From patchwork Mon Sep 9 19:46:22 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Tulio Magno Quites Machado Filho X-Patchwork-Id: 1982758 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=ascii.art.br header.i=@ascii.art.br header.a=rsa-sha256 header.s=dreamhost header.b=Xif02lBd; dkim-atps=neutral Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=sourceware.org (client-ip=2620:52:3:1:0:246e:9693:128c; helo=server2.sourceware.org; envelope-from=libc-alpha-bounces~incoming=patchwork.ozlabs.org@sourceware.org; receiver=patchwork.ozlabs.org) Received: from server2.sourceware.org (server2.sourceware.org [IPv6:2620:52:3:1:0:246e:9693:128c]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (secp384r1) server-digest SHA384) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4X2cns1ZHmz1y1l for ; Tue, 10 Sep 2024 05:48:16 +1000 (AEST) Received: from server2.sourceware.org (localhost [IPv6:::1]) by sourceware.org (Postfix) with ESMTP id 5423A3858C53 for ; Mon, 9 Sep 2024 19:48:14 +0000 (GMT) X-Original-To: libc-alpha@sourceware.org Delivered-To: libc-alpha@sourceware.org Received: from dormouse.elm.relay.mailchannels.net (dormouse.elm.relay.mailchannels.net [23.83.212.50]) by sourceware.org (Postfix) with ESMTPS id 4B8E73858C41 for ; Mon, 9 Sep 2024 19:47:52 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org 4B8E73858C41 Authentication-Results: sourceware.org; dmarc=pass (p=none dis=none) header.from=ascii.art.br Authentication-Results: sourceware.org; spf=pass smtp.mailfrom=ascii.art.br ARC-Filter: OpenARC Filter v1.0.0 sourceware.org 4B8E73858C41 Authentication-Results: server2.sourceware.org; arc=pass smtp.remote-ip=23.83.212.50 ARC-Seal: i=2; a=rsa-sha256; d=sourceware.org; s=key; t=1725911274; cv=pass; b=HWVMLFW6HkNb2LQ6AtJa5qTIzh2JdJUJ2UfuR98J60VpED7g+UJY9gCvAlNQJxfN8T6oBTsmHdaoNFNes3/7ab7XPN4Jjh3ik68V2SmjGpu9fS3+xkyYvh+v8Xud86J9e2RG5+Sozn4aO0tU2uaqN6YGIS2KWufaCZlUZcV+32k= ARC-Message-Signature: i=2; a=rsa-sha256; d=sourceware.org; s=key; t=1725911274; c=relaxed/simple; bh=ouAkRaZNjkjSMsvPyMPeqCOEaTMX1cgCKXx2oyh4I9c=; h=DKIM-Signature:From:To:Subject:Date:Message-ID:MIME-Version; b=c4Di9Jr4mEaK1a3fxQV+4KfOmCzZZqkD7xOMQTblPIVR4ea5e2u8MUa/oC7SHdgg7WEw+WNUAQYbl4Z2+LmmKyI7WNVgNMNJvsHPUuLQ48PgdSKbrjRqMap03t4ALQ8l0Pp1hk7qzijLwhQspO7agvqYgLBesFkAzLC0YoPzUQg= ARC-Authentication-Results: i=2; server2.sourceware.org X-Sender-Id: dreamhost|x-authsender|tuliom@ascii.art.br Received: from relay.mailchannels.net (localhost [127.0.0.1]) by relay.mailchannels.net (Postfix) with ESMTP id 37ACD24869; Mon, 9 Sep 2024 19:47:51 +0000 (UTC) Received: from pdx1-sub0-mail-a206.dreamhost.com (trex-5.trex.outbound.svc.cluster.local [100.96.73.164]) (Authenticated sender: dreamhost) by relay.mailchannels.net (Postfix) with ESMTPA id D0AA6255A2; Mon, 9 Sep 2024 19:47:50 +0000 (UTC) ARC-Seal: i=1; s=arc-2022; d=mailchannels.net; t=1725911270; a=rsa-sha256; cv=none; b=PwzRQ4TTU74ML3ZDjM46m4C7J5ESFz++XSHBwtBajFLGeAoLZLS2MEpiTvPo+FCWsYp5MB 5BweD6z2NW3uzot5OiUQbmluleXk2WFbRPw5MWiiIwvQDG79MZLBMiVMGtT1fwPP2OpD7s Q9OakVi/e3xaFWT2gcdNod8wQ04t/n/XsAeBjojKIp+UUbJ9RkH1tvMPcPC/+CuW+W4xM4 U249F0k3ftB1IbqETEq9/A3YkK/A3DFwyQGeuoy4GRYC0mngbt5idty2dvAN9dEXapKag9 6ImGRkq3cvtw31krpFqSsJHDS0klFKBBGuT5GNaSVTNG7ooJgyBAlYLlcW/ROQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=mailchannels.net; s=arc-2022; t=1725911270; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding:dkim-signature; bh=y8f9xj49Wj+n/4XGmKp0F71iAONfdkWOeeDN9NasuAM=; b=f/kTuz/owACWGSO5TIwYekC3r/nFQE+5L3Qv6sr2F09qqTjufsHwk0XRBOauR5Y0yFXzuK GS7arwsHayL+UOSwfwP81wanNH5vKYdIEKpxU+8eXuYoxebp6tBvl/zIiy8cj9H60/tin8 