Skip to content

ubsan finds null pointer dereference in legacy code computing the equivalent of offset  #73644

Open

Description

Description

macro CONTAINING_RECORD in

#define CONTAINING_RECORD(address, type, field) ((type *)( \
dereferences NULL pointer prior to taking address of such dereference.

ubsan runtime will complain about this.

The code contains what appears to be legacy idiomatic code for computing offsetof(). offsetof() was a late addition to C.

I've confirmed that for clang-14 for C and C++ programs, ubsan will not complain about what goes on underneath the covers of offsetof.

It would be nice of some compile time tool could find this; perhaps there's some flag to clang, msvcc or gcc that can sniff these out?

grepping and hand editing turns up these suspicious code smells:

./mono/mono/eglib/glib.h:#   define offsetof(s_name,n_name) (size_t)(char *)&(((s_name*)0)->m_name)
./coreclr/nativeaot/Runtime/CommonMacros.h:#define offsetof(s,m)   (uintptr_t)( (intptr_t)&reinterpret_cast<const volatile char&>((((s *)0)->m)) )
./coreclr/pal/src/include/pal/list.h:                                                  (ULONG_PTR)(&((type *)0)->field)))

The macro definitions look especialy smelly.

I do not know all of the clients of pal/list.h, nor the legacy requirements, etc, etc.

I think we should "program to the tool" rather than suppressing errors from this construct; the suppression is likely to be a blunt insrument.

Reproduction Steps

compile -fsanitize=address without suppressions and run without suppressions, and hope your test triggers runtime error

runtime error: member access within null pointer of type

Expected behavior

no runtime errors when there are no suppressions

Actual behavior

runtime errors when there are no suppressions

Regression?

No response

Known Workarounds

No response

Configuration

No response

Other information

No response

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions