[COMMITTED] Add test case for bug 17079
diff mbox

Message ID 56014E46.9050108@redhat.com
State New
Headers show

Commit Message

Florian Weimer Sept. 22, 2015, 12:49 p.m. UTC
Unfortunately, the initial commit had the wrong bug number.

I checked that the new test fails without the fix from bug 17079, and
passes on master.  It runs reasonably quickly even under valgrind.

Patch
diff mbox

From 90fa42a1d7b78de0d75f7e3af362275b2abe807f Mon Sep 17 00:00:00 2001
Message-Id: <90fa42a1d7b78de0d75f7e3af362275b2abe807f.1442925971.git.fweimer@redhat.com>
In-Reply-To: <cover.1442925971.git.fweimer@redhat.com>
References: <cover.1442925971.git.fweimer@redhat.com>
From: Florian Weimer <fweimer@redhat.com>
Date: Tue, 22 Sep 2015 13:40:17 +0200
Subject: [PATCH 2/2] Test in commit e07aabba73ea62e7dfa0512507c92efb851fbdbe
 is for bug 17079
To: libc-alpha@sourceware.org

---
 ChangeLog      |   5 ++
 nss/Makefile   |   2 +-
 nss/bug17079.c | 236 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++
 nss/bug18287.c | 235 --------------------------------------------------------
 4 files changed, 242 insertions(+), 236 deletions(-)
 create mode 100644 nss/bug17079.c
 delete mode 100644 nss/bug18287.c

diff --git a/ChangeLog b/ChangeLog
index 29d0d51..f3dbabc 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,10 @@ 
 2015-09-22  Florian Weimer  <fweimer@redhat.com>
 
+	* nss/bug17079.c: Renamed from nss/bug18287.c.  Add description.
+	* nss/Makefile (tests): Update.
+
+2015-09-22  Florian Weimer  <fweimer@redhat.com>
+
 	* nss/bug18287.c: New file.
 	* nss/Makefile (tests): Add bug18287.
 
diff --git a/nss/Makefile b/nss/Makefile
index f6ef912..02a5016 100644
--- a/nss/Makefile
+++ b/nss/Makefile
@@ -48,7 +48,7 @@  makedb-modules = xmalloc hash-string
 extra-objs		+= $(makedb-modules:=.o)
 
 tests			= test-netdb tst-nss-test1 test-digits-dots \
-			  tst-nss-getpwent bug18287
+			  tst-nss-getpwent bug17079
 xtests			= bug-erange
 
