| 413 | } |
| 414 | |
| 415 | ErrorGeneric::ErrorGeneric(u32 tid, uptr pc_, uptr bp_, uptr sp_, uptr addr, |
| 416 | bool is_write_, uptr access_size_) |
| 417 | : ErrorBase(tid), |
| 418 | addr_description(addr, access_size_, /*shouldLockThreadRegistry=*/false), |
| 419 | pc(pc_), |
| 420 | bp(bp_), |
| 421 | sp(sp_), |
| 422 | access_size(access_size_), |
| 423 | is_write(is_write_), |
| 424 | shadow_val(0) { |
| 425 | scariness.Clear(); |
| 426 | if (access_size) { |
| 427 | if (access_size <= 9) { |
| 428 | char desr[] = "?-byte"; |
| 429 | desr[0] = '0' + access_size; |
| 430 | scariness.Scare(access_size + access_size / 2, desr); |
| 431 | } else if (access_size >= 10) { |
| 432 | scariness.Scare(15, "multi-byte"); |
| 433 | } |
| 434 | is_write ? scariness.Scare(20, "write") : scariness.Scare(1, "read"); |
| 435 | |
| 436 | // Determine the error type. |
| 437 | bug_descr = "unknown-crash"; |
| 438 | if (AddrIsInMem(addr)) { |
| 439 | u8 *shadow_addr = (u8 *)MemToShadow(addr); |
| 440 | // If we are accessing 16 bytes, look at the second shadow byte. |
| 441 | if (*shadow_addr == 0 && access_size > ASAN_SHADOW_GRANULARITY) |
| 442 | shadow_addr++; |
| 443 | // If we are in the partial right redzone, look at the next shadow byte. |
| 444 | if (*shadow_addr > 0 && *shadow_addr < 128) shadow_addr++; |
| 445 | bool far_from_bounds = false; |
| 446 | shadow_val = *shadow_addr; |
| 447 | int bug_type_score = 0; |
| 448 | // For use-after-frees reads are almost as bad as writes. |
| 449 | int read_after_free_bonus = 0; |
| 450 | switch (shadow_val) { |
| 451 | case kAsanHeapLeftRedzoneMagic: |
| 452 | case kAsanArrayCookieMagic: |
| 453 | bug_descr = "heap-buffer-overflow"; |
| 454 | bug_type_score = 10; |
| 455 | far_from_bounds = AdjacentShadowValuesAreFullyPoisoned(shadow_addr); |
| 456 | break; |
| 457 | case kAsanHeapFreeMagic: |
| 458 | bug_descr = "heap-use-after-free"; |
| 459 | bug_type_score = 20; |
| 460 | if (!is_write) read_after_free_bonus = 18; |
| 461 | break; |
| 462 | case kAsanStackLeftRedzoneMagic: |
| 463 | bug_descr = "stack-buffer-underflow"; |
| 464 | bug_type_score = 25; |
| 465 | far_from_bounds = AdjacentShadowValuesAreFullyPoisoned(shadow_addr); |
| 466 | break; |
| 467 | case kAsanInitializationOrderMagic: |
| 468 | bug_descr = "initialization-order-fiasco"; |
| 469 | bug_type_score = 1; |
| 470 | break; |
| 471 | case kAsanStackMidRedzoneMagic: |
| 472 | case kAsanStackRightRedzoneMagic: |
nothing calls this directly
no test coverage detected