1 /* Copyright (C) 2004 Free Software Foundation, Inc.
2 This file is part of the GNU C Library.
3 Contributed by Jakub Jelinek <jakub@redhat.com>, 2004.
5 The GNU C Library is free software; you can redistribute it and/or
6 modify it under the terms of the GNU Lesser General Public
7 License as published by the Free Software Foundation; either
8 version 2.1 of the License, or (at your option) any later version.
10 The GNU C Library is distributed in the hope that it will be useful,
11 but WITHOUT ANY WARRANTY; without even the implied warranty of
12 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
13 Lesser General Public License for more details.
15 You should have received a copy of the GNU Lesser General Public
16 License along with the GNU C Library; if not, write to the Free
17 Software Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA
28 static void do_prepare (void);
29 static int do_test (void);
30 #define PREPARE(argc, argv) do_prepare ()
31 #define TEST_FUNCTION do_test ()
32 #include "../test-skeleton.c"
37 int temp_fd
= create_temp_file ("tst-chk1.", &temp_filename
);
40 printf ("cannot create temporary file: %m\n");
44 const char *strs
= "abcdefgh\nABCDEFGHI\nabcdefghij\nABCDEFGHIJ";
45 if (write (temp_fd
, strs
, strlen (strs
)) != strlen (strs
))
47 puts ("could not write test strings into file");
48 unlink (temp_filename
);
53 volatile int chk_fail_ok
;
62 longjmp (chk_fail_buf
, 1);
71 const char *str1
= "JIHGFEDCBA";
72 const char *str2
= "F";
73 const char *str3
= "%s%n%s%n";
74 const char *str4
= "Hello, ";
75 const char *str5
= "World!\n";
81 do { printf ("Failure on line %d\n", __LINE__); ret = 1; } while (0)
82 #define CHK_FAIL_START \
84 if (! setjmp (chk_fail_buf)) \
86 #define CHK_FAIL_END \
91 #if __USE_FORTIFY_LEVEL >= 2
92 #define CHK_FAIL2_START CHK_FAIL_START
93 #define CHK_FAIL2_END CHK_FAIL_END
95 #define CHK_FAIL2_START
104 sa
.sa_handler
= handler
;
106 sigemptyset (&sa
.sa_mask
);
108 sigaction (SIGABRT
, &sa
, NULL
);
110 struct A
{ char buf1
[9]; char buf2
[1]; } a
;
112 printf ("Test checking routines at fortify level %d\n",
113 #ifdef __USE_FORTIFY_LEVEL
114 (int) __USE_FORTIFY_LEVEL
120 /* These ops can be done without runtime checking of object size. */
121 memcpy (buf
, "abcdefghij", 10);
122 memmove (buf
+ 1, buf
, 9);
123 if (memcmp (buf
, "aabcdefghi", 10))
126 if (mempcpy (buf
+ 5, "abcde", 5) != buf
+ 10 || memcmp (buf
, "aabcdabcde", 10))
129 memset (buf
+ 8, 'j', 2);
130 if (memcmp (buf
, "aabcdabcjj", 10))
133 strcpy (buf
+ 4, "EDCBA");
134 if (memcmp (buf
, "aabcEDCBA", 10))
137 if (stpcpy (buf
+ 8, "F") != buf
+ 9 || memcmp (buf
, "aabcEDCBF", 10))
140 strncpy (buf
+ 6, "X", 4);
141 if (memcmp (buf
, "aabcEDX\0\0", 10))
144 if (sprintf (buf
+ 7, "%s", "67") != 2 || memcmp (buf
, "aabcEDX67", 10))
147 if (snprintf (buf
+ 7, 3, "%s", "987654") != 6
148 || memcmp (buf
, "aabcEDX98", 10))
151 /* These ops need runtime checking, but shouldn't __chk_fail. */
