, 0LLU) < poisoned(0LLU, 0LLU));
3541   EXPECT_POISONED(poisoned(0xFF, 0xFF) < poisoned(0xFF, 0xFF));
3542   EXPECT_POISONED(poisoned(0xFFFFFFFFU, 0xFFFFFFFFU) <
3543                   poisoned(0xFFFFFFFFU, 0xFFFFFFFFU));
3544   EXPECT_POISONED(poisoned(-1, 0xFFFFFFFFU) <
3545                   poisoned(-1, 0xFFFFFFFFU));
3546 
3547   EXPECT_NOT_POISONED(poisoned(0, 0) <= poisoned(0, 0));
3548   EXPECT_NOT_POISONED(poisoned(0U, 0) <= poisoned(0U, 0));
3549   EXPECT_NOT_POISONED(poisoned(0LL, 0LLU) <= poisoned(0LL, 0LLU));
3550   EXPECT_NOT_POISONED(poisoned(0LLU, 0LLU) <= poisoned(0LLU, 0LLU));
3551   EXPECT_POISONED(poisoned(0xFF, 0xFF) <= poisoned(0xFF, 0xFF));
3552   EXPECT_POISONED(poisoned(0xFFFFFFFFU, 0xFFFFFFFFU) <=
3553                   poisoned(0xFFFFFFFFU, 0xFFFFFFFFU));
3554   EXPECT_POISONED(poisoned(-1, 0xFFFFFFFFU) <=
3555                   poisoned(-1, 0xFFFFFFFFU));
3556 
3557   EXPECT_NOT_POISONED(poisoned(0, 0) > poisoned(0, 0));
3558   EXPECT_NOT_POISONED(poisoned(0U, 0) > poisoned(0U, 0));
3559   EXPECT_NOT_POISONED(poisoned(0LL, 0LLU) > poisoned(0LL, 0LLU));
3560   EXPECT_NOT_POISONED(poisoned(0LLU, 0LLU) > poisoned(0LLU, 0LLU));
3561   EXPECT_POISONED(poisoned(0xFF, 0xFF) > poisoned(0xFF, 0xFF));
3562   EXPECT_POISONED(poisoned(0xFFFFFFFFU, 0xFFFFFFFFU) >
3563                   poisoned(0xFFFFFFFFU, 0xFFFFFFFFU));
3564   EXPECT_POISONED(poisoned(-1, 0xFFFFFFFFU) >
3565                   poisoned(-1, 0xFFFFFFFFU));
3566 
3567   EXPECT_NOT_POISONED(poisoned(0, 0) >= poisoned(0, 0));
3568   EXPECT_NOT_POISONED(poisoned(0U, 0) >= poisoned(0U, 0));
3569   EXPECT_NOT_POISONED(poisoned(0LL, 0LLU) >= poisoned(0LL, 0LLU));
3570   EXPECT_NOT_POISONED(poisoned(0LLU, 0LLU) >= poisoned(0LLU, 0LLU));
3571   EXPECT_POISONED(poisoned(0xFF, 0xFF) >= poisoned(0xFF, 0xFF));
3572   EXPECT_POISONED(poisoned(0xFFFFFFFFU, 0xFFFFFFFFU) >=
3573                   poisoned(0xFFFFFFFFU, 0xFFFFFFFFU));
3574   EXPECT_POISONED(poisoned(-1, 0xFFFFFFFFU) >=
3575                   poisoned(-1, 0xFFFFFFFFU));
3576 
3577   EXPECT_POISONED(poisoned(6, 0xF) > poisoned(7, 0));
3578   EXPECT_POISONED(poisoned(0xF, 0xF) > poisoned(7, 0));
3579 
3580   EXPECT_NOT_POISONED(poisoned(-1, 0x80000000U) >= poisoned(-1, 0U));
3581 }
3582 
3583 #if MSAN_HAS_M128
TEST(MemorySanitizer,ICmpVectorRelational)3584 TEST(MemorySanitizer, ICmpVectorRelational) {
3585   EXPECT_NOT_POISONED(
3586       _mm_cmplt_epi16(poisoned(_mm_set1_epi16(0), _mm_set1_epi16(0)),
3587                    poisoned(_mm_set1_epi16(0), _mm_set1_epi16(0))));
3588   EXPECT_NOT_POISONED(
3589       _mm_cmplt_epi16(poisoned(_mm_set1_epi32(0), _mm_set1_epi32(0)),
3590                    poisoned(_mm_set1_epi32(0), _mm_set1_epi32(0))));
3591   EXPECT_POISONED(
3592       _mm_cmplt_epi16(poisoned(_mm_set1_epi16(0), _mm_set1_epi16(0xFFFF)),
3593                    poisoned(_mm_set1_epi16(0), _mm_set1_epi16(0xFFFF))));
3594   EXPECT_POISONED(_mm_cmpgt_epi16(poisoned(_mm_set1_epi16(6), _mm_set1_epi16(0xF)),
3595                                poisoned(_mm_set1_epi16(7), _mm_set1_epi16(0))));
3596 }
3597 #endif
3598 
3599 // Volatile bitfield store is implemented as load-mask-store
3600 // Test that we don't warn on the store of (uninitialized) padding.
