debug/tst-chk1.c

   1 /* Copyright (C) 2004-2013 Free Software Foundation, Inc.
   2    This file is part of the GNU C Library.
   3    Contributed by Jakub Jelinek <jakub@redhat.com>, 2004.
   4
   5    The GNU C Library is free software; you can redistribute it and/or
   6    modify it under the terms of the GNU Lesser General Public
   7    License as published by the Free Software Foundation; either
   8    version 2.1 of the License, or (at your option) any later version.
   9
  10    The GNU C Library is distributed in the hope that it will be useful,
  11    but WITHOUT ANY WARRANTY; without even the implied warranty of
  12    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  13    Lesser General Public License for more details.
  14
  15    You should have received a copy of the GNU Lesser General Public
  16    License along with the GNU C Library; if not, see
  17    <http://www.gnu.org/licenses/>.  */
  18
  19 #include <assert.h>
  20 #include <fcntl.h>
  21 #include <locale.h>
  22 #include <obstack.h>
  23 #include <paths.h>
  24 #include <setjmp.h>
  25 #include <signal.h>
  26 #include <stdio.h>
  27 #include <stdlib.h>
  28 #include <string.h>
  29 #include <unistd.h>
  30 #include <wchar.h>
  31 #include <sys/poll.h>
  32 #include <sys/select.h>
  33 #include <sys/socket.h>
  34 #include <sys/un.h>
  35
  36
  37 #define obstack_chunk_alloc malloc
  38 #define obstack_chunk_free free
  39
  40 char *temp_filename;
  41 static void do_prepare (void);
  42 static int do_test (void);
  43 #define PREPARE(argc, argv) do_prepare ()
  44 #define TEST_FUNCTION do_test ()
  45 #include "../test-skeleton.c"
  46
  47 static void
  48 do_prepare (void)
  49 {
  50   int temp_fd = create_temp_file ("tst-chk1.", &temp_filename);
  51   if (temp_fd == -1)
  52     {
  53       printf ("cannot create temporary file: %m\n");
  54       exit (1);
  55     }
  56
  57   const char *strs = "abcdefgh\nABCDEFGHI\nabcdefghij\nABCDEFGHIJ";
  58   if ((size_t) write (temp_fd, strs, strlen (strs)) != strlen (strs))
  59     {
  60       puts ("could not write test strings into file");
  61       unlink (temp_filename);
  62       exit (1);
  63     }
  64 }
  65
  66 volatile int chk_fail_ok;
  67 volatile int ret;
  68 jmp_buf chk_fail_buf;
  69
  70 static void
  71 handler (int sig)
  72 {
  73   if (chk_fail_ok)
  74     {
  75       chk_fail_ok = 0;
  76       longjmp (chk_fail_buf, 1);
  77     }
  78   else
  79     _exit (127);
  80 }
  81
  82 char buf[10];
  83 wchar_t wbuf[10];
  84 volatile size_t l0;
  85 volatile char *p;
  86 volatile wchar_t *wp;
  87 const char *str1 = "JIHGFEDCBA";
  88 const char *str2 = "F";
  89 const char *str3 = "%s%n%s%n";
  90 const char *str4 = "Hello, ";
  91 const char *str5 = "World!\n";
  92 const wchar_t *wstr1 = L"JIHGFEDCBA";
  93 const wchar_t *wstr2 = L"F";
  94 const wchar_t *wstr3 = L"%s%n%s%n";
  95 const wchar_t *wstr4 = L"Hello, ";
  96 const wchar_t *wstr5 = L"World!\n";
  97 char buf2[10] = "%s";
  98 int num1 = 67;
  99 int num2 = 987654;
 100
 101 #define FAIL() \
 102   do { printf ("Failure on line %d\n", __LINE__); ret = 1; } while (0)
 103 #define CHK_FAIL_START \
 104   chk_fail_ok = 1;                              \
 105   if (! setjmp (chk_fail_buf))                  \
 106     {
 107 #define CHK_FAIL_END \
 108       chk_fail_ok = 0;                          \
 109       FAIL ();                                  \
 110     }
 111 #if __USE_FORTIFY_LEVEL >= 2 && (!defined __cplusplus || defined __va_arg_pack)
 112 # define CHK_FAIL2_START CHK_FAIL_START
 113 # define CHK_FAIL2_END CHK_FAIL_END
 114 #else
 115 # define CHK_FAIL2_START
 116 # define CHK_FAIL2_END
 117 #endif
 118
 119 static int
 120 do_test (void)
 121 {
 122   struct sigaction sa;
 123   sa.sa_handler = handler;
 124   sa.sa_flags = 0;
 125   sigemptyset (&sa.sa_mask);
 126
 127   sigaction (SIGABRT, &sa, NULL);
 128
 129   /* Avoid all the buffer overflow messages on stderr.  */
 130   int fd = open (_PATH_DEVNULL, O_WRONLY);
 131   if (fd == -1)
 132     close (STDERR_FILENO);
 133   else
 134     {
 135       dup2 (fd, STDERR_FILENO);
 136       close (fd);
 137     }
 138   setenv ("LIBC_FATAL_STDERR_", "1", 1);
 139
 140   struct A { char buf1[9]; char buf2[1]; } a;
 141   struct wA { wchar_t buf1[9]; wchar_t buf2[1]; } wa;
 142
 143   printf ("Test checking routines at fortify level %d\n",
 144 #ifdef __USE_FORTIFY_LEVEL
 145           (int) __USE_FORTIFY_LEVEL
 146 #else
 147           0
 148 #endif
 149           );
 150
 151 #if defined __USE_FORTIFY_LEVEL && !defined __fortify_function
 152   printf ("Test skipped");
 153   if (l0 == 0)
 154     return 0;
 155 #endif
 156
 157   /* These ops can be done without runtime checking of object size.  */
 158   memcpy (buf, "abcdefghij", 10);
 159   memmove (buf + 1, buf, 9);
 160   if (memcmp (buf, "aabcdefghi", 10))
 161     FAIL ();
 162
 163   if (mempcpy (buf + 5, "abcde", 5) != buf + 10
 164       || memcmp (buf, "aabcdabcde", 10))
 165     FAIL ();
 166
 167   memset (buf + 8, 'j', 2);
 168   if (memcmp (buf, "aabcdabcjj", 10))
 169     FAIL ();
 170
 171   strcpy (buf + 4, "EDCBA");
 172   if (memcmp (buf, "aabcEDCBA", 10))
 173     FAIL ();
 174
 175   if (stpcpy (buf + 8, "F") != buf + 9 || memcmp (buf, "aabcEDCBF", 10))
 176     FAIL ();
 177
 178   strncpy (buf + 6, "X", 4);
 179   if (memcmp (buf, "aabcEDX\0\0", 10))
