projects / thirdparty / glibc.git / blame
| Commit | Line | Data |
|---|---|---|
| af7519f7 PP |
1 | /* Bug 22786: test for buffer overflow in realpath. |
| 2 | Copyright (C) 2018 Free Software Foundation, Inc. | |
| 3 | This file is part of the GNU C Library. | |
| 4 | ||
| 5 | The GNU C Library is free software; you can redistribute it and/or | |
| 6 | modify it under the terms of the GNU Lesser General Public | |
| 7 | License as published by the Free Software Foundation; either | |
| 8 | version 2.1 of the License, or (at your option) any later version. | |
| 9 | ||
| 10 | The GNU C Library is distributed in the hope that it will be useful, | |
| 11 | but WITHOUT ANY WARRANTY; without even the implied warranty of | |
| 12 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU | |
| 13 | Lesser General Public License for more details. | |
| 14 | ||
| 15 | You should have received a copy of the GNU Lesser General Public | |
| 16 | License along with the GNU C Library; if not, see | |
| 17 | <http://www.gnu.org/licenses/>. */ | |
| 18 | ||
| 19 | /* This file must be run from within a directory called "stdlib". */ | |
| 20 | ||
| 21 | #include <errno.h> | |
| 22 | #include <limits.h> | |
| 23 | #include <stdio.h> | |
| 24 | #include <stdlib.h> | |
| 25 | #include <string.h> | |
| 26 | #include <unistd.h> | |
| 27 | #include <sys/stat.h> | |
| 28 | #include <sys/types.h> | |
| 29 | #include <support/test-driver.h> | |
| 30 | #include <libc-diag.h> | |
| 31 | ||
| 32 | static int | |
| 33 | do_test (void) | |
| 34 | { | |
| 35 | const char dir[] = "bz22786"; | |
| 36 | const char lnk[] = "bz22786/symlink"; | |
| 37 | ||
| 38 | rmdir (dir); | |
| 39 | if (mkdir (dir, 0755) != 0 && errno != EEXIST) | |
| 40 | { | |
| 41 | printf ("mkdir %s: %m\n", dir); | |
| 42 | return EXIT_FAILURE; | |
| 43 | } | |
| 44 | if (symlink (".", lnk) != 0 && errno != EEXIST) | |
| 45 | { | |
| 46 | printf ("symlink (%s, %s): %m\n", dir, lnk); | |
| 47 | return EXIT_FAILURE; | |
| 48 | } | |
| 49 | ||
| 50 | const size_t path_len = (size_t) INT_MAX + 1; | |
| 51 | ||
| 52 | DIAG_PUSH_NEEDS_COMMENT; | |
| 53 | #if __GNUC_PREREQ (7, 0) | |
| 54 | /* GCC 7 warns about too-large allocations; here we need such | |
| 55 | allocation to succeed for the test to work. */ | |
| 56 | DIAG_IGNORE_NEEDS_COMMENT (7, "-Walloc-size-larger-than="); | |
| 57 | #endif | |
| 58 | char *path = malloc (path_len); | |
| 59 | DIAG_POP_NEEDS_COMMENT; | |
| 60 | ||
| 61 | if (path == NULL) | |
| 62 | { | |
| 63 | printf ("malloc (%zu): %m\n", path_len); | |
| 64 | return EXIT_UNSUPPORTED; | |
| 65 | } | |
| 66 | ||
| 67 | /* Construct very long path = "bz22786/symlink/aaaa....." */ | |
| 68 | char *p = mempcpy (path, lnk, sizeof (lnk) - 1); | |
| 69 | *(p++) = '/'; | |
| 70 | memset (p, 'a', path_len - (path - p) - 2); | |
| 71 | p[path_len - (path - p) - 1] = '\0'; | |
| 72 | ||
| 73 | /* This call crashes before the fix for bz22786 on 32-bit platforms. */ | |
| 74 | p = realpath (path, NULL); | |
| 75 | ||
| 76 | if (p != NULL || errno != ENAMETOOLONG) | |
| 77 | { | |
| 78 | printf ("realpath: %s (%m)", p); | |
| 79 | return EXIT_FAILURE; | |
| 80 | } | |
| 81 | ||
| 82 | /* Cleanup. */ | |
| 83 | unlink (lnk); | |
| 84 | rmdir (dir); | |
| 85 | ||
| 86 | return 0; | |
| 87 | } | |
| 88 | ||
| 89 | #define TEST_FUNCTION do_test | |
| 90 | #include <support/test-driver.c> |