152 memcpy (buf
, "abcdefghij", l0
+ 10);
153 memmove (buf
+ 1, buf
, l0
+ 9);
154 if (memcmp (buf
, "aabcdefghi", 10))
157 if (mempcpy (buf
+ 5, "abcde", l0
+ 5) != buf
+ 10 || memcmp (buf
, "aabcdabcde", 10))
160 memset (buf
+ 8, 'j', l0
+ 2);
161 if (memcmp (buf
, "aabcdabcjj", 10))
164 strcpy (buf
+ 4, str1
+ 5);
165 if (memcmp (buf
, "aabcEDCBA", 10))
168 if (stpcpy (buf
+ 8, str2
) != buf
+ 9 || memcmp (buf
, "aabcEDCBF", 10))
171 strncpy (buf
+ 6, "X", l0
+ 4);
172 if (memcmp (buf
, "aabcEDX\0\0", 10))
175 if (sprintf (buf
+ 7, "%d", num1
) != 2 || memcmp (buf
, "aabcEDX67", 10))
178 if (snprintf (buf
+ 7, 3, "%d", num2
) != 6 || memcmp (buf
, "aabcEDX98", 10))
183 if (memcmp (buf
, "aabcEDX9A", 10))
187 strncat (buf
, "ZYXWV", l0
+ 2);
188 if (memcmp (buf
, "aabcEDXZY", 10))
191 memcpy (a
.buf1
, "abcdefghij", l0
+ 10);
192 memmove (a
.buf1
+ 1, a
.buf1
, l0
+ 9);
193 if (memcmp (a
.buf1
, "aabcdefghi", 10))
196 if (mempcpy (a
.buf1
+ 5, "abcde", l0
+ 5) != a
.buf1
+ 10
197 || memcmp (a
.buf1
, "aabcdabcde", 10))
200 memset (a
.buf1
+ 8, 'j', l0
+ 2);
201 if (memcmp (a
.buf1
, "aabcdabcjj", 10))
204 #if __USE_FORTIFY_LEVEL < 2
205 /* The following tests are supposed to crash with -D_FORTIFY_SOURCE=2
206 and sufficient GCC support, as the string operations overflow
207 from a.buf1 into a.buf2. */
208 strcpy (a
.buf1
+ 4, str1
+ 5);
209 if (memcmp (a
.buf1
, "aabcEDCBA", 10))
212 if (stpcpy (a
.buf1
+ 8, str2
) != a
.buf1
+ 9 || memcmp (a
.buf1
, "aabcEDCBF", 10))
215 strncpy (a
.buf1
+ 6, "X", l0
+ 4);
216 if (memcmp (a
.buf1
, "aabcEDX\0\0", 10))
219 if (sprintf (a
.buf1
+ 7, "%d", num1
) != 2 || memcmp (a
.buf1
, "aabcEDX67", 10))
222 if (snprintf (a
.buf1
+ 7, 3, "%d", num2
) != 6
223 || memcmp (a
.buf1
, "aabcEDX98", 10))
226 a
.buf1
[l0
+ 8] = '\0';
227 strcat (a
.buf1
, "A");
228 if (memcmp (a
.buf1
, "aabcEDX9A", 10))
231 a
.buf1
[l0
+ 7] = '\0';
232 strncat (a
.buf1
, "ZYXWV", l0
+ 2);
233 if (memcmp (a
.buf1
, "aabcEDXZY", 10))
238 #if __USE_FORTIFY_LEVEL >= 1
239 /* Now check if all buffer overflows are caught at runtime. */
242 memcpy (buf
+ 1, "abcdefghij", l0
+ 10);
246 memmove (buf
+ 2, buf
+ 1, l0
+ 9);
250 p
= mempcpy (buf
+ 6, "abcde", l0
+ 5);
254 memset (buf
+ 9, 'j', l0
+ 2);
258 strcpy (buf
+ 5, str1
+ 5);
262 p
= stpcpy (buf
+ 9, str2
);
266 strncpy (buf
+ 7, "X", l0
+ 4);
270 sprintf (buf
+ 8, "%d", num1
);
274 snprintf (buf
+ 8, l0
+ 3, "%d", num2
);
277 memcpy (buf
, str1
+ 2, l0
+ 9);
282 memcpy (buf
, str1
+ 3, l0
+ 8);
284 strncat (buf
, "ZYXWV", l0
+ 3);
288 memcpy (a
.buf1
+ 1, "abcdefghij", l0
+ 10);
292 memmove (a
.buf1
+ 2, a
.buf1
+ 1, l0
+ 9);
296 p
= mempcpy (a
.buf1
+ 6, "abcde", l0
+ 5);
300 memset (a
.buf1
+ 9, 'j', l0
+ 2);
303 #if __USE_FORTIFY_LEVEL >= 2
310 strcpy (a
.buf1
+ (O
+ 4), str1
+ 5);
314 p
= stpcpy (a
.buf1
+ (O
+ 8), str2
);
318 strncpy (a
.buf1
+ (O
+ 6), "X", l0
+ 4);
322 sprintf (a
.buf1
+ (O
+ 7), "%d", num1
);
326 snprintf (a
.buf1
+ (O
+ 7), l0
+ 3, "%d", num2