 180     FAIL ();
 181
 182   if (sprintf (buf + 7, "%s", "67") != 2 || memcmp (buf, "aabcEDX67", 10))
 183     FAIL ();
 184
 185   if (snprintf (buf + 7, 3, "%s", "987654") != 6
 186       || memcmp (buf, "aabcEDX98", 10))
 187     FAIL ();
 188
 189   /* These ops need runtime checking, but shouldn't __chk_fail.  */
 190   memcpy (buf, "abcdefghij", l0 + 10);
 191   memmove (buf + 1, buf, l0 + 9);
 192   if (memcmp (buf, "aabcdefghi", 10))
 193     FAIL ();
 194
 195   if (mempcpy (buf + 5, "abcde", l0 + 5) != buf + 10
 196       || memcmp (buf, "aabcdabcde", 10))
 197     FAIL ();
 198
 199   memset (buf + 8, 'j', l0 + 2);
 200   if (memcmp (buf, "aabcdabcjj", 10))
 201     FAIL ();
 202
 203   strcpy (buf + 4, str1 + 5);
 204   if (memcmp (buf, "aabcEDCBA", 10))
 205     FAIL ();
 206
 207   if (stpcpy (buf + 8, str2) != buf + 9 || memcmp (buf, "aabcEDCBF", 10))
 208     FAIL ();
 209
 210   strncpy (buf + 6, "X", l0 + 4);
 211   if (memcmp (buf, "aabcEDX\0\0", 10))
 212     FAIL ();
 213
 214   if (stpncpy (buf + 5, "cd", l0 + 5) != buf + 7
 215       || memcmp (buf, "aabcEcd\0\0", 10))
 216     FAIL ();
 217
 218   if (sprintf (buf + 7, "%d", num1) != 2 || memcmp (buf, "aabcEcd67", 10))
 219     FAIL ();
 220
 221   if (snprintf (buf + 7, 3, "%d", num2) != 6 || memcmp (buf, "aabcEcd98", 10))
 222     FAIL ();
 223
 224   buf[l0 + 8] = '\0';
 225   strcat (buf, "A");
 226   if (memcmp (buf, "aabcEcd9A", 10))
 227     FAIL ();
 228
 229   buf[l0 + 7] = '\0';
 230   strncat (buf, "ZYXWV", l0 + 2);
 231   if (memcmp (buf, "aabcEcdZY", 10))
 232     FAIL ();
 233
 234   memcpy (a.buf1, "abcdefghij", l0 + 10);
 235   memmove (a.buf1 + 1, a.buf1, l0 + 9);
 236   if (memcmp (a.buf1, "aabcdefghi", 10))
 237     FAIL ();
 238
 239   if (mempcpy (a.buf1 + 5, "abcde", l0 + 5) != a.buf1 + 10
 240       || memcmp (a.buf1, "aabcdabcde", 10))
 241     FAIL ();
 242
 243   memset (a.buf1 + 8, 'j', l0 + 2);
 244   if (memcmp (a.buf1, "aabcdabcjj", 10))
 245     FAIL ();
 246
 247 #if __USE_FORTIFY_LEVEL < 2
 248   /* The following tests are supposed to crash with -D_FORTIFY_SOURCE=2
 249      and sufficient GCC support, as the string operations overflow
 250      from a.buf1 into a.buf2.  */
 251   strcpy (a.buf1 + 4, str1 + 5);
 252   if (memcmp (a.buf1, "aabcEDCBA", 10))
 253     FAIL ();
 254
 255   if (stpcpy (a.buf1 + 8, str2) != a.buf1 + 9
 256       || memcmp (a.buf1, "aabcEDCBF", 10))
 257     FAIL ();
 258
 259   strncpy (a.buf1 + 6, "X", l0 + 4);
 260   if (memcmp (a.buf1, "aabcEDX\0\0", 10))
 261     FAIL ();
 262
 263   if (sprintf (a.buf1 + 7, "%d", num1) != 2
 264       || memcmp (a.buf1, "aabcEDX67", 10))
 265     FAIL ();
 266
 267   if (snprintf (a.buf1 + 7, 3, "%d", num2) != 6
 268       || memcmp (a.buf1, "aabcEDX98", 10))
 269     FAIL ();
 270
 271   a.buf1[l0 + 8] = '\0';
 272   strcat (a.buf1, "A");
 273   if (memcmp (a.buf1, "aabcEDX9A", 10))
 274     FAIL ();
 275
 276   a.buf1[l0 + 7] = '\0';
 277   strncat (a.buf1, "ZYXWV", l0 + 2);
 278   if (memcmp (a.buf1, "aabcEDXZY", 10))
 279     FAIL ();
 280
 281 #endif
 282
 283 #if __USE_FORTIFY_LEVEL >= 1
 284   /* Now check if all buffer overflows are caught at runtime.  */
 285
 286   CHK_FAIL_START
 287   memcpy (buf + 1, "abcdefghij", l0 + 10);
 288   CHK_FAIL_END
 289
 290   CHK_FAIL_START
 291   memmove (buf + 2, buf + 1, l0 + 9);
 292   CHK_FAIL_END
 293
 294   CHK_FAIL_START
 295   p = (char *) mempcpy (buf + 6, "abcde", l0 + 5);
 296   CHK_FAIL_END
 297
 298   CHK_FAIL_START
 299   memset (buf + 9, 'j', l0 + 2);
 300   CHK_FAIL_END
 301
 302   CHK_FAIL_START
 303   strcpy (buf + 5, str1 + 5);
 304   CHK_FAIL_END
 305
 306   CHK_FAIL_START
 307   p = stpcpy (buf + 9, str2);
 308   CHK_FAIL_END
 309
 310   CHK_FAIL_START
 311   strncpy (buf + 7, "X", l0 + 4);
 312   CHK_FAIL_END
 313
 314   CHK_FAIL_START
 315   stpncpy (buf + 6, "cd", l0 + 5);
 316   CHK_FAIL_END
 317
 318 # if !defined __cplusplus || defined __va_arg_pack
 319   CHK_FAIL_START
 320   sprintf (buf + 8, "%d", num1);
 321   CHK_FAIL_END
 322
 323   CHK_FAIL_START
 324   snprintf (buf + 8, l0 + 3, "%d", num2);
 325   CHK_FAIL_END
 326
 327   CHK_FAIL_START
 328   swprintf (wbuf + 8, 3, L"%d", num1);
 329   CHK_FAIL_END
 330
 331   CHK_FAIL_START
 332   swprintf (wbuf + 8, l0 + 3, L"%d", num1);
 333   CHK_FAIL_END
 334 # endif
 335
 336   memcpy (buf, str1 + 2, l0 + 9);
 337   CHK_FAIL_START
 338   strcat (buf, "AB");
 339   CHK_FAIL_END
 340
 341   memcpy (buf, str1 + 3, l0 + 8);
 342   CHK_FAIL_START
 343   strncat (buf, "ZYXWV", l0 + 3);
 344   CHK_FAIL_END
 345
 346   CHK_FAIL_START
 347   memcpy (a.buf1 + 1, "abcdefghij", l0 + 10);
 348   CHK_FAIL_END
 349
 350   CHK_FAIL_START
 351   memmove (a.buf1 + 2, a.buf1 + 1, l0 + 9);
 352   CHK_FAIL_END
 353
 354   CHK_FAIL_START
 355   p = (char *) mempcpy (a.buf1 + 6, "abcde", l0 + 5);
 356   CHK_FAIL_END
 357
 358   CHK_FAIL_START
 359   memset (a.buf1 + 9, 'j', l0 + 2);
 360   CHK_FAIL_END
 361
 362 # if __USE_FORTIFY_LEVEL >= 2
 363 #  define O 0
 364 # else
 365 #  define O 1
 366 # endif
 367
 368   CHK_FAIL_START
 369   strcpy (a.buf1 + (O + 4), str1 + 5);
 370   CHK_FAIL_END
 371
 372   CHK_FAIL_START
 373   p = stpcpy (a.buf1 + (O + 8), str2);
 374   CHK_FAIL_END
 375
 376   CHK_FAIL_START
 377   strncpy (a.buf1 + (O + 6), "X", l0 + 4);
 378   CHK_FAIL_END
 379
 380 # if !defined __cplusplus || defined __va_arg_pack
