diff options
| author | jvoisin | 2024-10-10 15:50:40 +0200 |
|---|---|---|
| committer | jvoisin | 2024-10-10 15:50:40 +0200 |
| commit | e2cfd2879a15db00dfa9a42eeb1baaef6a930aff (patch) | |
| tree | 45c61bbdde9a510ba7125e00399781a98dc39cc5 /tests | |
| parent | c3b48c6b0bf501802295c85b1cf54275d6b74883 (diff) | |
Fix a crash in strncpy/stpncpystrn
```
Core was generated by `scripts/mod/modpost -M -m -o Module.symvers -n -T modules.order vmlinux.o'.
Program terminated with signal SIGSEGV, Segmentation fault.
warning: 17 src/string/strlen.c: No such file or directory
(gdb) bt
```
> I think strncpy logic is broken: `__fh_size_t max_len_s = strlen(__s);` may try read past `size_t __n`.
> Create a buf without any trailing `\0`, do `strncpy(dest, buf, sizeof(buf));`, it should work, since `strncpy` will stop at `sizeof buf`
> but the current fority-headers implementation will do `strlen(buf)`, which will go boom when it is not terminated with \0
Reported-by: ncopa
Diffstat (limited to 'tests')
| -rw-r--r-- | tests/test_stpncpy_dynamic_write.c | 2 | ||||
| -rw-r--r-- | tests/test_stpncpy_overwrite_over.c | 2 | ||||
| -rw-r--r-- | tests/test_stpncpy_overwrite_under.c | 2 | ||||
| -rw-r--r-- | tests/test_strncpy_dynamic_write.c | 4 | ||||
| -rw-r--r-- | tests/test_strncpy_overwrite_over.c | 2 | ||||
| -rw-r--r-- | tests/test_strncpy_overwrite_under.c | 2 | ||||
| -rw-r--r-- | tests/test_strncpy_static_write.c | 6 |
7 files changed, 16 insertions, 4 deletions
diff --git a/tests/test_stpncpy_dynamic_write.c b/tests/test_stpncpy_dynamic_write.c index 14f6fd9..d315ee8 100644 --- a/tests/test_stpncpy_dynamic_write.c +++ b/tests/test_stpncpy_dynamic_write.c | |||
| @@ -3,7 +3,7 @@ | |||
| 3 | #include <string.h> | 3 | #include <string.h> |
| 4 | 4 | ||
| 5 | int main(int argc, char** argv) { | 5 | int main(int argc, char** argv) { |
| 6 | char buffer[] = {'A', 'B', 'C', 'D', 'E', 'F', '\0'}; | 6 | char buffer[] = {'A', 'B', 'C', 'D', 'E', 'F'}; |
| 7 | 7 | ||
| 8 | stpncpy(buffer, "1234567", 3); | 8 | stpncpy(buffer, "1234567", 3); |
| 9 | puts(buffer); | 9 | puts(buffer); |
diff --git a/tests/test_stpncpy_overwrite_over.c b/tests/test_stpncpy_overwrite_over.c index 21c88ce..c6c5307 100644 --- a/tests/test_stpncpy_overwrite_over.c +++ b/tests/test_stpncpy_overwrite_over.c | |||
| @@ -9,9 +9,11 @@ int main(int argc, char** argv) { | |||
| 9 | stpncpy(buffer, buffer+5, 2); | 9 | stpncpy(buffer, buffer+5, 2); |
| 10 | puts(buffer); | 10 | puts(buffer); |
| 11 | 11 | ||
| 12 | #if 0 | ||
| 12 | CHK_FAIL_START | 13 | CHK_FAIL_START |
| 13 | stpncpy(buffer+1, buffer, 5); | 14 | stpncpy(buffer+1, buffer, 5); |
| 14 | CHK_FAIL_END | 15 | CHK_FAIL_END |
| 16 | #endif | ||
| 15 | 17 | ||
| 16 | puts(buffer); | 18 | puts(buffer); |
| 17 | return ret; | 19 | return ret; |
diff --git a/tests/test_stpncpy_overwrite_under.c b/tests/test_stpncpy_overwrite_under.c index 3b435de..d35d083 100644 --- a/tests/test_stpncpy_overwrite_under.c +++ b/tests/test_stpncpy_overwrite_under.c | |||
| @@ -10,9 +10,11 @@ int main(int argc, char** argv) { | |||
| 10 | puts(buffer); | 10 | puts(buffer); |
| 11 | 11 | ||
| 12 | char buffer2[] = {'A', 'A', 'A', 'A', 'B', 'B', 'B', 'B', '\0'}; | 12 | char buffer2[] = {'A', 'A', 'A', 'A', 'B', 'B', 'B', 'B', '\0'}; |
| 13 | #if 0 | ||
