mirror of
https://sourceware.org/git/glibc.git
synced 2024-11-21 12:30:06 +00:00
stdio-common: Handle -1 buffer size in __sprintf_chk & co (bug 30039)
This shows up as an assertion failure when sprintf is called with a specifier like "%.8g" and libquadmath is linked in: Fatal glibc error: printf_buffer_as_file.c:31 (__printf_buffer_as_file_commit): assertion failed: file->stream._IO_write_ptr <= file->next->write_end Fix this by detecting pointer wraparound in __vsprintf_internal and saturate the addition to the end of the address space instead. Reviewed-by: Carlos O'Donell <carlos@redhat.com> Tested-by: Carlos O'Donell <carlos@redhat.com>
This commit is contained in:
parent
0674613e66
commit
0d50f477f4
@ -200,6 +200,10 @@ LDFLAGS-tst-backtrace6 = -rdynamic
|
||||
|
||||
CFLAGS-tst-ssp-1.c += -fstack-protector-all
|
||||
|
||||
# Disable compiler optimizations around vsprintf (the function under test).
|
||||
CFLAGS-tst-sprintf-fortify-unchecked.c = \
|
||||
-fno-builtin-vsprintf -fno-builtin-__vsprintf_chk
|
||||
|
||||
tests = backtrace-tst \
|
||||
tst-longjmp_chk \
|
||||
test-strcpy_chk \
|
||||
@ -211,6 +215,7 @@ tests = backtrace-tst \
|
||||
tst-backtrace5 \
|
||||
tst-backtrace6 \
|
||||
tst-realpath-chk \
|
||||
tst-sprintf-fortify-unchecked \
|
||||
$(tests-all-chk)
|
||||
|
||||
tests-time64 += \
|
||||
|
126
debug/tst-sprintf-fortify-unchecked.c
Normal file
126
debug/tst-sprintf-fortify-unchecked.c
Normal file
@ -0,0 +1,126 @@
|
||||
/* Tests for fortified sprintf with unknown buffer bounds (bug 30039).
|
||||
Copyright (C) 2023 Free Software Foundation, Inc.
|
||||
This file is part of the GNU C Library.
|
||||
|
||||
The GNU C Library is free software; you can redistribute it and/or
|
||||
modify it under the terms of the GNU Lesser General Public
|
||||
License as published by the Free Software Foundation; either
|
||||
version 2.1 of the License, or (at your option) any later version.
|
||||
|
||||
The GNU C Library is distributed in the hope that it will be useful,
|
||||
but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
Lesser General Public License for more details.
|
||||
|
||||
You should have received a copy of the GNU Lesser General Public
|
||||
License along with the GNU C Library; if not, see
|
||||
<https://www.gnu.org/licenses/>. */
|
||||
|
||||
#include <printf.h>
|
||||
#include <stdarg.h>
|
||||
#include <stdio.h>
|
||||
#include <string.h>
|
||||
#include <support/check.h>
|
||||
|
||||
/* This test is not built with _FORTIFY_SOURCE. Instead it calls the
|
||||
appropriate implementation directly. The fortify mode is specified
|
||||
in this variable. */
|
||||
static int fortify_mode;
|
||||
|
||||
/* This does not handle long-double redirects etc., but we test only
|
||||
format strings that stay within the confines of the base
|
||||
implementation. */
|
||||
int __vsprintf_chk (char *s, int flag, size_t slen, const char *format,
|
||||
va_list ap);
|
||||
|
||||
/* Invoke vsprintf or __vsprintf_chk according to fortify_mode. */
|
||||
static int
|
||||
my_vsprintf (char *buf, const char *format, va_list ap)
|
||||
{
|
||||
int result;
|
||||
if (fortify_mode == 0)
|
||||
result = vsprintf (buf, format, ap);
|
||||
else
|
||||
/* Call the fortified version with an unspecified length. */
|
||||
result = __vsprintf_chk (buf, fortify_mode - 1, -1, format, ap);
|
||||
return result;
|
||||
}
|
||||
|
||||
/* Run one test, with the specified expected output. */
|
||||
static void __attribute ((format (printf, 2, 3)))
|
||||
do_check (const char *expected, const char *format, ...)
