Check next shadow byte if partial granule. Add test case.

Author: thurstond

compiler-rt/lib/asan/asan_errors.cpp

@@ -605,10 +605,13 @@ static void PrintShadowMemoryForAddress(uptr addr) {
 static void CheckPoisonRecords(uptr addr) {
   if (!AddrIsInMem(addr))
     return;
-  uptr shadow_addr = MemToShadow(addr);
-  unsigned char poison_magic = *(reinterpret_cast<u8 *>(shadow_addr));
 
-  if (poison_magic != kAsanUserPoisonedMemoryMagic)
+  u8 *shadow_addr = (u8 *)MemToShadow(addr);
+  // If we are in the partial right redzone, look at the next shadow byte.
+  if (*shadow_addr > 0 && *shadow_addr < 128) shadow_addr++;
+  u8 shadow_val = *shadow_addr;
+
+  if (shadow_val != kAsanUserPoisonedMemoryMagic)
     return;
 
   Printf("\n");

compiler-rt/test/asan/TestCases/use-after-poison-history-size-partial-granule.cpp

@@ -0,0 +1,40 @@
+// Check that __asan_poison_memory_region and ASAN_OPTIONS=poison_history_size work.
+//
+// RUN: %clangxx_asan -O0 %s -o %t && env ASAN_OPTIONS=poison_history_size=1000 not %run %t 20 2>&1 | FileCheck %s
+//
+// Partial granule
+// RUN: %clangxx_asan -O0 %s -o %t && env ASAN_OPTIONS=poison_history_size=1000 not %run %t    2>&1 | FileCheck %s
+
+#include <stdio.h>
+#include <stdlib.h>
+
+extern "C" void __asan_poison_memory_region(void *, size_t);
+extern "C" void __asan_unpoison_memory_region(void *, size_t);
+
+void honey_ive_poisoned_the_memory(char *x) {
+  __asan_poison_memory_region(x + 10, 20);
+}
+
+void foo(char *x) { honey_ive_poisoned_the_memory(x); }
+
+int main(int argc, char **argv) {
+  char *x = new char[64];
+  x[10] = 0;
+  foo(x);
+  // Bytes [0,   9]: addressable
+  // Bytes [10,  31]: poisoned by A
+  // Bytes [32,  63]: addressable
+
+  int res = x[argc * 10]; // BOOOM
+  // CHECK: ERROR: AddressSanitizer: use-after-poison
+  // CHECK: main{{.*}}use-after-poison-history-size-partial-granule.cpp:[[@LINE-2]]
+
+  // CHECK: Memory was manually poisoned by thread T0:
+  // CHECK: honey_ive_poisoned_the_memory{{.*}}use-after-poison-history-size-partial-granule.cpp:[[@LINE-18]]
+  // CHECK: foo{{.*}}use-after-poison-history-size-partial-granule.cpp:[[@LINE-16]]
+  // CHECK: main{{.*}}use-after-poison-history-size-partial-granule.cpp:[[@LINE-12]]
+
+  delete[] x;
+
+  return 0;
+}