);
329 memcpy (a
.buf1
, str1
+ (3 - O
), l0
+ 8 + O
);
331 strcat (a
.buf1
, "AB");
334 memcpy (a
.buf1
, str1
+ (4 - O
), l0
+ 7 + O
);
336 strncat (a
.buf1
, "ZYXWV", l0
+ 3);
340 /* Now checks for %n protection. */
342 /* Constant literals passed directly are always ok
343 (even with warnings about possible bugs from GCC). */
345 if (sprintf (buf
, "%s%n%s%n", str2
, &n1
, str2
, &n2
) != 2
346 || n1
!= 1 || n2
!= 2)
349 /* In this case the format string is not known at compile time,
350 but resides in read-only memory, so is ok. */
351 if (snprintf (buf
, 4, str3
, str2
, &n1
, str2
, &n2
) != 2
352 || n1
!= 1 || n2
!= 2)
355 strcpy (buf2
+ 2, "%n%s%n");
356 /* When the format string is writable and contains %n,
357 with -D_FORTIFY_SOURCE=2 it causes __chk_fail. */
359 if (sprintf (buf
, buf2
, str2
, &n1
, str2
, &n1
) != 2)
364 if (snprintf (buf
, 3, buf2
, str2
, &n1
, str2
, &n1
) != 2)
368 /* But if there is no %n, even writable format string
371 if (sprintf (buf
, buf2
+ 4, str2
) != 1)
374 /* Constant literals passed directly are always ok
375 (even with warnings about possible bugs from GCC). */
376 if (printf ("%s%n%s%n", str4
, &n1
, str5
, &n2
) != 14
377 || n1
!= 7 || n2
!= 14)
380 /* In this case the format string is not known at compile time,
381 but resides in read-only memory, so is ok. */
382 if (printf (str3
, str4
, &n1
, str5
, &n2
) != 14
383 || n1
!= 7 || n2
!= 14)
386 strcpy (buf2
+ 2, "%n%s%n");
387 /* When the format string is writable and contains %n,
388 with -D_FORTIFY_SOURCE=2 it causes __chk_fail. */
390 if (printf (buf2
, str4
, &n1
, str5
, &n1
) != 14)
394 /* But if there is no %n, even writable format string
397 if (printf (buf2
+ 4, str5
) != 7)
402 /* Constant literals passed directly are always ok
403 (even with warnings about possible bugs from GCC). */
404 if (fprintf (fp
, "%s%n%s%n", str4
, &n1
, str5
, &n2
) != 14
405 || n1
!= 7 || n2
!= 14)
408 /* In this case the format string is not known at compile time,
409 but resides in read-only memory, so is ok. */
410 if (fprintf (fp
, str3
, str4
, &n1
, str5
, &n2
) != 14
411 || n1
!= 7 || n2
!= 14)
414 strcpy (buf2
+ 2, "%n%s%n");
415 /* When the format string is writable and contains %n,
416 with -D_FORTIFY_SOURCE=2 it causes __chk_fail. */
418 if (fprintf (fp
, buf2
, str4
, &n1
, str5
, &n1
) != 14)
422 /* But if there is no %n, even writable format string
425 if (fprintf (fp
, buf2
+ 4, str5
) != 7)
428 if (freopen (temp_filename
, "r", stdin
) == NULL
)
430 puts ("could not open temporary file");
434 if (gets (buf
) != buf
|| memcmp (buf
, "abcdefgh", 9))
436 if (gets (buf
) != buf
|| memcmp (buf
, "ABCDEFGHI", 10))
439 #if __USE_FORTIFY_LEVEL >= 1
441 if (gets (buf
) != buf
)
446 if (freopen (temp_filename
, "r", stdin
) == NULL
)
448 puts ("could not open temporary file");
452 if (fseek (stdin
, 9 + 10 + 11, SEEK_SET
))
454 puts ("could not seek in test file");
458 #if __USE_FORTIFY_LEVEL >= 1
460 if (gets (buf
) != buf
)