Re: [C PATCH 4/4] introduce ubsan checking for assigment of VM types 4/4

[Martin Uecker via Gcc-patches]

    c: introduce ubsan checking for assigment of VM types 4/4
    
    Support instrumentation of functions called via pointers.  To do so,
    record the declaration with the parameter types, so that it can be
    retrieved later.
    
    gcc/c:
            c-decl.cc (get_parm_info): Record function declaration
            for arguments.
            c-type.cc (process_vm_constraints): Instrument functions
            called via pointers.
    
    gcc/testsuide/gcc.dg:
            * ubsan/vm-bounds-2.c: Add warning.
            * ubsan/vm-bounds-5.c: New test.

diff --git a/gcc/c/c-decl.cc b/gcc/c/c-decl.cc
index 1af51c4acfc..c33adf7e5fe 100644
--- a/gcc/c/c-decl.cc
+++ b/gcc/c/c-decl.cc
@@ -8410,6 +8410,9 @@ get_parm_info (bool ellipsis, tree expr)
                 declared types.  The back end may override this later.  */
              DECL_ARG_TYPE (decl) = type;
              types = tree_cons (0, type, types);
+
+             /* Record the decl for use of UBSan bounds checking.  */
+             TREE_PURPOSE (types) = decl;
            }
          break;
 
diff --git a/gcc/c/c-typeck.cc b/gcc/c/c-typeck.cc
index aeddac315fc..43e7b96a55f 100644
--- a/gcc/c/c-typeck.cc
+++ b/gcc/c/c-typeck.cc
@@ -3601,9 +3601,20 @@ process_vm_constraints (location_t location,
        }
       else
        {
-         /* Functions called via pointers are not yet supported.  */
-         return void_node;
+         while (FUNCTION_TYPE != TREE_CODE (function))
+           function = TREE_TYPE (function);
+
+         args = TREE_PURPOSE (TYPE_ARG_TYPES (function));
+
+         if (!args)
+           {
+             /* FIXME: this can happen when forming composite types for the
+                conditional operator.  */
+             warning_at (location, 0, "Function call not instrumented.");
+             return void_node;
+           }
        }
+      gcc_assert (PARM_DECL == TREE_CODE (args));
     }
 
   FOR_EACH_VEC_SAFE_ELT (instr_vec, i, d)
diff --git a/gcc/testsuite/gcc.dg/ubsan/vm-bounds-2.c 
b/gcc/testsuite/gcc.dg/ubsan/vm-bounds-2.c
index 22f06231eaa..093cbddd2ea 100644
--- a/gcc/testsuite/gcc.dg/ubsan/vm-bounds-2.c
+++ b/gcc/testsuite/gcc.dg/ubsan/vm-bounds-2.c
@@ -31,7 +31,7 @@ void f(void)
 
        int u = 3; int v = 4;
        char a[u][v];
-       (1 ? f1 : f2)(u, v, a);
+       (1 ? f1 : f2)(u, v, a); /* { dg-warning "Function call not 
instrumented." } */
 }
 
 /* size expression in parameter */
diff --git a/gcc/testsuite/gcc.dg/ubsan/vm-bounds-5.c 
b/gcc/testsuite/gcc.dg/ubsan/vm-bounds-5.c
new file mode 100644
index 00000000000..1a251e39deb
--- /dev/null
+++ b/gcc/testsuite/gcc.dg/ubsan/vm-bounds-5.c
@@ -0,0 +1,72 @@
+/* { dg-do run } */
+/* { dg-options "-fsanitize=vla-bound" } */
+
+
+void foo1(void (*p)(int n, char (*a)[n]))
+{
+       char A0[3];
+       (*p)(3, &A0);
+       (*p)(4, &A0);   /* */
+       /* { dg-output "bound 4 of type 'char \\\[\\\*\\\]' does not match 
bound 3 of type 'char \\\[3\\\]'\[^\n\r]*(\n|\r\n|\r)" } */
+}
+
+void b0(int n, char (*a)[n]) { }
+
+
+int n;
+
+void foo2(void (*p)(int n, char (*a)[n]))
+{
+       n = 4;
+       char A0[3];
+       (*p)(3, &A0);
+       (*p)(4, &A0);
+       /* { dg-output "\[^\n\r]*bound 4 of type 'char \\\[\\\*\\\]' does not 
match bound 3 of type 'char \\\[3\\\]'\[^\n\r]*(\n|\r\n|\r)" } */
+}
+
+void foo3(void (*p)(int n0, char (*a)[n]))
+{
+       n = 4;
+       char A0[3];
+       (*p)(3, &A0);   /* */
+       /* { dg-output "\[^\n\r]*bound 4 of type 'char \\\[\\\*\\\]' does not 
match bound 3 of type 'char \\\[3\\\]'\[^\n\r]*(\n|\r\n|\r)" } */
+       (*p)(4, &A0);   /* */
+       /* { dg-output "\[^\n\r]*bound 4 of type 'char \\\[\\\*\\\]' does not 
match bound 3 of type 'char \\\[3\\\]'\[^\n\r]*(\n|\r\n|\r)" } */
+}
+
+void foo4(void (*p)(int n, char (*a)[n]))
+{
+       n = 3;
+       char A0[3];
+       (*p)(3, &A0);
+       (*p)(4, &A0);   /* */
+       /* { dg-output "\[^\n\r]*bound 4 of type 'char \\\[\\\*\\\]' does not 
match bound 3 of type 'char \\\[3\\\]'" } */
+}
+
+
+void foo5(void (*p)(int n0, char (*a)[n]))
+{
+       n = 3;
+       char A0[3];
+       (*p)(3, &A0);
+       (*p)(4, &A0);
+}
+
+
+void b1(int n0, char (*a)[n]) { }
+
+
+
+int main()
+{
+       foo1(&b0);
+
+       foo2(&b1);
+       foo3(&b1); // we should diagnose mismatch and run-time discrepancies
+
+       foo4(&b1);
+       foo5(&b1); // we should diagnose mismatch and run-time discrepancies
+}
+
+
+