3601 struct VolatileBitfieldStruct {
3602   volatile unsigned x : 1;
3603   unsigned y : 1;
3604 };
3605 
TEST(MemorySanitizer,VolatileBitfield)3606 TEST(MemorySanitizer, VolatileBitfield) {
3607   VolatileBitfieldStruct *S = new VolatileBitfieldStruct;
3608   S->x = 1;
3609   EXPECT_NOT_POISONED((unsigned)S->x);
3610   EXPECT_POISONED((unsigned)S->y);
3611 }
3612 
TEST(MemorySanitizer,UnalignedLoad)3613 TEST(MemorySanitizer, UnalignedLoad) {
3614   char x[32] __attribute__((aligned(8)));
3615   U4 origin = __LINE__;
3616   for (unsigned i = 0; i < sizeof(x) / 4; ++i)
3617     __msan_set_origin(x + 4 * i, 4, origin + i);
3618 
3619   memset(x + 8, 0, 16);
3620   EXPECT_POISONED_O(__sanitizer_unaligned_load16(x + 6), origin + 1);
3621   EXPECT_POISONED_O(__sanitizer_unaligned_load16(x + 7), origin + 1);
3622   EXPECT_NOT_POISONED(__sanitizer_unaligned_load16(x + 8));
3623   EXPECT_NOT_POISONED(__sanitizer_unaligned_load16(x + 9));
3624   EXPECT_NOT_POISONED(__sanitizer_unaligned_load16(x + 22));
3625   EXPECT_POISONED_O(__sanitizer_unaligned_load16(x + 23), origin + 6);
3626   EXPECT_POISONED_O(__sanitizer_unaligned_load16(x + 24), origin + 6);
3627 
3628   EXPECT_POISONED_O(__sanitizer_unaligned_load32(x + 4), origin + 1);
3629   EXPECT_POISONED_O(__sanitizer_unaligned_load32(x + 7), origin + 1);
3630   EXPECT_NOT_POISONED(__sanitizer_unaligned_load32(x + 8));
3631   EXPECT_NOT_POISONED(__sanitizer_unaligned_load32(x + 9));
3632   EXPECT_NOT_POISONED(__sanitizer_unaligned_load32(x + 20));
3633   EXPECT_POISONED_O(__sanitizer_unaligned_load32(x + 21), origin + 6);
3634   EXPECT_POISONED_O(__sanitizer_unaligned_load32(x + 24), origin + 6);
3635 
3636   EXPECT_POISONED_O(__sanitizer_unaligned_load64(x), origin);
3637   EXPECT_POISONED_O(__sanitizer_unaligned_load64(x + 1), origin);
3638   EXPECT_POISONED_O(__sanitizer_unaligned_load64(x + 7), origin + 1);
3639   EXPECT_NOT_POISONED(__sanitizer_unaligned_load64(x + 8));
3640   EXPECT_NOT_POISONED(__sanitizer_unaligned_load64(x + 9));
3641   EXPECT_NOT_POISONED(__sanitizer_unaligned_load64(x + 16));
3642   EXPECT_POISONED_O(__sanitizer_unaligned_load64(x + 17), origin + 6);
3643   EXPECT_POISONED_O(__sanitizer_unaligned_load64(x + 21), origin + 6);
3644   EXPECT_POISONED_O(__sanitizer_unaligned_load64(x + 24), origin + 6);
3645 }
3646 
TEST(MemorySanitizer,UnalignedStore16)3647 TEST(MemorySanitizer, UnalignedStore16) {
3648   char x[5] __attribute__((aligned(4)));
3649   U2 y2 = 0;
3650   U4 origin = __LINE__;
3651   __msan_poison(&y2, 1);
3652   __msan_set_origin(&y2, 1, origin);
3653 
3654   __sanitizer_unaligned_store16(x + 1, y2);
3655   EXPECT_POISONED_O(x[0], origin);
3656   EXPECT_POISONED_O(x[1], origin);
3657   EXPECT_NOT_POISONED(x[2]);
3658   EXPECT_POISONED_O(x[3], origin);
3659 }
3660 
TEST(MemorySanitizer,UnalignedStore32)3661 TEST(MemorySanitizer, UnalignedStore32) {
3662   char x[8] __attribute__((aligned(4)));
3663   U4 y4 = 0;
3664   U4 origin = __LINE__;
3665   __msan_poison(&y4, 2);
3666   __msan_set_origin(&y4, 2, origin);
3667 
3668   __sanitizer_unaligned_store32(x + 3, y4);
3669   EXPECT_POISONED_O(x[0], origin);
3670   EXPECT_POISONED_O(x[1], origin);
3671   EXPECT_POISONED_O(x[2], origin);
3672   EXPECT_POISONED_O(x[3], origin);
3673   EXPECT_POISONED_O(x[4], origin);
3674   EXPECT_NOT_POISONED(x[5]);
3675   EXPECT_NOT_POISONED(x[6]);
3676   EXPECT_POISONED_O(x[7], origin);
3677 }
3678 
TEST(MemorySanitizer,UnalignedStore64)3679 TEST(MemorySanitizer, UnalignedStore64) {
3680   char x[16] __attribute__((aligned(8)));
3681   U8 y8 = 0;
3682   U4 origin = __LINE__;
3683   __msan_poison(&y8, 3);
3684   __msan_poison(((char *)&y8) + sizeof(y8) - 2, 1);
3685   __msan_set_origin(&y8, 8, origin);
3686 
3687   __sanitizer_unaligned_store64(x + 3, y8);
3688   EXPECT_POISONED_O(x[0], origin);
3689   EXPECT_POISONED_O(x[1], origin);
3690   EXPECT_POISONED_O(x[2], origin);
3691   EXPECT_POISONED_O(x[3], origin);
3692   EXPECT_POISONED_O(x[4], origin);
3693   EXPECT_POISONED_O(x[5], origin);
3694   EXPECT_NOT_POISONED(x[6]);
3695   EXPECT_NOT_POISONED(x[7]);
3696   EXPECT_NOT_POISONED(x[8]);
3697   EXPECT_POISONED_O(x[9], origin);
3698   EXPECT_NOT_POISONED(x[10]);
3699   EXPECT_POISONED_O(x[11], origin);
3700 }
3701 
TEST(MemorySanitizer,UnalignedStore16_precise)3702 TEST(MemorySanitizer, UnalignedStore16_precise) {
3703   char x[8] __attribute__((aligned(4)));
3704   U2 y = 0;
3705   U4 originx1 = __LINE__;
3706   U4 originx2 = __LINE__;
3707   U4 originy = __LINE__;
3708   __msan_poison(x, sizeof(x));
3709   __msan_set_origin(x, 4, originx1);
3710   __msan_set_origin(x + 4, 4, originx2);
3711   __msan_poison(((char *)&y) + 1, 1);
3712   __msan_set_origin(&y, sizeof(y), originy);
3713 
3714   __sanitizer_unaligned_store16(x + 3, y);
3715   EXPECT_POISONED_O(x[0], originx1);
3716   EXPECT_POISONED_O(x[1], originx1);
3717   EXPECT_POISONED_O(x[2], originx1);
3718   EXPECT_NOT_POISONED(x[3]);
3719   EXPECT_POISONED_O(x[4], originy);
3720   EXPECT_POISONED_O(x[5], originy);
3721   EXPECT_POISONED_O(x[6], originy);
3722   EXPECT_POISONED_O(x[7], originy);