 # Specify rules for the nss_* modules.  We have some services.
diff --git a/nss/bug17079.c b/nss/bug17079.c
new file mode 100644
index 0000000..9846737
--- /dev/null
+++ b/nss/bug17079.c
@@ -0,0 +1,236 @@ 
+/* Test for bug 17079: heap overflow in NSS with small buffers.
+   Copyright (C) 2015 Free Software Foundation, Inc.
+   This file is part of the GNU C Library.
+
+   The GNU C Library is free software; you can redistribute it and/or
+   modify it under the terms of the GNU Lesser General Public
+   License as published by the Free Software Foundation; either
+   version 2.1 of the License, or (at your option) any later version.
+
+   The GNU C Library is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   Lesser General Public License for more details.
+
+   You should have received a copy of the GNU Lesser General Public
+   License along with the GNU C Library; if not, see
+   <http://www.gnu.org/licenses/>.  */
+
+#include <errno.h>
+#include <pwd.h>
+#include <stdbool.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+/* Check if two passwd structs contain the same data.  */
+static bool
+equal (const struct passwd *a, const struct passwd *b)
+{
+  return strcmp (a->pw_name, b->pw_name) == 0
+    && strcmp (a->pw_passwd, b->pw_passwd) == 0
+    && a->pw_uid == b->pw_uid
+    && a->pw_gid == b->pw_gid
+    && strcmp (a->pw_gecos, b->pw_gecos) == 0
+    && strcmp (a->pw_dir, b->pw_dir) == 0
+    && strcmp (a->pw_shell, b->pw_shell) == 0;
+}
+
+enum { MAX_TEST_ITEMS = 10 };
+static struct passwd test_items[MAX_TEST_ITEMS];
+static int test_count;
+
+/* Initialize test_items and test_count above, with data from the
+   passwd database.  */
+static bool
+init_test_items (void)
+{
+  setpwent ();
+  do
+    {
+      struct passwd *pwd = getpwent ();
+      if (pwd == NULL)
+        break;
+      struct passwd *target = test_items + test_count;
+      target->pw_name = strdup (pwd->pw_name);
+      target->pw_passwd = strdup (pwd->pw_passwd);
+      target->pw_uid = pwd->pw_uid;
+      target->pw_gid = pwd->pw_gid;
+      target->pw_gecos = strdup (pwd->pw_gecos);
+      target->pw_dir = strdup (pwd->pw_dir);
+      target->pw_shell = strdup (pwd->pw_shell);
+    }
+  while (++test_count < MAX_TEST_ITEMS);
+  endpwent ();
+
+  /* Filter out those test items which cannot be looked up by name or
+     UID.  */
+  bool found = false;
+  for (int i = 0; i < test_count; ++i)
+    {
+      struct passwd *pwd1 = getpwnam (test_items[i].pw_name);
+      struct passwd *pwd2 = getpwuid (test_items[i].pw_uid);
+      if (pwd1 == NULL || !equal (pwd1, test_items + i)
+          || pwd2 == NULL || !equal (pwd2, test_items + i))
+        test_items[i].pw_name = NULL;
+      else
+        found = true;
+    }
+
+  if (!found)
+    puts ("error: no accounts found which can be looked up by name and UID.");
+  return found;
+}
+
+/* Set to true if an error is encountered.  */
+static bool errors;
+
+/* Return true if the padding has not been tampered with.  */
+static bool
+check_padding (char *buffer, size_t size, char pad)
+{
+  char *end = buffer + size;
+  while (buffer < end)
+    {
+      if (*buffer != pad)
+        return false;
+      ++buffer;
+    }
+  return true;
+}
+
+/* Test one buffer size and padding combination.  */
+static void
+test_one (const struct passwd *item, size_t buffer_size,
+           char pad, size_t padding_size)
+{
+  char *buffer = malloc (buffer_size + padding_size);
+  if (buffer == NULL)
+    {
+      puts ("error: malloc failure");
+      errors = true;
+      return;
+    }
+
+  struct passwd pwd;
+  struct passwd *result;
+  int ret;
+
+  /* Test getpwname_r.  */
+  memset (buffer, pad, buffer_size + padding_size);
+  pwd = (struct passwd) {};
+  ret = getpwnam_r (item->pw_name, &pwd, buffer, buffer_size, &result);
+  if (!check_padding (buffer + buffer_size, padding_size, pad))
+    {
+      printf ("error: padding change: "
+              "name \"%s\", buffer size %zu, padding size %zu, pad 0x%02x\n",
+              item->pw_name, buffer_size, padding_size, (unsigned char) pad);
+      errors = true;
+    }
+  if (ret == 0)
+    {
+      if (result == NULL)
+        {
+          printf ("error: no data: name \"%s\", buffer size %zu\n",
+                  item->pw_name, buffer_size);
+          errors = true;
+        }
+      else if (!equal (item, result))
+        {
+          printf ("error: lookup mismatch: name \"%s\", buffer size %zu\n",
+                  item->pw_name, buffer_size);
+          errors = true;
+        }
+    }
+  else if (ret != ERANGE)
+    {
+      errno = ret;
+      printf ("error: lookup failure for name \"%s\": %m (%d)\n",
+              item->pw_name, ret);
+      errors = true;
+    }
+
+  /* Test getpwuid_r.  */
+  memset (buffer, pad, buffer_size + padding_size);
+  pwd = (struct passwd) {};
