gcc/testsuite/gcc.dg/torture/pr53908.c

   1 /* { dg-do run } */
   2 /* SEGV at comment below.  */
   3 typedef unsigned int size_t;
   4 typedef enum har {
   5   he_fatal = (-199),
   6   he_not_initialized,
   7   he_bad_input,
   8   he_memory_too_small,
   9   he_bad_action,
  10   he_duplicate,
  11   he_bad_nonce,
  12   he_stale_nonce,
  13   he_bad_credentials,
  14   he_bad_user,
  15   he_no_such_user,
  16   he_bad_passwd,
  17   he_unknown_auth_scheme,
  18   he_not_found,
  19   he_failed_digest_file_check,
  20   he_failed_digest_file_save,
  21   he_process_not_privileged,
  22   he_other,
  23   he_end_of_range,
  24   ha_no_error = 0,
  25   ha_no_value = 1
  26 } har;
  27 typedef enum realm_type
  28 {
  29   axis_realm = 0,
  30   ws_realm
  31 } realm_type;
  32
  33 __attribute__((__noclone__, __noinline__))
  34 har has_www_auth(char *, size_t, realm_type, har);
  35
  36 __attribute__((__noclone__, __noinline__))
  37 har has_auth_user(const char *, const char *, realm_type, char *, size_t);
  38
  39 __attribute__((__noclone__, __noinline__))
  40 char *ha_get_string_value(void);
  41
  42 typedef struct
  43 {
  44   unsigned int track_id;
  45   char* user;
  46   char* realm;
  47   char* authent;
  48   int internal_realm;
  49 } request;
  50 enum user_response {
  51   file_not_found_user_response = -3,
  52   access_denied_user_response = -2,
  53   no_user_response = -1,
  54   ok_user_response = 0
  55 };
  56 struct realm_group {
  57   char *name;
  58   int id;
  59   struct realm_group *next;
  60 };
  61 struct realm {
  62   char *name;
  63   char *space;
  64   struct realm_group *groups;
  65   struct realm *next;
  66 };
  67 struct user_info {
  68   char *name;
  69   int no_groups;
  70   int groups[128];
  71   struct user_info *next;
  72 };
  73 static struct user_info *find_user(const char *user_name);
  74 static int is_member_of_groups(const struct user_info *user_item,
  75                                 const struct realm_group *groups);
  76 int authent_author(request *req);
  77 struct realm *realms = ((void *)0);
  78 struct user_info *users = ((void *)0);
  79 static struct user_info*
  80 find_user(const char *user_name)
  81 {
  82   struct user_info *user_item;
  83   user_item = users;
  84   while (user_item != ((void *)0)) {
  85     /* SEGV due to NULL access here on user_name.  See also comment below.  */
  86     if ((__builtin_strcmp(user_item->name, user_name) == 0))
  87       break;
  88     user_item = user_item->next;
  89   }
  90   return user_item;
  91 }
  92 static int
  93 is_member_of_groups(const struct user_info *user_item,
  94                     const struct realm_group *groups)
  95 {
  96   const struct realm_group *group_item;
  97   int i;
  98   group_item = groups;
  99   while (group_item != ((void *)0)) {
 100     for (i = 0; i < user_item->no_groups; i++)
 101       if (user_item->groups[i] == group_item->id)
 102         return 0;
 103     group_item = group_item->next;
 104   }
 105   return -1;
 106 }
 107 char *foo (void) __attribute__((__noclone__, __noinline__));
 108 char* g_strdup (const char *str) __attribute__((__malloc__, __noclone__, __noinline__));
 109 int g_strcmp0 (const char *str1, const char *str2);
 110 static int
 111 is_basic(char **user)
 112 {
 113   char *passwd_ptr;
 114   char *authent = foo();
 115   passwd_ptr = __builtin_strchr(authent, ':');
 116   if (passwd_ptr != ((void *)0)) {
 117     *user = g_strdup(authent);
 118     return 0;
 119   }
 120   return -1;
 121 }
 122 static int
 123 is_digest(char **user)
 124 {
 125   int ret_val = -1;
 126   char *authent;
 127   authent = ha_get_string_value();
 128   if (authent) {
 129     *user = g_strdup(authent);
 130     ret_val = 0;
 131   }
 132   return ret_val;
 133 }
 134 __attribute__((__noclone__, __noinline__))
 135 void g_free (void * mem);
 136 static enum user_response
 137 get_user_info_from_header(const realm_type type,
 138                           char **user_name,
 139                           struct user_info **user_item)
 140 {
 141   int ret_val = no_user_response;
 142   if ((type == ws_realm)) {
 143     if (is_basic(user_name) == 0)
 144       ret_val = access_denied_user_response;
 145     if (is_digest(user_name) == 0)
 146       ret_val = ok_user_response;
 147   } else {
 148     if (is_basic(user_name) < 0 &&
