Skip to content

Commit 662ba0d

Browse files
mordantejoaosaffran
mordante
authored and
joaosaffran
committed
[NFC][libc++] Guard against operator& hijacking. (llvm#128351)
This set usage of operator& instead of std::addressof seems not be easy to "abuse". Some seem easy to misuse, like basic_ostream::operator<<, trying to do that results in compilation errors since the `widen` function is not specialized for the hijacking character type. Hence there are no tests.
1 parent f6e2d6d commit 662ba0d

File tree

23 files changed

+87
-70
lines changed

23 files changed

+87
-70
lines changed

‎libcxx/include/__atomic/atomic.h

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -363,7 +363,7 @@ struct atomic<_Tp> : __atomic_base<_Tp> {
363363
// https://github.com/llvm/llvm-project/issues/47978
364364
// clang bug: __old is not updated on failure for atomic<long double>::compare_exchange_weak
365365
// Note __old = __self.load(memory_order_relaxed) will not work
366-
std::__cxx_atomic_load_inplace(std::addressof(__self.__a_), &__old, memory_order_relaxed);
366+
std::__cxx_atomic_load_inplace(std::addressof(__self.__a_), std::addressof(__old), memory_order_relaxed);
367367
}
368368
# endif
369369
__new = __operation(__old, __operand);

‎libcxx/include/__atomic/atomic_ref.h

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -119,7 +119,7 @@ struct __atomic_ref_base {
119119
// that the pointer is going to be aligned properly at runtime because that is a (checked) precondition
120120
// of atomic_ref's constructor.
121121
static constexpr bool is_always_lock_free =
122-
__atomic_always_lock_free(sizeof(_Tp), &__get_aligner_instance<required_alignment>::__instance);
122+
__atomic_always_lock_free(sizeof(_Tp), std::addressof(__get_aligner_instance<required_alignment>::__instance));
123123

124124
_LIBCPP_HIDE_FROM_ABI bool is_lock_free() const noexcept { return __atomic_is_lock_free(sizeof(_Tp), __ptr_); }
125125

‎libcxx/include/__charconv/traits.h

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,7 @@
1515
#include <__charconv/tables.h>
1616
#include <__charconv/to_chars_base_10.h>
1717
#include <__config>
18+
#include <__memory/addressof.h>
1819
#include <__type_traits/enable_if.h>
1920
#include <__type_traits/is_unsigned.h>
2021
#include <cstdint>
@@ -142,7 +143,7 @@ __mul_overflowed(unsigned short __a, _Tp __b, unsigned short& __r) {
142143
template <typename _Tp>
143144
inline _LIBCPP_CONSTEXPR_SINCE_CXX23 _LIBCPP_HIDE_FROM_ABI bool __mul_overflowed(_Tp __a, _Tp __b, _Tp& __r) {
144145
static_assert(is_unsigned<_Tp>::value, "");
145-
return __builtin_mul_overflow(__a, __b, &__r);
146+
return __builtin_mul_overflow(__a, __b, std::addressof(__r));
146147
}
147148

148149
template <typename _Tp, typename _Up>

‎libcxx/include/__filesystem/path.h

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@
1717
#include <__fwd/functional.h>
1818
#include <__iterator/back_insert_iterator.h>
1919
#include <__iterator/iterator_traits.h>
20+
#include <__memory/addressof.h>
2021
#include <__type_traits/decay.h>
2122
#include <__type_traits/enable_if.h>
2223
#include <__type_traits/is_pointer.h>
@@ -584,7 +585,7 @@ class _LIBCPP_EXPORTED_FROM_ABI path {
584585

585586
template <class _ECharT, __enable_if_t<__can_convert_char<_ECharT>::value, int> = 0>
586587
_LIBCPP_HIDE_FROM_ABI path& operator+=(_ECharT __x) {
587-
_PathCVT<_ECharT>::__append_source(__pn_, basic_string_view<_ECharT>(&__x, 1));
588+
_PathCVT<_ECharT>::__append_source(__pn_, basic_string_view<_ECharT>(std::addressof(__x), 1));
588589
return *this;
589590
}
590591

‎libcxx/include/__functional/hash.h

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,7 @@
1313
#include <__cstddef/nullptr_t.h>
1414
#include <__functional/unary_function.h>
1515
#include <__fwd/functional.h>
16+
#include <__memory/addressof.h>
1617
#include <__type_traits/conjunction.h>
1718
#include <__type_traits/enable_if.h>
1819
#include <__type_traits/invoke.h>
@@ -33,7 +34,7 @@ _LIBCPP_BEGIN_NAMESPACE_STD
3334
template <class _Size>
3435
inline _LIBCPP_HIDE_FROM_ABI _Size __loadword(const void* __p) {
3536
_Size __r;
36-
std::memcpy(&__r, __p, sizeof(__r));
37+
std::memcpy(std::addressof(__r), __p, sizeof(__r));
3738
return __r;
3839
}
3940