t1Cc6a21PORNAz/Rn3CvBYcMRUygxbo9Q4ukohANijNxlc+1SeAV28ajYf+TrZBSwVBp8R 031zFkaHq8Lu/pU7ZQFtjC6+LGtriwj+ka3II9TTB81wI4UgmwAZ1yGRhoitlOPoREy9rC N0wBe6U5NptiQfk62/RNJ0I4UF0VXn3z2Z4R/A1AJSmlzix6skIaLS7m8dLjyw== ARC-Authentication-Results: i=1; rspamd-77766c4bb8-t2tjj; auth=pass smtp.auth=dreamhost smtp.mailfrom=tuliom@ascii.art.br X-Sender-Id: dreamhost|x-authsender|tuliom@ascii.art.br X-MC-Relay: Neutral X-MailChannels-SenderId: dreamhost|x-authsender|tuliom@ascii.art.br X-MailChannels-Auth-Id: dreamhost X-Whistle-Blushing: 7befec53178b50b9_1725911271067_1445104251 X-MC-Loop-Signature: 1725911271067:381372912 X-MC-Ingress-Time: 1725911271066 Received: from pdx1-sub0-mail-a206.dreamhost.com (pop.dreamhost.com [64.90.62.162]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384) by 100.96.73.164 (trex/7.0.2); Mon, 09 Sep 2024 19:47:51 +0000 Received: from ascii.art.br (ip-191-5-85-185.isp.valenet.com.br [191.5.85.185]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) (Authenticated sender: tuliom@ascii.art.br) by pdx1-sub0-mail-a206.dreamhost.com (Postfix) with ESMTPSA id 4X2cnL2cJrz1l; Mon, 9 Sep 2024 12:47:50 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ascii.art.br; s=dreamhost; t=1725911270; bh=y8f9xj49Wj+n/4XGmKp0F71iAONfdkWOeeDN9NasuAM=; h=From:To:Cc:Subject:Date:Content-Transfer-Encoding; b=Xif02lBd463+3hRUIOP4qUheDvIsDACJ8Z8WF96bcWppzh+fAwHdMeKCxL3aYyiR0 wqNDUmXd0pY+22yIQ6aK0Q/TtAJhAb5/kfrTrMD62xyhsHynvsaKFuDKG7HK69S9ig YJmvdnTLOk5zwWtg7hTseu7z/F49d7CWJKsGfnevBwz9cqznd+xtC24XVYx+0e+UA+ Qdxs02c1CXeobS9baeq4xoRsoWP7dgOtCFcTfyo9y1K5mgbXD/39ZqCWO8vcMi8M3t 94J+S8eYeYTqdR3DCgS2NpDw+9SU9Vo1yS9M5BfG0MUOpKLkog6mgzDf+k+vzz31+x mfBeywDGvY7hw== From: Tulio Magno Quites Machado Filho To: libc-alpha@sourceware.org Cc: Carlos O'Donell Subject: [PATCH] Add a new fwrite test that exercises buffer overflow Date: Mon, 9 Sep 2024 16:46:22 -0300 Message-ID: <20240909194622.2565139-1-tuliom@ascii.art.br> X-Mailer: git-send-email 2.46.0 MIME-Version: 1.0 X-Spam-Status: No, score=-4.2 required=5.0 tests=BAYES_00, DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, DKIM_VALID_EF, GIT_PATCH_0, KAM_SHORT, RCVD_IN_ABUSEAT, RCVD_IN_BARRACUDACENTRAL, RCVD_IN_DNSWL_NONE, RCVD_IN_MSPIKE_H4, RCVD_IN_MSPIKE_WL, RCVD_IN_SBL_CSS, SPF_HELO_NONE, SPF_PASS, TXREP autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on server2.sourceware.org X-BeenThere: libc-alpha@sourceware.org X-Mailman-Version: 2.1.30 Precedence: list List-Id: Libc-alpha mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: libc-alpha-bounces~incoming=patchwork.ozlabs.org@sourceware.org From: Tulio Magno Quites Machado Filho Exercises fwrite's internal buffer when doing a file operation. The new test, exercises 2 overflow behaviors: 1. Call fwrite multiple times making usage of fwrite's internal buffer. The total number of bytes written is larger than fwrite's internal buffer, forcing an automatic flush. 2. Call fwrite a single time with an amount of data that is larger than fwrite's internal buffer. Reviewed-by: Carlos O'Donell --- stdio-common/Makefile | 1 + stdio-common/tst-fwrite-overflow.c | 123 +++++++++++++++++++++++++++++ 2 files changed, 124 insertions(+) create mode 100644 stdio-common/tst-fwrite-overflow.c diff --git a/stdio-common/Makefile b/stdio-common/Makefile index ce7f7cdd3b..a0e2753418 100644 --- a/stdio-common/Makefile +++ b/stdio-common/Makefile @@ -224,6 +224,7 @@ tests := \ tst-fseek \ tst-fwrite \ tst-fwrite-memstrm \ + tst-fwrite-overflow \ tst-fwrite-ro \ tst-getline \ tst-getline-enomem \ diff --git