glibc/string/string.h
Siddhesh Poyarekar c82bdf033f Don't add access size hints to fortifiable functions
In the context of a function definition, the size hints imply that the
size of an object pointed to by one parameter is another parameter.
This doesn't make sense for the fortified versions of the functions
since that's the bit it's trying to validate.

This is harmless with __builtin_object_size since it has fairly simple
semantics when it comes to objects passed as function parameters.
With __builtin_dynamic_object_size we could (as my patchset for gcc[1]
already does) use the access attribute to determine the object size in
the general case but it misleads the fortified functions.

Basically the problem occurs when access attributes are present on
regular functions that have inline fortified definitions to generate
_chk variants; the attributes get inherited by these definitions,
causing problems when analyzing them.  For example with poll(fds, nfds,
timeout), nfds is hinted using the __attr_access as being the size of
fds.

Now, when analyzing the inline function definition in bits/poll2.h, the
compiler sees that nfds is the size of fds and tries to use that
information in the function body.  In _FORTIFY_SOURCE=3 case, where the
object size could be a non-constant expression, this information results
in the conclusion that nfds is the size of fds, which defeats the
purpose of the implementation because we're trying to check here if nfds
does indeed represent the size of fds.  Hence for this case, it is best
to not have the access attribute.

With the attributes gone, the expression evaluation should get delayed
until the function is actually inlined into its destinations.

Disable the access attribute for fortified function inline functions
when building at _FORTIFY_SOURCE=3 to make this work better.  The
access attributes remain for the _chk variants since they can be used
by the compiler to warn when the caller is passing invalid arguments.

[1] https://gcc.gnu.org/pipermail/gcc-patches/2021-October/581125.html

Signed-off-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
(cherry picked from commit e938c02748)
2022-03-11 20:36:24 +05:30

