]>
Commit | Line | Data |
---|---|---|
5460617d PP |
1 | /* Bug 22786: test for buffer overflow in realpath. |
2 | Copyright (C) 2018 Free Software Foundation, Inc. | |
3 | This file is part of the GNU C Library. | |
4 | ||
5 | The GNU C Library is free software; you can redistribute it and/or | |
6 | modify it under the terms of the GNU Lesser General Public | |
7 | License as published by the Free Software Foundation; either | |
8 | version 2.1 of the License, or (at your option) any later version. | |
9 | ||
10 | The GNU C Library is distributed in the hope that it will be useful, | |
11 | but WITHOUT ANY WARRANTY; without even the implied warranty of | |
12 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU | |
13 | Lesser General Public License for more details. | |
14 | ||
15 | You should have received a copy of the GNU Lesser General Public | |
16 | License along with the GNU C Library; if not, see | |
17 | <http://www.gnu.org/licenses/>. */ | |
18 | ||
19 | /* This file must be run from within a directory called "stdlib". */ | |
20 | ||
21 | #include <errno.h> | |
22 | #include <limits.h> | |
23 | #include <stdio.h> | |
24 | #include <stdlib.h> | |
25 | #include <string.h> | |
26 | #include <unistd.h> | |
27 | #include <sys/stat.h> | |
28 | #include <sys/types.h> | |
f5e7e959 | 29 | #include <support/blob_repeat.h> |
6c3a8a9d PP |
30 | #include <support/check.h> |
31 | #include <support/support.h> | |
32 | #include <support/temp_file.h> | |
5460617d PP |
33 | #include <support/test-driver.h> |
34 | #include <libc-diag.h> | |
35 | ||
36 | static int | |
37 | do_test (void) | |
38 | { | |
6c3a8a9d PP |
39 | const char *dir = support_create_temp_directory ("bz22786."); |
40 | const char *lnk = xasprintf ("%s/symlink", dir); | |
41 | const size_t path_len = (size_t) INT_MAX + strlen (lnk) + 1; | |
5460617d | 42 | |
f5e7e959 FW |
43 | struct support_blob_repeat repeat |
44 | = support_blob_repeat_allocate ("a", 1, path_len); | |
45 | char *path = repeat.start; | |
3bad2358 SL |
46 | if (path == NULL) |
47 | { | |
f5e7e959 | 48 | printf ("Repeated allocation (%zu bytes): %m\n", path_len); |
3bad2358 SL |
49 | /* On 31-bit s390 the malloc will always fail as we do not have |
50 | so much memory, and we want to mark the test unsupported. | |
51 | Likewise on systems with little physical memory the test will | |
52 | fail and should be unsupported. */ | |
53 | return EXIT_UNSUPPORTED; | |
54 | } | |
55 | ||
56 | TEST_VERIFY_EXIT (symlink (".", lnk) == 0); | |
5460617d | 57 | |
6c3a8a9d PP |
58 | /* Construct very long path = "/tmp/bz22786.XXXX/symlink/aaaa....." */ |
59 | char *p = mempcpy (path, lnk, strlen (lnk)); | |
5460617d | 60 | *(p++) = '/'; |
6c3a8a9d | 61 | p[path_len - (p - path) - 1] = '\0'; |
5460617d PP |
62 | |
63 | /* This call crashes before the fix for bz22786 on 32-bit platforms. */ | |
64 | p = realpath (path, NULL); | |
65 | ||
66 | if (p != NULL || errno != ENAMETOOLONG) | |
67 | { | |
68 | printf ("realpath: %s (%m)", p); | |
69 | return EXIT_FAILURE; | |
70 | } | |
71 | ||
72 | /* Cleanup. */ | |
73 | unlink (lnk); | |
f5e7e959 | 74 | support_blob_repeat_free (&repeat); |
5460617d PP |
75 | |
76 | return 0; | |
77 | } | |
78 | ||
79 | #define TEST_FUNCTION do_test | |
80 | #include <support/test-driver.c> |