@@ -276,7 +277,7 @@ struct __scalar_hash<_Tp, 2> : public __unary_function<_Tp, size_t> {
276277
} __s;
277278
} __u;
278279
__u.__t = __v;
279-
return __murmur2_or_cityhash<size_t>()(&__u, sizeof(__u));
280+
return __murmur2_or_cityhash<size_t>()(std::addressof(__u), sizeof(__u));
280281
}
281282
};
282283

@@ -292,7 +293,7 @@ struct __scalar_hash<_Tp, 3> : public __unary_function<_Tp, size_t> {
292293
} __s;
293294
} __u;
294295
__u.__t = __v;
295-
return __murmur2_or_cityhash<size_t>()(&__u, sizeof(__u));
296+
return __murmur2_or_cityhash<size_t>()(std::addressof(__u), sizeof(__u));
296297
}
297298
};
298299

@@ -309,7 +310,7 @@ struct __scalar_hash<_Tp, 4> : public __unary_function<_Tp, size_t> {
309310
} __s;
310311
} __u;
311312
__u.__t = __v;
312-
return __murmur2_or_cityhash<size_t>()(&__u, sizeof(__u));
313+
return __murmur2_or_cityhash<size_t>()(std::addressof(__u), sizeof(__u));
313314
}
314315
};
315316

@@ -332,7 +333,7 @@ struct _LIBCPP_TEMPLATE_VIS hash<_Tp*> : public __unary_function<_Tp*, size_t> {
332333
size_t __a;
333334
} __u;
334335
__u.__t = __v;
335-
return __murmur2_or_cityhash<size_t>()(&__u, sizeof(__u));
336+
return __murmur2_or_cityhash<size_t>()(std::addressof(__u), sizeof(__u));
336337
}
337338
};
338339

‎libcxx/include/__iterator/aliasing_iterator.h

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@
1212
#include <__config>
1313
#include <__cstddef/ptrdiff_t.h>
1414
#include <__iterator/iterator_traits.h>
15+
#include <__memory/addressof.h>
1516
#include <__memory/pointer_traits.h>
1617
#include <__type_traits/is_trivial.h>
1718

@@ -102,7 +103,7 @@ struct __aliasing_iterator_wrapper {
102103

103104
_LIBCPP_HIDE_FROM_ABI _Alias operator*() const _NOEXCEPT {
104105
_Alias __val;
105-
__builtin_memcpy(&__val, std::__to_address(__base_), sizeof(value_type));
106+
__builtin_memcpy(std::addressof(__val), std::__to_address(__base_), sizeof(value_type));
106107
return __val;
107108
}
108109

‎libcxx/include/__locale

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@
1212

1313
#include <__config>
1414
#include <__locale_dir/locale_base_api.h>
15+
#include <__memory/addressof.h>
1516
#include <__memory/shared_count.h>
1617
#include <__mutex/once_flag.h>
1718
#include <__type_traits/make_unsigned.h>
@@ -156,7 +157,7 @@ locale locale::combine(const locale& __other) const {
156157
if (!std::has_facet<_Facet>(__other))
157158
std::__throw_runtime_error("locale::combine: locale missing facet");
158159

159-
return locale(*this, &const_cast<_Facet&>(std::use_facet<_Facet>(__other)));
160+
return locale(*this, std::addressof(const_cast<_Facet&>(std::use_facet<_Facet>(__other))));
160161
}
161162

162163
template <class _Facet>

‎libcxx/include/__mdspan/layout_left.h

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@
2121
#include <__config>
2222
#include <__fwd/mdspan.h>
2323
#include <__mdspan/extents.h>
24+
#include <__memory/addressof.h>
2425
#include <__type_traits/common_type.h>
2526
#include <__type_traits/is_constructible.h>
2627
#include <__type_traits/is_convertible.h>
@@ -58,7 +59,7 @@ class layout_left::mapping {
5859

5960
index_type __prod = __ext.extent(0);
6061
for (rank_type __r = 1; __r < extents_type::rank(); __r++) {
61-
bool __overflowed = __builtin_mul_overflow(__prod, __ext.extent(__r), &__prod);
62+
bool __overflowed = __builtin_mul_overflow(__prod, __ext.extent(__r), std::addressof(__prod));
6263
if (__overflowed)
6364
return false;
6465
}