526 lines
18 KiB
C

/* Copyright (C) 1991-2021 Free Software Foundation, Inc.
This file is part of the GNU C Library.
The GNU C Library is free software; you can redistribute it and/or
modify it under the terms of the GNU Lesser General Public
License as published by the Free Software Foundation; either
version 2.1 of the License, or (at your option) any later version.
The GNU C Library is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
Lesser General Public License for more details.
You should have received a copy of the GNU Lesser General Public
License along with the GNU C Library; if not, see
<https://www.gnu.org/licenses/>. */
/*
* ISO C99 Standard: 7.21 String handling <string.h>
*/
#ifndef _STRING_H
#define _STRING_H 1
#define __GLIBC_INTERNAL_STARTING_HEADER_IMPLEMENTATION
#include <bits/libc-header-start.h>
__BEGIN_DECLS
/* Get size_t and NULL from <stddef.h>. */
#define __need_size_t
#define __need_NULL
#include <stddef.h>
/* Tell the caller that we provide correct C++ prototypes. */
#if defined __cplusplus && (__GNUC_PREREQ (4, 4) \
|| __glibc_clang_prereq (3, 5))
# define __CORRECT_ISO_CPP_STRING_H_PROTO
#endif
/* Copy N bytes of SRC to DEST. */
extern void *memcpy (void *__restrict __dest, const void *__restrict __src,
size_t __n) __THROW __nonnull ((1, 2));
/* Copy N bytes of SRC to DEST, guaranteeing
correct behavior for overlapping strings. */
extern void *memmove (void *__dest, const void *__src, size_t __n)
__THROW __nonnull ((1, 2));
/* Copy no more than N bytes of SRC to DEST, stopping when C is found.
Return the position in DEST one byte past where C was copied,
or NULL if C was not found in the first N bytes of SRC. */
#if defined __USE_MISC || defined __USE_XOPEN || __GLIBC_USE (ISOC2X)
extern void *memccpy (void *__restrict __dest, const void *__restrict __src,
int __c, size_t __n)
__THROW __nonnull ((1, 2)) __attr_access ((__write_only__, 1, 4));
#endif /* Misc || X/Open. */
/* Set N bytes of S to C. */
extern void *memset (void *__s, int __c, size_t __n) __THROW __nonnull ((1));
/* Compare N bytes of S1 and S2. */
extern int memcmp (const void *__s1, const void *__s2, size_t __n)
__THROW __attribute_pure__ __nonnull ((1, 2));
/* Search N bytes of S for C. */
#ifdef __CORRECT_ISO_CPP_STRING_H_PROTO
extern "C++"
{
extern void *memchr (void *__s, int __c, size_t __n)
__THROW __asm ("memchr") __attribute_pure__ __nonnull ((1));
extern const void *memchr (const void *__s, int __c, size_t __n)
__THROW __asm ("memchr") __attribute_pure__ __nonnull ((1));
# ifdef __OPTIMIZE__
__extern_always_inline void *
memchr (void *__s, int __c, size_t __n) __THROW
{
return __builtin_memchr (__s, __c, __n);
}
__extern_always_inline const void *
memchr (const void *__s, int __c, size_t __n) __THROW
{
return __builtin_memchr (__s, __c, __n);
}
# endif
}
#else
extern void *memchr (const void *__s, int __c, size_t __n)
__THROW __attribute_pure__ __nonnull ((1));
#endif
#ifdef __USE_GNU
/* Search in S for C. This is similar to `memchr' but there is no
length limit. */
# ifdef __CORRECT_ISO_CPP_STRING_H_PROTO
extern "C++" void *rawmemchr (void *__s, int __c)
__THROW __asm ("rawmemchr") __attribute_pure__ __nonnull ((1));
extern "C++" const void *rawmemchr (const void *__s, int __c)
__THROW __asm ("rawmemchr") __attribute_pure__ __nonnull ((1));
# else
extern void *rawmemchr (const void *__s, int __c)
__THROW __attribute_pure__ __nonnull ((1));
# endif
/* Search N bytes of S for the final occurrence of C. */
# ifdef __CORRECT_ISO_CPP_STRING_H_PROTO
extern "C++" void *memrchr (void *__s, int __c, size_t __n)
__THROW __asm ("memrchr") __attribute_pure__ __nonnull ((1))
__attr_access ((__read_only__, 1, 3));
extern "C++" const void *memrchr (const void *__s, int __c, size_t __n)
__THROW __asm ("memrchr") __attribute_pure__ __nonnull ((1))
__attr_access ((__read_only__, 1, 3));
# else
extern void *memrchr (const void *__s, int __c, size_t __n)
__THROW __attribute_pure__ __nonnull ((1))
__attr_access ((__read_only__, 1, 3));
# endif
#endif
/* Copy SRC to DEST. */
extern char *strcpy (char *__restrict __dest, const char *__restrict __src)
__THROW __nonnull ((1, 2));
/* Copy no more than N characters of SRC to DEST. */
extern char *strncpy (char *__restrict __dest,
const char *__restrict __src, size_t __n)
__THROW __nonnull ((1, 2));
/* Append SRC onto DEST. */
extern char *strcat (char *__restrict __dest, const char *__restrict __src)
