|
Packit |
6c4009 |
/* Test for vfprintf nargs allocation overflow (BZ #13656).
|
|
Packit |
6c4009 |
Copyright (C) 2012-2018 Free Software Foundation, Inc.
|
|
Packit |
6c4009 |
This file is part of the GNU C Library.
|
|
Packit |
6c4009 |
Contributed by Kees Cook <keescook@chromium.org>, 2012.
|
|
Packit |
6c4009 |
|
|
Packit |
6c4009 |
The GNU C Library is free software; you can redistribute it and/or
|
|
Packit |
6c4009 |
modify it under the terms of the GNU Lesser General Public
|
|
Packit |
6c4009 |
License as published by the Free Software Foundation; either
|
|
Packit |
6c4009 |
version 2.1 of the License, or (at your option) any later version.
|
|
Packit |
6c4009 |
|
|
Packit |
6c4009 |
The GNU C Library is distributed in the hope that it will be useful,
|
|
Packit |
6c4009 |
but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
Packit |
6c4009 |
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
|
Packit |
6c4009 |
Lesser General Public License for more details.
|
|
Packit |
6c4009 |
|
|
Packit |
6c4009 |
You should have received a copy of the GNU Lesser General Public
|
|
Packit |
6c4009 |
License along with the GNU C Library; if not, see
|
|
Packit |
6c4009 |
<http://www.gnu.org/licenses/>. */
|
|
Packit |
6c4009 |
|
|
Packit |
6c4009 |
#include <stdio.h>
|
|
Packit |
6c4009 |
#include <stdlib.h>
|
|
Packit |
6c4009 |
#include <stdint.h>
|
|
Packit |
6c4009 |
#include <unistd.h>
|
|
Packit |
6c4009 |
#include <inttypes.h>
|
|
Packit |
6c4009 |
#include <string.h>
|
|
Packit |
6c4009 |
#include <signal.h>
|
|
Packit |
6c4009 |
|
|
Packit |
6c4009 |
static int
|
|
Packit |
6c4009 |
format_failed (const char *fmt, const char *expected)
|
|
Packit |
6c4009 |
{
|
|
Packit |
6c4009 |
char output[80];
|
|
Packit |
6c4009 |
|
|
Packit |
6c4009 |
printf ("%s : ", fmt);
|
|
Packit |
6c4009 |
|
|
Packit |
6c4009 |
memset (output, 0, sizeof output);
|
|
Packit |
6c4009 |
/* Having sprintf itself detect a failure is good. */
|
|
Packit |
6c4009 |
if (sprintf (output, fmt, 1, 2, 3, "test") > 0
|
|
Packit |
6c4009 |
&& strcmp (output, expected) != 0)
|
|
Packit |
6c4009 |
{
|
|
Packit |
6c4009 |
printf ("FAIL (output '%s' != expected '%s')\n", output, expected);
|
|
Packit |
6c4009 |
return 1;
|
|
Packit |
6c4009 |
}
|
|
Packit |
6c4009 |
puts ("ok");
|
|
Packit |
6c4009 |
return 0;
|
|
Packit |
6c4009 |
}
|
|
Packit |
6c4009 |
|
|
Packit |
6c4009 |
static int
|
|
Packit |
6c4009 |
do_test (void)
|
|
Packit |
6c4009 |
{
|
|
Packit |
6c4009 |
int rc = 0;
|
|
Packit |
6c4009 |
char buf[64];
|
|
Packit |
6c4009 |
|
|
Packit |
6c4009 |
/* Regular positionals work. */
|
|
Packit |
6c4009 |
if (format_failed ("%1$d", "1") != 0)
|
|
Packit |
6c4009 |
rc = 1;
|
|
Packit |
6c4009 |
|
|
Packit |
6c4009 |
/* Regular width positionals work. */
|
|
Packit |
6c4009 |
if (format_failed ("%1$*2$d", " 1") != 0)
|
|
Packit |
6c4009 |
rc = 1;
|
|
Packit |
6c4009 |
|
|
Packit |
6c4009 |
/* Positional arguments are constructed via read_int, so nargs can only
|
|
Packit |
6c4009 |
overflow on 32-bit systems. On 64-bit systems, it will attempt to
|
|
Packit |
6c4009 |
allocate a giant amount of memory and possibly crash, which is the
|
|
Packit |
6c4009 |
expected situation. Since the 64-bit behavior is arch-specific, only
|
|
Packit |
6c4009 |
test this on 32-bit systems. */
|
|
Packit |
6c4009 |
if (sizeof (long int) == 4)
|
|
Packit |
6c4009 |
{
|
|
Packit |
6c4009 |
sprintf (buf, "%%1$d %%%" PRIdPTR "$d",
|
|
Packit |
6c4009 |
(intptr_t) (UINT32_MAX / sizeof (int)));
|
|
Packit |
6c4009 |
if (format_failed (buf, "1 %$d") != 0)
|
|
Packit |
6c4009 |
rc = 1;
|
|
Packit |
6c4009 |
}
|
|
Packit |
6c4009 |
|
|
Packit |
6c4009 |
return rc;
|
|
Packit |
6c4009 |
}
|
|
Packit |
6c4009 |
|
|
Packit |
6c4009 |
#define TEST_FUNCTION do_test ()
|
|
Packit |
6c4009 |
#include "../test-skeleton.c"
|