+  ret = getpwuid_r (item->pw_uid, &pwd, buffer, buffer_size, &result);
+  if (!check_padding (buffer + buffer_size, padding_size, pad))
+    {
+      printf ("error: padding change: "
+              "UID %ld, buffer size %zu, padding size %zu, pad 0x%02x\n",
+              (long) item->pw_uid, buffer_size, padding_size,
+              (unsigned char) pad);
+      errors = true;
+    }
+  if (ret == 0)
+    {
+      if (result == NULL)
+        {
+          printf ("error: no data: UID %ld, buffer size %zu\n",
+                  (long) item->pw_uid, buffer_size);
+          errors = true;
+        }
+      else if (!equal (item, result))
+        {
+          printf ("error: lookup mismatch: UID %ld, buffer size %zu\n",
+                  (long) item->pw_uid, buffer_size);
+          errors = true;
+        }
+    }
+  else if (ret != ERANGE)
+    {
+      errno = ret;
+      printf ("error: lookup failure for UID \"%ld\": %m (%d)\n",
+              (long) item->pw_uid, ret);
+      errors = true;
+    }
+
+  free (buffer);
+}
+
+/* Test one buffer size with different paddings.  */
+static void
+test_buffer_size (size_t buffer_size)
+{
+  for (int i = 0; i < test_count; ++i)
+    for (size_t padding_size = 0; padding_size < 3; ++padding_size)
+      {
+        test_one (test_items + i, buffer_size, '\0', padding_size);
+        if (padding_size > 0)
+          {
+            test_one (test_items + i, buffer_size, ':', padding_size);
+            test_one (test_items + i, buffer_size, '\n', padding_size);
+            test_one (test_items + i, buffer_size, '\xff', padding_size);
+            test_one (test_items + i, buffer_size, '@', padding_size);
+          }
+      }
+}
+
+int
+do_test (void)
+{
+  if (!init_test_items ())
+    return 1;
+  printf ("info: %d test items\n", test_count);
+
+  for (size_t buffer_size = 0; buffer_size <= 65; ++buffer_size)
+    test_buffer_size (buffer_size);
+  for (size_t buffer_size = 64 + 4; buffer_size < 256; buffer_size += 4)
+    test_buffer_size (buffer_size);
+  test_buffer_size (255);
+  test_buffer_size (257);
+  for (size_t buffer_size = 256; buffer_size < 512; buffer_size += 8)
+    test_buffer_size (buffer_size);
+  test_buffer_size (511);
+  test_buffer_size (513);
+  test_buffer_size (1024);
+  test_buffer_size (2048);
+
+  if (errors)
+    return 1;
+  else
+    return 0;
+}
+
+#define TEST_FUNCTION do_test ()
+#include "../test-skeleton.c"
diff --git a/nss/bug18287.c b/nss/bug18287.c
deleted file mode 100644
index 57abab0..0000000
--- a/nss/bug18287.c
+++ /dev/null
@@ -1,235 +0,0 @@ 
-/* Copyright (C) 2015 Free Software Foundation, Inc.
-   This file is part of the GNU C Library.
-
-   The GNU C Library is free software; you can redistribute it and/or
-   modify it under the terms of the GNU Lesser General Public
-   License as published by the Free Software Foundation; either
-   version 2.1 of the License, or (at your option) any later version.
-
-   The GNU C Library is distributed in the hope that it will be useful,
-   but WITHOUT ANY WARRANTY; without even the implied warranty of
-   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-   Lesser General Public License for more details.
-
-   You should have received a copy of the GNU Lesser General Public
-   License along with the GNU C Library; if not, see
-   <http://www.gnu.org/licenses/>.  */
-
-#include <errno.h>
-#include <pwd.h>
-#include <stdbool.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-
-/* Check if two passwd structs contain the same data.  */
-static bool
-equal (const struct passwd *a, const struct passwd *b)
-{
-  return strcmp (a->pw_name, b->pw_name) == 0
-    && strcmp (a->pw_passwd, b->pw_passwd) == 0
-    && a->pw_uid == b->pw_uid
-    && a->pw_gid == b->pw_gid
-    && strcmp (a->pw_gecos, b->pw_gecos) == 0
-    && strcmp (a->pw_dir, b->pw_dir) == 0
-    && strcmp (a->pw_shell, b->pw_shell) == 0;
-}
-
-enum { MAX_TEST_ITEMS = 10 };
-static struct passwd test_items[MAX_TEST_ITEMS];
-static int test_count;
-
-/* Initialize test_items and test_count above, with data from the
-   passwd database.  */
-static bool
-init_test_items (void)
-{
-  setpwent ();
-  do
-    {
-      struct passwd *pwd = getpwent ();
-      if (pwd == NULL)
-        break;
-      struct passwd *target = test_items + test_count;
-      target->pw_name = strdup (pwd->pw_name);
-      target->pw_passwd = strdup (pwd->pw_passwd);
-      target->pw_uid = pwd->pw_uid;
-      target->pw_gid = pwd->pw_gid;
-      target->pw_gecos = strdup (pwd->pw_gecos);
-      target->pw_dir = strdup (pwd->pw_dir);
-      target->pw_shell = strdup (pwd->pw_shell);
-    }
-  while (++test_count < MAX_TEST_ITEMS);
-  endpwent ();
-
-  /* Filter out those test items which cannot be looked up by name or
-     UID.  */
-  bool found = false;
-  for (int i = 0; i < test_count; ++i)
-    {