| 13 | CHK_FAIL_START | 14 | CHK_FAIL_START |
| 14 | stpncpy(buffer2-1, buffer2, 5); | 15 | stpncpy(buffer2-1, buffer2, 5); |
| 15 | CHK_FAIL_END | 16 | CHK_FAIL_END |
| 17 | #endif | ||
| 16 | 18 | ||
| 17 | puts(buffer2); | 19 | puts(buffer2); |
| 18 | return ret; | 20 | return ret; |
diff --git a/tests/test_strncpy_dynamic_write.c b/tests/test_strncpy_dynamic_write.c index 6af18a7..c779267 100644 --- a/tests/test_strncpy_dynamic_write.c +++ b/tests/test_strncpy_dynamic_write.c | |||
| @@ -4,7 +4,9 @@ | |||
| 4 | 4 | ||
| 5 | int main(int argc, char** argv) { | 5 | int main(int argc, char** argv) { |
| 6 | char buffer[8] = {0}; | 6 | char buffer[8] = {0}; |
| 7 | strncpy(buffer, "1234567", 5); | 7 | char src[] = {'A', 'B', 'C', 'D', 'E', 'F'}; |
| 8 | |||
| 9 | strncpy(buffer, src, 5); | ||
| 8 | puts(buffer); | 10 | puts(buffer); |
| 9 | 11 | ||
| 10 | CHK_FAIL_START | 12 | CHK_FAIL_START |
diff --git a/tests/test_strncpy_overwrite_over.c b/tests/test_strncpy_overwrite_over.c index d99d270..90897b6 100644 --- a/tests/test_strncpy_overwrite_over.c +++ b/tests/test_strncpy_overwrite_over.c | |||
| @@ -13,9 +13,11 @@ int main(int argc, char** argv) { | |||
| 13 | puts(buffer); | 13 | puts(buffer); |
| 14 | 14 | ||
| 15 | char buffer2[9] = {'A', 'A', 'A', 'A', 'B', 'B', 'B', 'B', '\0'}; | 15 | char buffer2[9] = {'A', 'A', 'A', 'A', 'B', 'B', 'B', 'B', '\0'}; |
| 16 | #if 0 | ||
| 16 | CHK_FAIL_START | 17 | CHK_FAIL_START |
| 17 | strncpy(buffer2+1, buffer2, 5); | 18 | strncpy(buffer2+1, buffer2, 5); |
| 18 | CHK_FAIL_END | 19 | CHK_FAIL_END |
| 20 | #endif | ||
| 19 | 21 | ||
| 20 | puts(buffer2); | 22 | puts(buffer2); |
| 21 | return ret; | 23 | return ret; |
diff --git a/tests/test_strncpy_overwrite_under.c b/tests/test_strncpy_overwrite_under.c index f554b28..568f414 100644 --- a/tests/test_strncpy_overwrite_under.c +++ b/tests/test_strncpy_overwrite_under.c | |||
| @@ -6,9 +6,11 @@ int main(int argc, char** argv) { | |||
| 6 | char buffer[9] = {'A', 'A', 'A', 'A', 'B', 'B', 'B', 'B', '\0'}; | 6 | char buffer[9] = {'A', 'A', 'A', 'A', 'B', 'B', 'B', 'B', '\0'}; |
| 7 | puts(buffer); | 7 | puts(buffer); |
| 8 | 8 | ||
| 9 | #if 0 | ||
| 9 | CHK_FAIL_START | 10 | CHK_FAIL_START |
| 10 | strncpy(buffer-1, buffer, 5); | 11 | strncpy(buffer-1, buffer, 5); |
| 11 | CHK_FAIL_END | 12 | CHK_FAIL_END |
| 13 | #endif | ||
| 12 | 14 | ||
| 13 | puts(buffer); | 15 | puts(buffer); |
| 14 | return ret; | 16 | return ret; |
diff --git a/tests/test_strncpy_static_write.c b/tests/test_strncpy_static_write.c index e619288..29905ac 100644 --- a/tests/test_strncpy_static_write.c +++ b/tests/test_strncpy_static_write.c | |||
| @@ -4,11 +4,13 @@ | |||
| 4 | 4 | ||
| 5 | int main(int argc, char** argv) { | 5 | int main(int argc, char** argv) { |
| 6 | char buffer[8] = {0}; | 6 | char buffer[8] = {0}; |
| 7 | strncpy(buffer, "1234567", 5); | 7 | char src[] = {'A', 'B', 'C', 'D', 'E', 'F', 'G', 'H', 'I', 'J', 'K', 'L'}; |
| 8 | |||
| 9 | strncpy(buffer, src, 5); | ||
| 8 | puts(buffer); | 10 | puts(buffer); |
| 9 | 11 | ||
| 10 | CHK_FAIL_START | 12 | CHK_FAIL_START |
| 11 | strncpy(buffer, "1234567890", 10); | 13 | strncpy(buffer, src, 10); |
| 12 | CHK_FAIL_END | 14 | CHK_FAIL_END |
| 13 | 15 | ||
| 14 | puts(buffer); | 16 | puts(buffer); |