__THROW __nonnull ((1, 2));
/* Append no more than N characters from SRC onto DEST. */
extern char *strncat (char *__restrict __dest, const char *__restrict __src,
size_t __n) __THROW __nonnull ((1, 2));
/* Compare S1 and S2. */
extern int strcmp (const char *__s1, const char *__s2)
__THROW __attribute_pure__ __nonnull ((1, 2));
/* Compare N characters of S1 and S2. */
extern int strncmp (const char *__s1, const char *__s2, size_t __n)
__THROW __attribute_pure__ __nonnull ((1, 2));
/* Compare the collated forms of S1 and S2. */
extern int strcoll (const char *__s1, const char *__s2)
__THROW __attribute_pure__ __nonnull ((1, 2));
/* Put a transformation of SRC into no more than N bytes of DEST. */
extern size_t strxfrm (char *__restrict __dest,
const char *__restrict __src, size_t __n)
__THROW __nonnull ((2)) __attr_access ((__write_only__, 1, 3));
#ifdef __USE_XOPEN2K8
/* POSIX.1-2008 extended locale interface (see locale.h). */
# include <bits/types/locale_t.h>
/* Compare the collated forms of S1 and S2, using sorting rules from L. */
extern int strcoll_l (const char *__s1, const char *__s2, locale_t __l)
__THROW __attribute_pure__ __nonnull ((1, 2, 3));
/* Put a transformation of SRC into no more than N bytes of DEST,
using sorting rules from L. */
extern size_t strxfrm_l (char *__dest, const char *__src, size_t __n,
locale_t __l) __THROW __nonnull ((2, 4))
__attr_access ((__write_only__, 1, 3));
#endif
#if (defined __USE_XOPEN_EXTENDED || defined __USE_XOPEN2K8 \
|| __GLIBC_USE (LIB_EXT2) || __GLIBC_USE (ISOC2X))
/* Duplicate S, returning an identical malloc'd string. */
extern char *strdup (const char *__s)
__THROW __attribute_malloc__ __nonnull ((1));
#endif
/* Return a malloc'd copy of at most N bytes of STRING. The
resultant string is terminated even if no null terminator
appears before STRING[N]. */
#if defined __USE_XOPEN2K8 || __GLIBC_USE (LIB_EXT2) || __GLIBC_USE (ISOC2X)
extern char *strndup (const char *__string, size_t __n)
__THROW __attribute_malloc__ __nonnull ((1));
#endif
#if defined __USE_GNU && defined __GNUC__
/* Duplicate S, returning an identical alloca'd string. */
# define strdupa(s) \
(__extension__ \
({ \
const char *__old = (s); \
size_t __len = strlen (__old) + 1; \
char *__new = (char *) __builtin_alloca (__len); \
(char *) memcpy (__new, __old, __len); \
}))
/* Return an alloca'd copy of at most N bytes of string. */
# define strndupa(s, n) \
(__extension__ \
({ \
const char *__old = (s); \
size_t __len = strnlen (__old, (n)); \
char *__new = (char *) __builtin_alloca (__len + 1); \
__new[__len] = '\0'; \
(char *) memcpy (__new, __old, __len); \
}))
#endif
/* Find the first occurrence of C in S. */
#ifdef __CORRECT_ISO_CPP_STRING_H_PROTO
extern "C++"
{
extern char *strchr (char *__s, int __c)
__THROW __asm ("strchr") __attribute_pure__ __nonnull ((1));
extern const char *strchr (const char *__s, int __c)
__THROW __asm ("strchr") __attribute_pure__ __nonnull ((1));
# ifdef __OPTIMIZE__
__extern_always_inline char *
strchr (char *__s, int __c) __THROW
{
return __builtin_strchr (__s, __c);
}
__extern_always_inline const char *
strchr (const char *__s, int __c) __THROW
{
return __builtin_strchr (__s, __c);
}
# endif
}
#else
extern char *strchr (const char *__s, int __c)
__THROW __attribute_pure__ __nonnull ((1));
#endif
/* Find the last occurrence of C in S. */
#ifdef __CORRECT_ISO_CPP_STRING_H_PROTO
extern "C++"
{
extern char *strrchr (char *__s, int __c)
__THROW __asm ("strrchr") __attribute_pure__ __nonnull ((1));
extern const char *strrchr (const char *__s, int __c)
__THROW __asm ("strrchr") __attribute_pure__ __nonnull ((1));
# ifdef __OPTIMIZE__
__extern_always_inline char *
strrchr (char *__s, int __c) __THROW
{
return __builtin_strrchr (__s, __c);
}
__extern_always_inline const char *
strrchr (const char *__s, int __c) __THROW
{
return __builtin_strrchr (__s, __c);
}
# endif
}
#else
extern char *strrchr (const char *__s, int __c)
__THROW __attribute_pure__ __nonnull ((1));
#endif
#ifdef __USE_GNU
/* This function is similar to `strchr'. But it returns a pointer to
the closing NUL byte in case C is not found in S. */
# ifdef __CORRECT_ISO_CPP_STRING_H_PROTO
extern "C++" char *strchrnul (char *__s, int __c)
__THROW __asm ("strchrnul") __attribute_pure__ __nonnull ((1));
extern "C++" const char *strchrnul (const char *__s, int __c)
__THROW __asm ("strchrnul") __attribute_pure__ __nonnull ((1));
# else
extern char *strchrnul (const char *__s, int __c)
