posix/tst-regcomp-truncated.c

   1 /* Test compilation of truncated regular expressions.
   2    Copyright (C) 2018-2019 Free Software Foundation, Inc.
   3    This file is part of the GNU C Library.
   4
   5    The GNU C Library is free software; you can redistribute it and/or
   6    modify it under the terms of the GNU Lesser General Public
   7    License as published by the Free Software Foundation; either
   8    version 2.1 of the License, or (at your option) any later version.
   9
  10    The GNU C Library is distributed in the hope that it will be useful,
  11    but WITHOUT ANY WARRANTY; without even the implied warranty of
  12    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  13    Lesser General Public License for more details.
  14
  15    You should have received a copy of the GNU Lesser General Public
  16    License along with the GNU C Library; if not, see
  17    <https://www.gnu.org/licenses/>.  */
  18
  19 /* This test constructs various patterns in an attempt to trigger
  20    over-reading the regular expression compiler, such as bug
  21    23578.  */
  22
  23 #include <array_length.h>
  24 #include <errno.h>
  25 #include <locale.h>
  26 #include <regex.h>
  27 #include <stdio.h>
  28 #include <stdlib.h>
  29 #include <string.h>
  30 #include <support/check.h>
  31 #include <support/next_to_fault.h>
  32 #include <support/support.h>
  33 #include <support/test-driver.h>
  34 #include <wchar.h>
  35
  36 /* Locales to test.  */
  37 static const char locales[][17] =
  38   {
  39     "C",
  40     "en_US.UTF-8",
  41     "de_DE.ISO-8859-1",
  42   };
  43
  44 /* Syntax options.  Will be combined with other flags.  */
  45 static const reg_syntax_t syntaxes[] =
  46   {
  47     RE_SYNTAX_EMACS,
  48     RE_SYNTAX_AWK,
  49     RE_SYNTAX_GNU_AWK,
  50     RE_SYNTAX_POSIX_AWK,
  51     RE_SYNTAX_GREP,
  52     RE_SYNTAX_EGREP,
  53     RE_SYNTAX_POSIX_EGREP,
  54     RE_SYNTAX_POSIX_BASIC,
  55     RE_SYNTAX_POSIX_EXTENDED,
  56     RE_SYNTAX_POSIX_MINIMAL_EXTENDED,
  57   };
  58
  59 /* Trailing characters placed after the initial character.  */
  60 static const char trailing_strings[][4] =
  61   {
  62     "",
  63     "[",
  64     "\\",
  65     "[\\",
  66     "(",
  67     "(\\",
  68     "\\(",
  69   };
  70
  71 static int
  72 do_test (void)
  73 {
  74   /* Staging buffer for the constructed regular expression.  */
  75   char buffer[16];
  76
  77   /* Allocation used to detect over-reading by the regular expression
  78      compiler.  */
  79   struct support_next_to_fault ntf
  80     = support_next_to_fault_allocate (sizeof (buffer));
  81
  82   /* Arbitrary Unicode codepoint at which we stop generating
  83      characters.  We do not probe the whole range because that would
  84      take too long due to combinatorical exploision as the result of
  85      combination with other flags.  */
  86   static const wchar_t last_character = 0xfff;
  87
  88   for (size_t locale_idx = 0; locale_idx < array_length (locales);
  89        ++ locale_idx)
  90     {
  91       if (setlocale (LC_ALL, locales[locale_idx]) == NULL)
  92         {
  93           support_record_failure ();
  94           printf ("error: setlocale (\"%s\"): %m", locales[locale_idx]);
  95           continue;
  96         }
  97       if (test_verbose > 0)
  98         printf ("info: testing locale \"%s\"\n", locales[locale_idx]);
  99
 100       for (wchar_t wc = 0; wc <= last_character; ++wc)
 101         {
 102           char *after_wc;
 103           if (wc == 0)
 104             {
 105               /* wcrtomb treats L'\0' in a special way.  */
 106               *buffer = '\0';
 107               after_wc = &buffer[1];
 108             }
 109           else
 110             {
 111               mbstate_t ps = { };
 112               size_t ret = wcrtomb (buffer, wc, &ps);
 113               if (ret == (size_t) -1)
 114                 {
 115                   /* EILSEQ means that the target character set
 116                      cannot encode the character.  */
 117                   if (errno != EILSEQ)
 118                     {
 119                       support_record_failure ();
 120                       printf ("error: wcrtomb (0x%x) failed: %m\n",
 121                               (unsigned) wc);
 122                     }
 123                   continue;
 124                 }
 125               TEST_VERIFY_EXIT (ret != 0);
 126               after_wc = &buffer[ret];
 127             }
 128
 129           for (size_t trailing_idx = 0;
 130                trailing_idx < array_length (trailing_strings);
 131                ++trailing_idx)
 132             {
 133               char *after_trailing
 134                 = stpcpy (after_wc, trailing_strings[trailing_idx]);
 135
 136               for (int do_nul = 0; do_nul < 2; ++do_nul)
 137                 {
 138                   char *after_nul;
 139                   if (do_nul)
 140                     {
 141                       *after_trailing = '\0';
 142                       after_nul = &after_trailing[1];
 143                     }
 144                   else
 145                     after_nul = after_trailing;
 146
 147                   size_t length = after_nul - buffer;
 148
 149                   /* Make sure that the faulting region starts
 150                      after the used portion of the buffer.  */
 151                   char *ntf_start = ntf.buffer + sizeof (buffer) - length;
 152                   memcpy (ntf_start, buffer, length);
 153
 154                   for (const reg_syntax_t *psyntax = syntaxes;
 155                        psyntax < array_end (syntaxes); ++psyntax)
 156                     for (int do_icase = 0; do_icase < 2; ++do_icase)
 157                       {
 158                         re_syntax_options = *psyntax;
 159                         if (do_icase)
 160                           re_syntax_options |= RE_ICASE;
 161
 162                         regex_t reg;
 163                         memset (&reg, 0, sizeof (reg));
 164                         const char *msg = re_compile_pattern
 165                           (ntf_start, length, &reg);
 166                         if (msg != NULL)
 167                           {
 168                             if (test_verbose > 0)
 169                               {
 170                                 char *quoted = support_quote_blob
 171                                   (buffer, length);
 172                                 printf ("info: compilation failed for pattern"
 173                                         " \"%s\", syntax 0x%lx: %s\n",
 174                                         quoted, re_syntax_options, msg);
 175                                 free (quoted);
 176                               }
 177                           }
 178                         else
 179                           regfree (&reg);
 180                       }
 181                 }
 182             }
 183         }
 184     }
 185
 186   support_next_to_fault_free (&ntf);
 187
 188   return 0;
 189 }
 190
 191 #include <support/test-driver.c>