‎libcxx/include/__mdspan/layout_right.h

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@
2222
#include <__cstddef/size_t.h>
2323
#include <__fwd/mdspan.h>
2424
#include <__mdspan/extents.h>
25+
#include <__memory/addressof.h>
2526
#include <__type_traits/common_type.h>
2627
#include <__type_traits/is_constructible.h>
2728
#include <__type_traits/is_convertible.h>
@@ -58,7 +59,7 @@ class layout_right::mapping {
5859

5960
index_type __prod = __ext.extent(0);
6061
for (rank_type __r = 1; __r < extents_type::rank(); __r++) {
61-
bool __overflowed = __builtin_mul_overflow(__prod, __ext.extent(__r), &__prod);
62+
bool __overflowed = __builtin_mul_overflow(__prod, __ext.extent(__r), std::addressof(__prod));
6263
if (__overflowed)
6364
return false;
6465
}

‎libcxx/include/__mdspan/layout_stride.h

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@
2222
#include <__config>
2323
#include <__fwd/mdspan.h>
2424
#include <__mdspan/extents.h>
25+
#include <__memory/addressof.h>
2526
#include <__type_traits/common_type.h>
2627
#include <__type_traits/is_constructible.h>
2728
#include <__type_traits/is_convertible.h>
@@ -86,7 +87,7 @@ class layout_stride::mapping {
8687

8788
index_type __prod = __ext.extent(0);
8889
for (rank_type __r = 1; __r < __rank_; __r++) {
89-
bool __overflowed = __builtin_mul_overflow(__prod, __ext.extent(__r), &__prod);
90+
bool __overflowed = __builtin_mul_overflow(__prod, __ext.extent(__r), std::addressof(__prod));
9091
if (__overflowed)
9192
return false;
9293
}
@@ -109,11 +110,12 @@ class layout_stride::mapping {
109110
}
110111
if (__ext.extent(__r) == static_cast<index_type>(0))
111112
return true;
112-
index_type __prod = (__ext.extent(__r) - 1);
113-
bool __overflowed_mul = __builtin_mul_overflow(__prod, static_cast<index_type>(__strides[__r]), &__prod);
113+
index_type __prod = (__ext.extent(__r) - 1);
114+
bool __overflowed_mul =
115+
__builtin_mul_overflow(__prod, static_cast<index_type>(__strides[__r]), std::addressof(__prod));
114116
if (__overflowed_mul)
115117
return false;
116-
bool __overflowed_add = __builtin_add_overflow(__size, __prod, &__size);
118+
bool __overflowed_add = __builtin_add_overflow(__size, __prod, std::addressof(__size));
117119
if (__overflowed_add)
118120
return false;
119121
}

‎libcxx/include/__mdspan/mdspan.h

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@
2222
#include <__fwd/mdspan.h>
2323
#include <__mdspan/default_accessor.h>
2424
#include <__mdspan/extents.h>
25+
#include <__memory/addressof.h>
2526
#include <__type_traits/extent.h>
2627
#include <__type_traits/is_abstract.h>
2728
#include <__type_traits/is_array.h>
@@ -215,7 +216,7 @@ class mdspan {
215216
_LIBCPP_ASSERT_UNCATEGORIZED(
216217
false == ([&]<size_t... _Idxs>(index_sequence<_Idxs...>) {
217218
size_type __prod = 1;
218-
return (__builtin_mul_overflow(__prod, extent(_Idxs), &__prod) || ... || false);
219+
return (__builtin_mul_overflow(__prod, extent(_Idxs), std::addressof(__prod)) || ... || false);
219220
}(make_index_sequence<rank()>())),
220221
"mdspan: size() is not representable as size_type");
221222
return [&]<size_t... _Idxs>(index_sequence<_Idxs...>) {

‎libcxx/include/__memory/shared_count.h

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@
1010
#define _LIBCPP___MEMORY_SHARED_COUNT_H
1111

1212
#include <__config>
13+
#include <__memory/addressof.h>
1314
#include <typeinfo>
1415

