(original) (raw)

I used the instruction from here:

to compile the following c file

#include
#include
#include


void \_\_sanitizer\_cov\_trace\_pc\_guard\_init(uint32\_t \*start,
uint32\_t \*stop) {
static uint64\_t N; // Counter for the guards.
if (start == stop || \*start) return; // Initialize only once.
printf("INIT: %p %p\\n", start, stop);
for (uint32\_t \*x = start; x < stop; x++)
\*x = ++N; // Guards should start from 1.
}

void \_\_sanitizer\_cov\_trace\_pc\_guard(uint32\_t \*guard) {
if (!\*guard) return; // Duplicate the guard check.

void \*PC = \_\_builtin\_return\_address(0);
char PcDescr\[1024\];

}


int addition(int num1, int num2)
{
int sum;
sum = num1+num2;
if(sum)
return sum;
else
return 0;

}

int substraction(int num1, int num2)
{
int sum;
sum = num1-num2;

if(sum)
return sum;
else
return -1;
}

int main()
{
int var1, var2,res;
printf("Enter number 1: ");
scanf("%d",&var1);
printf("Enter number 2: ");
scanf("%d",&var2);

if(var1 >1){

res = addition(var1, var2);
printf ("Output: %d", res);
}
if(var2 > 2){
res = substraction(var1, var2);
printf ("Output2: %d", res);
}

return 0;
}

test.sh

export CC=clang
export LDFLAGS="-O0 -g -fsanitize-coverage=trace-pc-guard -fsanitize-coverage-allowlist=./whitelist.txt -fsanitize-coverage-blocklist=./blacklist.txt"

$CC $LD\_LFAGS test.c -o test

blacklist.txt contains:

fun:addition\*

and whitelist.txt contains

src:\*
fun:\*

Basically I want everything to be instrumented except function addition. I'm using clang 11.

The problem is if I look in the disassembly of the binary sanitizer\_cov\_trace\_pc\_guard in any of the 3 functions: main/addition/substraction. It should instrument all , except addition.