 381   CHK_FAIL_START
 382   sprintf (a.buf1 + (O + 7), "%d", num1);
 383   CHK_FAIL_END
 384
 385   CHK_FAIL_START
 386   snprintf (a.buf1 + (O + 7), l0 + 3, "%d", num2);
 387   CHK_FAIL_END
 388 # endif
 389
 390   memcpy (a.buf1, str1 + (3 - O), l0 + 8 + O);
 391   CHK_FAIL_START
 392   strcat (a.buf1, "AB");
 393   CHK_FAIL_END
 394
 395   memcpy (a.buf1, str1 + (4 - O), l0 + 7 + O);
 396   CHK_FAIL_START
 397   strncat (a.buf1, "ZYXWV", l0 + 3);
 398   CHK_FAIL_END
 399 #endif
 400
 401
 402   /* These ops can be done without runtime checking of object size.  */
 403   wmemcpy (wbuf, L"abcdefghij", 10);
 404   wmemmove (wbuf + 1, wbuf, 9);
 405   if (wmemcmp (wbuf, L"aabcdefghi", 10))
 406     FAIL ();
 407
 408   if (wmempcpy (wbuf + 5, L"abcde", 5) != wbuf + 10
 409       || wmemcmp (wbuf, L"aabcdabcde", 10))
 410     FAIL ();
 411
 412   wmemset (wbuf + 8, L'j', 2);
 413   if (wmemcmp (wbuf, L"aabcdabcjj", 10))
 414     FAIL ();
 415
 416   wcscpy (wbuf + 4, L"EDCBA");
 417   if (wmemcmp (wbuf, L"aabcEDCBA", 10))
 418     FAIL ();
 419
 420   if (wcpcpy (wbuf + 8, L"F") != wbuf + 9 || wmemcmp (wbuf, L"aabcEDCBF", 10))
 421     FAIL ();
 422
 423   wcsncpy (wbuf + 6, L"X", 4);
 424   if (wmemcmp (wbuf, L"aabcEDX\0\0", 10))
 425     FAIL ();
 426
 427   if (swprintf (wbuf + 7, 3, L"%ls", L"987654") >= 0
 428       || wmemcmp (wbuf, L"aabcEDX98", 10))
 429     FAIL ();
 430
 431   if (swprintf (wbuf + 7, 3, L"64") != 2
 432       || wmemcmp (wbuf, L"aabcEDX64", 10))
 433     FAIL ();
 434
 435   /* These ops need runtime checking, but shouldn't __chk_fail.  */
 436   wmemcpy (wbuf, L"abcdefghij", l0 + 10);
 437   wmemmove (wbuf + 1, wbuf, l0 + 9);
 438   if (wmemcmp (wbuf, L"aabcdefghi", 10))
 439     FAIL ();
 440
 441   if (wmempcpy (wbuf + 5, L"abcde", l0 + 5) != wbuf + 10
 442       || wmemcmp (wbuf, L"aabcdabcde", 10))
 443     FAIL ();
 444
 445   wmemset (wbuf + 8, L'j', l0 + 2);
 446   if (wmemcmp (wbuf, L"aabcdabcjj", 10))
 447     FAIL ();
 448
 449   wcscpy (wbuf + 4, wstr1 + 5);
 450   if (wmemcmp (wbuf, L"aabcEDCBA", 10))
 451     FAIL ();
 452
 453   if (wcpcpy (wbuf + 8, wstr2) != wbuf + 9 || wmemcmp (wbuf, L"aabcEDCBF", 10))
 454     FAIL ();
 455
 456   wcsncpy (wbuf + 6, L"X", l0 + 4);
 457   if (wmemcmp (wbuf, L"aabcEDX\0\0", 10))
 458     FAIL ();
 459
 460   if (wcpncpy (wbuf + 5, L"cd", l0 + 5) != wbuf + 7
 461       || wmemcmp (wbuf, L"aabcEcd\0\0", 10))
 462     FAIL ();
 463
 464   if (swprintf (wbuf + 7, 3, L"%d", num2) >= 0
 465       || wmemcmp (wbuf, L"aabcEcd98", 10))
 466     FAIL ();
 467
 468   wbuf[l0 + 8] = L'\0';
 469   wcscat (wbuf, L"A");
 470   if (wmemcmp (wbuf, L"aabcEcd9A", 10))
 471     FAIL ();
 472
 473   wbuf[l0 + 7] = L'\0';
 474   wcsncat (wbuf, L"ZYXWV", l0 + 2);
 475   if (wmemcmp (wbuf, L"aabcEcdZY", 10))
 476     FAIL ();
 477
 478   wmemcpy (wa.buf1, L"abcdefghij", l0 + 10);
 479   wmemmove (wa.buf1 + 1, wa.buf1, l0 + 9);
 480   if (wmemcmp (wa.buf1, L"aabcdefghi", 10))
 481     FAIL ();
 482
 483   if (wmempcpy (wa.buf1 + 5, L"abcde", l0 + 5) != wa.buf1 + 10
 484       || wmemcmp (wa.buf1, L"aabcdabcde", 10))
 485     FAIL ();
 486
 487   wmemset (wa.buf1 + 8, L'j', l0 + 2);
 488   if (wmemcmp (wa.buf1, L"aabcdabcjj", 10))
 489     FAIL ();
 490
 491 #if __USE_FORTIFY_LEVEL < 2
 492   /* The following tests are supposed to crash with -D_FORTIFY_SOURCE=2
 493      and sufficient GCC support, as the string operations overflow
 494      from a.buf1 into a.buf2.  */
 495   wcscpy (wa.buf1 + 4, wstr1 + 5);
 496   if (wmemcmp (wa.buf1, L"aabcEDCBA", 10))
 497     FAIL ();
 498
 499   if (wcpcpy (wa.buf1 + 8, wstr2) != wa.buf1 + 9
 500       || wmemcmp (wa.buf1, L"aabcEDCBF", 10))
 501     FAIL ();
 502
 503   wcsncpy (wa.buf1 + 6, L"X", l0 + 4);
 504   if (wmemcmp (wa.buf1, L"aabcEDX\0\0", 10))
 505     FAIL ();
 506
 507   if (swprintf (wa.buf1 + 7, 3, L"%d", num2) >= 0
 508       || wmemcmp (wa.buf1, L"aabcEDX98", 10))
 509     FAIL ();
 510
 511   wa.buf1[l0 + 8] = L'\0';
 512   wcscat (wa.buf1, L"A");
 513   if (wmemcmp (wa.buf1, L"aabcEDX9A", 10))
 514     FAIL ();
 515
 516   wa.buf1[l0 + 7] = L'\0';
 517   wcsncat (wa.buf1, L"ZYXWV", l0 + 2);
 518   if (wmemcmp (wa.buf1, L"aabcEDXZY", 10))
 519     FAIL ();
 520
 521 #endif
 522
 523 #if __USE_FORTIFY_LEVEL >= 1
 524   /* Now check if all buffer overflows are caught at runtime.  */
 525
 526   CHK_FAIL_START
 527   wmemcpy (wbuf + 1, L"abcdefghij", l0 + 10);
 528   CHK_FAIL_END
 529
 530   CHK_FAIL_START
 531   wmemcpy (wbuf + 9, L"abcdefghij", l0 + 10);
 532   CHK_FAIL_END
 533
 534   CHK_FAIL_START
 535   wmemmove (wbuf + 2, wbuf + 1, l0 + 9);
 536   CHK_FAIL_END
 537
 538   CHK_FAIL_START
 539   wp = wmempcpy (wbuf + 6, L"abcde", l0 + 5);
 540   CHK_FAIL_END
 541
 542   CHK_FAIL_START
 543   wmemset (wbuf + 9, L'j', l0 + 2);
 544   CHK_FAIL_END
 545
 546   CHK_FAIL_START
 547   wcscpy (wbuf + 5, wstr1 + 5);
 548   CHK_FAIL_END
 549
 550   CHK_FAIL_START
 551   wp = wcpcpy (wbuf + 9, wstr2);
 552   CHK_FAIL_END
 553
 554   CHK_FAIL_START
 555   wcsncpy (wbuf + 7, L"X", l0 + 4);
 556   CHK_FAIL_END
 557
 558   CHK_FAIL_START
 559   wcsncpy (wbuf + 9, L"XABCDEFGH", 8);
 560   CHK_FAIL_END
 561
 562   CHK_FAIL_START
 563   wcpncpy (wbuf + 9, L"XABCDEFGH", 8);
 564   CHK_FAIL_END
 565
 566   CHK_FAIL_START
 567   wcpncpy (wbuf + 6, L"cd", l0 + 5);
 568   CHK_FAIL_END
 569
 570   wmemcpy (wbuf, wstr1 + 2, l0 + 9);