1516
#if !defined(_LIBCPP_HAS_NO_PRAGMA_SYSTEM_HEADER)
@@ -52,7 +53,7 @@ inline _LIBCPP_HIDE_FROM_ABI _ValueType __libcpp_acquire_load(_ValueType const*
5253
template <class _Tp>
5354
inline _LIBCPP_HIDE_FROM_ABI _Tp __libcpp_atomic_refcount_increment(_Tp& __t) _NOEXCEPT {
5455
#if _LIBCPP_HAS_BUILTIN_ATOMIC_SUPPORT && _LIBCPP_HAS_THREADS
55-
return __atomic_add_fetch(&__t, 1, __ATOMIC_RELAXED);
56+
return __atomic_add_fetch(std::addressof(__t), 1, __ATOMIC_RELAXED);
5657
#else
5758
return __t += 1;
5859
#endif
@@ -61,7 +62,7 @@ inline _LIBCPP_HIDE_FROM_ABI _Tp __libcpp_atomic_refcount_increment(_Tp& __t) _N
6162
template <class _Tp>
6263
inline _LIBCPP_HIDE_FROM_ABI _Tp __libcpp_atomic_refcount_decrement(_Tp& __t) _NOEXCEPT {
6364
#if _LIBCPP_HAS_BUILTIN_ATOMIC_SUPPORT && _LIBCPP_HAS_THREADS
64-
return __atomic_add_fetch(&__t, -1, __ATOMIC_ACQ_REL);
65+
return __atomic_add_fetch(std::addressof(__t), -1, __ATOMIC_ACQ_REL);
6566
#else
6667
return __t -= 1;
6768
#endif

‎libcxx/include/__ostream/basic_ostream.h

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,7 @@
1515

1616
# include <__exception/operations.h>
1717
# include <__fwd/memory.h>
18+
# include <__memory/addressof.h>
1819
# include <__memory/unique_ptr.h>
1920
# include <__new/exceptions.h>
2021
# include <__ostream/put_character_sequence.h>
@@ -339,7 +340,7 @@ basic_ostream<_CharT, _Traits>& basic_ostream<_CharT, _Traits>::operator<<(const
339340

340341
template <class _CharT, class _Traits>
341342
_LIBCPP_HIDE_FROM_ABI basic_ostream<_CharT, _Traits>& operator<<(basic_ostream<_CharT, _Traits>& __os, _CharT __c) {
342-
return std::__put_character_sequence(__os, &__c, 1);
343+
return std::__put_character_sequence(__os, std::addressof(__c), 1);
343344
}
344345

345346
template <class _CharT, class _Traits>
@@ -353,9 +354,9 @@ _LIBCPP_HIDE_FROM_ABI basic_ostream<_CharT, _Traits>& operator<<(basic_ostream<_
353354
typedef ostreambuf_iterator<_CharT, _Traits> _Ip;
354355
if (std::__pad_and_output(
355356
_Ip(__os),
356-
&__c,
357-
(__os.flags() & ios_base::adjustfield) == ios_base::left ? &__c + 1 : &__c,
358-
&__c + 1,
357+
std::addressof(__c),
358+
std::addressof(__c) + (((__os.flags() & ios_base::adjustfield) == ios_base::left) ? 1 : 0),
359+
std::addressof(__c) + 1,
359360
__os,
360361
__os.fill())
361362
.failed())

‎libcxx/include/__split_buffer

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -233,7 +233,7 @@ _LIBCPP_CONSTEXPR_SINCE_CXX20 bool __split_buffer<_Tp, _Allocator>::__invariants
233233
// Postcondition: size() == size() + __n
234234
template <class _Tp, class _Allocator>
235235
_LIBCPP_CONSTEXPR_SINCE_CXX20 void __split_buffer<_Tp, _Allocator>::__construct_at_end(size_type __n) {
236-
_ConstructTransaction __tx(&this->__end_, __n);
236+
_ConstructTransaction __tx(std::addressof(this->__end_), __n);
237237
for (; __tx.__pos_ != __tx.__end_; ++__tx.__pos_) {
238238
__alloc_traits::construct(__alloc_, std::__to_address(__tx.__pos_));
239239
}
@@ -248,7 +248,7 @@ _LIBCPP_CONSTEXPR_SINCE_CXX20 void __split_buffer<_Tp, _Allocator>::__construct_
248248
template <class _Tp, class _Allocator>
249249
_LIBCPP_CONSTEXPR_SINCE_CXX20 void
250250
__split_buffer<_Tp, _Allocator>::__construct_at_end(size_type __n, const_reference __x) {
251-
_ConstructTransaction __tx(&this->__end_, __n);
251+
_ConstructTransaction __tx(std::addressof(this->__end_), __n);
252252
for (; __tx.__pos_ != __tx.__end_; ++__tx.__pos_) {
253253
__alloc_traits::construct(__alloc_, std::__to_address(__tx.__pos_), __x);
254254
}
@@ -283,7 +283,7 @@ template <class _Tp, class _Allocator>
283283
template <class _ForwardIterator>
284284
_LIBCPP_CONSTEXPR_SINCE_CXX20 void
285285
__split_buffer<_Tp, _Allocator>::__construct_at_end_with_size(_ForwardIterator __first, size_type __n) {
286-
_ConstructTransaction __tx(&this->__end_, __n);
286+
_ConstructTransaction __tx(std::addressof(this->__end_), __n);
287287
for (; __tx.__pos_ != __tx.__end_; ++__tx.__pos_, (void)++__first) {
288288
__alloc_traits::construct(__alloc_, std::__to_address(__tx.__pos_), *__first);
289289
}