3723 }
3724 
TEST(MemorySanitizer,UnalignedStore16_precise2)3725 TEST(MemorySanitizer, UnalignedStore16_precise2) {
3726   char x[8] __attribute__((aligned(4)));
3727   U2 y = 0;
3728   U4 originx1 = __LINE__;
3729   U4 originx2 = __LINE__;
3730   U4 originy = __LINE__;
3731   __msan_poison(x, sizeof(x));
3732   __msan_set_origin(x, 4, originx1);
3733   __msan_set_origin(x + 4, 4, originx2);
3734   __msan_poison(((char *)&y), 1);
3735   __msan_set_origin(&y, sizeof(y), originy);
3736 
3737   __sanitizer_unaligned_store16(x + 3, y);
3738   EXPECT_POISONED_O(x[0], originy);
3739   EXPECT_POISONED_O(x[1], originy);
3740   EXPECT_POISONED_O(x[2], originy);
3741   EXPECT_POISONED_O(x[3], originy);
3742   EXPECT_NOT_POISONED(x[4]);
3743   EXPECT_POISONED_O(x[5], originx2);
3744   EXPECT_POISONED_O(x[6], originx2);
3745   EXPECT_POISONED_O(x[7], originx2);
3746 }
3747 
TEST(MemorySanitizer,UnalignedStore64_precise)3748 TEST(MemorySanitizer, UnalignedStore64_precise) {
3749   char x[12] __attribute__((aligned(8)));
3750   U8 y = 0;
3751   U4 originx1 = __LINE__;
3752   U4 originx2 = __LINE__;
3753   U4 originx3 = __LINE__;
3754   U4 originy = __LINE__;
3755   __msan_poison(x, sizeof(x));
3756   __msan_set_origin(x, 4, originx1);
3757   __msan_set_origin(x + 4, 4, originx2);
3758   __msan_set_origin(x + 8, 4, originx3);
3759   __msan_poison(((char *)&y) + 1, 1);
3760   __msan_poison(((char *)&y) + 7, 1);
3761   __msan_set_origin(&y, sizeof(y), originy);
3762 
3763   __sanitizer_unaligned_store64(x + 2, y);
3764   EXPECT_POISONED_O(x[0], originy);
3765   EXPECT_POISONED_O(x[1], originy);
3766   EXPECT_NOT_POISONED(x[2]);
3767   EXPECT_POISONED_O(x[3], originy);
3768 
3769   EXPECT_NOT_POISONED(x[4]);
3770   EXPECT_NOT_POISONED(x[5]);
3771   EXPECT_NOT_POISONED(x[6]);
3772   EXPECT_NOT_POISONED(x[7]);
3773 
3774   EXPECT_NOT_POISONED(x[8]);
3775   EXPECT_POISONED_O(x[9], originy);
3776   EXPECT_POISONED_O(x[10], originy);
3777   EXPECT_POISONED_O(x[11], originy);
3778 }
3779 
TEST(MemorySanitizer,UnalignedStore64_precise2)3780 TEST(MemorySanitizer, UnalignedStore64_precise2) {
3781   char x[12] __attribute__((aligned(8)));
3782   U8 y = 0;
3783   U4 originx1 = __LINE__;
3784   U4 originx2 = __LINE__;
3785   U4 originx3 = __LINE__;
3786   U4 originy = __LINE__;
3787   __msan_poison(x, sizeof(x));
3788   __msan_set_origin(x, 4, originx1);
3789   __msan_set_origin(x + 4, 4, originx2);
3790   __msan_set_origin(x + 8, 4, originx3);
3791   __msan_poison(((char *)&y) + 3, 3);
3792   __msan_set_origin(&y, sizeof(y), originy);
3793 
3794   __sanitizer_unaligned_store64(x + 2, y);
3795   EXPECT_POISONED_O(x[0], originx1);
3796   EXPECT_POISONED_O(x[1], originx1);
3797   EXPECT_NOT_POISONED(x[2]);
3798   EXPECT_NOT_POISONED(x[3]);
3799 
3800   EXPECT_NOT_POISONED(x[4]);
3801   EXPECT_POISONED_O(x[5], originy);
3802   EXPECT_POISONED_O(x[6], originy);
3803   EXPECT_POISONED_O(x[7], originy);
3804 
3805   EXPECT_NOT_POISONED(x[8]);
3806   EXPECT_NOT_POISONED(x[9]);
3807   EXPECT_POISONED_O(x[10], originx3);
3808   EXPECT_POISONED_O(x[11], originx3);
3809 }
3810 
3811 #if (defined(__x86_64__) && defined(__clang__))
3812 namespace {
3813 typedef U1 V16x8 __attribute__((__vector_size__(16)));
3814 typedef U2 V8x16 __attribute__((__vector_size__(16)));
3815 typedef U4 V4x32 __attribute__((__vector_size__(16)));
3816 typedef U8 V2x64 __attribute__((__vector_size__(16)));
3817 typedef U4 V8x32 __attribute__((__vector_size__(32)));
3818 typedef U8 V4x64 __attribute__((__vector_size__(32)));
3819 typedef U4 V2x32 __attribute__((__vector_size__(8)));
3820 typedef U2 V4x16 __attribute__((__vector_size__(8)));
3821 typedef U1 V8x8 __attribute__((__vector_size__(8)));
3822 
3823 
shift_sse2_left_scalar(V8x16 x,U4 y)3824 V8x16 shift_sse2_left_scalar(V8x16 x, U4 y) {
3825   return _mm_slli_epi16(x, y);
3826 }
3827 
shift_sse2_left(V8x16 x,V8x16 y)3828 V8x16 shift_sse2_left(V8x16 x, V8x16 y) {
3829   return _mm_sll_epi16(x, y);
3830 }
3831 
TEST(VectorShiftTest,sse2_left_scalar)3832 TEST(VectorShiftTest, sse2_left_scalar) {
3833   V8x16 v = {Poisoned<U2>(0, 3), Poisoned<U2>(0, 7), 2, 3, 4, 5, 6, 7};
3834   V8x16 u = shift_sse2_left_scalar(v, 2);
3835   EXPECT_POISONED(u[0]);
3836   EXPECT_POISONED(u[1]);
3837   EXPECT_NOT_POISONED(u[0] | (3U << 2));
3838   EXPECT_NOT_POISONED(u[1] | (7U << 2));
3839   u[0] = u[1] = 0;
3840   EXPECT_NOT_POISONED(u);
3841 }
3842 
TEST(VectorShiftTest,sse2_left_scalar_by_uninit)3843 TEST(VectorShiftTest, sse2_left_scalar_by_uninit) {
3844   V8x16 v = {0, 1, 2, 3, 4, 5, 6, 7};
3845   V8x16 u = shift_sse2_left_scalar(v, Poisoned<U4>());
3846   EXPECT_POISONED(u[0]);
3847   EXPECT_POISONED(u[1]);
3848   EXPECT_POISONED(u[2]);
3849   EXPECT_POISONED(u[3]);
3850   EXPECT_POISONED(u[4]);
3851   EXPECT_POISONED(u[5]);
3852   EXPECT_POISONED(u[6]);
3853   EXPECT_POISONED(u[7]);
3854 }
3855 
TEST(VectorShiftTest,sse2_left)3856 TEST(VectorShiftTest, sse2_left) {
3857   V8x16 v = {Poisoned<U2>(0, 3), Poisoned<U2>(0, 7), 2, 3, 4, 5, 6, 7};
3858   // Top 64 bits of shift count don't affect the result.
