1: /* Copyright (C) 2004, 2005, 2006, 2007 Free Software Foundation, Inc.
    2:    This file is part of the GNU C Library.
    3:    Contributed by Jakub Jelinek <jakub@redhat.com>, 2004.
    4: 
    5:    The GNU C Library is free software; you can redistribute it and/or
    6:    modify it under the terms of the GNU Lesser General Public
    7:    License as published by the Free Software Foundation; either
    8:    version 2.1 of the License, or (at your option) any later version.
    9: 
   10:    The GNU C Library is distributed in the hope that it will be useful,
   11:    but WITHOUT ANY WARRANTY; without even the implied warranty of
   12:    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
   13:    Lesser General Public License for more details.
   14: 
   15:    You should have received a copy of the GNU Lesser General Public
   16:    License along with the GNU C Library; if not, write to the Free
   17:    Software Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA
   18:    02111-1307 USA.  */
   19: 
   20: #include <assert.h>
   21: #include <fcntl.h>
   22: #include <locale.h>
   23: #include <paths.h>
   24: #include <setjmp.h>
   25: #include <signal.h>
   26: #include <stdio.h>
   27: #include <stdlib.h>
   28: #include <string.h>
   29: #include <unistd.h>
   30: #include <wchar.h>
   31: #include <sys/socket.h>
   32: #include <sys/un.h>
   33: 
   34: char *temp_filename;
   35: static void do_prepare (void);
   36: static int do_test (void);
   37: #define PREPARE(argc, argv) do_prepare ()
   38: #define TEST_FUNCTION do_test ()
   39: #include "../test-skeleton.c"
   40: 
   41: static void
   42: do_prepare (void)
   43: {
   44:   int temp_fd = create_temp_file ("tst-chk1.", &temp_filename);
   45:   if (temp_fd == -1)
   46:     {
   47:       printf ("cannot create temporary file: %m\n");
   48:       exit (1);
   49:     }
   50: 
   51:   const char *strs = "abcdefgh\nABCDEFGHI\nabcdefghij\nABCDEFGHIJ";
   52:   if ((size_t) write (temp_fd, strs, strlen (strs)) != strlen (strs))
   53:     {
   54:       puts ("could not write test strings into file");
   55:       unlink (temp_filename);
   56:       exit (1);
   57:     }
   58: }
   59: 
   60: volatile int chk_fail_ok;
   61: volatile int ret;
   62: jmp_buf chk_fail_buf;
   63: 
   64: static void
   65: handler (int sig)
   66: {
   67:   if (chk_fail_ok)
   68:     {
   69:       chk_fail_ok = 0;
   70:       longjmp (chk_fail_buf, 1);
   71:     }
   72:   else
   73:     _exit (127);
   74: }
   75: 
   76: char buf[10];
   77: wchar_t wbuf[10];
   78: volatile size_t l0;
   79: volatile char *p;
   80: volatile wchar_t *wp;
   81: const char *str1 = "JIHGFEDCBA";
   82: const char *str2 = "F";
   83: const char *str3 = "%s%n%s%n";
   84: const char *str4 = "Hello, ";