‎libcxx/include/__stop_token/intrusive_shared_ptr.h

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@
1414
#include <__atomic/memory_order.h>
1515
#include <__config>
1616
#include <__cstddef/nullptr_t.h>
17+
#include <__memory/addressof.h>
1718
#include <__type_traits/is_reference.h>
1819
#include <__utility/move.h>
1920
#include <__utility/swap.h>
@@ -113,7 +114,7 @@ struct __intrusive_shared_ptr {
113114

114115
_LIBCPP_HIDE_FROM_ABI static void __decrement_ref_count(_Tp& __obj) {
115116
if (__get_atomic_ref_count(__obj).fetch_sub(1, std::memory_order_acq_rel) == 1) {
116-
delete &__obj;
117+
delete std::addressof(__obj);
117118
}
118119
}
119120

‎libcxx/include/__string/constexpr_c_functions.h

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -146,7 +146,7 @@ _LIBCPP_HIDE_FROM_ABI _LIBCPP_CONSTEXPR_SINCE_CXX14 _Tp* __constexpr_memchr(_Tp*
146146
return nullptr;
147147
} else {
148148
char __value_buffer = 0;
149-
__builtin_memcpy(&__value_buffer, &__value, sizeof(char));
149+
__builtin_memcpy(&__value_buffer, std::addressof(__value), sizeof(char));
150150
return static_cast<_Tp*>(__builtin_memchr(__str, __value_buffer, __count));
151151
}
152152
}

‎libcxx/include/__thread/thread.h

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@
1616
#include <__exception/terminate.h>
1717
#include <__functional/hash.h>
1818
#include <__functional/unary_function.h>
19+
#include <__memory/addressof.h>
1920
#include <__memory/unique_ptr.h>
2021
#include <__mutex/mutex.h>
2122
#include <__system_error/throw_system_error.h>
@@ -215,7 +216,7 @@ thread::thread(_Fp&& __f, _Args&&... __args) {
215216
_TSPtr __tsp(new __thread_struct);
216217
typedef tuple<_TSPtr, __decay_t<_Fp>, __decay_t<_Args>...> _Gp;
217218
unique_ptr<_Gp> __p(new _Gp(std::move(__tsp), std::forward<_Fp>(__f), std::forward<_Args>(__args)...));
218-
int __ec = std::__libcpp_thread_create(&__t_, &__thread_proxy<_Gp>, __p.get());
219+
int __ec = std::__libcpp_thread_create(&__t_, std::addressof(__thread_proxy<_Gp>), __p.get());
219220
if (__ec == 0)
220221
__p.release();
221222
else

‎libcxx/include/cwchar

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -107,6 +107,7 @@ size_t wcsrtombs(char* restrict dst, const wchar_t** restrict src, size_t len,
107107
#else
108108
# include <__config>
109109
# include <__cstddef/size_t.h>
110+
# include <__memory/addressof.h>
110111
# include <__type_traits/copy_cv.h>
111112
# include <__type_traits/is_constant_evaluated.h>
112113
# include <__type_traits/is_equality_comparable.h>
@@ -237,7 +238,7 @@ _LIBCPP_HIDE_FROM_ABI _LIBCPP_CONSTEXPR_SINCE_CXX14 _Tp* __constexpr_wmemchr(_Tp
237238
# if __has_builtin(__builtin_wmemchr)
238239
if (!__libcpp_is_constant_evaluated()) {
239240
wchar_t __value_buffer = 0;
240-
__builtin_memcpy(&__value_buffer, &__value, sizeof(wchar_t));
241+
__builtin_memcpy(&__value_buffer, std::addressof(__value), sizeof(wchar_t));
241242
return reinterpret_cast<_Tp*>(
242243
__builtin_wmemchr(reinterpret_cast<__copy_cv_t<_Tp, wchar_t>*>(__str), __value_buffer, __count));
243244
}

0 commit comments

Comments
 (0)