3859   V2x64 s = {2, Poisoned<U8>()};
3860   V8x16 u = shift_sse2_left(v, s);
3861   EXPECT_POISONED(u[0]);
3862   EXPECT_POISONED(u[1]);
3863   EXPECT_NOT_POISONED(u[0] | (3U << 2));
3864   EXPECT_NOT_POISONED(u[1] | (7U << 2));
3865   u[0] = u[1] = 0;
3866   EXPECT_NOT_POISONED(u);
3867 }
3868 
TEST(VectorShiftTest,sse2_left_by_uninit)3869 TEST(VectorShiftTest, sse2_left_by_uninit) {
3870   V8x16 v = {Poisoned<U2>(0, 3), Poisoned<U2>(0, 7), 2, 3, 4, 5, 6, 7};
3871   V2x64 s = {Poisoned<U8>(), Poisoned<U8>()};
3872   V8x16 u = shift_sse2_left(v, s);
3873   EXPECT_POISONED(u[0]);
3874   EXPECT_POISONED(u[1]);
3875   EXPECT_POISONED(u[2]);
3876   EXPECT_POISONED(u[3]);
3877   EXPECT_POISONED(u[4]);
3878   EXPECT_POISONED(u[5]);
3879   EXPECT_POISONED(u[6]);
3880   EXPECT_POISONED(u[7]);
3881 }
3882 
3883 #ifdef __AVX2__
shift_avx2_left(V4x32 x,V4x32 y)3884 V4x32 shift_avx2_left(V4x32 x, V4x32 y) {
3885   return _mm_sllv_epi32(x, y);
3886 }
3887 // This is variable vector shift that's only available starting with AVX2.
3888 // V4x32 shift_avx2_left(V4x32 x, V4x32 y) {
TEST(VectorShiftTest,avx2_left)3889 TEST(VectorShiftTest, avx2_left) {
3890   V4x32 v = {Poisoned<U2>(0, 3), Poisoned<U2>(0, 7), 2, 3};
3891   V4x32 s = {2, Poisoned<U4>(), 3, Poisoned<U4>()};
3892   V4x32 u = shift_avx2_left(v, s);
3893   EXPECT_POISONED(u[0]);
3894   EXPECT_NOT_POISONED(u[0] | (~7U));
3895   EXPECT_POISONED(u[1]);
3896   EXPECT_POISONED(u[1] | (~31U));
3897   EXPECT_NOT_POISONED(u[2]);
3898   EXPECT_POISONED(u[3]);
3899   EXPECT_POISONED(u[3] | (~31U));
3900 }
3901 #endif // __AVX2__
3902 } // namespace
3903 
TEST(VectorPackTest,sse2_packssdw_128)3904 TEST(VectorPackTest, sse2_packssdw_128) {
3905   const unsigned S2_max = (1 << 15) - 1;
3906   V4x32 a = {Poisoned<U4>(0, 0xFF0000), Poisoned<U4>(0, 0xFFFF0000),
3907              S2_max + 100, 4};
3908   V4x32 b = {Poisoned<U4>(0, 0xFF), S2_max + 10000, Poisoned<U4>(0, 0xFF00),
3909              S2_max};
3910 
3911   V8x16 c = _mm_packs_epi32(a, b);
3912 
3913   EXPECT_POISONED(c[0]);
3914   EXPECT_POISONED(c[1]);
3915   EXPECT_NOT_POISONED(c[2]);
3916   EXPECT_NOT_POISONED(c[3]);
3917   EXPECT_POISONED(c[4]);
3918   EXPECT_NOT_POISONED(c[5]);
3919   EXPECT_POISONED(c[6]);
3920   EXPECT_NOT_POISONED(c[7]);
3921 
3922   EXPECT_EQ(c[2], S2_max);
3923   EXPECT_EQ(c[3], 4);
3924   EXPECT_EQ(c[5], S2_max);
3925   EXPECT_EQ(c[7], S2_max);
3926 }
3927 
TEST(VectorPackTest,mmx_packuswb)3928 TEST(VectorPackTest, mmx_packuswb) {
3929   const unsigned U1_max = (1 << 8) - 1;
3930   V4x16 a = {Poisoned<U2>(0, 0xFF00), Poisoned<U2>(0, 0xF000U), U1_max + 100,
3931              4};
3932   V4x16 b = {Poisoned<U2>(0, 0xFF), U1_max - 1, Poisoned<U2>(0, 0xF), U1_max};
3933   V8x8 c = _mm_packs_pu16(a, b);
3934 
3935   EXPECT_POISONED(c[0]);
3936   EXPECT_POISONED(c[1]);
3937   EXPECT_NOT_POISONED(c[2]);
3938   EXPECT_NOT_POISONED(c[3]);
3939   EXPECT_POISONED(c[4]);
3940   EXPECT_NOT_POISONED(c[5]);
3941   EXPECT_POISONED(c[6]);
3942   EXPECT_NOT_POISONED(c[7]);
3943 
3944   EXPECT_EQ(c[2], U1_max);
3945   EXPECT_EQ(c[3], 4);
3946   EXPECT_EQ(c[5], U1_max - 1);
3947   EXPECT_EQ(c[7], U1_max);
3948 }
3949 
TEST(VectorSadTest,sse2_psad_bw)3950 TEST(VectorSadTest, sse2_psad_bw) {
3951   V16x8 a = {Poisoned<U1>(), 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15};
3952   V16x8 b = {100, 101, 102, 103, 104, 105, 106, 107,
3953              108, 109, 110, 111, 112, 113, 114, 115};
3954   V2x64 c = _mm_sad_epu8(a, b);
3955 
3956   EXPECT_POISONED(c[0]);
3957   EXPECT_NOT_POISONED(c[1]);
3958 
3959   EXPECT_EQ(800U, c[1]);
3960 }
3961 
TEST(VectorMaddTest,mmx_pmadd_wd)3962 TEST(VectorMaddTest, mmx_pmadd_wd) {
3963   V4x16 a = {Poisoned<U2>(), 1, 2, 3};
