debugging/gcc
[[TOC]]
GCC
Static-Analyzer
Example: Static-Analyzer - Use after free
Source code
use_after_free.c++
#include <iostream> int main(int argc, char *argv[]) { char *charArray = new char[10]; delete [] charArray; std::cout << charArray[0] << std::endl; }
Set up compiler environment
module add compiler/gnu/11
Compile
c++ -fanalyzer use_after_free.c++ -o use_after_free
use_after_free.c++: In function ‘int main(int, char**)’: use_after_free.c++:6:29: warning: dereference of NULL ‘charArray’ [CWE-476] [-Wanalyzer-null-dereference] 6 | std::cout << charArray[0] << std::endl; | ~~~~~~~~~~~^ ‘int main(int, char**)’: events 1-5 | | 4 | char *charArray = new char[10]; | | ^ | | | | | (1) allocated here | 5 | delete [] charArray; | | ~~~~~~~~~~~~~~~~~~~ | | | | | (2) assuming ‘charArray’ is NULL | | (3) following ‘false’ branch (when ‘charArray’ is NULL)... | 6 | std::cout << charArray[0] << std::endl; | | ~~~~~~~~~~~~ | | | | | (4) ...to here | | (5) dereference of NULL ‘charArray’ | use_after_free.c++:6:29: warning: use after ‘delete[]’ of ‘charArray’ [CWE-416] [-Wanalyzer-use-after-free] 6 | std::cout << charArray[0] << std::endl; | ~~~~~~~~~~~^ ‘int main(int, char**)’: events 1-6 | | 4 | char *charArray = new char[10]; | | ^ | | | | | (1) allocated here | 5 | delete [] charArray; | | ~~~~~~~~~~~~~~~~~~~ | | | | | | | (4) ...to here | | | (5) deleted here | | (2) assuming ‘charArray’ is non-NULL | | (3) following ‘true’ branch (when ‘charArray’ is non-NULL)... | 6 | std::cout << charArray[0] << std::endl; | | ~~~~~~~~~~~~ | | | | | (6) use after ‘delete[]’ of ‘charArray’; deleted at (5) |
Sanitizer
- Wikipedia: Address Sanitizer
- AddressSanitizer with gcc
- Available runtime config options
- Run-time flags)
- Environment variable
ASAN_OPTIONS="help=1"
Example: Sanitizer - Use after free
Source code
use_after_free.c++
#include <iostream> int main(int argc, char *argv[]) { char *charArray = new char[10]; delete [] charArray; std::cout << charArray[0] << std::endl; }
Set up compiler environment
module add compiler/gnu/11
Compile
c++ -fsanitize=address -g use_after_free.c++ -o use_after_free
Execute
./use_after_free
================================================================= ==145732==ERROR: AddressSanitizer: heap-use-after-free on address 0x602000000010 at pc 0x000000400c2a bp 0x7fff611fb3e0 sp 0x7fff611fb3d8 READ of size 1 at 0x602000000010 thread T0 #0 0x400c29 in main /home/hk-project-scs/bq0742/use_after_free.c++:6 #1 0x1478fc16a492 in __libc_start_main (/lib64/libc.so.6+0x23492) #2 0x400b0d in _start (/hkfs/home/project/hk-project-scs/bq0742/use_after_free+0x400b0d) 0x602000000010 is located 0 bytes inside of 10-byte region [0x602000000010,0x60200000001a) freed by thread T0 here: #0 0x1478fcf70217 in operator delete[](void*) (/opt/gcc/11/lib64/libasan.so.6+0xb3217) #1 0x400bf5 in main /home/hk-project-scs/bq0742/use_after_free.c++:5 #2 0x1478fc16a492 in __libc_start_main (/lib64/libc.so.6+0x23492) previously allocated by thread T0 here: #0 0x1478fcf6f857 in operator new[](unsigned long) (/opt/gcc/11/lib64/libasan.so.6+0xb2857) #1 0x400bde in main /home/hk-project-scs/bq0742/use_after_free.c++:4 #2 0x1478fc16a492 in __libc_start_main (/lib64/libc.so.6+0x23492) ...
Example: Sanitizer - Division by zero
Source code
division_by_zero.c++
#include <iostream> int main(int argc, char *argv[]) { int a=1, b=0; std::cout << a/b << std::endl; }
Set up compiler environment
module add compiler/gnu/11
Compile
c++ -fsanitize=undefined division_by_zero.c++ -o division_by_zero
Execute
./division_by_zero
division_by_zero.c++:5:19: runtime error: division by zero Floating point exception (core dumped)
Example: Sanitizer - Data race
Source code
data_race.c++
#include <iostream> int main () { int i = 0; #pragma omp parallel ++; istd::cout << i << std::endl; }
Set up compiler environment
module add compiler/gnu/11
Compile
c++ -fsanitize=thread -fopenmp -g data_race.c++ -o data_race
Execute
./data_race
================== WARNING: ThreadSanitizer: data race (pid=151519) Write of size 4 at 0x7ffc0fd11148 by thread T144: #0 main._omp_fn.0 /home/hk-project-scs/bq0742/data_race.c++:6 (data_race+0x400d0b) #1 <null> <null> (libgomp.so.1+0x1d205) Previous write of size 4 at 0x7ffc0fd11148 by thread T150: #0 main._omp_fn.0 /home/hk-project-scs/bq0742/data_race.c++:6 (data_race+0x400d0b) #1 <null> <null> (libgomp.so.1+0x1d205) Location is stack of main thread. Location is global '<null>' at 0x000000000000 ([stack]+0x00000001f148) Thread T144 (tid=151664, running) created by main thread at: #0 pthread_create <null> (libtsan.so.0+0x5f375) #1 <null> <null> (libgomp.so.1+0x1d81b) #2 __libc_start_main <null> (libc.so.6+0x23492) Thread T150 (tid=151670, running) created by main thread at: #0 pthread_create <null> (libtsan.so.0+0x5f375) #1 <null> <null> (libgomp.so.1+0x1d81b) #2 __libc_start_main <null> (libc.so.6+0x23492)