stdlib/test-bz22786.c

   1 /* Bug 22786: test for buffer overflow in realpath.
   2    Copyright (C) 2018 Free Software Foundation, Inc.
   3    This file is part of the GNU C Library.
   4
   5    The GNU C Library is free software; you can redistribute it and/or
   6    modify it under the terms of the GNU Lesser General Public
   7    License as published by the Free Software Foundation; either
   8    version 2.1 of the License, or (at your option) any later version.
   9
  10    The GNU C Library is distributed in the hope that it will be useful,
  11    but WITHOUT ANY WARRANTY; without even the implied warranty of
  12    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  13    Lesser General Public License for more details.
  14
  15    You should have received a copy of the GNU Lesser General Public
  16    License along with the GNU C Library; if not, see
  17    <http://www.gnu.org/licenses/>.  */
  18
  19 /* This file must be run from within a directory called "stdlib".  */
  20
  21 #include <errno.h>
  22 #include <limits.h>
  23 #include <stdio.h>
  24 #include <stdlib.h>
  25 #include <string.h>
  26 #include <unistd.h>
  27 #include <sys/stat.h>
  28 #include <sys/types.h>
  29 #include <support/check.h>
  30 #include <support/support.h>
  31 #include <support/temp_file.h>
  32 #include <support/test-driver.h>
  33 #include <libc-diag.h>
  34
  35 static int
  36 do_test (void)
  37 {
  38   const char *dir = support_create_temp_directory ("bz22786.");
  39   const char *lnk = xasprintf ("%s/symlink", dir);
  40   const size_t path_len = (size_t) INT_MAX + strlen (lnk) + 1;
  41
  42   DIAG_PUSH_NEEDS_COMMENT;
  43 #if __GNUC_PREREQ (7, 0)
  44   /* GCC 7 warns about too-large allocations; here we need such
  45      allocation to succeed for the test to work.  */
  46   DIAG_IGNORE_NEEDS_COMMENT (7, "-Walloc-size-larger-than=");
  47 #endif
  48   char *path = malloc (path_len);
  49   DIAG_POP_NEEDS_COMMENT;
  50   if (path == NULL)
  51     {
  52       printf ("malloc (%zu): %m\n", path_len);
  53       /* On 31-bit s390 the malloc will always fail as we do not have
  54          so much memory, and we want to mark the test unsupported.
  55          Likewise on systems with little physical memory the test will
  56          fail and should be unsupported.  */
  57       return EXIT_UNSUPPORTED;
  58     }
  59
  60   TEST_VERIFY_EXIT (symlink (".", lnk) == 0);
  61
  62   /* Construct very long path = "/tmp/bz22786.XXXX/symlink/aaaa....."  */
  63   char *p = mempcpy (path, lnk, strlen (lnk));
  64   *(p++) = '/';
  65   memset (p, 'a', path_len - (p - path) - 2);
  66   p[path_len - (p - path) - 1] = '\0';
  67
  68   /* This call crashes before the fix for bz22786 on 32-bit platforms.  */
  69   p = realpath (path, NULL);
  70
  71   if (p != NULL || errno != ENAMETOOLONG)
  72     {
  73       printf ("realpath: %s (%m)", p);
  74       return EXIT_FAILURE;
  75     }
  76
  77   /* Cleanup.  */
  78   unlink (lnk);
  79
  80   return 0;
  81 }
  82
  83 #define TEST_FUNCTION do_test
  84 #include <support/test-driver.c>