   85: const char *str5 = "World!\n";
   86: const wchar_t *wstr1 = L"JIHGFEDCBA";
   87: const wchar_t *wstr2 = L"F";
   88: const wchar_t *wstr3 = L"%s%n%s%n";
   89: const wchar_t *wstr4 = L"Hello, ";
   90: const wchar_t *wstr5 = L"World!\n";
   91: char buf2[10] = "%s";
   92: int num1 = 67;
   93: int num2 = 987654;
   94: 
   95: #define FAIL() \
   96:   do { printf ("Failure on line %d\n", __LINE__); ret = 1; } while (0)
   97: #define CHK_FAIL_START \
   98:   chk_fail_ok = 1;                              \
   99:   if (! setjmp (chk_fail_buf))                  \
  100:     {
  101: #define CHK_FAIL_END \
  102:       chk_fail_ok = 0;                          \
  103:       FAIL ();                                  \
  104:     }
  105: #if __USE_FORTIFY_LEVEL >= 2 && (!defined __cplusplus || defined __va_arg_pack)
  106: #define CHK_FAIL2_START CHK_FAIL_START
  107: #define CHK_FAIL2_END CHK_FAIL_END
  108: #else
  109: #define CHK_FAIL2_START
  110: #define CHK_FAIL2_END
  111: #endif
  112: 
  113: static int
  114: do_test (void)
  115: {
  116:   struct sigaction sa;
  117:   sa.sa_handler = handler;
  118:   sa.sa_flags = 0;
  119:   sigemptyset (&sa.sa_mask);
  120: 
  121:   sigaction (SIGABRT, &sa, NULL);
  122: 
  123:   /* Avoid all the buffer overflow messages on stderr.  */
  124:   int fd = open (_PATH_DEVNULL, O_WRONLY);
  125:   if (fd == -1)
  126:     close (STDERR_FILENO);
  127:   else
  128:     {
  129:       dup2 (fd, STDERR_FILENO);
  130:       close (fd);
  131:     }
  132:   setenv ("LIBC_FATAL_STDERR_", "1", 1);
  133: 
  134:   struct A { char buf1[9]; char buf2[1]; } a;
  135:   struct wA { wchar_t buf1[9]; wchar_t buf2[1]; } wa;
  136: 
  137:   printf ("Test checking routines at fortify level %d\n",
  138: #ifdef __USE_FORTIFY_LEVEL
  139:           (int) __USE_FORTIFY_LEVEL
  140: #else
  141:           0
  142: #endif
  143:           );
  144: 
  145: #if defined __USE_FORTIFY_LEVEL && !defined __extern_always_inline
  146:   printf ("Test skipped");
  147:   if (l0 == 0)
  148:     return 0;
  149: #endif
  150: 
  151:   /* These ops can be done without runtime checking of object size.  */
  152:   memcpy (buf, "abcdefghij", 10);
  153:   memmove (buf + 1, buf, 9);
  154:   if (memcmp (buf, "aabcdefghi", 10))
  155:     FAIL ();
  156: 
  157:   if (mempcpy (buf + 5, "abcde", 5) != buf + 10
  158:       || memcmp (buf, "aabcdabcde", 10))
  159:     FAIL ();
  160: 
  161:   memset (buf + 8, 'j', 2);
  162:   if (memcmp (buf, "aabcdabcjj", 10))
  163:     FAIL ();
  164: 
  165:   strcpy (buf + 4, "EDCBA");
  166:   if (memcmp (buf, "aabcEDCBA", 10))
  167:     FAIL ();
  168: 
  169:   if (stpcpy (buf + 8, "F") != buf + 9 || memcmp (buf, "aabcEDCBF", 10))
  170:     FAIL ();
  171: 