__THROW __attribute_pure__ __nonnull ((1));
# endif
#endif
/* Return the length of the initial segment of S which
consists entirely of characters not in REJECT. */
extern size_t strcspn (const char *__s, const char *__reject)
__THROW __attribute_pure__ __nonnull ((1, 2));
/* Return the length of the initial segment of S which
consists entirely of characters in ACCEPT. */
extern size_t strspn (const char *__s, const char *__accept)
__THROW __attribute_pure__ __nonnull ((1, 2));
/* Find the first occurrence in S of any character in ACCEPT. */
#ifdef __CORRECT_ISO_CPP_STRING_H_PROTO
extern "C++"
{
extern char *strpbrk (char *__s, const char *__accept)
__THROW __asm ("strpbrk") __attribute_pure__ __nonnull ((1, 2));
extern const char *strpbrk (const char *__s, const char *__accept)
__THROW __asm ("strpbrk") __attribute_pure__ __nonnull ((1, 2));
# ifdef __OPTIMIZE__
__extern_always_inline char *
strpbrk (char *__s, const char *__accept) __THROW
{
return __builtin_strpbrk (__s, __accept);
}
__extern_always_inline const char *
strpbrk (const char *__s, const char *__accept) __THROW
{
return __builtin_strpbrk (__s, __accept);
}
# endif
}
#else
extern char *strpbrk (const char *__s, const char *__accept)
__THROW __attribute_pure__ __nonnull ((1, 2));
#endif
/* Find the first occurrence of NEEDLE in HAYSTACK. */
#ifdef __CORRECT_ISO_CPP_STRING_H_PROTO
extern "C++"
{
extern char *strstr (char *__haystack, const char *__needle)
__THROW __asm ("strstr") __attribute_pure__ __nonnull ((1, 2));
extern const char *strstr (const char *__haystack, const char *__needle)
__THROW __asm ("strstr") __attribute_pure__ __nonnull ((1, 2));
# ifdef __OPTIMIZE__
__extern_always_inline char *
strstr (char *__haystack, const char *__needle) __THROW
{
return __builtin_strstr (__haystack, __needle);
}
__extern_always_inline const char *
strstr (const char *__haystack, const char *__needle) __THROW
{
return __builtin_strstr (__haystack, __needle);
}
# endif
}
#else
extern char *strstr (const char *__haystack, const char *__needle)
__THROW __attribute_pure__ __nonnull ((1, 2));
#endif
/* Divide S into tokens separated by characters in DELIM. */
extern char *strtok (char *__restrict __s, const char *__restrict __delim)
__THROW __nonnull ((2));
/* Divide S into tokens separated by characters in DELIM. Information
passed between calls are stored in SAVE_PTR. */
extern char *__strtok_r (char *__restrict __s,
const char *__restrict __delim,
char **__restrict __save_ptr)
__THROW __nonnull ((2, 3));
#ifdef __USE_POSIX
extern char *strtok_r (char *__restrict __s, const char *__restrict __delim,
char **__restrict __save_ptr)
__THROW __nonnull ((2, 3));
#endif
#ifdef __USE_GNU
/* Similar to `strstr' but this function ignores the case of both strings. */
# ifdef __CORRECT_ISO_CPP_STRING_H_PROTO
extern "C++" char *strcasestr (char *__haystack, const char *__needle)
__THROW __asm ("strcasestr") __attribute_pure__ __nonnull ((1, 2));
extern "C++" const char *strcasestr (const char *__haystack,
const char *__needle)
__THROW __asm ("strcasestr") __attribute_pure__ __nonnull ((1, 2));
# else
extern char *strcasestr (const char *__haystack, const char *__needle)
__THROW __attribute_pure__ __nonnull ((1, 2));
# endif
#endif
#ifdef __USE_GNU
/* Find the first occurrence of NEEDLE in HAYSTACK.
NEEDLE is NEEDLELEN bytes long;
HAYSTACK is HAYSTACKLEN bytes long. */
extern void *memmem (const void *__haystack, size_t __haystacklen,
const void *__needle, size_t __needlelen)
__THROW __attribute_pure__ __nonnull ((1, 3))
__attr_access ((__read_only__, 1, 2))
__attr_access ((__read_only__, 3, 4));
/* Copy N bytes of SRC to DEST, return pointer to bytes after the
last written byte. */
extern void *__mempcpy (void *__restrict __dest,
const void *__restrict __src, size_t __n)
__THROW __nonnull ((1, 2));
extern void *mempcpy (void *__restrict __dest,
const void *__restrict __src, size_t __n)
__THROW __nonnull ((1, 2));
#endif
/* Return the length of S. */
extern size_t strlen (const char *__s)
__THROW __attribute_pure__ __nonnull ((1));
#ifdef __USE_XOPEN2K8
/* Find the length of STRING, but scan at most MAXLEN characters.
If no '\0' terminator is found in that many characters, return MAXLEN. */
extern size_t strnlen (const char *__string, size_t __maxlen)
__THROW __attribute_pure__ __nonnull ((1));
#endif
/* Return a string describing the meaning of the `errno' code in ERRNUM. */
