From b5a6a725e56d2769e874366b5398f23adba7cd64 Mon Sep 17 00:00:00 2001
From: Saran Tunyasuvunakool <stunya@google.com>
Date: Fri, 27 May 2022 17:33:56 -0700
Subject: [PATCH] Asan-poison padding regions in mjModel and mjData buffers.

This allows us to detect reads and writes that are logically out of bounds.

PiperOrigin-RevId: 451520772
Change-Id: I614a8062c404d97148166bcd37db399420956d8b
---
 src/engine/engine_io.c | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/src/engine/engine_io.c b/src/engine/engine_io.c
index 5a088f15..6fdf7d42 100644
--- a/src/engine/engine_io.c
+++ b/src/engine/engine_io.c
@@ -27,6 +27,13 @@
 #include "engine/engine_util_errmem.h"
 #include "engine/engine_vfs.h"
 
+#ifdef ADDRESS_SANITIZER
+#include <sanitizer/asan_interface.h>
+#else
+#define ASAN_POISON_MEMORY_REGION(addr, size) ((void)(addr), (void)(size))
+#define ASAN_UNPOISON_MEMORY_REGION(addr, size) ((void)(addr), (void)(size))
+#endif
+
 #ifdef MEMORY_SANITIZER
 #include <sanitizer/msan_interface.h>
 #endif
@@ -330,6 +337,7 @@ static void mj_setPtrModel(mjModel* m) {
   // assign pointers with padding
 #define X(type, name, nr, nc)                                           \
   m->name = (type*)(ptr + SKIP((intptr_t)ptr, sizeof(type)));           \
+  ASAN_POISON_MEMORY_REGION(ptr, PTRDIFF(m->name, ptr));                \
   ptr += SKIP((intptr_t)ptr, sizeof(type)) + sizeof(type)*(m->nr)*(nc);
 
   MJMODEL_POINTERS
@@ -754,6 +762,7 @@ static void mj_setPtrData(const mjModel* m, mjData* d) {
   // assign pointers with padding
 #define X(type, name, nr, nc)                                           \
   d->name = (type*)(ptr + SKIP((intptr_t)ptr, sizeof(type)));           \
+  ASAN_POISON_MEMORY_REGION(ptr, PTRDIFF(d->name, ptr));                \
   ptr += SKIP((intptr_t)ptr, sizeof(type)) + sizeof(type)*(m->nr)*(nc);
 
   MJDATA_POINTERS
@@ -919,7 +928,16 @@ static void _resetData(const mjModel* m, mjData* d, unsigned char debug_value) {
   //------------------------------ clear buffer, set defaults
 
   // fill buffer with debug_value (normally 0)
+#ifdef ADDRESS_SANITIZER
+  {
+    #define X(type, name, nr, nc) memset(d->name, (int)debug_value, sizeof(type)*(m->nr)*(nc));
+    MJDATA_POINTERS_PREAMBLE(m)
+    MJDATA_POINTERS
+    #undef X
+  }
+#else
   memset(d->buffer, (int)debug_value, d->nbuffer);
+#endif
 
 #ifdef MEMORY_SANITIZER
   // Tell msan to treat the entire buffer as uninitialized