-      struct passwd *pwd1 = getpwnam (test_items[i].pw_name);
-      struct passwd *pwd2 = getpwuid (test_items[i].pw_uid);
-      if (pwd1 == NULL || !equal (pwd1, test_items + i)
-          || pwd2 == NULL || !equal (pwd2, test_items + i))
-        test_items[i].pw_name = NULL;
-      else
-        found = true;
-    }
-
-  if (!found)
-    puts ("error: no accounts found which can be looked up by name and UID.");
-  return found;
-}
-
-/* Set to true if an error is encountered.  */
-static bool errors;
-
-/* Return true if the padding has not been tampered with.  */
-static bool
-check_padding (char *buffer, size_t size, char pad)
-{
-  char *end = buffer + size;
-  while (buffer < end)
-    {
-      if (*buffer != pad)
-        return false;
-      ++buffer;
-    }
-  return true;
-}
-
-/* Test one buffer size and padding combination.  */
-static void
-test_one (const struct passwd *item, size_t buffer_size,
-           char pad, size_t padding_size)
-{
-  char *buffer = malloc (buffer_size + padding_size);
-  if (buffer == NULL)
-    {
-      puts ("error: malloc failure");
-      errors = true;
-      return;
-    }
-
-  struct passwd pwd;
-  struct passwd *result;
-  int ret;
-
-  /* Test getpwname_r.  */
-  memset (buffer, pad, buffer_size + padding_size);
-  pwd = (struct passwd) {};
-  ret = getpwnam_r (item->pw_name, &pwd, buffer, buffer_size, &result);
-  if (!check_padding (buffer + buffer_size, padding_size, pad))
-    {
-      printf ("error: padding change: "
-              "name \"%s\", buffer size %zu, padding size %zu, pad 0x%02x\n",
-              item->pw_name, buffer_size, padding_size, (unsigned char) pad);
-      errors = true;
-    }
-  if (ret == 0)
-    {
-      if (result == NULL)
-        {
-          printf ("error: no data: name \"%s\", buffer size %zu\n",
-                  item->pw_name, buffer_size);
-          errors = true;
-        }
-      else if (!equal (item, result))
-        {
-          printf ("error: lookup mismatch: name \"%s\", buffer size %zu\n",
-                  item->pw_name, buffer_size);
-          errors = true;
-        }
-    }
-  else if (ret != ERANGE)
-    {
-      errno = ret;
-      printf ("error: lookup failure for name \"%s\": %m (%d)\n",
-              item->pw_name, ret);
-      errors = true;
-    }
-
-  /* Test getpwuid_r.  */
-  memset (buffer, pad, buffer_size + padding_size);
-  pwd = (struct passwd) {};
-  ret = getpwuid_r (item->pw_uid, &pwd, buffer, buffer_size, &result);
-  if (!check_padding (buffer + buffer_size, padding_size, pad))
-    {
-      printf ("error: padding change: "
-              "UID %ld, buffer size %zu, padding size %zu, pad 0x%02x\n",
-              (long) item->pw_uid, buffer_size, padding_size,
-              (unsigned char) pad);
-      errors = true;
-    }
-  if (ret == 0)
-    {
-      if (result == NULL)
-        {
-          printf ("error: no data: UID %ld, buffer size %zu\n",
-                  (long) item->pw_uid, buffer_size);
-          errors = true;
-        }
-      else if (!equal (item, result))
-        {
-          printf ("error: lookup mismatch: UID %ld, buffer size %zu\n",
-                  (long) item->pw_uid, buffer_size);
-          errors = true;
-        }
-    }
-  else if (ret != ERANGE)
-    {
-      errno = ret;
-      printf ("error: lookup failure for UID \"%ld\": %m (%d)\n",
-              (long) item->pw_uid, ret);
-      errors = true;
-    }
-
-  free (buffer);
-}
-
-/* Test one buffer size with different paddings.  */
-static void
-test_buffer_size (size_t buffer_size)
-{
-  for (int i = 0; i < test_count; ++i)
-    for (size_t padding_size = 0; padding_size < 3; ++padding_size)
-      {
-        test_one (test_items + i, buffer_size, '\0', padding_size);
-        if (padding_size > 0)
-          {
-            test_one (test_items + i, buffer_size, ':', padding_size);
-            test_one (test_items + i, buffer_size, '\n', padding_size);
-            test_one (test_items + i, buffer_size, '\xff', padding_size);
-            test_one (test_items + i, buffer_size, '@', padding_size);
-          }
-      }
-}
-
-int
-do_test (void)
-{
-  if (!init_test_items ())
-    return 1;
-  printf ("info: %d test items\n", test_count);
-
-  for (size_t buffer_size = 0; buffer_size <= 65; ++buffer_size)
-    test_buffer_size (buffer_size);
-  for (size_t buffer_size = 64 + 4; buffer_size < 256; buffer_size += 4)
-    test_buffer_size (buffer_size);
-  test_buffer_size (255);
-  test_buffer_size (257);
-  for (size_t buffer_size = 256; buffer_size < 512; buffer_size += 8)
-    test_buffer_size (buffer_size);
-  test_buffer_size (511);
-  test_buffer_size (513);
-  test_buffer_size (1024);
-  test_buffer_size (2048);
-
-  if (errors)
-    return 1;
-  else
-    return 0;
-}
-
-#define TEST_FUNCTION do_test ()
-#include "../test-skeleton.c"
-- 
2.4.3