Let vptr be the pointer to the vtable which is carried along objects whose classes are subject to virtual functions.
Alteration of the 'vptr' is likely not intended behavior. However, such alterations cannot be detected as illegal memory accesses, since the pointer lies in boundaries of allocated memory. 'Efence' and 'valgrind/memcheck' won't help--to my knowledge.
Nevertheless, unintended vptr change may lead to serious trouble. If the vptr is altered to point to arbitrary memory, then a delete operator is likely to cause an immediate segmentation fault.
Is there anything that may set 'guards' on vtables, or on pointers to vtables, so that any alteration is monitored?
Clang++ does not seem to do the whole job. Given
#include <string.h>
#include <stdio.h>
struct X { virtual ~X() {} };
int main(int argc, char** argv)
{
X x;
memset((void*)&x, 0, sizeof(X));
printf("<before exit>\n");
return 0;
}
Compiled and executed ...
> clang++ -fsanitize=undefined -fsanitize=vptr tmp.cpp -o test
> ./test
Detects the violation upon call to 'virtual ~X()'.
<before exit>
<unknown>: runtime error: member call on address 0xbfe30ab8 which does not point to an object of type 'X'
0xbfe30ab8: note: object has invalid vptr
74 0b e3 bf 00 00 00 00 4d 46 48 b7 74 0b e3 bf 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
^~~~~~~~~~~
invalid vptr
The same does not work for
...
X* x_p = new X();
memset((void*)x_p, 0, sizeof(X));
delete x_p;
printf("<before exit>\n");
...
A detector of vptr corruption should set some type of 'watch points' on the vptr-s of all objects.
