Improve documentation for malloc etc. (BZ#27719)

[thirdparty/glibc.git] / stdio-common / tst-sscanf.c

diff --git a/stdio-common/tst-sscanf.c b/stdio-common/tst-sscanf.c
index b76f757c90f4fdd68d777fd71ccf7397b170f7f8..47bfc89feb4f7f2554eeb9a220c7e8f32c878169 100644 (file)
--- a/stdio-common/tst-sscanf.c
+++ b/stdio-common/tst-sscanf.c
@@ -1,4 +1,4 @@
-/* Copyright (C) 2000, 2002, 2004, 2007 Free Software Foundation, Inc.
+/* Copyright (C) 2000-2021 Free Software Foundation, Inc.
    This file is part of the GNU C Library.
    Contributed by Jakub Jelinek <jakub@redhat.com>, 2000.
 
@@ -13,10 +13,10 @@
    Lesser General Public License for more details.
 
    You should have received a copy of the GNU Lesser General Public
-   License along with the GNU C Library; if not, write to the Free
-   Software Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA
-   02111-1307 USA.  */
+   License along with the GNU C Library; if not, see
+   <https://www.gnu.org/licenses/>.  */
 
+#include <array_length.h>
 #include <stdlib.h>
 #include <stdio.h>
 #include <locale.h>
@@ -65,7 +65,7 @@ const long int val_long[] =
   -12345678, 987654321, 123456789, 987654321, 123456789, 987654321
 };
 
-struct int_test
+struct test
 {
   const CHAR *str;
   const CHAR *fmt;
@@ -93,14 +93,40 @@ struct int_test
   { L("foo bar"), L("foo bar"), 0 },
   { L("foo bar"), L("foo %d"), 0 },
   { L("foo bar"), L("foon%d"), 0 },
+  { L("foo (nil)"), L("foo %p"), 1},
+  { L("foo (nil)"), L("foo %4p"), 0},
   { L("foo "), L("foo %n"), 0 },
   { L("foo%bar1"), L("foo%%bar%d"), 1 },
   /* Some OSes skip whitespace here while others don't.  */
   { L("foo \t %bar1"), L("foo%%bar%d"), 1 }
 };
 
-int
-main (void)
+struct test double_tests[] =
+{
+  { L("-1"), L("%1g"), 0 },
+  { L("-.1"), L("%2g"), 0 },
+  { L("-inf"), L("%3g"), 0 },
+  { L("+0"), L("%1g"),  },
+  { L("-0x1p0"), L("%2g"), 1 },
+  { L("-..1"), L("%g"), 0 },
+  { L("-inf"), L("%g"), 1 }
+};
+
+struct test2
+{
+  const CHAR *str;
+  const CHAR *fmt;
+  int retval;
+  char residual;
+} double_tests2[] =
+{
+  { L("0e+0"), L("%g%c"), 1, 0 },
+  { L("0xe+0"), L("%g%c"), 2, '+' },
+  { L("0x.e+0"), L("%g%c"), 2, '+' },
+};
+
+static int
+do_test (void)
 {
   double d[6];
   long l[6];
@@ -159,9 +185,10 @@ main (void)
        break;
     }
 
-  for (i = 0; i < sizeof (int_tests) / sizeof (int_tests[0]); ++i)
+  for (i = 0; i < array_length (int_tests); ++i)
     {
-      int dummy, ret;
+      long dummy;
+      int ret;
 
       if ((ret = SSCANF (int_tests[i].str, int_tests[i].fmt,
                         &dummy)) != int_tests[i].retval)
@@ -172,5 +199,76 @@ main (void)
        }
     }
 
+  for (i = 0; i < array_length (double_tests); ++i)
+    {
+      double dummy;
+      int ret;
+
+      if ((ret = SSCANF (double_tests[i].str, double_tests[i].fmt,
+                        &dummy)) != double_tests[i].retval)
+       {
+         printf ("double_tests[%d] returned %d != %d\n",
+                 i, ret, double_tests[i].retval);
+         result = 1;
+       }
+    }
+
+  for (i = 0; i < array_length (double_tests2); ++i)
+    {
+      double dummy;
+      int ret;
+      char c = 0;
+
+      if ((ret = SSCANF (double_tests2[i].str, double_tests2[i].fmt,
+                        &dummy, &c)) != double_tests2[i].retval)
+       {
+         printf ("double_tests2[%d] returned %d != %d\n",
+                 i, ret, double_tests2[i].retval);
+         result = 1;
+       }
+      else if (ret == 2 && c != double_tests2[i].residual)
+       {
+         printf ("double_tests2[%d] stopped at '%c' != '%c'\n",
+                 i, c, double_tests2[i].residual);
+         result = 1;
+       }
+    }
+
+  /* BZ #16618
+     The test will segfault during SSCANF if the buffer overflow
+     is not fixed.  The size of `s` is such that it forces the use
+     of malloc internally and this triggers the incorrect computation.
+     Thus the value for SIZE is arbitrariy high enough that malloc
+     is used.  */
+  {
+#define SIZE 131072
+    CHAR *s = malloc ((SIZE + 1) * sizeof (*s));
+    if (s == NULL)
+      abort ();
+    for (size_t i = 0; i < SIZE; i++)
+      s[i] = L('0');
+    s[SIZE] = L('\0');
+    int i = 42;
+    /* Scan multi-digit zero into `i`.  */
+    if (SSCANF (s, L("%d"), &i) != 1)
+      {
+       printf ("FAIL: bug16618: SSCANF did not read one input item.\n");
+       result = 1;
+      }
+    if (i != 0)
+      {
+       printf ("FAIL: bug16618: Value of `i` was not zero as expected.\n");
+       result = 1;
+      }
+    free (s);
+    if (result != 1)
+      printf ("PASS: bug16618: Did not crash.\n");
+#undef SIZE
+  }
+
+
   return result;
 }
+
+#define TEST_FUNCTION do_test ()
+#include "../test-skeleton.c"