extern char *strerror (int __errnum) __THROW;
#ifdef __USE_XOPEN2K
/* Reentrant version of `strerror'.
There are 2 flavors of `strerror_r', GNU which returns the string
and may or may not use the supplied temporary buffer and POSIX one
which fills the string into the buffer.
To use the POSIX version, -D_XOPEN_SOURCE=600 or -D_POSIX_C_SOURCE=200112L
without -D_GNU_SOURCE is needed, otherwise the GNU version is
preferred. */
# if defined __USE_XOPEN2K && !defined __USE_GNU
/* Fill BUF with a string describing the meaning of the `errno' code in
ERRNUM. */
# ifdef __REDIRECT_NTH
extern int __REDIRECT_NTH (strerror_r,
(int __errnum, char *__buf, size_t __buflen),
__xpg_strerror_r) __nonnull ((2))
__attr_access ((__write_only__, 2, 3));
# else
extern int __xpg_strerror_r (int __errnum, char *__buf, size_t __buflen)
__THROW __nonnull ((2)) __attr_access ((__write_only__, 2, 3));
# define strerror_r __xpg_strerror_r
# endif
# else
/* If a temporary buffer is required, at most BUFLEN bytes of BUF will be
used. */
extern char *strerror_r (int __errnum, char *__buf, size_t __buflen)
__THROW __nonnull ((2)) __wur __attr_access ((__write_only__, 2, 3));
# endif
# ifdef __USE_GNU
/* Return a string describing the meaning of tthe error in ERR. */
extern const char *strerrordesc_np (int __err) __THROW;
/* Return a string with the error name in ERR. */
extern const char *strerrorname_np (int __err) __THROW;
# endif
#endif
#ifdef __USE_XOPEN2K8
/* Translate error number to string according to the locale L. */
extern char *strerror_l (int __errnum, locale_t __l) __THROW;
#endif
#ifdef __USE_MISC
# include <strings.h>
/* Set N bytes of S to 0. The compiler will not delete a call to this
function, even if S is dead after the call. */
extern void explicit_bzero (void *__s, size_t __n) __THROW __nonnull ((1))
__fortified_attr_access (__write_only__, 1, 2);
/* Return the next DELIM-delimited token from *STRINGP,
terminating it with a '\0', and update *STRINGP to point past it. */
extern char *strsep (char **__restrict __stringp,
const char *__restrict __delim)
__THROW __nonnull ((1, 2));
#endif
#ifdef __USE_XOPEN2K8
/* Return a string describing the meaning of the signal number in SIG. */
extern char *strsignal (int __sig) __THROW;
# ifdef __USE_GNU
/* Return an abbreviation string for the signal number SIG. */
extern const char *sigabbrev_np (int __sig) __THROW;
/* Return a string describing the meaning of the signal number in SIG,
the result is not translated. */
extern const char *sigdescr_np (int __sig) __THROW;
# endif
/* Copy SRC to DEST, returning the address of the terminating '\0' in DEST. */
extern char *__stpcpy (char *__restrict __dest, const char *__restrict __src)
__THROW __nonnull ((1, 2));
extern char *stpcpy (char *__restrict __dest, const char *__restrict __src)
__THROW __nonnull ((1, 2));
/* Copy no more than N characters of SRC to DEST, returning the address of
the last character written into DEST. */
extern char *__stpncpy (char *__restrict __dest,
const char *__restrict __src, size_t __n)
__THROW __nonnull ((1, 2));
extern char *stpncpy (char *__restrict __dest,
const char *__restrict __src, size_t __n)
__THROW __nonnull ((1, 2));
#endif
#ifdef __USE_GNU
/* Compare S1 and S2 as strings holding name & indices/version numbers. */
extern int strverscmp (const char *__s1, const char *__s2)
__THROW __attribute_pure__ __nonnull ((1, 2));
/* Sautee STRING briskly. */
extern char *strfry (char *__string) __THROW __nonnull ((1));
/* Frobnicate N bytes of S. */
extern void *memfrob (void *__s, size_t __n) __THROW __nonnull ((1))
__attr_access ((__write_only__, 1, 2));
# ifndef basename
/* Return the file name within directory of FILENAME. We don't
declare the function if the `basename' macro is available (defined
in <libgen.h>) which makes the XPG version of this function
available. */
# ifdef __CORRECT_ISO_CPP_STRING_H_PROTO
extern "C++" char *basename (char *__filename)
__THROW __asm ("basename") __nonnull ((1));
extern "C++" const char *basename (const char *__filename)
__THROW __asm ("basename") __nonnull ((1));
# else
extern char *basename (const char *__filename) __THROW __nonnull ((1));
# endif
# endif
#endif
#if __GNUC_PREREQ (3,4)
# if __USE_FORTIFY_LEVEL > 0 && defined __fortify_function
/* Functions with security checks. */
# include <bits/string_fortified.h>
# endif
#endif
__END_DECLS
#endif /* string.h */