  172:   strncpy (buf + 6, "X", 4);
  173:   if (memcmp (buf, "aabcEDX\0\0", 10))
  174:     FAIL ();
  175: 
  176:   if (sprintf (buf + 7, "%s", "67") != 2 || memcmp (buf, "aabcEDX67", 10))
  177:     FAIL ();
  178: 
  179:   if (snprintf (buf + 7, 3, "%s", "987654") != 6
  180:       || memcmp (buf, "aabcEDX98", 10))
  181:     FAIL ();
  182: 
  183:   /* These ops need runtime checking, but shouldn't __chk_fail.  */
  184:   memcpy (buf, "abcdefghij", l0 + 10);
  185:   memmove (buf + 1, buf, l0 + 9);
  186:   if (memcmp (buf, "aabcdefghi", 10))
  187:     FAIL ();
  188: 
  189:   if (mempcpy (buf + 5, "abcde", l0 + 5) != buf + 10
  190:       || memcmp (buf, "aabcdabcde", 10))
  191:     FAIL ();
  192: 
  193:   memset (buf + 8, 'j', l0 + 2);
  194:   if (memcmp (buf, "aabcdabcjj", 10))
  195:     FAIL ();
  196: 
  197:   strcpy (buf + 4, str1 + 5);
  198:   if (memcmp (buf, "aabcEDCBA", 10))
  199:     FAIL ();
  200: 
  201:   if (stpcpy (buf + 8, str2) != buf + 9 || memcmp (buf, "aabcEDCBF", 10))
  202:     FAIL ();
  203: 
  204:   strncpy (buf + 6, "X", l0 + 4);
  205:   if (memcmp (buf, "aabcEDX\0\0", 10))
  206:     FAIL ();
  207: 
  208:   if (stpncpy (buf + 5, "cd", l0 + 5) != buf + 7
  209:       || memcmp (buf, "aabcEcd\0\0", 10))
  210:     FAIL ();
  211: 
  212:   if (sprintf (buf + 7, "%d", num1) != 2 || memcmp (buf, "aabcEcd67", 10))
  213:     FAIL ();
  214: 
  215:   if (snprintf (buf + 7, 3, "%d", num2) != 6 || memcmp (buf, "aabcEcd98", 10))
  216:     FAIL ();
  217: 
  218:   buf[l0 + 8] = '\0';
  219:   strcat (buf, "A");
  220:   if (memcmp (buf, "aabcEcd9A", 10))
  221:     FAIL ();
  222: 
  223:   buf[l0 + 7] = '\0';
  224:   strncat (buf, "ZYXWV", l0 + 2);
  225:   if (memcmp (buf, "aabcEcdZY", 10))
  226:     FAIL ();
  227: 
  228:   memcpy (a.buf1, "abcdefghij", l0 + 10);
  229:   memmove (a.buf1 + 1, a.buf1, l0 + 9);
  230:   if (memcmp (a.buf1, "aabcdefghi", 10))
  231:     FAIL ();
  232: 
  233:   if (mempcpy (a.buf1 + 5, "abcde", l0 + 5) != a.buf1 + 10
  234:       || memcmp (a.buf1, "aabcdabcde", 10))
  235:     FAIL ();
  236: 
  237:   memset (a.buf1 + 8, 'j', l0 + 2);
  238:   if (memcmp (a.buf1, "aabcdabcjj", 10))
  239:     FAIL ();
  240: 
  241: #if __USE_FORTIFY_LEVEL < 2
  242:   /* The following tests are supposed to crash with -D_FORTIFY_SOURCE=2
  243:      and sufficient GCC support, as the string operations overflow
  244:      from a.buf1 into a.buf2.  */
  245:   strcpy (a.buf1 + 4, str1 + 5);
  246:   if (memcmp (a.buf1, "aabcEDCBA", 10))
  247:     FAIL ();
  248: 
  249:   if (stpcpy (a.buf1 + 8, str2) != a.buf1 + 9
  250:       || memcmp (a.buf1, "aabcEDCBF", 10))
  251:     FAIL ();
  252: 
  253:   strncpy (a.buf1 + 6, "X", l0 + 4);
  254:   if (memcmp (a.buf1, "aabcEDX\0\0", 10))
  255:     FAIL ();