3964   V4x16 b = {100, 101, 102, 103};
3965   V2x32 c = _mm_madd_pi16(a, b);
3966 
3967   EXPECT_POISONED(c[0]);
3968   EXPECT_NOT_POISONED(c[1]);
3969 
3970   EXPECT_EQ((unsigned)(2 * 102 + 3 * 103), c[1]);
3971 }
3972 
TEST(VectorCmpTest,mm_cmpneq_ps)3973 TEST(VectorCmpTest, mm_cmpneq_ps) {
3974   V4x32 c;
3975   c = _mm_cmpneq_ps(V4x32{Poisoned<U4>(), 1, 2, 3}, V4x32{4, 5, Poisoned<U4>(), 6});
3976   EXPECT_POISONED(c[0]);
3977   EXPECT_NOT_POISONED(c[1]);
3978   EXPECT_POISONED(c[2]);
3979   EXPECT_NOT_POISONED(c[3]);
3980 
3981   c = _mm_cmpneq_ps(V4x32{0, 1, 2, 3}, V4x32{4, 5, 6, 7});
3982   EXPECT_NOT_POISONED(c);
3983 }
3984 
TEST(VectorCmpTest,mm_cmpneq_sd)3985 TEST(VectorCmpTest, mm_cmpneq_sd) {
3986   V2x64 c;
3987   c = _mm_cmpneq_sd(V2x64{Poisoned<U8>(), 1}, V2x64{2, 3});
3988   EXPECT_POISONED(c[0]);
3989   c = _mm_cmpneq_sd(V2x64{1, 2}, V2x64{Poisoned<U8>(), 3});
3990   EXPECT_POISONED(c[0]);
3991   c = _mm_cmpneq_sd(V2x64{1, 2}, V2x64{3, 4});
3992   EXPECT_NOT_POISONED(c[0]);
3993   c = _mm_cmpneq_sd(V2x64{1, Poisoned<U8>()}, V2x64{2, Poisoned<U8>()});
3994   EXPECT_NOT_POISONED(c[0]);
3995   c = _mm_cmpneq_sd(V2x64{1, Poisoned<U8>()}, V2x64{1, Poisoned<U8>()});
3996   EXPECT_NOT_POISONED(c[0]);
3997 }
3998 
TEST(VectorCmpTest,builtin_ia32_ucomisdlt)3999 TEST(VectorCmpTest, builtin_ia32_ucomisdlt) {
4000   U4 c;
4001   c = __builtin_ia32_ucomisdlt(V2x64{Poisoned<U8>(), 1}, V2x64{2, 3});
4002   EXPECT_POISONED(c);
4003   c = __builtin_ia32_ucomisdlt(V2x64{1, 2}, V2x64{Poisoned<U8>(), 3});
4004   EXPECT_POISONED(c);
4005   c = __builtin_ia32_ucomisdlt(V2x64{1, 2}, V2x64{3, 4});
4006   EXPECT_NOT_POISONED(c);
4007   c = __builtin_ia32_ucomisdlt(V2x64{1, Poisoned<U8>()}, V2x64{2, Poisoned<U8>()});
4008   EXPECT_NOT_POISONED(c);
4009   c = __builtin_ia32_ucomisdlt(V2x64{1, Poisoned<U8>()}, V2x64{1, Poisoned<U8>()});
4010   EXPECT_NOT_POISONED(c);
4011 }
4012 
4013 #endif // defined(__x86_64__) && defined(__clang__)
4014 
TEST(MemorySanitizerOrigins,SetGet)4015 TEST(MemorySanitizerOrigins, SetGet) {
4016   EXPECT_EQ(TrackingOrigins(), !!__msan_get_track_origins());
4017   if (!TrackingOrigins()) return;
4018   int x;
4019   __msan_set_origin(&x, sizeof(x), 1234);
4020   EXPECT_ORIGIN(1234U, __msan_get_origin(&x));
4021   __msan_set_origin(&x, sizeof(x), 5678);
4022   EXPECT_ORIGIN(5678U, __msan_get_origin(&x));
4023   __msan_set_origin(&x, sizeof(x), 0);
4024   EXPECT_ORIGIN(0U, __msan_get_origin(&x));
4025 }
4026 
4027 namespace {
4028 struct S {
4029   U4 dummy;
4030   U2 a;
4031   U2 b;
4032 };
4033 
TEST(MemorySanitizerOrigins,InitializedStoreDoesNotChangeOrigin)4034 TEST(MemorySanitizerOrigins, InitializedStoreDoesNotChangeOrigin) {
4035   if (!TrackingOrigins()) return;
4036 
4037   S s;
4038   U4 origin = rand();  // NOLINT
4039   s.a = *GetPoisonedO<U2>(0, origin);
4040   EXPECT_ORIGIN(origin, __msan_get_origin(&s.a));
4041   EXPECT_ORIGIN(origin, __msan_get_origin(&s.b));
4042 
4043   s.b = 42;
4044   EXPECT_ORIGIN(origin, __msan_get_origin(&s.a));
4045   EXPECT_ORIGIN(origin, __msan_get_origin(&s.b));
4046 }
4047 }  // namespace
4048 
4049 template<class T, class BinaryOp>
4050 INLINE
BinaryOpOriginTest(BinaryOp op)4051 void BinaryOpOriginTest(BinaryOp op) {
4052   U4 ox = rand();  //NOLINT
4053   U4 oy = rand();  //NOLINT
4054   T *x = GetPoisonedO<T>(0, ox, 0);
4055   T *y = GetPoisonedO<T>(1, oy, 0);
4056   T *z = GetPoisonedO<T>(2, 0, 0);
4057 
4058   *z = op(*x, *y);
4059   U4 origin = __msan_get_origin(z);
4060   EXPECT_POISONED_O(*z, origin);
4061   EXPECT_EQ(true, __msan_origin_is_descendant_or_same(origin, ox) ||
4062                       __msan_origin_is_descendant_or_same(origin, oy));
4063 
4064   // y is poisoned, x is not.