 149         /* Load of *user_name here, but not after the is_digest call.  */
 150         is_digest(user_name) < 0)
 151       ;
 152     else if ((*user_item = find_user(*user_name)) != ((void *)0))
 153       ret_val = ok_user_response;
 154     else
 155       ret_val = access_denied_user_response;
 156     if (ret_val != ok_user_response)
 157       g_free(*user_name);
 158   }
 159   return ret_val;
 160 }
 161 static enum user_response
 162 authenticate_user(request *req,
 163                   char **user_name,
 164                   struct user_info **user_item)
 165 {
 166   char *authent = ((void *)0);
 167   har resp = ha_no_value;
 168   enum user_response user_resp;
 169   int ret_val = no_user_response;
 170   if (req->authent && __builtin_strlen(req->authent)) {
 171     authent = req->authent;
 172     user_resp = get_user_info_from_header(req->internal_realm,
 173                                           user_name,
 174                                           user_item);
 175     if (user_resp == ok_user_response) {
 176       resp = has_auth_user(authent, 0, req->internal_realm, "", 1);
 177       if (resp == ha_no_error)
 178         ret_val = ok_user_response;
 179       else if (resp != he_stale_nonce)
 180         ret_val = access_denied_user_response;
 181     } else if (user_resp == access_denied_user_response)
 182       ret_val = access_denied_user_response;
 183   }
 184   if (resp != he_memory_too_small && resp != ha_no_error)
 185     resp = has_www_auth("", 1, req->internal_realm, resp);
 186   return ret_val;
 187 }
 188
 189 int __attribute__ ((__noinline__, __noclone__))
 190 authent_author(request *req)
 191 {
 192   struct realm *realm;
 193   char *user_name = ((void *)0);
 194   struct user_info *user_item = ((void *)0);
 195   int res = 0;
 196   asm ("");
 197   realm = realms;
 198   if (__builtin_strcmp("Wsd", realm->name) == 0) {
 199     req->internal_realm = ws_realm;
 200     is_digest(&user_name);
 201   }
 202   if (authenticate_user(req, &user_name, &user_item) < 0) {
 203     if (user_name != ((void *)0))
 204       req->user = user_name;
 205     res = -2;
 206     goto authent_author_return;
 207   }
 208   if (is_member_of_groups(user_item, realm->groups) < 0)
 209     res = -1;
 210 authent_author_return:
 211   return res;
 212 }
 213
 214 int good0, good1, good2;
 215
 216 __attribute__ ((__noinline__, __noclone__))
 217 char *foo(void)
 218 {
 219   asm ("");
 220   good0++;
 221   return "";
 222 }
 223
 224 __attribute__ ((__noinline__, __noclone__))
 225 char *ha_get_string_value(void)
 226 {
 227   asm ("");
 228   good1++;
 229   return "f";
 230 }
 231
 232 __attribute__ ((__noinline__, __noclone__))
 233 har has_auth_user(const char *a, const char *b, realm_type c, char *d, size_t e)
 234 {
 235   asm ("");
 236   if (*a != 'z' || a[1] != 0 || b != 0 || c != axis_realm || *d != 0
 237       || e != 1)
 238     __builtin_abort ();
 239   return ha_no_error;
 240 }
 241
 242 __attribute__ ((__noinline__, __noclone__))
 243 har has_www_auth(char *a, size_t b, realm_type c, har d)
 244 {
 245   (void)(*a+b+c+d);
 246   asm ("");
 247   __builtin_abort ();
 248 }
 249
 250
 251 char *strdupped_user = "me";
 252 __attribute__((__malloc__, __noclone__, __noinline__))
 253 char* g_strdup (const char *str)
 254 {
 255   asm ("");
 256   if (*str != 'f')
 257     __builtin_abort ();
 258   good2++;
 259   return strdupped_user;
 260 }
 261
 262 __attribute__((__noclone__, __noinline__))
 263 void g_free (void * mem)
 264 {
 265   (void)mem;
 266   asm ("");
 267   __builtin_abort ();
 268 }
 269
 270 struct user_info me = { .name = "me", .no_groups = 1, .groups = {42}, .next = 0};
 271 struct user_info you = { .name = "you", .next = &me};
 272 struct realm_group xgroups = { .name = "*", .id = 42, .next = 0};
 273
 274 int main(void)
 275 {
 276   char *orig_user = "?";
 277   struct realm r = { .name = "x", .space = "space?", .groups = &xgroups, .next = 0};
 278   request req = { .user = orig_user, .realm = "!", .authent = "z",
 279                   .internal_realm = axis_realm};
 280   realms = &r;
 281   users = &you;
 282   if (authent_author (&req) != 0 || good0 != 1 || good1 != 1 || good2 != 1
 283       || req.user != orig_user
 284       || req.internal_realm != axis_realm)
 285     __builtin_abort ();
 286   __builtin_exit (0);
 287 }
 288