blob: 1a489aae963cb45270406331db79b6484a71445a (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
|
// run
// Copyright 2011 The Go Authors. All rights reserved.
// Use of this source code is governed by a BSD-style
// license that can be found in the LICENSE file.
package main
import "unsafe"
// Having a big address space means that indexing
// at a 256 MB offset from a nil pointer might not
// cause a memory access fault. This test checks
// that Go is doing the correct explicit checks to catch
// these nil pointer accesses, not just relying on the hardware.
var dummy [256 << 20]byte // give us a big address space
func main() {
// the test only tests what we intend to test
// if dummy starts in the first 256 MB of memory.
// otherwise there might not be anything mapped
// at the address that might be accidentally
// dereferenced below.
if uintptr(unsafe.Pointer(&dummy)) > 256<<20 {
panic("dummy too far out")
}
shouldPanic(p1)
shouldPanic(p2)
shouldPanic(p3)
shouldPanic(p4)
shouldPanic(p5)
shouldPanic(p6)
shouldPanic(p7)
shouldPanic(p8)
shouldPanic(p9)
shouldPanic(p10)
}
func shouldPanic(f func()) {
defer func() {
if recover() == nil {
panic("memory reference did not panic")
}
}()
f()
}
func p1() {
// Array index.
var p *[1 << 30]byte = nil
println(p[256<<20]) // very likely to be inside dummy, but should panic
}
var xb byte
func p2() {
var p *[1 << 30]byte = nil
xb = 123
// Array index.
println(p[uintptr(unsafe.Pointer(&xb))]) // should panic
}
func p3() {
// Array to slice.
var p *[1 << 30]byte = nil
var x []byte = p[0:] // should panic
_ = x
}
var q *[1 << 30]byte
func p4() {
// Array to slice.
var x []byte
var y = &x
*y = q[0:] // should crash (uses arraytoslice runtime routine)
}
func fb([]byte) {
panic("unreachable")
}
func p5() {
// Array to slice.
var p *[1 << 30]byte = nil
fb(p[0:]) // should crash
}
func p6() {
// Array to slice.
var p *[1 << 30]byte = nil
var _ []byte = p[10 : len(p)-10] // should crash
}
type T struct {
x [256 << 20]byte
i int
}
func f() *T {
return nil
}
var y *T
var x = &y
func p7() {
// Struct field access with large offset.
println(f().i) // should crash
}
func p8() {
// Struct field access with large offset.
println((*x).i) // should crash
}
func p9() {
// Struct field access with large offset.
var t *T
println(&t.i) // should crash
}
func p10() {
// Struct field access with large offset.
var t *T
println(t.i) // should crash
}
|