  256: 
  257:   if (sprintf (a.buf1 + 7, "%d", num1) != 2
  258:       || memcmp (a.buf1, "aabcEDX67", 10))
  259:     FAIL ();
  260: 
  261:   if (snprintf (a.buf1 + 7, 3, "%d", num2) != 6
  262:       || memcmp (a.buf1, "aabcEDX98", 10))
  263:     FAIL ();
  264: 
  265:   a.buf1[l0 + 8] = '\0';
  266:   strcat (a.buf1, "A");
  267:   if (memcmp (a.buf1, "aabcEDX9A", 10))
  268:     FAIL ();
  269: 
  270:   a.buf1[l0 + 7] = '\0';
  271:   strncat (a.buf1, "ZYXWV", l0 + 2);
  272:   if (memcmp (a.buf1, "aabcEDXZY", 10))
  273:     FAIL ();
  274: 
  275: #endif
  276: 
  277: #if __USE_FORTIFY_LEVEL >= 1
  278:   /* Now check if all buffer overflows are caught at runtime.  */
  279: 
  280:   CHK_FAIL_START
  281:   memcpy (buf + 1, "abcdefghij", l0 + 10);
  282:   CHK_FAIL_END
  283: 
  284:   CHK_FAIL_START
  285:   memmove (buf + 2, buf + 1, l0 + 9);
  286:   CHK_FAIL_END
  287: 
  288:   CHK_FAIL_START
  289:   p = (char *) mempcpy (buf + 6, "abcde", l0 + 5);
  290:   CHK_FAIL_END
  291: 
  292:   CHK_FAIL_START
  293:   memset (buf + 9, 'j', l0 + 2);
  294:   CHK_FAIL_END
  295: 
  296:   CHK_FAIL_START
  297:   strcpy (buf + 5, str1 + 5);
  298:   CHK_FAIL_END
  299: 
  300:   CHK_FAIL_START
  301:   p = stpcpy (buf + 9, str2);
  302:   CHK_FAIL_END
  303: 
  304:   CHK_FAIL_START
  305:   strncpy (buf + 7, "X", l0 + 4);
  306:   CHK_FAIL_END
  307: 
  308:   CHK_FAIL_START
  309:   stpncpy (buf + 6, "cd", l0 + 5);
  310:   CHK_FAIL_END
  311: 
  312: # if !defined __cplusplus || defined __va_arg_pack
  313:   CHK_FAIL_START
  314:   sprintf (buf + 8, "%d", num1);
  315:   CHK_FAIL_END
  316: 
  317:   CHK_FAIL_START
  318:   snprintf (buf + 8, l0 + 3, "%d", num2);
  319:   CHK_FAIL_END
  320: 
  321:   CHK_FAIL_START
  322:   swprintf (wbuf + 8, 3, L"%d", num1);
  323:   CHK_FAIL_END
  324: 
  325:   CHK_FAIL_START
  326:   swprintf (wbuf + 8, l0 + 3, L"%d", num1);
  327:   CHK_FAIL_END
  328: # endif
  329: 
  330:   memcpy (buf, str1 + 2, l0 + 9);
  331:   CHK_FAIL_START
  332:   strcat (buf, "AB");
  333:   CHK_FAIL_END
  334: 
  335:   memcpy (buf, str1 + 3, l0 + 8);
  336:   CHK_FAIL_START
  337:   strncat (buf, "ZYXWV", l0 + 3);
  338:   CHK_FAIL_END
  339: 
  340:   CHK_FAIL_START
  341:   memcpy (a.buf1 + 1, "abcdefghij", l0 + 10);
  342:   CHK_FAIL_END
  343: 
  344:   CHK_FAIL_START
  345:   memmove (a.buf1 + 2, a.buf1 + 1, l0 + 9);
  346:   CHK_FAIL_END
  347: 
  348:   CHK_FAIL_START
  349:   p = (char *) mempcpy (a.buf1 + 6, "abcde", l0 + 5);
  350:   CHK_FAIL_END
  351: 
  352:   CHK_FAIL_START
  353:   memset (a.buf1 + 9, 'j', l0 + 2);
  354:   CHK_FAIL_END
  355: 
  356: # if __USE_FORTIFY_LEVEL >= 2
  357: #  define O 0
  358: # else
  359: #  define O 1
  360: # endif
  361: 
  362:   CHK_FAIL_START