4065   *x = 10101;
4066   *y = *GetPoisonedO<T>(1, oy);
4067   break_optimization(x);
4068   __msan_set_origin(z, sizeof(*z), 0);
4069   *z = op(*x, *y);
4070   EXPECT_POISONED_O(*z, oy);
4071   EXPECT_ORIGIN(oy, __msan_get_origin(z));
4072 
4073   // x is poisoned, y is not.
4074   *x = *GetPoisonedO<T>(0, ox);
4075   *y = 10101010;
4076   break_optimization(y);
4077   __msan_set_origin(z, sizeof(*z), 0);
4078   *z = op(*x, *y);
4079   EXPECT_POISONED_O(*z, ox);
4080   EXPECT_ORIGIN(ox, __msan_get_origin(z));
4081 }
4082 
XOR(const T & a,const T & b)4083 template<class T> INLINE T XOR(const T &a, const T&b) { return a ^ b; }
ADD(const T & a,const T & b)4084 template<class T> INLINE T ADD(const T &a, const T&b) { return a + b; }
SUB(const T & a,const T & b)4085 template<class T> INLINE T SUB(const T &a, const T&b) { return a - b; }
MUL(const T & a,const T & b)4086 template<class T> INLINE T MUL(const T &a, const T&b) { return a * b; }
AND(const T & a,const T & b)4087 template<class T> INLINE T AND(const T &a, const T&b) { return a & b; }
OR(const T & a,const T & b)4088 template<class T> INLINE T OR (const T &a, const T&b) { return a | b; }
4089 
TEST(MemorySanitizerOrigins,BinaryOp)4090 TEST(MemorySanitizerOrigins, BinaryOp) {
4091   if (!TrackingOrigins()) return;
4092   BinaryOpOriginTest<S8>(XOR<S8>);
4093   BinaryOpOriginTest<U8>(ADD<U8>);
4094   BinaryOpOriginTest<S4>(SUB<S4>);
4095   BinaryOpOriginTest<S4>(MUL<S4>);
4096   BinaryOpOriginTest<U4>(OR<U4>);
4097   BinaryOpOriginTest<U4>(AND<U4>);
4098   BinaryOpOriginTest<double>(ADD<U4>);
4099   BinaryOpOriginTest<float>(ADD<S4>);
4100   BinaryOpOriginTest<double>(ADD<double>);
4101   BinaryOpOriginTest<float>(ADD<double>);
4102 }
4103 
TEST(MemorySanitizerOrigins,Unary)4104 TEST(MemorySanitizerOrigins, Unary) {
4105   if (!TrackingOrigins()) return;
4106   EXPECT_POISONED_O(*GetPoisonedO<S8>(0, __LINE__), __LINE__);
4107   EXPECT_POISONED_O(*GetPoisonedO<S8>(0, __LINE__), __LINE__);
4108   EXPECT_POISONED_O(*GetPoisonedO<S8>(0, __LINE__), __LINE__);
4109   EXPECT_POISONED_O(*GetPoisonedO<S8>(0, __LINE__), __LINE__);
4110 
4111   EXPECT_POISONED_O(*GetPoisonedO<S4>(0, __LINE__), __LINE__);
4112   EXPECT_POISONED_O(*GetPoisonedO<S4>(0, __LINE__), __LINE__);
4113   EXPECT_POISONED_O(*GetPoisonedO<S4>(0, __LINE__), __LINE__);
4114   EXPECT_POISONED_O(*GetPoisonedO<S4>(0, __LINE__), __LINE__);
4115 
4116   EXPECT_POISONED_O(*GetPoisonedO<U4>(0, __LINE__), __LINE__);
4117   EXPECT_POISONED_O(*GetPoisonedO<U4>(0, __LINE__), __LINE__);
4118   EXPECT_POISONED_O(*GetPoisonedO<U4>(0, __LINE__), __LINE__);
4119   EXPECT_POISONED_O(*GetPoisonedO<U4>(0, __LINE__), __LINE__);
4120 
4121   EXPECT_POISONED_O(*GetPoisonedO<S4>(0, __LINE__), __LINE__);
4122   EXPECT_POISONED_O(*GetPoisonedO<S4>(0, __LINE__), __LINE__);
4123   EXPECT_POISONED_O(*GetPoisonedO<S4>(0, __LINE__), __LINE__);
4124   EXPECT_POISONED_O(*GetPoisonedO<S4>(0, __LINE__), __LINE__);
4125 
4126   EXPECT_POISONED_O((void*)*GetPoisonedO<S8>(0, __LINE__), __LINE__);
4127   EXPECT_POISONED_O((U8)*GetPoisonedO<void*>(0, __LINE__), __LINE__);
4128 }
4129 
TEST(MemorySanitizerOrigins,EQ)4130 TEST(MemorySanitizerOrigins, EQ) {
4131   if (!TrackingOrigins()) return;
4132   EXPECT_POISONED_O(*GetPoisonedO<S4>(0, __LINE__) <= 11, __LINE__);
4133   EXPECT_POISONED_O(*GetPoisonedO<S4>(0, __LINE__) == 11, __LINE__);
4134   EXPECT_POISONED_O(*GetPoisonedO<float>(0, __LINE__) == 1.1, __LINE__);
4135 }
4136 
TEST(MemorySanitizerOrigins,DIV)4137 TEST(MemorySanitizerOrigins, DIV) {
4138   if (!TrackingOrigins()) return;
4139   EXPECT_POISONED_O(*GetPoisonedO<U8>(0, __LINE__) / 100, __LINE__);
4140   unsigned o = __LINE__;
4141   EXPECT_UMR_O(volatile unsigned y = 100 / *GetPoisonedO<S4>(0, o, 1), o);
4142 }
4143 
TEST(MemorySanitizerOrigins,SHIFT)4144 TEST(MemorySanitizerOrigins, SHIFT) {
4145   if (!TrackingOrigins()) return;
4146   EXPECT_POISONED_O(*GetPoisonedO<U8>(0, __LINE__) >> 10, __LINE__);
4147   EXPECT_POISONED_O(*GetPoisonedO<S8>(0, __LINE__) >> 10, __LINE__);
4148   EXPECT_POISONED_O(*GetPoisonedO<S8>(0, __LINE__) << 10, __LINE__);
4149   EXPECT_POISONED_O(10U << *GetPoisonedO<U8>(0, __LINE__), __LINE__);
4150   EXPECT_POISONED_O(-10 >> *GetPoisonedO<S8>(0, __LINE__), __LINE__);
4151   EXPECT_POISONED_O(-10 << *GetPoisonedO<S8>(0, __LINE__), __LINE__);
4152 }
4153 
4154 template<class T, int N>
MemCpyTest()4155 void MemCpyTest() {
4156   int ox = __LINE__;
4157   T *x = new T[N];
4158   T *y = new T[N];
4159   T *z = new T[N];
4160   T *q = new T[N];
4161   __msan_poison(x, N * sizeof(T));
4162   __msan_set_origin(x, N * sizeof(T), ox);