a/stdio-common/tst-fwrite-overflow.c b/stdio-common/tst-fwrite-overflow.c new file mode 100644 index 0000000000..1516e4cd0a --- /dev/null +++ b/stdio-common/tst-fwrite-overflow.c @@ -0,0 +1,123 @@ +/* Test the overflow of fwrite's internal buffer. + Copyright (C) 2024 Free Software Foundation, Inc. + This file is part of the GNU C Library. + + The GNU C Library is free software; you can redistribute it and/or + modify it under the terms of the GNU Lesser General Public + License as published by the Free Software Foundation; either + version 2.1 of the License, or (at your option) any later version. + + The GNU C Library is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + Lesser General Public License for more details. + + You should have received a copy of the GNU Lesser General Public + License along with the GNU C Library; if not, see + . */ + +/* stdio.h provides BUFSIZ, which is the size of fwrite's internal buffer. */ +#include +#include +#include +#include +#include +#include +#include + +/* Length of the buffers in bytes. */ +#define RWBUF_SIZE 2 * BUFSIZ + +void +test_one_rw (const char *in, size_t nmemb, size_t block) +{ + int fd; + FILE *f; + char *out; + size_t written, to_write; + + printf ("Testing with nmemb = %zd, block = %zd\n", nmemb, block); + + TEST_VERIFY_EXIT (nmemb <= RWBUF_SIZE); + /* Ensure fwrite's internal buffer will overflow. */ + TEST_VERIFY_EXIT (nmemb > BUFSIZ); + + /* Create a temporary file and open it for reading and writing. */ + fd = create_temp_file ("tst-fwrite-overflow", NULL); + TEST_VERIFY_EXIT (fd != -1); + f = fdopen (fd, "w+"); + TEST_VERIFY_EXIT (f != NULL); + + /* Call fwrite() as many times as needed, until all data is written, + limiting the amount of data written per call to block bytes. */ + for (written = 0; written < nmemb; written += to_write) + { + if (written + block <= nmemb) + { + to_write = block; + } + else + { + to_write = nmemb - written; + } + /* Check if fwrite() returns the expected value. No errors are + expected. */ + TEST_COMPARE (fwrite (in + written, 1, to_write, f), to_write); + TEST_COMPARE (ferror (f), 0); + } + + /* Ensure all the data is flushed to file. */ + TEST_COMPARE (fflush (f), 0); + + /* We have to check if the contents in the file are correct. Go back to + the beginning of the file. */ + rewind (f); + /* Try to allocate a buffer and save the contents of the generated file to + it. */ + out = malloc (RWBUF_SIZE); + TEST_VERIFY_EXIT (out != NULL); + TEST_COMPARE (fread (out, 1, nmemb, f), nmemb); + + /* Ensure the output has the expected contents. */ + TEST_COMPARE (memcmp (out, in, nmemb), 0); + + xfclose (f); + free (out); +} + +static int +do_test (void) +{ + char * in; + int i, j; + size_t nmemb[] = {BUFSIZ + 1, RWBUF_SIZE, 0}; + /* Maximum number of bytes written for each fwrite call. */ + size_t block[] = {100, 1024, 2047, 0}; + /* The largest block must fit entirely in fwrite's buffer. */ + _Static_assert (2047 < BUFSIZ, + "a block must fit in fwrite's internal buffer"); + + in = malloc (RWBUF_SIZE); + TEST_VERIFY_EXIT (in != NULL); + for (i = 0; i < RWBUF_SIZE / 2; i++) + in[i] = i % 0xff; + + for (i = 0; nmemb[i] != 0; i++) + { + for (j = 0; block[j] != 0; j++) + { + /* Run a test with an array of nmemb bytes. Write at most block + bytes per fwrite call. */ + test_one_rw (in, nmemb[i], block[j]); + } + /* Run a test that overflows fwrite's internal buffer in a single call. + This call should not use the buffer and should be written directly + to the file. */ + test_one_rw (in, nmemb[i], nmemb[i]); + } + + free (in); + return 0; +} + +#include