  363:   strcpy (a.buf1 + (O + 4), str1 + 5);
  364:   CHK_FAIL_END
  365: 
  366:   CHK_FAIL_START
  367:   p = stpcpy (a.buf1 + (O + 8), str2);
  368:   CHK_FAIL_END
  369: 
  370:   CHK_FAIL_START
  371:   strncpy (a.buf1 + (O + 6), "X", l0 + 4);
  372:   CHK_FAIL_END
  373: 
  374: # if !defined __cplusplus || defined __va_arg_pack
  375:   CHK_FAIL_START
  376:   sprintf (a.buf1 + (O + 7), "%d", num1);
  377:   CHK_FAIL_END
  378: 
  379:   CHK_FAIL_START
  380:   snprintf (a.buf1 + (O + 7), l0 + 3, "%d", num2);
  381:   CHK_FAIL_END
  382: # endif
  383: 
  384:   memcpy (a.buf1, str1 + (3 - O), l0 + 8 + O);
  385:   CHK_FAIL_START
  386:   strcat (a.buf1, "AB");
  387:   CHK_FAIL_END
  388: 
  389:   memcpy (a.buf1, str1 + (4 - O), l0 + 7 + O);
  390:   CHK_FAIL_START
  391:   strncat (a.buf1, "ZYXWV", l0 + 3);
  392:   CHK_FAIL_END
  393: #endif
  394: 
  395: 
  396:   /* These ops can be done without runtime checking of object size.  */
  397:   wmemcpy (wbuf, L"abcdefghij", 10);
  398:   wmemmove (wbuf + 1, wbuf, 9);
  399:   if (wmemcmp (wbuf, L"aabcdefghi", 10))
  400:     FAIL ();
  401: 
  402:   if (wmempcpy (wbuf + 5, L"abcde", 5) != wbuf + 10
  403:       || wmemcmp (wbuf, L"aabcdabcde", 10))
  404:     FAIL ();
  405: 
  406:   wmemset (wbuf + 8, L'j', 2);
  407:   if (wmemcmp (wbuf, L"aabcdabcjj", 10))
  408:     FAIL ();
  409: 
  410:   wcscpy (wbuf + 4, L"EDCBA");
  411:   if (wmemcmp (wbuf, L"aabcEDCBA", 10))
  412:     FAIL ();
  413: 
  414:   if (wcpcpy (wbuf + 8, L"F") != wbuf + 9 || wmemcmp (wbuf, L"aabcEDCBF", 10))
  415:     FAIL ();
  416: 
  417:   wcsncpy (wbuf + 6, L"X", 4);
  418:   if (wmemcmp (wbuf, L"aabcEDX\0\0", 10))
  419:     FAIL ();
  420: 
  421:   if (swprintf (wbuf + 7, 3, L"%ls", L"987654") >= 0
  422:       || wmemcmp (wbuf, L"aabcEDX98", 10))
  423:     FAIL ();
  424: 
  425:   if (swprintf (wbuf + 7, 3, L"64") != 2
  426:       || wmemcmp (wbuf, L"aabcEDX64", 10))
  427:     FAIL ();
  428: 
  429:   /* These ops need runtime checking, but shouldn't __chk_fail.  */
  430:   wmemcpy (wbuf, L"abcdefghij", l0 + 10);
  431:   wmemmove (wbuf + 1, wbuf, l0 + 9);
  432:   if (wmemcmp (wbuf, L"aabcdefghi", 10))
  433:     FAIL ();
  434: 
  435:   if (wmempcpy (wbuf + 5, L"abcde", l0 + 5) != wbuf + 10
  436:       || wmemcmp (wbuf, L"aabcdabcde", 10))
  437:     FAIL ();
  438: 
  439:   wmemset (wbuf + 8, L'j', l0 + 2);
  440:   if (wmemcmp (wbuf, L"aabcdabcjj", 10))
  441:     FAIL ();
  442: 
  443:   wcscpy (wbuf + 4, wstr1 + 5);
  444:   if (wmemcmp (wbuf, L"aabcEDCBA", 10))
  445:     FAIL ();
  446: 
  447:   if (wcpcpy (wbuf + 8, wstr2) != wbuf + 9 || wmemcmp (wbuf, L"aabcEDCBF", 10))
  448:     FAIL ();
  449: 
  450:   wcsncpy (wbuf + 6, L"X", l0 + 4);
  451:   if (wmemcmp (wbuf, L"aabcEDX\0\0", 10))
  452:     FAIL ();