4163   __msan_set_origin(y, N * sizeof(T), 777777);
4164   __msan_set_origin(z, N * sizeof(T), 888888);
4165   EXPECT_NOT_POISONED(x);
4166   memcpy(y, x, N * sizeof(T));
4167   EXPECT_POISONED_O(y[0], ox);
4168   EXPECT_POISONED_O(y[N/2], ox);
4169   EXPECT_POISONED_O(y[N-1], ox);
4170   EXPECT_NOT_POISONED(x);
4171   void *res = mempcpy(q, x, N * sizeof(T));
4172   ASSERT_EQ(q + N, res);
4173   EXPECT_POISONED_O(q[0], ox);
4174   EXPECT_POISONED_O(q[N/2], ox);
4175   EXPECT_POISONED_O(q[N-1], ox);
4176   EXPECT_NOT_POISONED(x);
4177   memmove(z, x, N * sizeof(T));
4178   EXPECT_POISONED_O(z[0], ox);
4179   EXPECT_POISONED_O(z[N/2], ox);
4180   EXPECT_POISONED_O(z[N-1], ox);
4181 }
4182 
TEST(MemorySanitizerOrigins,LargeMemCpy)4183 TEST(MemorySanitizerOrigins, LargeMemCpy) {
4184   if (!TrackingOrigins()) return;
4185   MemCpyTest<U1, 10000>();
4186   MemCpyTest<U8, 10000>();
4187 }
4188 
TEST(MemorySanitizerOrigins,SmallMemCpy)4189 TEST(MemorySanitizerOrigins, SmallMemCpy) {
4190   if (!TrackingOrigins()) return;
4191   MemCpyTest<U8, 1>();
4192   MemCpyTest<U8, 2>();
4193   MemCpyTest<U8, 3>();
4194 }
4195 
TEST(MemorySanitizerOrigins,Select)4196 TEST(MemorySanitizerOrigins, Select) {
4197   if (!TrackingOrigins()) return;
4198   EXPECT_NOT_POISONED(g_one ? 1 : *GetPoisonedO<S4>(0, __LINE__));
4199   EXPECT_POISONED_O(*GetPoisonedO<S4>(0, __LINE__), __LINE__);
4200   S4 x;
4201   break_optimization(&x);
4202   x = g_1 ? *GetPoisonedO<S4>(0, __LINE__) : 0;
4203 
4204   EXPECT_POISONED_O(g_1 ? *GetPoisonedO<S4>(0, __LINE__) : 1, __LINE__);
4205   EXPECT_POISONED_O(g_0 ? 1 : *GetPoisonedO<S4>(0, __LINE__), __LINE__);
4206 }
4207 
RetvalOriginTest(U4 origin)4208 NOINLINE int RetvalOriginTest(U4 origin) {
4209   int *a = new int;
4210   break_optimization(a);
4211   __msan_set_origin(a, sizeof(*a), origin);
4212   int res = *a;
4213   delete a;
4214   return res;
4215 }
4216 
TEST(MemorySanitizerOrigins,Retval)4217 TEST(MemorySanitizerOrigins, Retval) {
4218   if (!TrackingOrigins()) return;
4219   EXPECT_POISONED_O(RetvalOriginTest(__LINE__), __LINE__);
4220 }
4221 
ParamOriginTest(int param,U4 origin)4222 NOINLINE void ParamOriginTest(int param, U4 origin) {
4223   EXPECT_POISONED_O(param, origin);
4224 }
4225 
TEST(MemorySanitizerOrigins,Param)4226 TEST(MemorySanitizerOrigins, Param) {
4227   if (!TrackingOrigins()) return;
4228   int *a = new int;
4229   U4 origin = __LINE__;
4230   break_optimization(a);
4231   __msan_set_origin(a, sizeof(*a), origin);
4232   ParamOriginTest(*a, origin);
4233   delete a;
4234 }
4235 
TEST(MemorySanitizerOrigins,Invoke)4236 TEST(MemorySanitizerOrigins, Invoke) {
4237   if (!TrackingOrigins()) return;
4238   StructWithDtor s;  // Will cause the calls to become invokes.
4239   EXPECT_POISONED_O(RetvalOriginTest(__LINE__), __LINE__);
4240 }
4241 
TEST(MemorySanitizerOrigins,strlen)4242 TEST(MemorySanitizerOrigins, strlen) {
4243   S8 alignment;
4244   break_optimization(&alignment);
4245   char x[4] = {'a', 'b', 0, 0};
4246   __msan_poison(&x[2], 1);
4247   U4 origin = __LINE__;
4248   __msan_set_origin(x, sizeof(x), origin);
4249   EXPECT_UMR_O(volatile unsigned y = strlen(x), origin);
4250 }
4251 
TEST(MemorySanitizerOrigins,wcslen)4252 TEST(MemorySanitizerOrigins, wcslen) {
4253   wchar_t w[3] = {'a', 'b', 0};
4254   U4 origin = __LINE__;
4255   __msan_set_origin(w, sizeof(w), origin);
4256   __msan_poison(&w[2], sizeof(wchar_t));
4257   EXPECT_UMR_O(volatile unsigned y = wcslen(w), origin);
4258 }
4259 
4260 #if MSAN_HAS_M128
TEST(MemorySanitizerOrigins,StoreIntrinsic)4261 TEST(MemorySanitizerOrigins, StoreIntrinsic) {
4262   __m128 x, y;
4263   U4 origin = __LINE__;
4264   __msan_set_origin(&x, sizeof(x), origin);
4265   __msan_poison(&x, sizeof(x));
4266   _mm_storeu_ps((float*)&y, x);
4267   EXPECT_POISONED_O(y, origin);
4268 }
4269 #endif
4270 
RecursiveMalloc(int depth)4271 NOINLINE void RecursiveMalloc(int depth) {
4272   static int count;
4273   count++;
4274   if ((count % (1024 * 1024)) == 0)
4275     printf("RecursiveMalloc: %d\n", count);
4276   int *x1 = new int;
4277   int *x2 = new int;
4278   break_optimization(x1);
4279   break_optimization(x2);
4280   if (depth > 0) {
4281     RecursiveMalloc(depth-1);
4282     RecursiveMalloc(depth-1);
4283   }
4284   delete x1;
4285   delete x2;
4286 }
4287 
TEST(MemorySanitizer,Select)4288 TEST(MemorySanitizer, Select) {
4289   int x;
4290   int volatile* p = &x;
4291   int z = *p ? 1 : 0;
4292   EXPECT_POISONED(z);
4293 }
4294 
TEST(MemorySanitizer,SelectPartial)4295 TEST(MemorySanitizer, SelectPartial) {
4296   // Precise instrumentation of select.