 571   CHK_FAIL_START
 572   wcscat (wbuf, L"AB");
 573   CHK_FAIL_END
 574
 575   wmemcpy (wbuf, wstr1 + 3, l0 + 8);
 576   CHK_FAIL_START
 577   wcsncat (wbuf, L"ZYXWV", l0 + 3);
 578   CHK_FAIL_END
 579
 580   CHK_FAIL_START
 581   wmemcpy (wa.buf1 + 1, L"abcdefghij", l0 + 10);
 582   CHK_FAIL_END
 583
 584   CHK_FAIL_START
 585   wmemmove (wa.buf1 + 2, wa.buf1 + 1, l0 + 9);
 586   CHK_FAIL_END
 587
 588   CHK_FAIL_START
 589   wp = wmempcpy (wa.buf1 + 6, L"abcde", l0 + 5);
 590   CHK_FAIL_END
 591
 592   CHK_FAIL_START
 593   wmemset (wa.buf1 + 9, L'j', l0 + 2);
 594   CHK_FAIL_END
 595
 596 #if __USE_FORTIFY_LEVEL >= 2
 597 # define O 0
 598 #else
 599 # define O 1
 600 #endif
 601
 602   CHK_FAIL_START
 603   wcscpy (wa.buf1 + (O + 4), wstr1 + 5);
 604   CHK_FAIL_END
 605
 606   CHK_FAIL_START
 607   wp = wcpcpy (wa.buf1 + (O + 8), wstr2);
 608   CHK_FAIL_END
 609
 610   CHK_FAIL_START
 611   wcsncpy (wa.buf1 + (O + 6), L"X", l0 + 4);
 612   CHK_FAIL_END
 613
 614   wmemcpy (wa.buf1, wstr1 + (3 - O), l0 + 8 + O);
 615   CHK_FAIL_START
 616   wcscat (wa.buf1, L"AB");
 617   CHK_FAIL_END
 618
 619   wmemcpy (wa.buf1, wstr1 + (4 - O), l0 + 7 + O);
 620   CHK_FAIL_START
 621   wcsncat (wa.buf1, L"ZYXWV", l0 + 3);
 622   CHK_FAIL_END
 623 #endif
 624
 625
 626   /* Now checks for %n protection.  */
 627
 628   /* Constant literals passed directly are always ok
 629      (even with warnings about possible bugs from GCC).  */
 630   int n1, n2;
 631   if (sprintf (buf, "%s%n%s%n", str2, &n1, str2, &n2) != 2
 632       || n1 != 1 || n2 != 2)
 633     FAIL ();
 634
 635   /* In this case the format string is not known at compile time,
 636      but resides in read-only memory, so is ok.  */
 637   if (snprintf (buf, 4, str3, str2, &n1, str2, &n2) != 2
 638       || n1 != 1 || n2 != 2)
 639     FAIL ();
 640
 641   strcpy (buf2 + 2, "%n%s%n");
 642   /* When the format string is writable and contains %n,
 643      with -D_FORTIFY_SOURCE=2 it causes __chk_fail.  */
 644   CHK_FAIL2_START
 645   if (sprintf (buf, buf2, str2, &n1, str2, &n1) != 2)
 646     FAIL ();
 647   CHK_FAIL2_END
 648
 649   CHK_FAIL2_START
 650   if (snprintf (buf, 3, buf2, str2, &n1, str2, &n1) != 2)
 651     FAIL ();
 652   CHK_FAIL2_END
 653
 654   /* But if there is no %n, even writable format string
 655      should work.  */
 656   buf2[6] = '\0';
 657   if (sprintf (buf, buf2 + 4, str2) != 1)
 658     FAIL ();
 659
 660   /* Constant literals passed directly are always ok
 661      (even with warnings about possible bugs from GCC).  */
 662   if (printf ("%s%n%s%n", str4, &n1, str5, &n2) != 14
 663       || n1 != 7 || n2 != 14)
 664     FAIL ();
 665
 666   /* In this case the format string is not known at compile time,
 667      but resides in read-only memory, so is ok.  */
 668   if (printf (str3, str4, &n1, str5, &n2) != 14
 669       || n1 != 7 || n2 != 14)
 670     FAIL ();
 671
 672   strcpy (buf2 + 2, "%n%s%n");
 673   /* When the format string is writable and contains %n,
 674      with -D_FORTIFY_SOURCE=2 it causes __chk_fail.  */
 675   CHK_FAIL2_START
 676   if (printf (buf2, str4, &n1, str5, &n1) != 14)
 677     FAIL ();
 678   CHK_FAIL2_END
 679
 680   /* But if there is no %n, even writable format string
 681      should work.  */
 682   buf2[6] = '\0';
 683   if (printf (buf2 + 4, str5) != 7)
 684     FAIL ();
 685
 686   FILE *fp = stdout;
 687
 688   /* Constant literals passed directly are always ok
 689      (even with warnings about possible bugs from GCC).  */
 690   if (fprintf (fp, "%s%n%s%n", str4, &n1, str5, &n2) != 14
 691       || n1 != 7 || n2 != 14)
 692     FAIL ();
 693
 694   /* In this case the format string is not known at compile time,
 695      but resides in read-only memory, so is ok.  */
 696   if (fprintf (fp, str3, str4, &n1, str5, &n2) != 14
 697       || n1 != 7 || n2 != 14)
 698     FAIL ();
 699
 700   strcpy (buf2 + 2, "%n%s%n");
 701   /* When the format string is writable and contains %n,
 702      with -D_FORTIFY_SOURCE=2 it causes __chk_fail.  */
 703   CHK_FAIL2_START
 704   if (fprintf (fp, buf2, str4, &n1, str5, &n1) != 14)
 705     FAIL ();
 706   CHK_FAIL2_END
 707
 708   /* But if there is no %n, even writable format string
 709      should work.  */
 710   buf2[6] = '\0';
 711   if (fprintf (fp, buf2 + 4, str5) != 7)
 712     FAIL ();
 713
 714   char *my_ptr = NULL;
 715   strcpy (buf2 + 2, "%n%s%n");
 716   /* When the format string is writable and contains %n,
 717      with -D_FORTIFY_SOURCE=2 it causes __chk_fail.  */
 718   CHK_FAIL2_START
 719   if (asprintf (&my_ptr, buf2, str4, &n1, str5, &n1) != 14)
 720     FAIL ();
 721   else
 722     free (my_ptr);
 723   CHK_FAIL2_END
 724
 725   struct obstack obs;
 726   obstack_init (&obs);
 727   CHK_FAIL2_START
 728   if (obstack_printf (&obs, buf2, str4, &n1, str5, &n1) != 14)
 729     FAIL ();
 730   CHK_FAIL2_END
 731   obstack_free (&obs, NULL);
 732
 733   my_ptr = NULL;
 734   if (asprintf (&my_ptr, "%s%n%s%n", str4, &n1, str5, &n1) != 14)
 735     FAIL ();
 736   else
 737     free (my_ptr);
 738
 739   obstack_init (&obs);
 740   if (obstack_printf (&obs, "%s%n%s%n", str4, &n1, str5, &n1) != 14)
 741     FAIL ();
 742   obstack_free (&obs, NULL);
 743
 744   if (freopen (temp_filename, "r", stdin) == NULL)
 745     {
 746       puts ("could not open temporary file");
 747       exit (1);
 748     }
 749
