/* Test for bug 17079: heap overflow in NSS with small buffers.

   Copyright (C) 2015-2018 Free Software Foundation, Inc.

   This file is part of the GNU C Library.

   The GNU C Library is free software; you can redistribute it and/or

   modify it under the terms of the GNU Lesser General Public

   License as published by the Free Software Foundation; either

   version 2.1 of the License, or (at your option) any later version.

   The GNU C Library is distributed in the hope that it will be useful,

   but WITHOUT ANY WARRANTY; without even the implied warranty of

   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU

   Lesser General Public License for more details.

   You should have received a copy of the GNU Lesser General Public

   License along with the GNU C Library; if not, see

   <http://www.gnu.org/licenses/>.  */

#include <errno.h>

#include <nss.h>

#include <pwd.h>

#include <stdbool.h>

#include <stdio.h>

#include <stdlib.h>

#include <string.h>

#include <support/support.h>

/* Check if two passwd structs contain the same data.  */

static bool

equal (const struct passwd *a, const struct passwd *b)

{

  return strcmp (a->pw_name, b->pw_name) == 0

    && strcmp (a->pw_passwd, b->pw_passwd) == 0

    && a->pw_uid == b->pw_uid

    && a->pw_gid == b->pw_gid

    && strcmp (a->pw_gecos, b->pw_gecos) == 0

    && strcmp (a->pw_dir, b->pw_dir) == 0

    && strcmp (a->pw_shell, b->pw_shell) == 0;

}

enum { MAX_TEST_ITEMS = 10 };

static struct passwd test_items[MAX_TEST_ITEMS];

static int test_count;

/* Initialize test_items and test_count above, with data from the

   passwd database.  */

static bool

init_test_items (void)

{

  setpwent ();

  do

    {

      struct passwd *pwd = getpwent ();

      if (pwd == NULL)

        break;

      struct passwd *target = test_items + test_count;

      target->pw_name = xstrdup (pwd->pw_name);

      target->pw_passwd = xstrdup (pwd->pw_passwd);

      target->pw_uid = pwd->pw_uid;

      target->pw_gid = pwd->pw_gid;

      target->pw_gecos = xstrdup (pwd->pw_gecos);

      target->pw_dir = xstrdup (pwd->pw_dir);

      target->pw_shell = xstrdup (pwd->pw_shell);

    }

  while (++test_count < MAX_TEST_ITEMS);

  endpwent ();

  /* Filter out those test items which cannot be looked up by name or

     UID.  */

  bool found = false;

  for (int i = 0; i < test_count; ++i)

    {

      struct passwd *pwd1 = getpwnam (test_items[i].pw_name);

      struct passwd *pwd2 = getpwuid (test_items[i].pw_uid);

      if (pwd1 == NULL || !equal (pwd1, test_items + i)

          || pwd2 == NULL || !equal (pwd2, test_items + i))

        {

          printf ("info: skipping user \"%s\", UID %ld due to inconsistency\n",

                  test_items[i].pw_name, (long) test_items[i].pw_uid);

          test_items[i].pw_name = NULL;

        }

      else

        found = true;

    }

  if (!found)

    puts ("error: no accounts found which can be looked up by name and UID.");

  return found;

}

/* Set to true if an error is encountered.  */

static bool errors;

/* Return true if the padding has not been tampered with.  */

static bool

check_padding (char *buffer, size_t size, char pad)

{

  char *end = buffer + size;

  while (buffer < end)

    {

      if (*buffer != pad)

        return false;

      ++buffer;

    }

  return true;

}

/* Test one buffer size and padding combination.  */

static void

test_one (const struct passwd *item, size_t buffer_size,

           char pad, size_t padding_size)

{

  char *buffer = xmalloc (buffer_size + padding_size);

  struct passwd pwd;

  struct passwd *result;

  int ret;

  /* Test getpwname_r.  */

  memset (buffer, pad, buffer_size + padding_size);

  pwd = (struct passwd) {};

  ret = getpwnam_r (item->pw_name, &pwd, buffer, buffer_size, &result);

  if (!check_padding (buffer + buffer_size, padding_size, pad))

    {

      printf ("error: padding change: "

              "name \"%s\", buffer size %zu, padding size %zu, pad 0x%02x\n",

              item->pw_name, buffer_size, padding_size, (unsigned char) pad);

      errors = true;

    }

  if (ret == 0)

    {

      if (result == NULL)

        {

          printf ("error: no data: name \"%s\", buffer size %zu\n",

                  item->pw_name, buffer_size);

          errors = true;

        }

      else if (!equal (item, result))

        {

          printf ("error: lookup mismatch: name \"%s\", buffer size %zu\n",

                  item->pw_name, buffer_size);

          errors = true;

        }

    }

  else if (ret != ERANGE)

    {

      errno = ret;

      printf ("error: lookup failure for name \"%s\": %m (%d)\n",

              item->pw_name, ret);

      errors = true;

    }

  /* Test getpwuid_r.  */

  memset (buffer, pad, buffer_size + padding_size);

  pwd = (struct passwd) {};

  ret = getpwuid_r (item->pw_uid, &pwd, buffer, buffer_size, &result);

  if (!check_padding (buffer + buffer_size, padding_size, pad))

    {

      printf ("error: padding change: "

              "UID %ld, buffer size %zu, padding size %zu, pad 0x%02x\n",

              (long) item->pw_uid, buffer_size, padding_size,

              (unsigned char) pad);

      errors = true;

    }

  if (ret == 0)

    {

      if (result == NULL)

        {

          printf ("error: no data: UID %ld, buffer size %zu\n",

                  (long) item->pw_uid, buffer_size);

          errors = true;

        }

      else if (!equal (item, result))

        {

          printf ("error: lookup mismatch: UID %ld, buffer size %zu\n",

                  (long) item->pw_uid, buffer_size);

          errors = true;

        }

    }

  else if (ret != ERANGE)

    {

      errno = ret;

      printf ("error: lookup failure for UID \"%ld\": %m (%d)\n",

              (long) item->pw_uid, ret);

      errors = true;

    }

  free (buffer);

}

/* Test one buffer size with different paddings.  */

static void

test_buffer_size (size_t buffer_size)

{

  for (int i = 0; i < test_count; ++i)

    for (size_t padding_size = 0; padding_size < 3; ++padding_size)

      {

        /* Skip entries with inconsistent name/UID lookups.  */

        if (test_items[i].pw_name == NULL)

          continue;

        test_one (test_items + i, buffer_size, '\0', padding_size);

        if (padding_size > 0)

          {

            test_one (test_items + i, buffer_size, ':', padding_size);

            test_one (test_items + i, buffer_size, '\n', padding_size);

            test_one (test_items + i, buffer_size, '\xff', padding_size);

            test_one (test_items + i, buffer_size, '@', padding_size);

          }

      }

}

int

do_test (void)

{

  __nss_configure_lookup ("passwd", "files");

  if (!init_test_items ())

    return 1;

  printf ("info: %d test items\n", test_count);

  for (size_t buffer_size = 0; buffer_size <= 65; ++buffer_size)

    test_buffer_size (buffer_size);

  for (size_t buffer_size = 64 + 4; buffer_size < 256; buffer_size += 4)

    test_buffer_size (buffer_size);

  test_buffer_size (255);

  test_buffer_size (257);

  for (size_t buffer_size = 256; buffer_size < 512; buffer_size += 8)

    test_buffer_size (buffer_size);

  test_buffer_size (511);

  test_buffer_size (513);

  test_buffer_size (1024);

  test_buffer_size (2048);

  if (errors)

    return 1;

  else

    return 0;

}

#include <support/test-driver.c>