  453: 
  454:   if (wcpncpy (wbuf + 5, L"cd", l0 + 5) != wbuf + 7
  455:       || wmemcmp (wbuf, L"aabcEcd\0\0", 10))
  456:     FAIL ();
  457: 
  458:   if (swprintf (wbuf + 7, 3, L"%d", num2) >= 0
  459:       || wmemcmp (wbuf, L"aabcEcd98", 10))
  460:     FAIL ();
  461: 
  462:   wbuf[l0 + 8] = L'\0';
  463:   wcscat (wbuf, L"A");
  464:   if (wmemcmp (wbuf, L"aabcEcd9A", 10))
  465:     FAIL ();
  466: 
  467:   wbuf[l0 + 7] = L'\0';
  468:   wcsncat (wbuf, L"ZYXWV", l0 + 2);
  469:   if (wmemcmp (wbuf, L"aabcEcdZY", 10))
  470:     FAIL ();
  471: 
  472:   wmemcpy (wa.buf1, L"abcdefghij", l0 + 10);
  473:   wmemmove (wa.buf1 + 1, wa.buf1, l0 + 9);
  474:   if (wmemcmp (wa.buf1, L"aabcdefghi", 10))
  475:     FAIL ();
  476: 
  477:   if (wmempcpy (wa.buf1 + 5, L"abcde", l0 + 5) != wa.buf1 + 10
  478:       || wmemcmp (wa.buf1, L"aabcdabcde", 10))
  479:     FAIL ();
  480: 
  481:   wmemset (wa.buf1 + 8, L'j', l0 + 2);
  482:   if (wmemcmp (wa.buf1, L"aabcdabcjj", 10))
  483:     FAIL ();
  484: 
  485: #if __USE_FORTIFY_LEVEL < 2
  486:   /* The following tests are supposed to crash with -D_FORTIFY_SOURCE=2
  487:      and sufficient GCC support, as the string operations overflow
  488:      from a.buf1 into a.buf2.  */
  489:   wcscpy (wa.buf1 + 4, wstr1 + 5);
  490:   if (wmemcmp (wa.buf1, L"aabcEDCBA", 10))
  491:     FAIL ();
  492: 
  493:   if (wcpcpy (wa.buf1 + 8, wstr2) != wa.buf1 + 9
  494:       || wmemcmp (wa.buf1, L"aabcEDCBF", 10))
  495:     FAIL ();
  496: 
  497:   wcsncpy (wa.buf1 + 6, L"X", l0 + 4);
  498:   if (wmemcmp (wa.buf1, L"aabcEDX\0\0", 10))
  499:     FAIL ();
  500: 
  501:   if (swprintf (wa.buf1 + 7, 3, L"%d", num2) >= 0
  502:       || wmemcmp (wa.buf1, L"aabcEDX98", 10))
  503:     FAIL ();
  504: 
  505:   wa.buf1[l0 + 8] = L'\0';
  506:   wcscat (wa.buf1, L"A");
  507:   if (wmemcmp (wa.buf1, L"aabcEDX9A", 10))
  508:     FAIL ();
  509: 
  510:   wa.buf1[l0 + 7] = L'\0';
  511:   wcsncat (wa.buf1, L"ZYXWV", l0 + 2);
  512:   if (wmemcmp (wa.buf1, L"aabcEDXZY", 10))
  513:     FAIL ();
  514: 
  515: #endif
  516: 
  517: #if __USE_FORTIFY_LEVEL >= 1
  518:   /* Now check if all buffer overflows are caught at runtime.  */
  519: 
  520:   CHK_FAIL_START
  521:   wmemcpy (wbuf + 1, L"abcdefghij", l0 + 10);
  522:   CHK_FAIL_END
  523: 
  524:   CHK_FAIL_START
  525:   wmemcpy (wbuf + 9, L"abcdefghij", l0 + 10);
  526:   CHK_FAIL_END
  527: 
  528:   CHK_FAIL_START
  529:   wmemmove (wbuf + 2, wbuf + 1, l0 + 9);
  530:   CHK_FAIL_END
  531: 
  532:   CHK_FAIL_START
  533:   wp = wmempcpy (wbuf + 6, L"abcde", l0 + 5);
  534:   CHK_FAIL_END
  535: 
  536:   CHK_FAIL_START
  537:   wmemset (wbuf + 9, L'j', l0 + 2);
  538:   CHK_FAIL_END
  539: 
  540:   CHK_FAIL_START
  541:   wcscpy (wbuf + 5, wstr1 + 5);