 750   if (gets (buf) != buf || memcmp (buf, "abcdefgh", 9))
 751     FAIL ();
 752   if (gets (buf) != buf || memcmp (buf, "ABCDEFGHI", 10))
 753     FAIL ();
 754
 755 #if __USE_FORTIFY_LEVEL >= 1
 756   CHK_FAIL_START
 757   if (gets (buf) != buf)
 758     FAIL ();
 759   CHK_FAIL_END
 760 #endif
 761
 762   rewind (stdin);
 763
 764   if (fgets (buf, sizeof (buf), stdin) != buf
 765       || memcmp (buf, "abcdefgh\n", 10))
 766     FAIL ();
 767   if (fgets (buf, sizeof (buf), stdin) != buf || memcmp (buf, "ABCDEFGHI", 10))
 768     FAIL ();
 769
 770   rewind (stdin);
 771
 772   if (fgets (buf, l0 + sizeof (buf), stdin) != buf
 773       || memcmp (buf, "abcdefgh\n", 10))
 774     FAIL ();
 775
 776 #if __USE_FORTIFY_LEVEL >= 1
 777   CHK_FAIL_START
 778   if (fgets (buf, sizeof (buf) + 1, stdin) != buf)
 779     FAIL ();
 780   CHK_FAIL_END
 781
 782   CHK_FAIL_START
 783   if (fgets (buf, l0 + sizeof (buf) + 1, stdin) != buf)
 784     FAIL ();
 785   CHK_FAIL_END
 786 #endif
 787
 788   rewind (stdin);
 789
 790   if (fgets_unlocked (buf, sizeof (buf), stdin) != buf
 791       || memcmp (buf, "abcdefgh\n", 10))
 792     FAIL ();
 793   if (fgets_unlocked (buf, sizeof (buf), stdin) != buf
 794       || memcmp (buf, "ABCDEFGHI", 10))
 795     FAIL ();
 796
 797   rewind (stdin);
 798
 799   if (fgets_unlocked (buf, l0 + sizeof (buf), stdin) != buf
 800       || memcmp (buf, "abcdefgh\n", 10))
 801     FAIL ();
 802
 803 #if __USE_FORTIFY_LEVEL >= 1
 804   CHK_FAIL_START
 805   if (fgets_unlocked (buf, sizeof (buf) + 1, stdin) != buf)
 806     FAIL ();
 807   CHK_FAIL_END
 808
 809   CHK_FAIL_START
 810   if (fgets_unlocked (buf, l0 + sizeof (buf) + 1, stdin) != buf)
 811     FAIL ();
 812   CHK_FAIL_END
 813 #endif
 814
 815   rewind (stdin);
 816
 817   if (fread (buf, 1, sizeof (buf), stdin) != sizeof (buf)
 818       || memcmp (buf, "abcdefgh\nA", 10))
 819     FAIL ();
 820   if (fread (buf, sizeof (buf), 1, stdin) != 1
 821       || memcmp (buf, "BCDEFGHI\na", 10))
 822     FAIL ();
 823
 824   rewind (stdin);
 825
 826   if (fread (buf, l0 + 1, sizeof (buf), stdin) != sizeof (buf)
 827       || memcmp (buf, "abcdefgh\nA", 10))
 828     FAIL ();
 829   if (fread (buf, sizeof (buf), l0 + 1, stdin) != 1
 830       || memcmp (buf, "BCDEFGHI\na", 10))
 831     FAIL ();
 832
 833 #if __USE_FORTIFY_LEVEL >= 1
 834   CHK_FAIL_START
 835   if (fread (buf, 1, sizeof (buf) + 1, stdin) != sizeof (buf) + 1)
 836     FAIL ();
 837   CHK_FAIL_END
 838
 839   CHK_FAIL_START
 840   if (fread (buf, sizeof (buf) + 1, l0 + 1, stdin) != 1)
 841     FAIL ();
 842   CHK_FAIL_END
 843 #endif
 844
 845   rewind (stdin);
 846
 847   if (fread_unlocked (buf, 1, sizeof (buf), stdin) != sizeof (buf)
 848       || memcmp (buf, "abcdefgh\nA", 10))
 849     FAIL ();
 850   if (fread_unlocked (buf, sizeof (buf), 1, stdin) != 1
 851       || memcmp (buf, "BCDEFGHI\na", 10))
 852     FAIL ();
 853
 854   rewind (stdin);
 855
 856   if (fread_unlocked (buf, 1, 4, stdin) != 4
 857       || memcmp (buf, "abcdFGHI\na", 10))
 858     FAIL ();
 859   if (fread_unlocked (buf, 4, 1, stdin) != 1
 860       || memcmp (buf, "efghFGHI\na", 10))
 861     FAIL ();
 862
 863   rewind (stdin);
 864
 865   if (fread_unlocked (buf, l0 + 1, sizeof (buf), stdin) != sizeof (buf)
 866       || memcmp (buf, "abcdefgh\nA", 10))
 867     FAIL ();
 868   if (fread_unlocked (buf, sizeof (buf), l0 + 1, stdin) != 1
 869       || memcmp (buf, "BCDEFGHI\na", 10))
 870     FAIL ();
 871
 872 #if __USE_FORTIFY_LEVEL >= 1
 873   CHK_FAIL_START
 874   if (fread_unlocked (buf, 1, sizeof (buf) + 1, stdin) != sizeof (buf) + 1)
 875     FAIL ();
 876   CHK_FAIL_END
 877
 878   CHK_FAIL_START
 879   if (fread_unlocked (buf, sizeof (buf) + 1, l0 + 1, stdin) != 1)
 880     FAIL ();
 881   CHK_FAIL_END
 882 #endif
 883
 884   lseek (fileno (stdin), 0, SEEK_SET);
 885
 886   if (read (fileno (stdin), buf, sizeof (buf) - 1) != sizeof (buf) - 1
 887       || memcmp (buf, "abcdefgh\n", 9))
 888     FAIL ();
 889   if (read (fileno (stdin), buf, sizeof (buf) - 1) != sizeof (buf) - 1
 890       || memcmp (buf, "ABCDEFGHI", 9))
 891     FAIL ();
 892
 893   lseek (fileno (stdin), 0, SEEK_SET);
 894
 895   if (read (fileno (stdin), buf, l0 + sizeof (buf) - 1) != sizeof (buf) - 1
 896       || memcmp (buf, "abcdefgh\n", 9))
 897     FAIL ();
 898
 899 #if __USE_FORTIFY_LEVEL >= 1
 900   CHK_FAIL_START
 901   if (read (fileno (stdin), buf, sizeof (buf) + 1) != sizeof (buf) + 1)
 902     FAIL ();
 903   CHK_FAIL_END
 904 #endif
 905
 906   if (pread (fileno (stdin), buf, sizeof (buf) - 1, sizeof (buf) - 2)
 907       != sizeof (buf) - 1
 908       || memcmp (buf, "\nABCDEFGH", 9))
 909     FAIL ();
 910   if (pread (fileno (stdin), buf, sizeof (buf) - 1, 0) != sizeof (buf) - 1
 911       || memcmp (buf, "abcdefgh\n", 9))
 912     FAIL ();
 913   if (pread (fileno (stdin), buf, l0 + sizeof (buf) - 1, sizeof (buf) - 3)
 914       != sizeof (buf) - 1
 915       || memcmp (buf, "h\nABCDEFG", 9))
 916     FAIL ();
 917
 918 #if __USE_FORTIFY_LEVEL >= 1
 919   CHK_FAIL_START
 920   if (pread (fileno (stdin), buf, sizeof (buf) + 1, 2 * sizeof (buf))
 921       != sizeof (buf) + 1)
 922     FAIL ();
 923   CHK_FAIL_END
 924 #endif
 925
 926   if (pread64 (fileno (stdin), buf, sizeof (buf) - 1, sizeof (buf) - 2)
 927       != sizeof (buf) - 1
 928       || memcmp (buf, "\nABCDEFGH", 9))
 929     FAIL ();
 930   if (pread64 (fileno (stdin), buf, sizeof (buf) - 1, 0) != sizeof (buf) - 1
 931       || memcmp (buf, "abcdefgh\n", 9))
 932     FAIL ();
 933   if (pread64 (fileno (stdin), buf, l0 + sizeof (buf) - 1, sizeof (buf) - 3)
 934       != sizeof (buf) - 1
 935       || memcmp (buf, "h\nABCDEFG", 9))
 936     FAIL ();
 937
 938 #if __USE_FORTIFY_LEVEL >= 1
 939   CHK_FAIL_START
 940   if (pread64 (fileno (stdin), buf, sizeof (buf) + 1, 2 * sizeof (buf))
 941       != sizeof (buf) + 1)
 942     FAIL ();
 943   CHK_FAIL_END
 944 #endif
 945
 946   if (freopen (temp_filename, "r", stdin) == NULL)
 947     {
 948       puts ("could not open temporary file");
 949       exit (1);
 950     }
 951
 952   if (fseek (stdin, 9 + 10 + 11, SEEK_SET))
 953     {
 954       puts ("could not seek in test file");
 955       exit (1);
 956     }
 957
 958 #if __USE_FORTIFY_LEVEL >= 1
 959   CHK_FAIL_START
 960   if (gets (buf) != buf)
 961     FAIL ();
 962   CHK_FAIL_END
 963 #endif
 964
 965   /* Check whether missing N$ formats are detected.  */
 966   CHK_FAIL2_START
 967   printf ("%3$d\n", 1, 2, 3, 4);
 968   CHK_FAIL2_END
 969
 970   CHK_FAIL2_START
 971   fprintf (stdout, "%3$d\n", 1, 2, 3, 4);
 972   CHK_FAIL2_END
 973
 974   CHK_FAIL2_START
 975   sprintf (buf, "%3$d\n", 1, 2, 3, 4);
 976   CHK_FAIL2_END
 977
 978   CHK_FAIL2_START
 979   snprintf (buf, sizeof (buf), "%3$d\n", 1, 2, 3, 4);
 980   CHK_FAIL2_END
 981
 982   int sp[2];
 983   if (socketpair (PF_UNIX, SOCK_STREAM, 0, sp))
 984     FAIL ();
 985   else
 986     {
 987       const char *sendstr = "abcdefgh\nABCDEFGH\n0123456789\n";
 988       if ((size_t) send (sp[0], sendstr, strlen (sendstr), 0)
 989           != strlen (sendstr))
 990         FAIL ();
 991
 992       char recvbuf[12];
 993       if (recv (sp[1], recvbuf, sizeof recvbuf, MSG_PEEK)
 994           != sizeof recvbuf
 995           || memcmp (recvbuf, sendstr, sizeof recvbuf) != 0)
 996         FAIL ();
 997
 998       if (recv (sp[1], recvbuf + 6, l0 + sizeof recvbuf - 7, MSG_PEEK)
 999           != sizeof recvbuf - 7
1000           || memcmp (recvbuf + 6, sendstr, sizeof recvbuf - 7) != 0)
1001         FAIL ();
1002
1003 #if __USE_FORTIFY_LEVEL >= 1
1004       CHK_FAIL_START
1005       if (recv (sp[1], recvbuf + 1, sizeof recvbuf, MSG_PEEK)
1006           != sizeof recvbuf)
1007         FAIL ();
1008       CHK_FAIL_END
1009
1010       CHK_FAIL_START
1011       if (recv (sp[1], recvbuf + 4, l0 + sizeof recvbuf - 3, MSG_PEEK)
1012           != sizeof recvbuf - 3)
1013         FAIL ();
1014       CHK_FAIL_END
1015 #endif
1016
1017       socklen_t sl;
1018       struct sockaddr_un sa_un;
1019
1020       sl = sizeof (sa_un);
1021       if (recvfrom (sp[1], recvbuf, sizeof recvbuf, MSG_PEEK,
1022                     (struct sockaddr *) &sa_un, &sl)
1023           != sizeof recvbuf
1024           || memcmp (recvbuf, sendstr, sizeof recvbuf) != 0)
1025         FAIL ();
1026
1027       sl = sizeof (sa_un);
1028       if (recvfrom (sp[1], recvbuf + 6, l0 + sizeof recvbuf - 7, MSG_PEEK,
1029                     (struct sockaddr *) &sa_un, &sl) != sizeof recvbuf - 7
1030           || memcmp (recvbuf + 6, sendstr, sizeof recvbuf - 7) != 0)
1031         FAIL ();
1032
1033 #if __USE_FORTIFY_LEVEL >= 1
1034       CHK_FAIL_START
1035       sl = sizeof (sa_un);
1036       if (recvfrom (sp[1], recvbuf + 1, sizeof recvbuf, MSG_PEEK,
1037                     (struct sockaddr *) &sa_un, &sl) != sizeof recvbuf)
1038         FAIL ();
1039       CHK_FAIL_END
1040
1041       CHK_FAIL_START
1042       sl = sizeof (sa_un);
1043       if (recvfrom (sp[1], recvbuf + 4, l0 + sizeof recvbuf - 3, MSG_PEEK,
1044                     (struct sockaddr *) &sa_un, &sl) != sizeof recvbuf - 3)
1045         FAIL ();
1046       CHK_FAIL_END
1047 #endif
1048
1049       close (sp[0]);
1050       close (sp[1]);
1051     }
1052
1053   char fname[] = "/tmp/tst-chk1-dir-XXXXXX\0foo";
1054   char *enddir = strchr (fname, '\0');
1055   if (mkdtemp (fname) == NULL)
1056     {
1057       printf ("mkdtemp failed: %m\n");
1058       return 1;
1059     }
1060   *enddir = '/';
1061   if (symlink ("bar", fname) != 0)
1062     FAIL ();
1063
1064   char readlinkbuf[4];
1065   if (readlink (fname, readlinkbuf, 4) != 3
1066       || memcmp (readlinkbuf, "bar", 3) != 0)
1067     FAIL ();
1068   if (readlink (fname, readlinkbuf + 1, l0 + 3) != 3
1069       || memcmp (readlinkbuf, "bbar", 4) != 0)
1070     FAIL ();
1071
1072 #if __USE_FORTIFY_LEVEL >= 1
1073   CHK_FAIL_START
1074   if (readlink (fname, readlinkbuf + 2, l0 + 3) != 3)
1075     FAIL ();
1076   CHK_FAIL_END
1077
1078   CHK_FAIL_START
1079   if (readlink (fname, readlinkbuf + 3, 4) != 3)
1080     FAIL ();
1081   CHK_FAIL_END
1082 #endif
1083
1084   int tmpfd = open ("/tmp", O_RDONLY | O_DIRECTORY);
1085   if (tmpfd < 0)
1086     FAIL ();
1087
1088   if (readlinkat (tmpfd, fname + sizeof ("/tmp/") - 1, readlinkbuf, 4) != 3
1089       || memcmp (readlinkbuf, "bar", 3) != 0)
1090     FAIL ();
1091   if (readlinkat (tmpfd, fname + sizeof ("/tmp/") - 1, readlinkbuf + 1,
1092                   l0 + 3) != 3
1093       || memcmp (readlinkbuf, "bbar", 4) != 0)
1094     FAIL ();
1095
1096 #if __USE_FORTIFY_LEVEL >= 1
1097   CHK_FAIL_START
1098   if (readlinkat (tmpfd, fname + sizeof ("/tmp/") - 1, readlinkbuf + 2,
1099                   l0 + 3) != 3)
1100     FAIL ();
1101   CHK_FAIL_END
1102
1103   CHK_FAIL_START
1104   if (readlinkat (tmpfd, fname + sizeof ("/tmp/") - 1, readlinkbuf + 3,
1105                   4) != 3)
1106     FAIL ();
1107   CHK_FAIL_END
1108 #endif
1109
1110   close (tmpfd);
1111
1112   char *cwd1 = getcwd (NULL, 0);
1113   if (cwd1 == NULL)
1114     FAIL ();
1115
1116   char *cwd2 = getcwd (NULL, 250);
1117   if (cwd2 == NULL)
1118     FAIL ();
1119
1120   if (cwd1 && cwd2)
1121     {
1122       if (strcmp (cwd1, cwd2) != 0)
1123         FAIL ();
1124
1125       *enddir = '\0';
1126       if (chdir (fname))
1127         FAIL ();
1128
1129       char *cwd3 = getcwd (NULL, 0);
1130       if (cwd3 == NULL)
1131         FAIL ();
1132       if (strcmp (fname, cwd3) != 0)
1133         printf ("getcwd after chdir is '%s' != '%s',"
1134                 "get{c,}wd tests skipped\n", cwd3, fname);
1135       else
1136         {
1137           char getcwdbuf[sizeof fname - 3];
1138
1139           char *cwd4 = getcwd (getcwdbuf, sizeof getcwdbuf);
1140           if (cwd4 != getcwdbuf
1141               || strcmp (getcwdbuf, fname) != 0)
1142             FAIL ();
1143
1144           cwd4 = getcwd (getcwdbuf + 1, l0 + sizeof getcwdbuf - 1);
1145           if (cwd4 != getcwdbuf + 1
1146               || getcwdbuf[0] != fname[0]
1147               || strcmp (getcwdbuf + 1, fname) != 0)
1148             FAIL ();
1149
1150 #if __USE_FORTIFY_LEVEL >= 1
1151           CHK_FAIL_START
1152           if (getcwd (getcwdbuf + 2, l0 + sizeof getcwdbuf)
1153               != getcwdbuf + 2)
1154             FAIL ();
1155           CHK_FAIL_END
1156
1157           CHK_FAIL_START
1158           if (getcwd (getcwdbuf + 2, sizeof getcwdbuf)
1159               != getcwdbuf + 2)
1160             FAIL ();
1161           CHK_FAIL_END
1162 #endif
1163
1164           if (getwd (getcwdbuf) != getcwdbuf
1165               || strcmp (getcwdbuf, fname) != 0)
1166             FAIL ();
1167
1168           if (getwd (getcwdbuf + 1) != getcwdbuf + 1
1169               || strcmp (getcwdbuf + 1, fname) != 0)
1170             FAIL ();
1171
1172 #if __USE_FORTIFY_LEVEL >= 1
1173           CHK_FAIL_START
1174           if (getwd (getcwdbuf + 2) != getcwdbuf + 2)
1175             FAIL ();
1176           CHK_FAIL_END
1177 #endif
1178         }
1179
1180       if (chdir (cwd1) != 0)
1181         FAIL ();
1182       free (cwd3);
1183     }
1184
1185   free (cwd1);
1186   free (cwd2);
1187   *enddir = '/';
1188   if (unlink (fname) != 0)
1189     FAIL ();
1190
1191   *enddir = '\0';
1192   if (rmdir (fname) != 0)
1193     FAIL ();
1194
1195
1196 #if PATH_MAX > 0
1197   char largebuf[PATH_MAX];
1198   char *realres = realpath (".", largebuf);
1199   if (realres != largebuf)
1200     FAIL ();
1201
1202 # if __USE_FORTIFY_LEVEL >= 1
1203   CHK_FAIL_START
1204   char realbuf[1];
1205   realres = realpath (".", realbuf);
1206   if (realres != realbuf)
1207     FAIL ();
1208   CHK_FAIL_END
1209 # endif
1210 #endif
1211
1212   if (setlocale (LC_ALL, "de_DE.UTF-8") != NULL)
1213     {
1214       assert (MB_CUR_MAX <= 10);
1215
1216       /* First a simple test.  */
1217       char enough[10];
1218       if (wctomb (enough, L'A') != 1)
1219         FAIL ();
1220
1221 #if __USE_FORTIFY_LEVEL >= 1
1222       /* We know the wchar_t encoding is ISO 10646.  So pick a
1223          character which has a multibyte representation which does not
1224          fit.  */
1225       CHK_FAIL_START
1226       char smallbuf[2];
1227       if (wctomb (smallbuf, L'\x100') != 2)
1228         FAIL ();
1229       CHK_FAIL_END
1230 #endif
1231
1232       mbstate_t s;
1233       memset (&s, '\0', sizeof (s));
1234       if (wcrtomb (enough, L'D', &s) != 1 || enough[0] != 'D')
1235         FAIL ();
1236
1237 #if __USE_FORTIFY_LEVEL >= 1
1238       /* We know the wchar_t encoding is ISO 10646.  So pick a
1239          character which has a multibyte representation which does not
1240          fit.  */
1241       CHK_FAIL_START
1242       char smallbuf[2];
1243       if (wcrtomb (smallbuf, L'\x100', &s) != 2)
1244         FAIL ();
1245       CHK_FAIL_END
1246 #endif
1247
1248       wchar_t wenough[10];
1249       memset (&s, '\0', sizeof (s));
1250       const char *cp = "A";
1251       if (mbsrtowcs (wenough, &cp, 10, &s) != 1
1252           || wcscmp (wenough, L"A") != 0)
1253         FAIL ();
1254
1255       cp = "BC";
1256       if (mbsrtowcs (wenough, &cp, l0 + 10, &s) != 2
1257           || wcscmp (wenough, L"BC") != 0)
1258         FAIL ();
1259
1260 #if __USE_FORTIFY_LEVEL >= 1
1261       CHK_FAIL_START
1262       wchar_t wsmallbuf[2];
1263       cp = "ABC";
1264       mbsrtowcs (wsmallbuf, &cp, 10, &s);
1265       CHK_FAIL_END
1266 #endif
1267
1268       cp = "A";
1269       if (mbstowcs (wenough, cp, 10) != 1
1270           || wcscmp (wenough, L"A") != 0)
1271         FAIL ();
1272
1273       cp = "DEF";
1274       if (mbstowcs (wenough, cp, l0 + 10) != 3
1275           || wcscmp (wenough, L"DEF") != 0)
1276         FAIL ();
1277
1278 #if __USE_FORTIFY_LEVEL >= 1
1279       CHK_FAIL_START
1280       wchar_t wsmallbuf[2];
1281       cp = "ABC";
1282       mbstowcs (wsmallbuf, cp, 10);
1283       CHK_FAIL_END
1284 #endif
1285
1286       memset (&s, '\0', sizeof (s));
1287       cp = "ABC";
1288       wcscpy (wenough, L"DEF");
1289       if (mbsnrtowcs (wenough, &cp, 1, 10, &s) != 1
1290           || wcscmp (wenough, L"AEF") != 0)
1291         FAIL ();
1292
1293       cp = "IJ";
1294       if (mbsnrtowcs (wenough, &cp, 1, l0 + 10, &s) != 1
1295           || wcscmp (wenough, L"IEF") != 0)
1296         FAIL ();
1297
1298 #if __USE_FORTIFY_LEVEL >= 1
1299       CHK_FAIL_START
1300       wchar_t wsmallbuf[2];
1301       cp = "ABC";
1302       mbsnrtowcs (wsmallbuf, &cp, 3, 10, &s);
1303       CHK_FAIL_END
1304 #endif
1305
1306       memset (&s, '\0', sizeof (s));
1307       const wchar_t *wcp = L"A";
1308       if (wcsrtombs (enough, &wcp, 10, &s) != 1
1309           || strcmp (enough, "A") != 0)
1310         FAIL ();
1311
1312       wcp = L"BC";
1313       if (wcsrtombs (enough, &wcp, l0 + 10, &s) != 2
1314           || strcmp (enough, "BC") != 0)
1315         FAIL ();
1316
1317 #if __USE_FORTIFY_LEVEL >= 1
1318       CHK_FAIL_START
1319       char smallbuf[2];
1320       wcp = L"ABC";
1321       wcsrtombs (smallbuf, &wcp, 10, &s);
1322       CHK_FAIL_END
1323 #endif
1324
1325       memset (enough, 'Z', sizeof (enough));
1326       wcp = L"EF";
1327       if (wcstombs (enough, wcp, 10) != 2
1328           || strcmp (enough, "EF") != 0)
1329         FAIL ();
1330
1331       wcp = L"G";
1332       if (wcstombs (enough, wcp, l0 + 10) != 1
1333           || strcmp (enough, "G") != 0)
1334         FAIL ();
1335
1336 #if __USE_FORTIFY_LEVEL >= 1
1337       CHK_FAIL_START
1338       char smallbuf[2];
1339       wcp = L"ABC";
1340       wcstombs (smallbuf, wcp, 10);
1341       CHK_FAIL_END
1342 #endif
1343
1344       memset (&s, '\0', sizeof (s));
1345       wcp = L"AB";
1346       if (wcsnrtombs (enough, &wcp, 1, 10, &s) != 1
1347           || strcmp (enough, "A") != 0)
1348         FAIL ();
1349
1350       wcp = L"BCD";
1351       if (wcsnrtombs (enough, &wcp, 1, l0 + 10, &s) != 1
1352           || strcmp (enough, "B") != 0)
1353         FAIL ();
1354
1355 #if __USE_FORTIFY_LEVEL >= 1
1356       CHK_FAIL_START
1357       char smallbuf[2];
1358       wcp = L"ABC";
1359       wcsnrtombs (smallbuf, &wcp, 3, 10, &s);
1360       CHK_FAIL_END
1361 #endif
1362     }
1363   else
1364     {
1365       puts ("cannot set locale");
1366       ret = 1;
1367     }
1368
1369   fd = posix_openpt (O_RDWR);
1370   if (fd != -1)
1371     {
1372       char enough[1000];
1373       if (ptsname_r (fd, enough, sizeof (enough)) != 0)
1374         FAIL ();
1375
1376 #if __USE_FORTIFY_LEVEL >= 1
1377       CHK_FAIL_START
1378       char smallbuf[2];
1379       if (ptsname_r (fd, smallbuf, sizeof (smallbuf) + 1) == 0)
1380         FAIL ();
1381       CHK_FAIL_END
1382 #endif
1383       close (fd);
1384     }
1385
1386 #if PATH_MAX > 0
1387   confstr (_CS_GNU_LIBC_VERSION, largebuf, sizeof (largebuf));
1388 # if __USE_FORTIFY_LEVEL >= 1
1389   CHK_FAIL_START
1390   char smallbuf[1];
1391   confstr (_CS_GNU_LIBC_VERSION, smallbuf, sizeof (largebuf));
1392   CHK_FAIL_END
1393 # endif
1394 #endif
1395
1396   gid_t grpslarge[5];
1397   int ngr = getgroups (5, grpslarge);
1398   asm volatile ("" : : "r" (ngr));
1399 #if __USE_FORTIFY_LEVEL >= 1
1400   CHK_FAIL_START
1401   char smallbuf[1];
1402   ngr = getgroups (5, (gid_t *) smallbuf);
1403   asm volatile ("" : : "r" (ngr));
1404   CHK_FAIL_END
1405 #endif
1406
1407   fd = open (_PATH_TTY, O_RDONLY);
1408   if (fd != -1)
1409     {
1410       char enough[1000];
1411       if (ttyname_r (fd, enough, sizeof (enough)) != 0)
1412         FAIL ();
1413
1414 #if __USE_FORTIFY_LEVEL >= 1
1415       CHK_FAIL_START
1416       char smallbuf[2];
1417       if (ttyname_r (fd, smallbuf, sizeof (smallbuf) + 1) == 0)
1418         FAIL ();
1419       CHK_FAIL_END
1420 #endif
1421       close (fd);
1422     }
1423
1424   char hostnamelarge[1000];
1425   gethostname (hostnamelarge, sizeof (hostnamelarge));
1426 #if __USE_FORTIFY_LEVEL >= 1
1427   CHK_FAIL_START
1428   char smallbuf[1];
1429   gethostname (smallbuf, sizeof (hostnamelarge));
1430   CHK_FAIL_END
1431 #endif
1432
1433   char loginlarge[1000];
1434   getlogin_r (loginlarge, sizeof (hostnamelarge));
1435 #if __USE_FORTIFY_LEVEL >= 1
1436   CHK_FAIL_START
1437   char smallbuf[1];
1438   getlogin_r (smallbuf, sizeof (loginlarge));
1439   CHK_FAIL_END
1440 #endif
1441
1442   char domainnamelarge[1000];
1443   int res = getdomainname (domainnamelarge, sizeof (domainnamelarge));
1444   asm volatile ("" : : "r" (res));
1445 #if __USE_FORTIFY_LEVEL >= 1
1446   CHK_FAIL_START
1447   char smallbuf[1];
1448   res = getdomainname (smallbuf, sizeof (domainnamelarge));
1449   asm volatile ("" : : "r" (res));
1450   CHK_FAIL_END
1451 #endif
1452
1453   fd_set s;
1454   FD_ZERO (&s);
1455   FD_SET (FD_SETSIZE - 1, &s);
1456 #if __USE_FORTIFY_LEVEL >= 1
1457   CHK_FAIL_START
1458   FD_SET (FD_SETSIZE, &s);
1459   CHK_FAIL_END
1460 #endif
1461   FD_CLR (FD_SETSIZE - 1, &s);
1462 #if __USE_FORTIFY_LEVEL >= 1
1463   CHK_FAIL_START
1464   FD_CLR (FD_SETSIZE, &s);
1465   CHK_FAIL_END
1466 #endif
1467   FD_ISSET (FD_SETSIZE - 1, &s);
1468 #if __USE_FORTIFY_LEVEL >= 1
1469   CHK_FAIL_START
1470   FD_ISSET (FD_SETSIZE, &s);
1471   CHK_FAIL_END
1472 #endif
1473
1474   struct pollfd fds[1];
1475   fds[0].fd = STDOUT_FILENO;
1476   fds[0].events = POLLOUT;
1477   poll (fds, 1, 0);
1478 #if __USE_FORTIFY_LEVEL >= 1
1479   CHK_FAIL_START
1480   poll (fds, 2, 0);
1481   CHK_FAIL_END
1482 #endif
1483   ppoll (fds, 1, NULL, NULL);
1484 #if __USE_FORTIFY_LEVEL >= 1
1485   CHK_FAIL_START
1486   ppoll (fds, 2, NULL, NULL);
1487   CHK_FAIL_END
1488 #endif
1489
1490   return ret;
1491 }