1 /*-
2 * Copyright (c) 2009 David Schultz <das@FreeBSD.org>
3 * Copyright (c) 2023, 2024 The FreeBSD Foundation
4 * All rights reserved.
5 *
6 * Portions of this software were developed by Robert Clausecker
7 * <fuz@FreeBSD.org> under sponsorship from the FreeBSD Foundation.
8 *
9 * Redistribution and use in source and binary forms, with or without
10 * modification, are permitted provided that the following conditions
11 * are met:
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
14 * 2. Redistributions in binary form must reproduce the above copyright
15 * notice, this list of conditions and the following disclaimer in the
16 * documentation and/or other materials provided with the distribution.
17 *
18 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
19 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
20 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
21 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
22 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
23 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
24 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
25 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
26 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
27 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
28 * SUCH DAMAGE.
29 */
30
31 #include <sys/cdefs.h>
32 #include <sys/param.h>
33 #include <sys/mman.h>
34 #include <assert.h>
35 #include <dlfcn.h>
36 #include <limits.h>
37 #include <stdio.h>
38 #include <stdlib.h>
39 #include <string.h>
40
41 #include <atf-c.h>
42
43 void *(*memccpy_fn)(void *restrict, const void *restrict, int, size_t);
44
45 static char *
makebuf(size_t len,int guard_at_end)46 makebuf(size_t len, int guard_at_end)
47 {
48 char *buf;
49 size_t alloc_size, page_size;
50
51 page_size = getpagesize();
52 alloc_size = roundup2(len, page_size) + page_size;
53
54 buf = mmap(NULL, alloc_size, PROT_READ | PROT_WRITE, MAP_ANON, -1, 0);
55 assert(buf);
56 if (guard_at_end) {
57 assert(mprotect(buf + alloc_size - page_size, page_size, PROT_NONE) == 0);
58 return (buf + alloc_size - page_size - len);
59 } else {
60 assert(mprotect(buf, page_size, PROT_NONE) == 0);
61 return (buf + page_size);
62 }
63 }
64
65 static void
freebuf(char * buf,size_t len,int guard_at_end)66 freebuf(char * buf, size_t len, int guard_at_end)
67 {
68 size_t alloc_size, page_size;
69
70 page_size = getpagesize();
71 alloc_size = roundup2(len, page_size) + page_size;
72
73 if (guard_at_end)
74 munmap(buf + len + page_size - alloc_size, alloc_size);
75 else
76 munmap(buf - page_size, alloc_size);
77 }
78
79 static void
test_memccpy(const char * s,size_t size)80 test_memccpy(const char *s, size_t size)
81 {
82 char *src, *dst, *expected;
83 size_t bufsize, x;
84 int i, j;
85
86 for (i = 0; i <= 1; i++) {
87 for (j = 0; j <= 1; j++) {
88 for (bufsize = 0; bufsize <= size + 32; bufsize++) {
89 dst = makebuf(bufsize, j);
90 if (bufsize < size) {
91 src = makebuf(bufsize, i);
92 memcpy(src, s, bufsize);
93 expected = NULL;
94 } else {
95 src = makebuf(size, i);
96 memcpy(src, s, size);
97 expected = dst + size;
98 }
99
100 memset(dst, 'X', bufsize);
101 assert(memccpy_fn(dst, src, s[size-1], bufsize) == expected);
102 assert(memcmp(src, dst, MIN(bufsize, size)) == 0);
103 for (x = size; x < bufsize; x++)
104 assert(dst[x] == 'X');
105
106 freebuf(dst, bufsize, j);
107 freebuf(src, bufsize < size ? bufsize : size, i);
108 }
109 }
110 }
111 }
112
113 static void
