1 /* Test for vfprintf nargs allocation overflow (BZ #13656).
2 Copyright (C) 2012-2014 Free Software Foundation, Inc.
3 This file is part of the GNU C Library.
4 Contributed by Kees Cook <keescook@chromium.org>, 2012.
6 The GNU C Library is free software; you can redistribute it and/or
7 modify it under the terms of the GNU Lesser General Public
8 License as published by the Free Software Foundation; either
9 version 2.1 of the License, or (at your option) any later version.
11 The GNU C Library is distributed in the hope that it will be useful,
12 but WITHOUT ANY WARRANTY; without even the implied warranty of
13 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 Lesser General Public License for more details.
16 You should have received a copy of the GNU Lesser General Public
17 License along with the GNU C Library; if not, see
18 <http://www.gnu.org/licenses/>. */
29 format_failed (const char *fmt
, const char *expected
)
33 printf ("%s : ", fmt
);
35 memset (output
, 0, sizeof output
);
36 /* Having sprintf itself detect a failure is good. */
37 if (sprintf (output
, fmt
, 1, 2, 3, "test") > 0
38 && strcmp (output
, expected
) != 0)
40 printf ("FAIL (output '%s' != expected '%s')\n", output
, expected
);
53 /* Regular positionals work. */
54 if (format_failed ("%1$d", "1") != 0)
57 /* Regular width positionals work. */
58 if (format_failed ("%1$*2$d", " 1") != 0)
61 /* Positional arguments are constructed via read_int, so nargs can only
62 overflow on 32-bit systems. On 64-bit systems, it will attempt to
63 allocate a giant amount of memory and possibly crash, which is the
64 expected situation. Since the 64-bit behavior is arch-specific, only
65 test this on 32-bit systems. */
66 if (sizeof (long int) == 4)
68 sprintf (buf
, "%%1$d %%%" PRIdPTR
"$d", UINT32_MAX
/ sizeof (int));
69 if (format_failed (buf
, "1 %$d") != 0)
76 #define TEST_FUNCTION do_test ()
77 #include "../test-skeleton.c"