Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Fix string::assign and ::resize_and_overwrite under ASan #3956

Merged
merged 8 commits into from
Aug 18, 2023
Merged

Fix string::assign and ::resize_and_overwrite under ASan #3956

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
835a545
ASAN fix
achabense Aug 12, 2023
96cddc4
update test
achabense Aug 12, 2023
c704179
formatting
achabense Aug 12, 2023
c367a86
remove std
achabense Aug 12, 2023
dd3ca8d
ASan fix in `basic_string::assign(pointer, size_type)`
CaseyCarter Aug 15, 2023
1243854
ASan fix for `basic_string::resize_and_overwrite`
CaseyCarter Aug 15, 2023
35de6c5
`basic_string::resize_and_overwrite` drive-by cleanup
CaseyCarter Aug 15, 2023
4915243
add test for the fix to my "fix"
achabense Aug 16, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 11 additions & 9 deletions stl/inc/xstring
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3371,11 +3371,12 @@ public:
_In_reads_(_Count) const _Elem* const _Ptr, _CRT_GUARDOVERFLOW const size_type _Count) {
// assign [_Ptr, _Ptr + _Count)
if (_Count <= _Mypair._Myval2._Myres) {
_ASAN_STRING_MODIFY(*this, _Mypair._Myval2._Mysize, _Count);
achabense marked this conversation as resolved.
Show resolved Hide resolved
_ASAN_STRING_REMOVE(*this);
_Elem* const _Old_ptr = _Mypair._Myval2._Myptr();
_Mypair._Myval2._Mysize = _Count;
_Traits::move(_Old_ptr, _Ptr, _Count);
_Traits::assign(_Old_ptr[_Count], _Elem());
_ASAN_STRING_CREATE(*this);
return *this;
}

Expand Down Expand Up @@ -4141,8 +4142,6 @@ public:
}
}

#pragma warning(push)
#pragma warning(disable : 4018) // '<=': signed/unsigned mismatch (we compare to 0 before _New_size below, so it's safe)
template <class _Operation>
constexpr void
#if _HAS_CXX23
Expand All @@ -4156,18 +4155,21 @@ public:
[](_Elem* const _New_ptr, const _Elem* const _Old_ptr, const size_type _Old_size) {
_Traits::copy(_New_ptr, _Old_ptr, _Old_size + 1);
});
} else {
_ASAN_STRING_MODIFY(*this, _Mypair._Myval2._Mysize, _New_size);
_Mypair._Myval2._Mysize = _New_size;
}

auto _Arg_ptr = _Mypair._Myval2._Myptr();
auto _Arg_size = _New_size;
const auto _Result_size = _STD move(_Op)(_Arg_ptr, _Arg_size);
auto _Arg_ptr = _Mypair._Myval2._Myptr();
auto _Arg_size = _New_size;
const auto _Result_size = _STD move(_Op)(_Arg_ptr, _Arg_size);
const auto _Result_as_size_type = static_cast<size_type>(_Result_size);
#if _CONTAINER_DEBUG_LEVEL > 0
_STL_VERIFY(_Result_size >= 0, "the returned size can't be smaller than 0");
_STL_VERIFY(_Result_size <= _New_size, "the returned size can't be greater than the passed size");
_STL_VERIFY(_Result_as_size_type <= _New_size, "the returned size can't be greater than the passed size");
#endif // _CONTAINER_DEBUG_LEVEL > 0
_Eos(static_cast<size_type>(_Result_size));
_Eos(_Result_as_size_type);
}
#pragma warning(pop)

#if _HAS_CXX23
template <class _Operation>
Expand Down
12 changes: 12 additions & 0 deletions tests/std/tests/GH_002030_asan_annotate_string/test.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1920,6 +1920,17 @@ void test_gh_3883() {
assert(t == "AAAAAAA");
}

void test_gh_3955() {
// GH-3955 <xstring>: ASAN report container-overflow in a legal case
string s(19, '0');
s = &s[3];
assert(s == string(16, '0'));

string t(19, '0');
s = &t[0];
assert(s == t);
}

int main() {
run_allocator_matrix<char>();
#ifdef __cpp_char8_t
Expand All @@ -1932,4 +1943,5 @@ int main() {
test_DevCom_10116361();
test_DevCom_10109507();
test_gh_3883();
test_gh_3955();
}