debug/tst-fortify.c

   1 /* Copyright (C) 2004-2023 Free Software Foundation, Inc.
   2    Copyright The GNU Toolchain Authors.
   3    This file is part of the GNU C Library.
   4
   5    The GNU C Library is free software; you can redistribute it and/or
   6    modify it under the terms of the GNU Lesser General Public
   7    License as published by the Free Software Foundation; either
   8    version 2.1 of the License, or (at your option) any later version.
   9
  10    The GNU C Library is distributed in the hope that it will be useful,
  11    but WITHOUT ANY WARRANTY; without even the implied warranty of
  12    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  13    Lesser General Public License for more details.
  14
  15    You should have received a copy of the GNU Lesser General Public
  16    License along with the GNU C Library; if not, see
  17    <https://www.gnu.org/licenses/>.  */
  18
  19 /* This file tests gets.  Force it to be declared.  */
  20 #include <features.h>
  21 #undef __GLIBC_USE_DEPRECATED_GETS
  22 #define __GLIBC_USE_DEPRECATED_GETS 1
  23
  24 #include <assert.h>
  25 #include <fcntl.h>
  26 #include <locale.h>
  27 #include <obstack.h>
  28 #include <setjmp.h>
  29 #include <signal.h>
  30 #include <stdio.h>
  31 #include <stdlib.h>
  32 #include <string.h>
  33 #include <unistd.h>
  34 #include <wchar.h>
  35 #include <sys/poll.h>
  36 #include <sys/select.h>
  37 #include <sys/socket.h>
  38 #include <sys/un.h>
  39
  40 #ifndef _GNU_SOURCE
  41 # define MEMPCPY memcpy
  42 # define WMEMPCPY wmemcpy
  43 # define MEMPCPY_RET(x) 0
  44 # define WMEMPCPY_RET(x) 0
  45 #else
  46 # define MEMPCPY mempcpy
  47 # define WMEMPCPY wmempcpy
  48 # define MEMPCPY_RET(x) __builtin_strlen (x)
  49 # define WMEMPCPY_RET(x) wcslen (x)
  50 #endif
  51
  52 #define obstack_chunk_alloc malloc
  53 #define obstack_chunk_free free
  54
  55 char *temp_filename;
  56 static void do_prepare (void);
  57 static int do_test (void);
  58 #define PREPARE(argc, argv) do_prepare ()
  59 #define TEST_FUNCTION do_test ()
  60 #include "../test-skeleton.c"
  61
  62 static void
  63 do_prepare (void)
  64 {
  65   int temp_fd = create_temp_file ("tst-chk1.", &temp_filename);
  66   if (temp_fd == -1)
  67     {
  68       printf ("cannot create temporary file: %m\n");
  69       exit (1);
  70     }
  71
  72   const char *strs = "abcdefgh\nABCDEFGHI\nabcdefghij\nABCDEFGHIJ";
  73   if ((size_t) write (temp_fd, strs, strlen (strs)) != strlen (strs))
  74     {
  75       puts ("could not write test strings into file");
  76       unlink (temp_filename);
  77       exit (1);
  78     }
  79 }
  80
  81 volatile int chk_fail_ok;
  82 volatile int ret;
  83 jmp_buf chk_fail_buf;
  84
  85 static void
  86 handler (int sig)
  87 {
  88   if (chk_fail_ok)
  89     {
  90       chk_fail_ok = 0;
  91       longjmp (chk_fail_buf, 1);
  92     }
  93   else
  94     _exit (127);
  95 }
  96
  97 #if __USE_FORTIFY_LEVEL == 3
  98 volatile size_t buf_size = 10;
  99 #else
 100 char buf[10];
 101 wchar_t wbuf[10];
 102 #define buf_size sizeof (buf)
 103 #endif
 104
 105 volatile size_t l0;
 106 volatile char *p;
 107 volatile wchar_t *wp;
 108 const char *str1 = "JIHGFEDCBA";
 109 const char *str2 = "F";
 110 const char *str3 = "%s%n%s%n";
 111 const char *str4 = "Hello, ";
 112 const char *str5 = "World!\n";
 113 const wchar_t *wstr1 = L"JIHGFEDCBA";
 114 const wchar_t *wstr2 = L"F";
 115 const wchar_t *wstr3 = L"%s%n%s%n";
 116 const wchar_t *wstr4 = L"Hello, ";
 117 const wchar_t *wstr5 = L"World!\n";
 118 char buf2[10] = "%s";
 119 int num1 = 67;
 120 int num2 = 987654;
 121
 122 #define FAIL() \
 123   do { printf ("Failure on line %d\n", __LINE__); ret = 1; } while (0)
 124 #define CHK_FAIL_START \
 125   chk_fail_ok = 1;                              \
 126   if (! setjmp (chk_fail_buf))                  \
 127     {
 128 #define CHK_FAIL_END \
 129       chk_fail_ok = 0;                          \
 130       FAIL ();                                  \
 131     }
 132 #if __USE_FORTIFY_LEVEL >= 2 && (!defined __cplusplus || defined __va_arg_pack)
 133 # define CHK_FAIL2_START CHK_FAIL_START
 134 # define CHK_FAIL2_END CHK_FAIL_END
 135 #else
 136 # define CHK_FAIL2_START
 137 # define CHK_FAIL2_END
 138 #endif
 139
 140 static int
 141 do_test (void)
 142 {
 143 #if __USE_FORTIFY_LEVEL == 3
 144   char *buf = (char *) malloc (buf_size);
 145   wchar_t *wbuf = (wchar_t *) malloc (buf_size * sizeof (wchar_t));
 146 #endif
 147   set_fortify_handler (handler);
 148
 149   struct A { char buf1[9]; char buf2[1]; } a;
 150   struct wA { wchar_t buf1[9]; wchar_t buf2[1]; } wa;
 151
 152   printf ("Test checking routines at fortify level %d\n",
 153 #ifdef __USE_FORTIFY_LEVEL
 154           (int) __USE_FORTIFY_LEVEL
 155 #else
 156           0
 157 #endif
 158           );
 159
 160 #if defined __USE_FORTIFY_LEVEL && !defined __fortify_function
 161   printf ("Test skipped");
 162   if (l0 == 0)
 163     return 0;
 164 #endif
 165
 166   /* These ops can be done without runtime checking of object size.  */
 167   memcpy (buf, "abcdefghij", 10);
 168   memmove (buf + 1, buf, 9);
 169   if (memcmp (buf, "aabcdefghi", 10))
 170     FAIL ();
 171
 172   memcpy (buf, "abcdefghij", 10);
 173   bcopy (buf, buf + 1, 9);
 174   if (memcmp (buf, "aabcdefghi", 10))
 175     FAIL ();
 176
 177   if (MEMPCPY (buf + 5, "abcde", 5) != buf + 5 + MEMPCPY_RET ("abcde")
 178       || memcmp (buf, "aabcdabcde", 10))
 179     FAIL ();
 180
 181   memset (buf + 8, 'j', 2);
 182   if (memcmp (buf, "aabcdabcjj", 10))
 183     FAIL ();
 184
 185   bzero (buf + 8, 2);
 186   if (memcmp (buf, "aabcdabc\0\0", 10))
 187     FAIL ();
 188
 189   explicit_bzero (buf + 6, 4);
 190   if (memcmp (buf, "aabcda\0\0\0\0", 10))
 191     FAIL ();
 192
 193   strcpy (buf + 4, "EDCBA");
 194   if (memcmp (buf, "aabcEDCBA", 10))
 195     FAIL ();
 196
 197   if (stpcpy (buf + 8, "F") != buf + 9 || memcmp (buf, "aabcEDCBF", 10))
 198     FAIL ();
 199
 200   strncpy (buf + 6, "X", 4);
 201   if (memcmp (buf, "aabcEDX\0\0", 10))
 202     FAIL ();
 203
 204   if (sprintf (buf + 7, "%s", "67") != 2 || memcmp (buf, "aabcEDX67", 10))
 205     FAIL ();
 206
 207   if (snprintf (buf + 7, 3, "%s", "987654") != 6
 208       || memcmp (buf, "aabcEDX98", 10))
 209     FAIL ();
 210
 211   /* These ops need runtime checking, but shouldn't __chk_fail.  */
 212   memcpy (buf, "abcdefghij", l0 + 10);
 213   memmove (buf + 1, buf, l0 + 9);
 214   if (memcmp (buf, "aabcdefghi", 10))
 215     FAIL ();
 216
 217   memcpy (buf, "abcdefghij", l0 + 10);
 218   bcopy (buf, buf + 1, l0 + 9);
 219   if (memcmp (buf, "aabcdefghi", 10))
 220     FAIL ();
 221
 222   if (MEMPCPY (buf + 5, "abcde", l0 + 5) != buf + 5 + MEMPCPY_RET ("abcde")
 223       || memcmp (buf, "aabcdabcde", 10))
 224     FAIL ();
 225
 226   memset (buf + 8, 'j', l0 + 2);
 227   if (memcmp (buf, "aabcdabcjj", 10))
 228     FAIL ();
 229
 230   bzero (buf + 8, l0 + 2);
 231   if (memcmp (buf, "aabcdabc\0\0", 10))
 232     FAIL ();
 233
 234   explicit_bzero (buf + 6, l0 + 4);
 235   if (memcmp (buf, "aabcda\0\0\0\0", 10))
 236     FAIL ();
 237
 238   strcpy (buf + 4, str1 + 5);
 239   if (memcmp (buf, "aabcEDCBA", 10))
 240     FAIL ();
 241
 242   if (stpcpy (buf + 8, str2) != buf + 9 || memcmp (buf, "aabcEDCBF", 10))
 243     FAIL ();
 244
 245   strncpy (buf + 6, "X", l0 + 4);
 246   if (memcmp (buf, "aabcEDX\0\0", 10))
 247     FAIL ();
 248
 249   if (stpncpy (buf + 5, "cd", l0 + 5) != buf + 7
 250       || memcmp (buf, "aabcEcd\0\0", 10))
 251     FAIL ();
 252
 253   if (sprintf (buf + 7, "%d", num1) != 2 || memcmp (buf, "aabcEcd67", 10))
 254     FAIL ();
 255
 256   if (snprintf (buf + 7, 3, "%d", num2) != 6 || memcmp (buf, "aabcEcd98", 10))
 257     FAIL ();
 258
 259   buf[l0 + 8] = '\0';
 260   strcat (buf, "A");
 261   if (memcmp (buf, "aabcEcd9A", 10))
 262     FAIL ();
 263
 264   buf[l0 + 7] = '\0';
 265   strncat (buf, "ZYXWV", l0 + 2);
 266   if (memcmp (buf, "aabcEcdZY", 10))
 267     FAIL ();
 268
 269   /* The following tests are supposed to succeed at all fortify
 270      levels, even though they overflow a.buf1 into a.buf2.  */
 271   memcpy (a.buf1, "abcdefghij", l0 + 10);
 272   memmove (a.buf1 + 1, a.buf1, l0 + 9);
 273   if (memcmp (a.buf1, "aabcdefghi", 10))
 274     FAIL ();
 275
 276   memcpy (a.buf1, "abcdefghij", l0 + 10);
 277   bcopy (a.buf1, a.buf1 + 1, l0 + 9);
 278   if (memcmp (a.buf1, "aabcdefghi", 10))
 279     FAIL ();
 280
 281   if (MEMPCPY (a.buf1 + 5, "abcde", l0 + 5)
 282       != a.buf1 + 5 + MEMPCPY_RET ("abcde")
 283       || memcmp (a.buf1, "aabcdabcde", 10))
 284     FAIL ();
 285
 286   memset (a.buf1 + 8, 'j', l0 + 2);
 287   if (memcmp (a.buf1, "aabcdabcjj", 10))
 288     FAIL ();
 289
 290   bzero (a.buf1 + 8, l0 + 2);
 291   if (memcmp (a.buf1, "aabcdabc\0\0", 10))
 292     FAIL ();
 293
 294   explicit_bzero (a.buf1 + 6, l0 + 4);
 295   if (memcmp (a.buf1, "aabcda\0\0\0\0", 10))
 296     FAIL ();
 297
 298 #if __USE_FORTIFY_LEVEL < 2
 299   /* The following tests are supposed to crash with -D_FORTIFY_SOURCE=2
 300      and sufficient GCC support, as the string operations overflow
 301      from a.buf1 into a.buf2.  */
 302   strcpy (a.buf1 + 4, str1 + 5);
 303   if (memcmp (a.buf1, "aabcEDCBA", 10))
 304     FAIL ();
 305
 306   if (stpcpy (a.buf1 + 8, str2) != a.buf1 + 9
 307       || memcmp (a.buf1, "aabcEDCBF", 10))
 308     FAIL ();
 309
 310   strncpy (a.buf1 + 6, "X", l0 + 4);
 311   if (memcmp (a.buf1, "aabcEDX\0\0", 10))
 312     FAIL ();
 313
 314   if (sprintf (a.buf1 + 7, "%d", num1) != 2
 315       || memcmp (a.buf1, "aabcEDX67", 10))
 316     FAIL ();
 317
 318   if (snprintf (a.buf1 + 7, 3, "%d", num2) != 6
 319       || memcmp (a.buf1, "aabcEDX98", 10))
 320     FAIL ();
 321
 322   a.buf1[l0 + 8] = '\0';
 323   strcat (a.buf1, "A");
 324   if (memcmp (a.buf1, "aabcEDX9A", 10))
 325     FAIL ();
 326
 327   a.buf1[l0 + 7] = '\0';
 328   strncat (a.buf1, "ZYXWV", l0 + 2);
 329   if (memcmp (a.buf1, "aabcEDXZY", 10))
 330     FAIL ();
 331
 332 #endif
 333
 334 #if __USE_FORTIFY_LEVEL >= 1
 335   /* Now check if all buffer overflows are caught at runtime.
 336      N.B. All tests involving a length parameter need to be done
 337      twice: once with the length a compile-time constant, once without.  */
 338
 339   CHK_FAIL_START
 340   memcpy (buf + 1, "abcdefghij", 10);
 341   CHK_FAIL_END
 342
 343   CHK_FAIL_START
 344   memcpy (buf + 1, "abcdefghij", l0 + 10);
 345   CHK_FAIL_END
 346
 347   CHK_FAIL_START
 348   memmove (buf + 2, buf + 1, 9);
 349   CHK_FAIL_END
 350
 351   CHK_FAIL_START
 352   memmove (buf + 2, buf + 1, l0 + 9);
 353   CHK_FAIL_END
 354
 355   CHK_FAIL_START
 356   bcopy (buf + 1, buf + 2, 9);
 357   CHK_FAIL_END
 358
 359   CHK_FAIL_START
 360   bcopy (buf + 1, buf + 2, l0 + 9);
 361   CHK_FAIL_END
 362
 363 #ifdef _GNU_SOURCE
 364   CHK_FAIL_START
 365   p = (char *) mempcpy (buf + 6, "abcde", 5);
 366   CHK_FAIL_END
 367
 368   CHK_FAIL_START
 369   p = (char *) mempcpy (buf + 6, "abcde", l0 + 5);
 370   CHK_FAIL_END
 371 #endif
 372
 373   CHK_FAIL_START
 374   memset (buf + 9, 'j', 2);
 375   CHK_FAIL_END
 376
 377   CHK_FAIL_START
 378   memset (buf + 9, 'j', l0 + 2);
 379   CHK_FAIL_END
 380
 381   CHK_FAIL_START
 382   bzero (buf + 9, 2);
 383   CHK_FAIL_END
 384
 385   CHK_FAIL_START
 386   bzero (buf + 9, l0 + 2);
 387   CHK_FAIL_END
 388
 389   CHK_FAIL_START
 390   explicit_bzero (buf + 9, 2);
 391   CHK_FAIL_END
 392
 393   CHK_FAIL_START
 394   explicit_bzero (buf + 9, l0 + 2);
 395   CHK_FAIL_END
 396
 397   CHK_FAIL_START
 398   strcpy (buf + 5, str1 + 5);
 399   CHK_FAIL_END
 400
 401   CHK_FAIL_START
 402   p = stpcpy (buf + 9, str2);
 403   CHK_FAIL_END
 404
 405   CHK_FAIL_START
 406   strncpy (buf + 7, "X", 4);
 407   CHK_FAIL_END
 408
 409   CHK_FAIL_START
 410   strncpy (buf + 7, "X", l0 + 4);
 411   CHK_FAIL_END
 412
 413   CHK_FAIL_START
 414   stpncpy (buf + 6, "cd", 5);
 415   CHK_FAIL_END
 416
 417   CHK_FAIL_START
 418   stpncpy (buf + 6, "cd", l0 + 5);
 419   CHK_FAIL_END
 420
 421 # if !defined __cplusplus || defined __va_arg_pack
 422   CHK_FAIL_START
 423   sprintf (buf + 8, "%d", num1);
 424   CHK_FAIL_END
 425
 426   CHK_FAIL_START
 427   snprintf (buf + 8, 3, "%d", num2);
 428   CHK_FAIL_END
 429
 430   CHK_FAIL_START
 431   snprintf (buf + 8, l0 + 3, "%d", num2);
 432   CHK_FAIL_END
 433
 434   CHK_FAIL_START
 435   swprintf (wbuf + 8, 3, L"%d", num1);
 436   CHK_FAIL_END
 437
 438   CHK_FAIL_START
 439   swprintf (wbuf + 8, l0 + 3, L"%d", num1);
 440   CHK_FAIL_END
 441 # endif
 442
 443   memcpy (buf, str1 + 2, 9);
 444   CHK_FAIL_START
 445   strcat (buf, "AB");
 446   CHK_FAIL_END
 447
 448   memcpy (buf, str1 + 3, 8);
 449   CHK_FAIL_START
 450   strncat (buf, "ZYXWV", 3);
 451   CHK_FAIL_END
 452
 453   memcpy (buf, str1 + 3, 8);
 454   CHK_FAIL_START
 455   strncat (buf, "ZYXWV", l0 + 3);
 456   CHK_FAIL_END
 457
 458   CHK_FAIL_START
 459   memcpy (a.buf1 + 1, "abcdefghij", 10);
 460   CHK_FAIL_END
 461
 462   CHK_FAIL_START
 463   memcpy (a.buf1 + 1, "abcdefghij", l0 + 10);
 464   CHK_FAIL_END
 465
 466   CHK_FAIL_START
 467   memmove (a.buf1 + 2, a.buf1 + 1, 9);
 468   CHK_FAIL_END
 469
 470   CHK_FAIL_START
 471   memmove (a.buf1 + 2, a.buf1 + 1, l0 + 9);
 472   CHK_FAIL_END
 473
 474   CHK_FAIL_START
 475   bcopy (a.buf1 + 1, a.buf1 + 2, 9);
 476   CHK_FAIL_END
 477
 478   CHK_FAIL_START
 479   bcopy (a.buf1 + 1, a.buf1 + 2, l0 + 9);
 480   CHK_FAIL_END
 481
 482 #ifdef _GNU_SOURCE
 483   CHK_FAIL_START
 484   p = (char *) mempcpy (a.buf1 + 6, "abcde", 5);
 485   CHK_FAIL_END
 486
 487   CHK_FAIL_START
 488   p = (char *) mempcpy (a.buf1 + 6, "abcde", l0 + 5);
 489   CHK_FAIL_END
 490 #endif
 491
 492   CHK_FAIL_START
 493   memset (a.buf1 + 9, 'j', 2);
 494   CHK_FAIL_END
 495
 496   CHK_FAIL_START
 497   memset (a.buf1 + 9, 'j', l0 + 2);
 498   CHK_FAIL_END
 499
 500   CHK_FAIL_START
 501   bzero (a.buf1 + 9, 2);
 502   CHK_FAIL_END
 503
 504   CHK_FAIL_START
 505   bzero (a.buf1 + 9, l0 + 2);
 506   CHK_FAIL_END
 507
 508   CHK_FAIL_START
 509   explicit_bzero (a.buf1 + 9, 2);
 510   CHK_FAIL_END
 511
 512   CHK_FAIL_START
 513   explicit_bzero (a.buf1 + 9, l0 + 2);
 514   CHK_FAIL_END
 515
 516 # if __USE_FORTIFY_LEVEL >= 2
 517 #  define O 0
 518 # else
 519 #  define O 1
 520 # endif
 521
 522   CHK_FAIL_START
 523   strcpy (a.buf1 + (O + 4), str1 + 5);
 524   CHK_FAIL_END
 525
 526   CHK_FAIL_START
 527   p = stpcpy (a.buf1 + (O + 8), str2);
 528   CHK_FAIL_END
 529
 530   CHK_FAIL_START
 531   strncpy (a.buf1 + (O + 6), "X", 4);
 532   CHK_FAIL_END
 533
 534   CHK_FAIL_START
 535   strncpy (a.buf1 + (O + 6), "X", l0 + 4);
 536   CHK_FAIL_END
 537
 538   CHK_FAIL_START
 539   strlcpy (a.buf1 + (O + 6), "X", 4);
 540   CHK_FAIL_END
 541
 542   CHK_FAIL_START
 543   strlcpy (a.buf1 + (O + 6), "X", l0 + 4);
 544   CHK_FAIL_END
 545
 546   {
 547     char *volatile buf2 = buf;
 548     if (strlcpy (buf2, "a", sizeof (buf) + 1) != 1)
 549       FAIL ();
 550   }
 551
 552 # if !defined __cplusplus || defined __va_arg_pack
 553   CHK_FAIL_START
 554   sprintf (a.buf1 + (O + 7), "%d", num1);
 555   CHK_FAIL_END
 556
 557   CHK_FAIL_START
 558   snprintf (a.buf1 + (O + 7), 3, "%d", num2);
 559   CHK_FAIL_END
 560
 561   CHK_FAIL_START
 562   snprintf (a.buf1 + (O + 7), l0 + 3, "%d", num2);
 563   CHK_FAIL_END
 564 # endif
 565
 566   memcpy (a.buf1, str1 + (3 - O), 8 + O);
 567   CHK_FAIL_START
 568   strcat (a.buf1, "AB");
 569   CHK_FAIL_END
 570
 571   memcpy (a.buf1, str1 + (4 - O), 7 + O);
 572   CHK_FAIL_START
 573   strncat (a.buf1, "ZYXWV", l0 + 3);
 574   CHK_FAIL_END
 575
 576   memset (a.buf1, 0, sizeof (a.buf1));
 577   CHK_FAIL_START
 578   strlcat (a.buf1 + (O + 6), "X", 4);
 579   CHK_FAIL_END
 580
 581   memset (a.buf1, 0, sizeof (a.buf1));
 582   CHK_FAIL_START
 583   strlcat (a.buf1 + (O + 6), "X", l0 + 4);
 584   CHK_FAIL_END
 585
 586   {
 587     buf[0] = '\0';
 588     char *volatile buf2 = buf;
 589     if (strlcat (buf2, "a", sizeof (buf) + 1) != 1)
 590       FAIL ();
 591   }
 592 #endif
 593
 594
 595   /* These ops can be done without runtime checking of object size.  */
 596   wmemcpy (wbuf, L"abcdefghij", 10);
 597   wmemmove (wbuf + 1, wbuf, 9);
 598   if (wmemcmp (wbuf, L"aabcdefghi", 10))
 599     FAIL ();
 600
 601   if (WMEMPCPY (wbuf + 5, L"abcde", 5) != wbuf + 5 + WMEMPCPY_RET (L"abcde")
 602       || wmemcmp (wbuf, L"aabcdabcde", 10))
 603     FAIL ();
 604
 605   wmemset (wbuf + 8, L'j', 2);
 606   if (wmemcmp (wbuf, L"aabcdabcjj", 10))
 607     FAIL ();
 608
 609   wcscpy (wbuf + 4, L"EDCBA");
 610   if (wmemcmp (wbuf, L"aabcEDCBA", 10))
 611     FAIL ();
 612
 613   if (wcpcpy (wbuf + 8, L"F") != wbuf + 9 || wmemcmp (wbuf, L"aabcEDCBF", 10))
 614     FAIL ();
 615
 616   wcsncpy (wbuf + 6, L"X", 4);
 617   if (wmemcmp (wbuf, L"aabcEDX\0\0", 10))
 618     FAIL ();
 619
 620   if (swprintf (wbuf + 7, 3, L"%ls", L"987654") >= 0
 621       || wmemcmp (wbuf, L"aabcEDX98", 10))
 622     FAIL ();
 623
 624   if (swprintf (wbuf + 7, 3, L"64") != 2
 625       || wmemcmp (wbuf, L"aabcEDX64", 10))
 626     FAIL ();
 627
 628   /* These ops need runtime checking, but shouldn't __chk_fail.  */
 629   wmemcpy (wbuf, L"abcdefghij", l0 + 10);
 630   wmemmove (wbuf + 1, wbuf, l0 + 9);
 631   if (wmemcmp (wbuf, L"aabcdefghi", 10))
 632     FAIL ();
 633
 634   if (WMEMPCPY (wbuf + 5, L"abcde", l0 + 5)
 635       != wbuf + 5 + WMEMPCPY_RET (L"abcde")
 636       || wmemcmp (wbuf, L"aabcdabcde", 10))
 637     FAIL ();
 638
 639   wmemset (wbuf + 8, L'j', l0 + 2);
 640   if (wmemcmp (wbuf, L"aabcdabcjj", 10))
 641     FAIL ();
 642
 643   wcscpy (wbuf + 4, wstr1 + 5);
 644   if (wmemcmp (wbuf, L"aabcEDCBA", 10))
 645     FAIL ();
 646
 647   if (wcpcpy (wbuf + 8, wstr2) != wbuf + 9 || wmemcmp (wbuf, L"aabcEDCBF", 10))
 648     FAIL ();
 649
 650   wcsncpy (wbuf + 6, L"X", l0 + 4);
 651   if (wmemcmp (wbuf, L"aabcEDX\0\0", 10))
 652     FAIL ();
 653
 654   if (wcpncpy (wbuf + 5, L"cd", l0 + 5) != wbuf + 7
 655       || wmemcmp (wbuf, L"aabcEcd\0\0", 10))
 656     FAIL ();
 657
 658   if (swprintf (wbuf + 7, 3, L"%d", num2) >= 0
 659       || wmemcmp (wbuf, L"aabcEcd98", 10))
 660     FAIL ();
 661
 662   wbuf[l0 + 8] = L'\0';
 663   wcscat (wbuf, L"A");
 664   if (wmemcmp (wbuf, L"aabcEcd9A", 10))
 665     FAIL ();
 666
 667   wbuf[l0 + 7] = L'\0';
 668   wcsncat (wbuf, L"ZYXWV", l0 + 2);
 669   if (wmemcmp (wbuf, L"aabcEcdZY", 10))
 670     FAIL ();
 671
 672   wmemcpy (wa.buf1, L"abcdefghij", l0 + 10);
 673   wmemmove (wa.buf1 + 1, wa.buf1, l0 + 9);
 674   if (wmemcmp (wa.buf1, L"aabcdefghi", 10))
 675     FAIL ();
 676
 677   if (WMEMPCPY (wa.buf1 + 5, L"abcde", l0 + 5)
 678       != wa.buf1 + 5 + WMEMPCPY_RET (L"abcde")
 679       || wmemcmp (wa.buf1, L"aabcdabcde", 10))
 680     FAIL ();
 681
 682   wmemset (wa.buf1 + 8, L'j', l0 + 2);
 683   if (wmemcmp (wa.buf1, L"aabcdabcjj", 10))
 684     FAIL ();
 685
 686 #if __USE_FORTIFY_LEVEL < 2
 687   /* The following tests are supposed to crash with -D_FORTIFY_SOURCE=2
 688      and sufficient GCC support, as the string operations overflow
 689      from a.buf1 into a.buf2.  */
 690   wcscpy (wa.buf1 + 4, wstr1 + 5);
 691   if (wmemcmp (wa.buf1, L"aabcEDCBA", 10))
 692     FAIL ();
 693
 694   if (wcpcpy (wa.buf1 + 8, wstr2) != wa.buf1 + 9
 695       || wmemcmp (wa.buf1, L"aabcEDCBF", 10))
 696     FAIL ();
 697
 698   wcsncpy (wa.buf1 + 6, L"X", l0 + 4);
 699   if (wmemcmp (wa.buf1, L"aabcEDX\0\0", 10))
 700     FAIL ();
 701
 702   if (swprintf (wa.buf1 + 7, 3, L"%d", num2) >= 0
 703       || wmemcmp (wa.buf1, L"aabcEDX98", 10))
 704     FAIL ();
 705
 706   wa.buf1[l0 + 8] = L'\0';
 707   wcscat (wa.buf1, L"A");
 708   if (wmemcmp (wa.buf1, L"aabcEDX9A", 10))
 709     FAIL ();
 710
 711   wa.buf1[l0 + 7] = L'\0';
 712   wcsncat (wa.buf1, L"ZYXWV", l0 + 2);
 713   if (wmemcmp (wa.buf1, L"aabcEDXZY", 10))
 714     FAIL ();
 715
 716 #endif
 717
 718 #if __USE_FORTIFY_LEVEL >= 1
 719   /* Now check if all buffer overflows are caught at runtime.
 720      N.B. All tests involving a length parameter need to be done
 721      twice: once with the length a compile-time constant, once without.  */
 722
 723   CHK_FAIL_START
 724   wmemcpy (wbuf + 1, L"abcdefghij", 10);
 725   CHK_FAIL_END
 726
 727   CHK_FAIL_START
 728   wmemcpy (wbuf + 1, L"abcdefghij", l0 + 10);
 729   CHK_FAIL_END
 730
 731   CHK_FAIL_START
 732   wmemcpy (wbuf + 9, L"abcdefghij", 10);
 733   CHK_FAIL_END
 734
 735   CHK_FAIL_START
 736   wmemcpy (wbuf + 9, L"abcdefghij", l0 + 10);
 737   CHK_FAIL_END
 738
 739   CHK_FAIL_START
 740   wmemmove (wbuf + 2, wbuf + 1, 9);
 741   CHK_FAIL_END
 742
 743   CHK_FAIL_START
 744   wmemmove (wbuf + 2, wbuf + 1, l0 + 9);
 745   CHK_FAIL_END
 746
 747 #ifdef _GNU_SOURCE
 748   CHK_FAIL_START
 749   wp = wmempcpy (wbuf + 6, L"abcde", 5);
 750   CHK_FAIL_END
 751
 752   CHK_FAIL_START
 753   wp = wmempcpy (wbuf + 6, L"abcde", l0 + 5);
 754   CHK_FAIL_END
 755 #endif
 756
 757   CHK_FAIL_START
 758   wmemset (wbuf + 9, L'j', 2);
 759   CHK_FAIL_END
 760
 761   CHK_FAIL_START
 762   wmemset (wbuf + 9, L'j', l0 + 2);
 763   CHK_FAIL_END
 764
 765   CHK_FAIL_START
 766   wcscpy (wbuf + 5, wstr1 + 5);
 767   CHK_FAIL_END
 768
 769   CHK_FAIL_START
 770   wp = wcpcpy (wbuf + 9, wstr2);
 771   CHK_FAIL_END
 772
 773   CHK_FAIL_START
 774   wcsncpy (wbuf + 7, L"X", 4);
 775   CHK_FAIL_END
 776
 777   CHK_FAIL_START
 778   wcsncpy (wbuf + 7, L"X", l0 + 4);
 779   CHK_FAIL_END
 780
 781   CHK_FAIL_START
 782   wcsncpy (wbuf + 9, L"XABCDEFGH", 8);
 783   CHK_FAIL_END
 784
 785   CHK_FAIL_START
 786   wcslcpy (wbuf + 7, L"X", 4);
 787   CHK_FAIL_END
 788
 789   CHK_FAIL_START
 790   wcslcpy (wbuf + 7, L"X", l0 + 4);
 791   CHK_FAIL_END
 792
 793   CHK_FAIL_START
 794   wcslcpy (wbuf + 9, L"XABCDEFGH", 8);
 795   CHK_FAIL_END
 796
 797   CHK_FAIL_START
 798   wcpncpy (wbuf + 9, L"XABCDEFGH", 8);
 799   CHK_FAIL_END
 800
 801   CHK_FAIL_START
 802   wcpncpy (wbuf + 6, L"cd", 5);
 803   CHK_FAIL_END
 804
 805   CHK_FAIL_START
 806   wcpncpy (wbuf + 6, L"cd", l0 + 5);
 807   CHK_FAIL_END
 808
 809   wmemcpy (wbuf, wstr1 + 2, 9);
 810   CHK_FAIL_START
 811   wcscat (wbuf, L"AB");
 812   CHK_FAIL_END
 813
 814   wmemcpy (wbuf, wstr1 + 3, 8);
 815   CHK_FAIL_START
 816   wcsncat (wbuf, L"ZYXWV", l0 + 3);
 817   CHK_FAIL_END
 818
 819   wmemcpy (wbuf, wstr1 + 4, 7);
 820   CHK_FAIL_START
 821   wcslcat (wbuf, L"ZYXWV", l0 + 11);
 822   CHK_FAIL_END
 823
 824   CHK_FAIL_START
 825   wmemcpy (wa.buf1 + 1, L"abcdefghij", 10);
 826   CHK_FAIL_END
 827
 828   CHK_FAIL_START
 829   wmemcpy (wa.buf1 + 1, L"abcdefghij", l0 + 10);
 830   CHK_FAIL_END
 831
 832   CHK_FAIL_START
 833   wmemmove (wa.buf1 + 2, wa.buf1 + 1, 9);
 834   CHK_FAIL_END
 835
 836   CHK_FAIL_START
 837   wmemmove (wa.buf1 + 2, wa.buf1 + 1, l0 + 9);
 838   CHK_FAIL_END
 839
 840 #ifdef _GNU_SOURCE
 841   CHK_FAIL_START
 842   wp = wmempcpy (wa.buf1 + 6, L"abcde", 5);
 843   CHK_FAIL_END
 844
 845   CHK_FAIL_START
 846   wp = wmempcpy (wa.buf1 + 6, L"abcde", l0 + 5);
 847   CHK_FAIL_END
 848 #endif
 849
 850   CHK_FAIL_START
 851   wmemset (wa.buf1 + 9, L'j', 2);
 852   CHK_FAIL_END
 853
 854   CHK_FAIL_START
 855   wmemset (wa.buf1 + 9, L'j', l0 + 2);
 856   CHK_FAIL_END
 857
 858 #if __USE_FORTIFY_LEVEL >= 2
 859 # define O 0
 860 #else
 861 # define O 1
 862 #endif
 863
 864   CHK_FAIL_START
 865   wcscpy (wa.buf1 + (O + 4), wstr1 + 5);
 866   CHK_FAIL_END
 867
 868   CHK_FAIL_START
 869   wp = wcpcpy (wa.buf1 + (O + 8), wstr2);
 870   CHK_FAIL_END
 871
 872   CHK_FAIL_START
 873   wcsncpy (wa.buf1 + (O + 6), L"X", 4);
 874   CHK_FAIL_END
 875
 876   CHK_FAIL_START
 877   wcsncpy (wa.buf1 + (O + 6), L"X", l0 + 4);
 878   CHK_FAIL_END
 879
 880   wmemcpy (wa.buf1, wstr1 + (3 - O), 8 + O);
 881   CHK_FAIL_START
 882   wcscat (wa.buf1, L"AB");
 883   CHK_FAIL_END
 884
 885   wmemcpy (wa.buf1, wstr1 + (4 - O), 7 + O);
 886   CHK_FAIL_START
 887   wcsncat (wa.buf1, L"ZYXWV", l0 + 3);
 888   CHK_FAIL_END
 889 #endif
 890
 891
 892   /* Now checks for %n protection.  */
 893
 894   /* Constant literals passed directly are always ok
 895      (even with warnings about possible bugs from GCC).  */
 896   int n1, n2;
 897   if (sprintf (buf, "%s%n%s%n", str2, &n1, str2, &n2) != 2
 898       || n1 != 1 || n2 != 2)
 899     FAIL ();
 900
 901   /* In this case the format string is not known at compile time,
 902      but resides in read-only memory, so is ok.  */
 903   if (snprintf (buf, 4, str3, str2, &n1, str2, &n2) != 2
 904       || n1 != 1 || n2 != 2)
 905     FAIL ();
 906
 907   strcpy (buf2 + 2, "%n%s%n");
 908   /* When the format string is writable and contains %n,
 909      with -D_FORTIFY_SOURCE=2 it causes __chk_fail.  */
 910   CHK_FAIL2_START
 911   if (sprintf (buf, buf2, str2, &n1, str2, &n1) != 2)
 912     FAIL ();
 913   CHK_FAIL2_END
 914
 915   CHK_FAIL2_START
 916   if (snprintf (buf, 3, buf2, str2, &n1, str2, &n1) != 2)
 917     FAIL ();
 918   CHK_FAIL2_END
 919
 920   /* But if there is no %n, even writable format string
 921      should work.  */
 922   buf2[6] = '\0';
 923   if (sprintf (buf, buf2 + 4, str2) != 1)
 924     FAIL ();
 925
 926   /* Constant literals passed directly are always ok
 927      (even with warnings about possible bugs from GCC).  */
 928   if (printf ("%s%n%s%n", str4, &n1, str5, &n2) != 14
 929       || n1 != 7 || n2 != 14)
 930     FAIL ();
 931
 932   /* In this case the format string is not known at compile time,
 933      but resides in read-only memory, so is ok.  */
 934   if (printf (str3, str4, &n1, str5, &n2) != 14
 935       || n1 != 7 || n2 != 14)
 936     FAIL ();
 937
 938   strcpy (buf2 + 2, "%n%s%n");
 939   /* When the format string is writable and contains %n,
 940      with -D_FORTIFY_SOURCE=2 it causes __chk_fail.  */
 941   CHK_FAIL2_START
 942   if (printf (buf2, str4, &n1, str5, &n1) != 14)
 943     FAIL ();
 944   CHK_FAIL2_END
 945
 946   /* But if there is no %n, even writable format string
 947      should work.  */
 948   buf2[6] = '\0';
 949   if (printf (buf2 + 4, str5) != 7)
 950     FAIL ();
 951
 952   FILE *fp = stdout;
 953
 954   /* Constant literals passed directly are always ok
 955      (even with warnings about possible bugs from GCC).  */
 956   if (fprintf (fp, "%s%n%s%n", str4, &n1, str5, &n2) != 14
 957       || n1 != 7 || n2 != 14)
 958     FAIL ();
 959
 960   /* In this case the format string is not known at compile time,
 961      but resides in read-only memory, so is ok.  */
 962   if (fprintf (fp, str3, str4, &n1, str5, &n2) != 14
 963       || n1 != 7 || n2 != 14)
 964     FAIL ();
 965
 966   strcpy (buf2 + 2, "%n%s%n");
 967   /* When the format string is writable and contains %n,
 968      with -D_FORTIFY_SOURCE=2 it causes __chk_fail.  */
 969   CHK_FAIL2_START
 970   if (fprintf (fp, buf2, str4, &n1, str5, &n1) != 14)
 971     FAIL ();
 972   CHK_FAIL2_END
 973
 974   /* But if there is no %n, even writable format string
 975      should work.  */
 976   buf2[6] = '\0';
 977   if (fprintf (fp, buf2 + 4, str5) != 7)
 978     FAIL ();
 979
 980 #ifdef _GNU_SOURCE
 981   char *my_ptr = NULL;
 982   strcpy (buf2 + 2, "%n%s%n");
 983   /* When the format string is writable and contains %n,
 984      with -D_FORTIFY_SOURCE=2 it causes __chk_fail.  */
 985   CHK_FAIL2_START
 986   if (asprintf (&my_ptr, buf2, str4, &n1, str5, &n1) != 14)
 987     FAIL ();
 988   else
 989     free (my_ptr);
 990   CHK_FAIL2_END
 991
 992   struct obstack obs;
 993   obstack_init (&obs);
 994   CHK_FAIL2_START
 995   if (obstack_printf (&obs, buf2, str4, &n1, str5, &n1) != 14)
 996     FAIL ();
 997   CHK_FAIL2_END
 998   obstack_free (&obs, NULL);
 999
1000   my_ptr = NULL;
1001   if (asprintf (&my_ptr, "%s%n%s%n", str4, &n1, str5, &n1) != 14)
1002     FAIL ();
1003   else
1004     free (my_ptr);
1005
1006   obstack_init (&obs);
1007   if (obstack_printf (&obs, "%s%n%s%n", str4, &n1, str5, &n1) != 14)
1008     FAIL ();
1009   obstack_free (&obs, NULL);
1010 #endif
1011
1012   if (freopen (temp_filename, "r", stdin) == NULL)
1013     {
1014       puts ("could not open temporary file");
1015       exit (1);
1016     }
1017
1018   if (gets (buf) != buf || memcmp (buf, "abcdefgh", 9))
1019     FAIL ();
1020   if (gets (buf) != buf || memcmp (buf, "ABCDEFGHI", 10))
1021     FAIL ();
1022
1023 #if __USE_FORTIFY_LEVEL >= 1
1024   CHK_FAIL_START
1025   if (gets (buf) != buf)
1026     FAIL ();
1027   CHK_FAIL_END
1028 #endif
1029
1030   rewind (stdin);
1031
1032   if (fgets (buf, buf_size, stdin) != buf
1033       || memcmp (buf, "abcdefgh\n", 10))
1034     FAIL ();
1035   if (fgets (buf, buf_size, stdin) != buf || memcmp (buf, "ABCDEFGHI", 10))
1036     FAIL ();
1037
1038   rewind (stdin);
1039
1040   if (fgets (buf, l0 + buf_size, stdin) != buf
1041       || memcmp (buf, "abcdefgh\n", 10))
1042     FAIL ();
1043
1044 #if __USE_FORTIFY_LEVEL >= 1
1045   CHK_FAIL_START
1046   if (fgets (buf, buf_size + 1, stdin) != buf)
1047     FAIL ();
1048   CHK_FAIL_END
1049
1050   CHK_FAIL_START
1051   if (fgets (buf, l0 + buf_size + 1, stdin) != buf)
1052     FAIL ();
1053   CHK_FAIL_END
1054 #endif
1055
1056   rewind (stdin);
1057
1058 #ifdef _GNU_SOURCE
1059   if (fgets_unlocked (buf, buf_size, stdin) != buf
1060       || memcmp (buf, "abcdefgh\n", 10))
1061     FAIL ();
1062   if (fgets_unlocked (buf, buf_size, stdin) != buf
1063       || memcmp (buf, "ABCDEFGHI", 10))
1064     FAIL ();
1065
1066   rewind (stdin);
1067
1068   if (fgets_unlocked (buf, l0 + buf_size, stdin) != buf
1069       || memcmp (buf, "abcdefgh\n", 10))
1070     FAIL ();
1071
1072 #if __USE_FORTIFY_LEVEL >= 1
1073   CHK_FAIL_START
1074   if (fgets_unlocked (buf, buf_size + 1, stdin) != buf)
1075     FAIL ();
1076   CHK_FAIL_END
1077
1078   CHK_FAIL_START
1079   if (fgets_unlocked (buf, l0 + buf_size + 1, stdin) != buf)
1080     FAIL ();
1081   CHK_FAIL_END
1082 #endif
1083
1084   rewind (stdin);
1085 #endif
1086
1087   if (fread (buf, 1, buf_size, stdin) != buf_size
1088       || memcmp (buf, "abcdefgh\nA", 10))
1089     FAIL ();
1090   if (fread (buf, buf_size, 1, stdin) != 1
1091       || memcmp (buf, "BCDEFGHI\na", 10))
1092     FAIL ();
1093
1094   rewind (stdin);
1095
1096   if (fread (buf, l0 + 1, buf_size, stdin) != buf_size
1097       || memcmp (buf, "abcdefgh\nA", 10))
1098     FAIL ();
1099   if (fread (buf, buf_size, l0 + 1, stdin) != 1
1100       || memcmp (buf, "BCDEFGHI\na", 10))
1101     FAIL ();
1102
1103 #if __USE_FORTIFY_LEVEL >= 1
1104   CHK_FAIL_START
1105   if (fread (buf, 1, buf_size + 1, stdin) != buf_size + 1)
1106     FAIL ();
1107   CHK_FAIL_END
1108
1109   CHK_FAIL_START
1110   if (fread (buf, buf_size + 1, l0 + 1, stdin) != 1)
1111     FAIL ();
1112   CHK_FAIL_END
1113 #endif
1114
1115   rewind (stdin);
1116
1117   if (fread_unlocked (buf, 1, buf_size, stdin) != buf_size
1118       || memcmp (buf, "abcdefgh\nA", 10))
1119     FAIL ();
1120   if (fread_unlocked (buf, buf_size, 1, stdin) != 1
1121       || memcmp (buf, "BCDEFGHI\na", 10))
1122     FAIL ();
1123
1124   rewind (stdin);
1125
1126   if (fread_unlocked (buf, 1, 4, stdin) != 4
1127       || memcmp (buf, "abcdFGHI\na", 10))
1128     FAIL ();
1129   if (fread_unlocked (buf, 4, 1, stdin) != 1
1130       || memcmp (buf, "efghFGHI\na", 10))
1131     FAIL ();
1132
1133   rewind (stdin);
1134
1135   if (fread_unlocked (buf, l0 + 1, buf_size, stdin) != buf_size
1136       || memcmp (buf, "abcdefgh\nA", 10))
1137     FAIL ();
1138   if (fread_unlocked (buf, buf_size, l0 + 1, stdin) != 1
1139       || memcmp (buf, "BCDEFGHI\na", 10))
1140     FAIL ();
1141
1142 #if __USE_FORTIFY_LEVEL >= 1
1143   CHK_FAIL_START
1144   if (fread_unlocked (buf, 1, buf_size + 1, stdin) != buf_size + 1)
1145     FAIL ();
1146   CHK_FAIL_END
1147
1148   CHK_FAIL_START
1149   if (fread_unlocked (buf, buf_size + 1, l0 + 1, stdin) != 1)
1150     FAIL ();
1151   CHK_FAIL_END
1152 #endif
1153
1154   lseek (fileno (stdin), 0, SEEK_SET);
1155
1156   if (read (fileno (stdin), buf, buf_size - 1) != buf_size - 1
1157       || memcmp (buf, "abcdefgh\n", 9))
1158     FAIL ();
1159   if (read (fileno (stdin), buf, buf_size - 1) != buf_size - 1
1160       || memcmp (buf, "ABCDEFGHI", 9))
1161     FAIL ();
1162
1163   lseek (fileno (stdin), 0, SEEK_SET);
1164
1165   if (read (fileno (stdin), buf, l0 + buf_size - 1) != buf_size - 1
1166       || memcmp (buf, "abcdefgh\n", 9))
1167     FAIL ();
1168
1169 #if __USE_FORTIFY_LEVEL >= 1
1170   CHK_FAIL_START
1171   if (read (fileno (stdin), buf, buf_size + 1) != buf_size + 1)
1172     FAIL ();
1173   CHK_FAIL_END
1174
1175   CHK_FAIL_START
1176   if (read (fileno (stdin), buf, l0 + buf_size + 1) != buf_size + 1)
1177     FAIL ();
1178   CHK_FAIL_END
1179 #endif
1180
1181   if (pread (fileno (stdin), buf, buf_size - 1, buf_size - 2)
1182       != buf_size - 1
1183       || memcmp (buf, "\nABCDEFGH", 9))
1184     FAIL ();
1185   if (pread (fileno (stdin), buf, buf_size - 1, 0) != buf_size - 1
1186       || memcmp (buf, "abcdefgh\n", 9))
1187     FAIL ();
1188   if (pread (fileno (stdin), buf, l0 + buf_size - 1, buf_size - 3)
1189       != buf_size - 1
1190       || memcmp (buf, "h\nABCDEFG", 9))
1191     FAIL ();
1192
1193 #if __USE_FORTIFY_LEVEL >= 1
1194   CHK_FAIL_START
1195   if (pread (fileno (stdin), buf, buf_size + 1, 2 * buf_size)
1196       != buf_size + 1)
1197     FAIL ();
1198   CHK_FAIL_END
1199
1200   CHK_FAIL_START
1201   if (pread (fileno (stdin), buf, l0 + buf_size + 1, 2 * buf_size)
1202       != buf_size + 1)
1203     FAIL ();
1204   CHK_FAIL_END
1205 #endif
1206
1207   if (pread64 (fileno (stdin), buf, buf_size - 1, buf_size - 2)
1208       != buf_size - 1
1209       || memcmp (buf, "\nABCDEFGH", 9))
1210     FAIL ();
1211   if (pread64 (fileno (stdin), buf, buf_size - 1, 0) != buf_size - 1
1212       || memcmp (buf, "abcdefgh\n", 9))
1213     FAIL ();
1214   if (pread64 (fileno (stdin), buf, l0 + buf_size - 1, buf_size - 3)
1215       != buf_size - 1
1216       || memcmp (buf, "h\nABCDEFG", 9))
1217     FAIL ();
1218
1219 #if __USE_FORTIFY_LEVEL >= 1
1220   CHK_FAIL_START
1221   if (pread64 (fileno (stdin), buf, buf_size + 1, 2 * buf_size)
1222       != buf_size + 1)
1223     FAIL ();
1224   CHK_FAIL_END
1225
1226   CHK_FAIL_START
1227   if (pread64 (fileno (stdin), buf, l0 + buf_size + 1, 2 * buf_size)
1228       != buf_size + 1)
1229     FAIL ();
1230   CHK_FAIL_END
1231 #endif
1232
1233   if (freopen (temp_filename, "r", stdin) == NULL)
1234     {
1235       puts ("could not open temporary file");
1236       exit (1);
1237     }
1238
1239   if (fseek (stdin, 9 + 10 + 11, SEEK_SET))
1240     {
1241       puts ("could not seek in test file");
1242       exit (1);
1243     }
1244
1245 #if __USE_FORTIFY_LEVEL >= 1
1246   CHK_FAIL_START
1247   if (gets (buf) != buf)
1248     FAIL ();
1249   CHK_FAIL_END
1250 #endif
1251
1252   /* Check whether missing N$ formats are detected.  */
1253   CHK_FAIL2_START
1254   printf ("%3$d\n", 1, 2, 3, 4);
1255   CHK_FAIL2_END
1256
1257   CHK_FAIL2_START
1258   fprintf (stdout, "%3$d\n", 1, 2, 3, 4);
1259   CHK_FAIL2_END
1260
1261   CHK_FAIL2_START
1262   sprintf (buf, "%3$d\n", 1, 2, 3, 4);
1263   CHK_FAIL2_END
1264
1265   CHK_FAIL2_START
1266   snprintf (buf, buf_size, "%3$d\n", 1, 2, 3, 4);
1267   CHK_FAIL2_END
1268
1269   int sp[2];
1270   if (socketpair (PF_UNIX, SOCK_STREAM, 0, sp))
1271     FAIL ();
1272   else
1273     {
1274       const char *sendstr = "abcdefgh\nABCDEFGH\n0123456789\n";
1275       if ((size_t) send (sp[0], sendstr, strlen (sendstr), 0)
1276           != strlen (sendstr))
1277         FAIL ();
1278
1279       char recvbuf[12];
1280       if (recv (sp[1], recvbuf, sizeof recvbuf, MSG_PEEK)
1281           != sizeof recvbuf
1282           || memcmp (recvbuf, sendstr, sizeof recvbuf) != 0)
1283         FAIL ();
1284
1285       if (recv (sp[1], recvbuf + 6, l0 + sizeof recvbuf - 7, MSG_PEEK)
1286           != sizeof recvbuf - 7
1287           || memcmp (recvbuf + 6, sendstr, sizeof recvbuf - 7) != 0)
1288         FAIL ();
1289
1290 #if __USE_FORTIFY_LEVEL >= 1
1291       CHK_FAIL_START
1292       if (recv (sp[1], recvbuf + 1, sizeof recvbuf, MSG_PEEK)
1293           != sizeof recvbuf)
1294         FAIL ();
1295       CHK_FAIL_END
1296
1297       CHK_FAIL_START
1298       if (recv (sp[1], recvbuf + 4, l0 + sizeof recvbuf - 3, MSG_PEEK)
1299           != sizeof recvbuf - 3)
1300         FAIL ();
1301       CHK_FAIL_END
1302 #endif
1303
1304       socklen_t sl;
1305       struct sockaddr_un sa_un;
1306
1307       sl = sizeof (sa_un);
1308       if (recvfrom (sp[1], recvbuf, sizeof recvbuf, MSG_PEEK,
1309                     (struct sockaddr *) &sa_un, &sl)
1310           != sizeof recvbuf
1311           || memcmp (recvbuf, sendstr, sizeof recvbuf) != 0)
1312         FAIL ();
1313
1314       sl = sizeof (sa_un);
1315       if (recvfrom (sp[1], recvbuf + 6, l0 + sizeof recvbuf - 7, MSG_PEEK,
1316                     (struct sockaddr *) &sa_un, &sl) != sizeof recvbuf - 7
1317           || memcmp (recvbuf + 6, sendstr, sizeof recvbuf - 7) != 0)
1318         FAIL ();
1319
1320 #if __USE_FORTIFY_LEVEL >= 1
1321       CHK_FAIL_START
1322       sl = sizeof (sa_un);
1323       if (recvfrom (sp[1], recvbuf + 1, sizeof recvbuf, MSG_PEEK,
1324                     (struct sockaddr *) &sa_un, &sl) != sizeof recvbuf)
1325         FAIL ();
1326       CHK_FAIL_END
1327
1328       CHK_FAIL_START
1329       sl = sizeof (sa_un);
1330       if (recvfrom (sp[1], recvbuf + 4, l0 + sizeof recvbuf - 3, MSG_PEEK,
1331                     (struct sockaddr *) &sa_un, &sl) != sizeof recvbuf - 3)
1332         FAIL ();
1333       CHK_FAIL_END
1334 #endif
1335
1336       close (sp[0]);
1337       close (sp[1]);
1338     }
1339
1340   char fname[] = "/tmp/tst-chk1-dir-XXXXXX\0foo";
1341   char *enddir = strchr (fname, '\0');
1342   if (mkdtemp (fname) == NULL)
1343     {
1344       printf ("mkdtemp failed: %m\n");
1345       return 1;
1346     }
1347   *enddir = '/';
1348   if (symlink ("bar", fname) != 0)
1349     FAIL ();
1350
1351   char readlinkbuf[4];
1352   if (readlink (fname, readlinkbuf, 4) != 3
1353       || memcmp (readlinkbuf, "bar", 3) != 0)
1354     FAIL ();
1355   if (readlink (fname, readlinkbuf + 1, l0 + 3) != 3
1356       || memcmp (readlinkbuf, "bbar", 4) != 0)
1357     FAIL ();
1358
1359 #if __USE_FORTIFY_LEVEL >= 1
1360   CHK_FAIL_START
1361   if (readlink (fname, readlinkbuf + 2, l0 + 3) != 3)
1362     FAIL ();
1363   CHK_FAIL_END
1364
1365   CHK_FAIL_START
1366   if (readlink (fname, readlinkbuf + 3, 4) != 3)
1367     FAIL ();
1368   CHK_FAIL_END
1369 #endif
1370
1371   int tmpfd = open ("/tmp", O_RDONLY | O_DIRECTORY);
1372   if (tmpfd < 0)
1373     FAIL ();
1374
1375   if (readlinkat (tmpfd, fname + sizeof ("/tmp/") - 1, readlinkbuf, 4) != 3
1376       || memcmp (readlinkbuf, "bar", 3) != 0)
1377     FAIL ();
1378   if (readlinkat (tmpfd, fname + sizeof ("/tmp/") - 1, readlinkbuf + 1,
1379                   l0 + 3) != 3
1380       || memcmp (readlinkbuf, "bbar", 4) != 0)
1381     FAIL ();
1382
1383 #if __USE_FORTIFY_LEVEL >= 1
1384   CHK_FAIL_START
1385   if (readlinkat (tmpfd, fname + sizeof ("/tmp/") - 1, readlinkbuf + 2,
1386                   l0 + 3) != 3)
1387     FAIL ();
1388   CHK_FAIL_END
1389
1390   CHK_FAIL_START
1391   if (readlinkat (tmpfd, fname + sizeof ("/tmp/") - 1, readlinkbuf + 3,
1392                   4) != 3)
1393     FAIL ();
1394   CHK_FAIL_END
1395 #endif
1396
1397   close (tmpfd);
1398
1399   char *cwd1 = getcwd (NULL, 0);
1400   if (cwd1 == NULL)
1401     FAIL ();
1402
1403   char *cwd2 = getcwd (NULL, 250);
1404   if (cwd2 == NULL)
1405     FAIL ();
1406
1407   if (cwd1 && cwd2)
1408     {
1409       if (strcmp (cwd1, cwd2) != 0)
1410         FAIL ();
1411
1412       *enddir = '\0';
1413       if (chdir (fname))
1414         FAIL ();
1415
1416       char *cwd3 = getcwd (NULL, 0);
1417       if (cwd3 == NULL)
1418         FAIL ();
1419       if (strcmp (fname, cwd3) != 0)
1420         printf ("getcwd after chdir is '%s' != '%s',"
1421                 "get{c,}wd tests skipped\n", cwd3, fname);
1422       else
1423         {
1424           char getcwdbuf[sizeof fname - 3];
1425
1426           char *cwd4 = getcwd (getcwdbuf, sizeof getcwdbuf);
1427           if (cwd4 != getcwdbuf
1428               || strcmp (getcwdbuf, fname) != 0)
1429             FAIL ();
1430
1431           cwd4 = getcwd (getcwdbuf + 1, l0 + sizeof getcwdbuf - 1);
1432           if (cwd4 != getcwdbuf + 1
1433               || getcwdbuf[0] != fname[0]
1434               || strcmp (getcwdbuf + 1, fname) != 0)
1435             FAIL ();
1436
1437 #if __USE_FORTIFY_LEVEL >= 1
1438           CHK_FAIL_START
1439           if (getcwd (getcwdbuf + 2, l0 + sizeof getcwdbuf)
1440               != getcwdbuf + 2)
1441             FAIL ();
1442           CHK_FAIL_END
1443
1444           CHK_FAIL_START
1445           if (getcwd (getcwdbuf + 2, sizeof getcwdbuf)
1446               != getcwdbuf + 2)
1447             FAIL ();
1448           CHK_FAIL_END
1449 #endif
1450
1451           if (getwd (getcwdbuf) != getcwdbuf
1452               || strcmp (getcwdbuf, fname) != 0)
1453             FAIL ();
1454
1455           if (getwd (getcwdbuf + 1) != getcwdbuf + 1
1456               || strcmp (getcwdbuf + 1, fname) != 0)
1457             FAIL ();
1458
1459 #if __USE_FORTIFY_LEVEL >= 1
1460           CHK_FAIL_START
1461           if (getwd (getcwdbuf + 2) != getcwdbuf + 2)
1462             FAIL ();
1463           CHK_FAIL_END
1464 #endif
1465         }
1466
1467       if (chdir (cwd1) != 0)
1468         FAIL ();
1469       free (cwd3);
1470     }
1471
1472   free (cwd1);
1473   free (cwd2);
1474   *enddir = '/';
1475   if (unlink (fname) != 0)
1476     FAIL ();
1477
1478   *enddir = '\0';
1479   if (rmdir (fname) != 0)
1480     FAIL ();
1481
1482
1483 #if PATH_MAX > 0
1484   char largebuf[PATH_MAX];
1485   char *realres = realpath (".", largebuf);
1486   if (realres != largebuf)
1487     FAIL ();
1488
1489 # if __USE_FORTIFY_LEVEL >= 1
1490   CHK_FAIL_START
1491   char realbuf[1];
1492   realres = realpath (".", realbuf);
1493   if (realres != realbuf)
1494     FAIL ();
1495   CHK_FAIL_END
1496 # endif
1497 #endif
1498
1499   if (setlocale (LC_ALL, "de_DE.UTF-8") != NULL)
1500     {
1501       assert (MB_CUR_MAX <= 10);
1502
1503       /* First a simple test.  */
1504       char enough[10];
1505       if (wctomb (enough, L'A') != 1)
1506         FAIL ();
1507
1508 #if __USE_FORTIFY_LEVEL >= 1
1509       /* We know the wchar_t encoding is ISO 10646.  So pick a
1510          character which has a multibyte representation which does not
1511          fit.  */
1512       CHK_FAIL_START
1513       char smallbuf[2];
1514       if (wctomb (smallbuf, L'\x100') != 2)
1515         FAIL ();
1516       CHK_FAIL_END
1517 #endif
1518
1519       mbstate_t s;
1520       memset (&s, '\0', sizeof (s));
1521       if (wcrtomb (enough, L'D', &s) != 1 || enough[0] != 'D')
1522         FAIL ();
1523
1524 #if __USE_FORTIFY_LEVEL >= 1
1525       /* We know the wchar_t encoding is ISO 10646.  So pick a
1526          character which has a multibyte representation which does not
1527          fit.  */
1528       CHK_FAIL_START
1529       char smallbuf[1];
1530       if (wcrtomb (smallbuf, L'\x100', &s) != 2)
1531         FAIL ();
1532       CHK_FAIL_END
1533
1534       /* Same input with a large enough buffer and we're good.  */
1535       char bigenoughbuf[2];
1536       if (wcrtomb (bigenoughbuf, L'\x100', &s) != 2)
1537         FAIL ();
1538 #endif
1539
1540       wchar_t wenough[10];
1541       memset (&s, '\0', sizeof (s));
1542       const char *cp = "A";
1543       if (mbsrtowcs (wenough, &cp, 10, &s) != 1
1544           || wcscmp (wenough, L"A") != 0)
1545         FAIL ();
1546
1547       cp = "BC";
1548       if (mbsrtowcs (wenough, &cp, l0 + 10, &s) != 2
1549           || wcscmp (wenough, L"BC") != 0)
1550         FAIL ();
1551
1552 #if __USE_FORTIFY_LEVEL >= 1
1553       CHK_FAIL_START
1554       wchar_t wsmallbuf[2];
1555       cp = "ABC";
1556       mbsrtowcs (wsmallbuf, &cp, 10, &s);
1557       CHK_FAIL_END
1558 #endif
1559
1560       /* Bug 29030 regression check */
1561       cp = "HelloWorld";
1562       if (mbsrtowcs (NULL, &cp, (size_t)-1, &s) != 10)
1563         FAIL ();
1564
1565       cp = "A";
1566       if (mbstowcs (wenough, cp, 10) != 1
1567           || wcscmp (wenough, L"A") != 0)
1568         FAIL ();
1569
1570       cp = "DEF";
1571       if (mbstowcs (wenough, cp, l0 + 10) != 3
1572           || wcscmp (wenough, L"DEF") != 0)
1573         FAIL ();
1574
1575 #if __USE_FORTIFY_LEVEL >= 1
1576       CHK_FAIL_START
1577       wchar_t wsmallbuf[2];
1578       cp = "ABC";
1579       mbstowcs (wsmallbuf, cp, 10);
1580       CHK_FAIL_END
1581 #endif
1582