|
||||
{
|
||||
va_list ap;
|
||||
va_start (ap, format);
|
||||
|
||||
char buf_expected[24];
|
||||
memset (buf_expected, '@', sizeof (buf_expected));
|
||||
TEST_VERIFY (strlen (expected) < sizeof (buf_expected));
|
||||
strcpy (buf_expected, expected);
|
||||
|
||||
char buf[sizeof (buf_expected)];
|
||||
memset (buf, '@', sizeof (buf));
|
||||
|
||||
int ret = my_vsprintf (buf, format, ap);
|
||||
TEST_COMPARE_BLOB (buf_expected, sizeof (buf_expected), buf, sizeof (buf));
|
||||
TEST_COMPARE (ret, strlen (expected));
|
||||
|
||||
va_end (ap);
|
||||
}
|
||||
|
||||
/* Run the tests in all fortify modes. */
|
||||
static void
|
||||
do_tests (void)
|
||||
{
|
||||
for (fortify_mode = 0; fortify_mode <= 3; ++fortify_mode)
|
||||
{
|
||||
do_check ("0", "%d", 0);
|
||||
do_check ("-2147483648", "%d", -2147483647 - 1);
|
||||
do_check ("-9223372036854775808", "%lld", -9223372036854775807LL - 1);
|
||||
do_check ("", "%s", "");
|
||||
do_check (" ", "%22s", "");
|
||||
do_check ("XXXXXXXXXXXXXXXXXXXXXX", "%s", "XXXXXXXXXXXXXXXXXXXXXX");
|
||||
do_check ("1.125000", "%f", 1.125);
|
||||
do_check ("1.125", "%g", 1.125);
|
||||
do_check ("1.125", "%.8g", 1.125);
|
||||
}
|
||||
}
|
||||
|
||||
/* printf callback that falls back to the glibc-supplied
|
||||
implementation. */
|
||||
static int
|
||||
dummy_printf_function (FILE *__stream,
|
||||
const struct printf_info *__info,
|
||||
const void *const *__args)
|
||||
{
|
||||
return -2; /* Request fallback. */
|
||||
}
|
||||
|
||||
/* Likewise for the type information. */
|
||||
static int
|
||||
dummy_arginfo_function (const struct printf_info *info,
|
||||
size_t n, int *argtypes, int *size)
|
||||
{
|
||||
return -1; /* Request fallback. */
|
||||
}
|
||||
|
||||
static int
|
||||
do_test (void)
|
||||
{
|
||||
do_tests ();
|
||||
|
||||
/* Activate __printf_function_invoke mode. */
|
||||
register_printf_specifier ('d', dummy_printf_function,
|
||||
dummy_arginfo_function);
|
||||
register_printf_specifier ('g', dummy_printf_function,
|
||||
dummy_arginfo_function);
|
||||
register_printf_specifier ('s', dummy_printf_function,
|
||||
dummy_arginfo_function);
|
||||
|
||||
/* Rerun the tests with callback functions. */
|
||||
do_tests ();
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
#include <support/test-driver.c>
|
@ -115,17 +115,26 @@ __printf_buffer_has_failed (struct __printf_buffer *buf)
|
||||
return buf->mode == __printf_buffer_mode_failed;
|
||||
}
|
||||
|
||||
/* Initialization of a buffer, using the memory region from [BASE,
|
||||
END) as the initial buffer contents. */
|
||||
static inline void
|
||||
__printf_buffer_init_end (struct __printf_buffer *buf, char *base, char *end,
|
||||
enum __printf_buffer_mode mode)
|
||||
{
|
||||
buf->write_base = base;
|
||||
buf->write_ptr = base;
|
||||
buf->write_end = end;
|
||||
buf->written = 0;
|
||||
buf->mode = mode;
|
||||
}
|
||||
|
||||
/* Initialization of a buffer, using the memory region from [BASE, BASE +LEN)
|
||||
as the initial buffer contents. LEN can be zero. */
|
||||
static inline void
|
||||
__printf_buffer_init (struct __printf_buffer *buf, char *base, size_t len,
|
||||
enum __printf_buffer_mode mode)
|
||||
{
|
||||
buf->write_base = base;
|
||||
buf->write_ptr = base;
|
||||
buf->write_end = base + len;
|
||||
buf->written = 0;
|
||||
buf->mode = mode;
|
||||
__printf_buffer_init_end (buf, base, base + len, mode);
|
||||
}
|
||||
|
||||
/* Called by printf_buffer_putc for a full buffer. */
|
||||
|
@ -45,14 +45,19 @@ __vsprintf_internal (char *string, size_t maxlen,
|
||||
if ((mode_flags & PRINTF_CHK) != 0)
|
||||
{
|
||||
string[0] = '\0';
|
||||
__printf_buffer_init (&buf, string, maxlen,
|
||||
/* In some cases, __sprintf_chk is called with an unknown buffer
|
||||
size (the special value -1). Prevent pointer wraparound in
|
||||
this case and saturate to the end of the address space. */
|
||||
uintptr_t end;
|
||||
if (__builtin_add_overflow ((uintptr_t) string, maxlen, &end))
|
||||
end = -1;
|
||||
__printf_buffer_init_end (&buf, string, (char *) end,
|
||||
__printf_buffer_mode_sprintf_chk);
|
||||
}
|
||||
else
|
||||
{
|
||||
__printf_buffer_init (&buf, string, 0, __printf_buffer_mode_sprintf);
|
||||
buf.write_end = (char *) ~(uintptr_t) 0; /* End of address space. */
|
||||
}
|
||||
/* Use end of address space. */
|
||||
__printf_buffer_init_end (&buf, string, (char *) ~(uintptr_t) 0,
|
||||
__printf_buffer_mode_sprintf);
|
||||
|
||||
__printf_buffer (&buf, format, args, mode_flags);
|
||||
|
||||
|
Loading…
Reference in New Issue
Block a user