test_sentinel(char * dest,char * src,size_t destlen,size_t srclen)114 test_sentinel(char *dest, char *src, size_t destlen, size_t srclen)
115 {
116 size_t i, effective_len;
117 void *res, *wantres;
118 const char *fail = NULL;
119 char terminator;
120
121 for (i = 0; i < srclen; i++)
122 /* src will never include (){} */
123 src[i] = '0' + i;
124
125 /* source sentinels: not to be copied */
126 src[-1] = '(';
127 src[srclen] = ')';
128
129 memset(dest, '\xee', destlen);
130
131 /* destination sentinels: not to be touched */
132 dest[-1] = '{';
133 dest[destlen] = '}';
134
135 effective_len = srclen < destlen ? srclen : destlen;
136 wantres = srclen <= destlen ? dest + srclen : NULL;
137 terminator = src[srclen-1];
138 res = memccpy_fn(dest, src, terminator, destlen);
139
140 if (dest[-1] != '{')
141 fail = "start sentinel overwritten";
142 else if (dest[destlen] != '}')
143 fail = "end sentinel overwritten";
144 else if (res != wantres)
145 fail = "incorrect return value";
146 else if (destlen > 0 && memcmp(src, dest, effective_len) != 0)
147 fail = "string not copied correctly";
148 else for (i = srclen; i < destlen; i++)
149 if (dest[i] != '\xee') {
150 fail = "buffer mutilated behind string";
151 break;
152 }
153
154 if (fail)
155 atf_tc_fail_nonfatal("%s\n"
156 "memccpy(%p \"%s\", %p \"%s\", %u '%c', %zu) = %p (want %p)\n",
157 fail, dest, dest, src, src, terminator, terminator, destlen, res, wantres);
158 }
159
160 ATF_TC_WITHOUT_HEAD(null);
ATF_TC_BODY(null,tc)161 ATF_TC_BODY(null, tc)
162 {
163 ATF_CHECK_EQ(memccpy_fn(NULL, "foo", 42, 0), NULL);
164 }
165
166 ATF_TC(zero_extension);
ATF_TC_HEAD(zero_extension,tc)167 ATF_TC_HEAD(zero_extension, tc)
168 {
169 atf_tc_set_md_var(tc, "descr",
170 "Ensure the upper bits of the terminator are ignored");
171 }
ATF_TC_BODY(zero_extension,tc)172 ATF_TC_BODY(zero_extension, tc)
173 {
174 int mask = -1 & ~UCHAR_MAX;
175 char buf[16];
176
177 memset(buf, 0xcc, sizeof(buf));
178 ATF_CHECK_EQ(memccpy(buf, "foobar", 'r', sizeof(buf)), buf + sizeof("foobar") - 1);
179 ATF_CHECK_EQ(memcmp(buf, "foobar", sizeof("foobar") - 1), 0);
180
181 memset(buf, 0xcc, sizeof(buf));
182 ATF_CHECK_EQ(memccpy(buf, "foobar", mask | 'r', sizeof(buf)), buf + sizeof("foobar") - 1);
183 ATF_CHECK_EQ(memcmp(buf, "foobar", sizeof("foobar") - 1), 0);
184 }
185
186 ATF_TC_WITHOUT_HEAD(bounds);
ATF_TC_BODY(bounds,tc)187 ATF_TC_BODY(bounds, tc)
188 {
189 size_t i;
190 char buf[64];
191
192 for (i = 0; i < sizeof(buf) - 1; i++) {
193 buf[i] = ' ' + i;
194 buf[i+1] = '\0';
195 test_memccpy(buf, i + 1);
196 }
197 }
198
199 ATF_TC_WITHOUT_HEAD(alignments);
ATF_TC_BODY(alignments,tc)200 ATF_TC_BODY(alignments, tc)
201 {
202 size_t srcalign, destalign, srclen, destlen;
203 char src[15+2+64]; /* 15 offsets + 64 max length + sentinels */
204 char dest[15+2+64]; /* 15 offsets + 64 max length + sentinels */
205
206 for (srcalign = 0; srcalign < 16; srcalign++)
207 for (destalign = 0; destalign < 16; destalign++)
208 for (srclen = 1; srclen < 64; srclen++)
209 for (destlen = 0; destlen < 64; destlen++)
210 test_sentinel(dest+destalign+1,
211 src+srcalign+1, destlen, srclen);
212 }
213
ATF_TP_ADD_TCS(tp)214 ATF_TP_ADD_TCS(tp)
215 {
216 void *dl_handle;
217
218 dl_handle = dlopen(NULL, RTLD_LAZY);
219 memccpy_fn = dlsym(dl_handle, "test_memccpy");
220 if (memccpy_fn == NULL)
221 memccpy_fn = memccpy;
222
223 ATF_TP_ADD_TC(tp, null);
224 ATF_TP_ADD_TC(tp, zero_extension);
225 ATF_TP_ADD_TC(tp, bounds);
226 ATF_TP_ADD_TC(tp, alignments);
227
228 return (atf_no_error());
229 }
230