1583       memset (&s, '\0', sizeof (s));
1584       cp = "ABC";
1585       wcscpy (wenough, L"DEF");
1586       if (mbsnrtowcs (wenough, &cp, 1, 10, &s) != 1
1587           || wcscmp (wenough, L"AEF") != 0)
1588         FAIL ();
1589
1590       cp = "IJ";
1591       if (mbsnrtowcs (wenough, &cp, 1, l0 + 10, &s) != 1
1592           || wcscmp (wenough, L"IEF") != 0)
1593         FAIL ();
1594
1595 #if __USE_FORTIFY_LEVEL >= 1
1596       CHK_FAIL_START
1597       wchar_t wsmallbuf[2];
1598       cp = "ABC";
1599       mbsnrtowcs (wsmallbuf, &cp, 3, 10, &s);
1600       CHK_FAIL_END
1601 #endif
1602
1603       memset (&s, '\0', sizeof (s));
1604       const wchar_t *wcp = L"A";
1605       if (wcsrtombs (enough, &wcp, 10, &s) != 1
1606           || strcmp (enough, "A") != 0)
1607         FAIL ();
1608
1609       wcp = L"BC";
1610       if (wcsrtombs (enough, &wcp, l0 + 10, &s) != 2
1611           || strcmp (enough, "BC") != 0)
1612         FAIL ();
1613
1614 #if __USE_FORTIFY_LEVEL >= 1
1615       CHK_FAIL_START
1616       char smallbuf[2];
1617       wcp = L"ABC";
1618       wcsrtombs (smallbuf, &wcp, 10, &s);
1619       CHK_FAIL_END
1620 #endif
1621
1622       memset (enough, 'Z', sizeof (enough));
1623       wcp = L"EF";
1624       if (wcstombs (enough, wcp, 10) != 2
1625           || strcmp (enough, "EF") != 0)
1626         FAIL ();
1627
1628       wcp = L"G";
1629       if (wcstombs (enough, wcp, l0 + 10) != 1
1630           || strcmp (enough, "G") != 0)
1631         FAIL ();
1632
1633 #if __USE_FORTIFY_LEVEL >= 1
1634       CHK_FAIL_START
1635       char smallbuf[2];
1636       wcp = L"ABC";
1637       wcstombs (smallbuf, wcp, 10);
1638       CHK_FAIL_END
1639 #endif
1640
1641       memset (&s, '\0', sizeof (s));
1642       wcp = L"AB";
1643       if (wcsnrtombs (enough, &wcp, 1, 10, &s) != 1
1644           || strcmp (enough, "A") != 0)
1645         FAIL ();
1646
1647       wcp = L"BCD";
1648       if (wcsnrtombs (enough, &wcp, 1, l0 + 10, &s) != 1
1649           || strcmp (enough, "B") != 0)
1650         FAIL ();
1651
1652 #if __USE_FORTIFY_LEVEL >= 1
1653       CHK_FAIL_START
1654       char smallbuf[2];
1655       wcp = L"ABC";
1656       wcsnrtombs (smallbuf, &wcp, 3, 10, &s);
1657       CHK_FAIL_END
1658 #endif
1659     }
1660   else
1661     {
1662       puts ("cannot set locale");
1663       ret = 1;
1664     }
1665
1666   int fd;
1667
1668 #ifdef _GNU_SOURCE
1669   fd = posix_openpt (O_RDWR);
1670   if (fd != -1)
1671     {
1672       char enough[1000];
1673       if (ptsname_r (fd, enough, sizeof (enough)) != 0)
1674         FAIL ();
1675
1676 #if __USE_FORTIFY_LEVEL >= 1
1677       CHK_FAIL_START
1678       char smallbuf[2];
1679       if (ptsname_r (fd, smallbuf, sizeof (smallbuf) + 1) == 0)
1680         FAIL ();
1681       CHK_FAIL_END
1682 #endif
1683       close (fd);
1684     }
1685 #endif
1686
1687 #if PATH_MAX > 0
1688   confstr (_CS_GNU_LIBC_VERSION, largebuf, sizeof (largebuf));
1689 # if __USE_FORTIFY_LEVEL >= 1
1690   CHK_FAIL_START
1691   char smallbuf[1];
1692   confstr (_CS_GNU_LIBC_VERSION, smallbuf, sizeof (largebuf));
1693   CHK_FAIL_END
1694 # endif
1695 #endif
1696
1697   gid_t grpslarge[5];
1698   int ngr = getgroups (5, grpslarge);
1699   asm volatile ("" : : "r" (ngr));
1700 #if __USE_FORTIFY_LEVEL >= 1
1701   CHK_FAIL_START
1702   char smallbuf[1];
1703   ngr = getgroups (5, (gid_t *) smallbuf);
1704   asm volatile ("" : : "r" (ngr));
1705   CHK_FAIL_END
1706 #endif
1707
1708   fd = open (_PATH_TTY, O_RDONLY);
1709   if (fd != -1)
1710     {
1711       char enough[1000];
1712       if (ttyname_r (fd, enough, sizeof (enough)) != 0)
1713         FAIL ();
1714
1715 #if __USE_FORTIFY_LEVEL >= 1
1716       CHK_FAIL_START
1717       char smallbuf[2];
1718       if (ttyname_r (fd, smallbuf, sizeof (smallbuf) + 1) == 0)
1719         FAIL ();
1720       CHK_FAIL_END
1721 #endif
1722       close (fd);
1723     }
1724
1725   char hostnamelarge[1000];
1726   gethostname (hostnamelarge, sizeof (hostnamelarge));
1727 #if __USE_FORTIFY_LEVEL >= 1
1728   CHK_FAIL_START
1729   char smallbuf[1];
1730   gethostname (smallbuf, sizeof (hostnamelarge));
1731   CHK_FAIL_END
1732 #endif
1733
1734   char loginlarge[1000];
1735   getlogin_r (loginlarge, sizeof (hostnamelarge));
1736 #if __USE_FORTIFY_LEVEL >= 1
1737   CHK_FAIL_START
1738   char smallbuf[1];
1739   getlogin_r (smallbuf, sizeof (loginlarge));
1740   CHK_FAIL_END
1741 #endif
1742
1743   char domainnamelarge[1000];
1744   int res = getdomainname (domainnamelarge, sizeof (domainnamelarge));
1745   asm volatile ("" : : "r" (res));
1746 #if __USE_FORTIFY_LEVEL >= 1
1747   CHK_FAIL_START
1748   char smallbuf[1];
1749   res = getdomainname (smallbuf, sizeof (domainnamelarge));
1750   asm volatile ("" : : "r" (res));
1751   CHK_FAIL_END
1752 #endif
1753
1754   fd_set s;
1755   FD_ZERO (&s);
1756
1757   FD_SET (FD_SETSIZE - 1, &s);
1758 #if __USE_FORTIFY_LEVEL >= 1
1759   CHK_FAIL_START
1760   FD_SET (FD_SETSIZE, &s);
1761   CHK_FAIL_END
1762
1763   CHK_FAIL_START
1764   FD_SET (l0 + FD_SETSIZE, &s);
1765   CHK_FAIL_END
1766 #endif
1767
1768   FD_CLR (FD_SETSIZE - 1, &s);
1769 #if __USE_FORTIFY_LEVEL >= 1
1770   CHK_FAIL_START
1771   FD_CLR (FD_SETSIZE, &s);
1772   CHK_FAIL_END
1773
1774   CHK_FAIL_START
1775   FD_SET (l0 + FD_SETSIZE, &s);
1776   CHK_FAIL_END
1777 #endif
1778
1779   FD_ISSET (FD_SETSIZE - 1, &s);
1780 #if __USE_FORTIFY_LEVEL >= 1
1781   CHK_FAIL_START
1782   FD_ISSET (FD_SETSIZE, &s);
1783   CHK_FAIL_END
1784
1785   CHK_FAIL_START
1786   FD_ISSET (l0 + FD_SETSIZE, &s);
1787   CHK_FAIL_END
1788 #endif
1789
1790   struct pollfd fds[1];
1791   fds[0].fd = STDOUT_FILENO;
1792   fds[0].events = POLLOUT;
1793   poll (fds, 1, 0);
1794 #if __USE_FORTIFY_LEVEL >= 1
1795   CHK_FAIL_START
1796   poll (fds, 2, 0);
1797   CHK_FAIL_END
1798
1799   CHK_FAIL_START
1800   poll (fds, l0 + 2, 0);
1801   CHK_FAIL_END
1802 #endif
1803 #ifdef _GNU_SOURCE
1804   ppoll (fds, 1, NULL, NULL);
1805 # if __USE_FORTIFY_LEVEL >= 1
1806   CHK_FAIL_START
1807   ppoll (fds, 2, NULL, NULL);
1808   CHK_FAIL_END
1809
1810   CHK_FAIL_START
1811   ppoll (fds, l0 + 2, NULL, NULL);
1812   CHK_FAIL_END
1813 # endif
1814 #endif
1815
1816   return ret;
1817 }