4297   // Some bits of the result do not depend on select condition, and must stay
4298   // initialized even if select condition is not. These are the bits that are
4299   // equal and initialized in both left and right select arguments.
4300   U4 x = 0xFFFFABCDU;
4301   U4 x_s = 0xFFFF0000U;
4302   __msan_partial_poison(&x, &x_s, sizeof(x));
4303   U4 y = 0xAB00U;
4304   U1 cond = true;
4305   __msan_poison(&cond, sizeof(cond));
4306   U4 z = cond ? x : y;
4307   __msan_print_shadow(&z, sizeof(z));
4308   EXPECT_POISONED(z & 0xFFU);
4309   EXPECT_NOT_POISONED(z & 0xFF00U);
4310   EXPECT_POISONED(z & 0xFF0000U);
4311   EXPECT_POISONED(z & 0xFF000000U);
4312   EXPECT_EQ(0xAB00U, z & 0xFF00U);
4313 }
4314 
TEST(MemorySanitizerStress,DISABLED_MallocStackTrace)4315 TEST(MemorySanitizerStress, DISABLED_MallocStackTrace) {
4316   RecursiveMalloc(22);
4317 }
4318 
TEST(MemorySanitizerAllocator,get_estimated_allocated_size)4319 TEST(MemorySanitizerAllocator, get_estimated_allocated_size) {
4320   size_t sizes[] = {0, 20, 5000, 1<<20};
4321   for (size_t i = 0; i < sizeof(sizes) / sizeof(*sizes); ++i) {
4322     size_t alloc_size = __sanitizer_get_estimated_allocated_size(sizes[i]);
4323     EXPECT_EQ(alloc_size, sizes[i]);
4324   }
4325 }
4326 
TEST(MemorySanitizerAllocator,get_allocated_size_and_ownership)4327 TEST(MemorySanitizerAllocator, get_allocated_size_and_ownership) {
4328   char *array = reinterpret_cast<char*>(malloc(100));
4329   int *int_ptr = new int;
4330 
4331   EXPECT_TRUE(__sanitizer_get_ownership(array));
4332   EXPECT_EQ(100U, __sanitizer_get_allocated_size(array));
4333 
4334   EXPECT_TRUE(__sanitizer_get_ownership(int_ptr));
4335   EXPECT_EQ(sizeof(*int_ptr), __sanitizer_get_allocated_size(int_ptr));
4336 
4337   void *wild_addr = reinterpret_cast<void*>(0x1);
4338   EXPECT_FALSE(__sanitizer_get_ownership(wild_addr));
4339   EXPECT_EQ(0U, __sanitizer_get_allocated_size(wild_addr));
4340 
4341   EXPECT_FALSE(__sanitizer_get_ownership(array + 50));
4342   EXPECT_EQ(0U, __sanitizer_get_allocated_size(array + 50));
4343 
4344   // NULL is a valid argument for GetAllocatedSize but is not owned.
4345   EXPECT_FALSE(__sanitizer_get_ownership(NULL));
4346   EXPECT_EQ(0U, __sanitizer_get_allocated_size(NULL));
4347 
4348   free(array);
4349   EXPECT_FALSE(__sanitizer_get_ownership(array));
4350   EXPECT_EQ(0U, __sanitizer_get_allocated_size(array));
4351 
4352   delete int_ptr;
4353 }
4354 
TEST(MemorySanitizer,MlockTest)4355 TEST(MemorySanitizer, MlockTest) {
4356   EXPECT_EQ(0, mlockall(MCL_CURRENT));
4357   EXPECT_EQ(0, mlock((void*)0x12345, 0x5678));
4358   EXPECT_EQ(0, munlockall());
4359   EXPECT_EQ(0, munlock((void*)0x987, 0x654));
4360 }
4361 
4362 // Test that LargeAllocator unpoisons memory before releasing it to the OS.
TEST(MemorySanitizer,LargeAllocatorUnpoisonsOnFree)4363 TEST(MemorySanitizer, LargeAllocatorUnpoisonsOnFree) {
4364   void *p = malloc(1024 * 1024);
4365   free(p);
4366 
4367   typedef void *(*mmap_fn)(void *, size_t, int, int, int, off_t);
4368   mmap_fn real_mmap = (mmap_fn)dlsym(RTLD_NEXT, "mmap");
4369 
4370   // Allocate the page that was released to the OS in free() with the real mmap,
4371   // bypassing the interceptor.
4372   char *q = (char *)real_mmap(p, 4096, PROT_READ | PROT_WRITE,
4373                               MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
4374   ASSERT_NE((char *)0, q);
4375 
4376   ASSERT_TRUE(q <= p);
4377   ASSERT_TRUE(q + 4096 > p);
4378 
4379   EXPECT_NOT_POISONED(q[0]);
4380   EXPECT_NOT_POISONED(q[10]);
4381   EXPECT_NOT_POISONED(q[100]);
4382 
4383   munmap(q, 4096);
4384 }
4385 
4386 #if SANITIZER_TEST_HAS_MALLOC_USABLE_SIZE
TEST(MemorySanitizer,MallocUsableSizeTest)4387 TEST(MemorySanitizer, MallocUsableSizeTest) {
4388   const size_t kArraySize = 100;
4389   char *array = Ident((char*)malloc(kArraySize));
4390   int *int_ptr = Ident(new int);
4391   EXPECT_EQ(0U, malloc_usable_size(NULL));
4392   EXPECT_EQ(kArraySize, malloc_usable_size(array));
4393   EXPECT_EQ(sizeof(int), malloc_usable_size(int_ptr));
4394   free(array);
4395   delete int_ptr;
4396 }
4397 #endif  // SANITIZER_TEST_HAS_MALLOC_USABLE_SIZE
4398