xref: /freebsd/contrib/libarchive/libarchive/test/test_archive_string_conversion_overread.c (revision 185becb1e1bd2657c156f78aeb52edac05ba5fb5)
1 /*-
2  * Copyright (c) 2026 Kaif Khan
3  * All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  *
14  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR(S) ``AS IS'' AND ANY EXPRESS OR
15  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
16  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
17  * IN NO EVENT SHALL THE AUTHOR(S) BE LIABLE FOR ANY DIRECT, INDIRECT,
18  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
19  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
20  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
21  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
22  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
23  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
24  */
25 #include "test.h"
26 
27 #define __LIBARCHIVE_TEST
28 #include "archive_string.h"
29 
30 /*
31  * archive_strncpy_l() passes a pointer and a byte count to the string
32  * conversion converter and does not require the buffer to be NUL
33  * terminated: the readers hand it a __archive_read_ahead() window sized
34  * exactly to the field length (mbsnbytes() returns that length when no
35  * NUL is present).  The best-effort converter must therefore stop after
36  * the declared number of bytes.
37  *
38  * Requesting a conversion from a charset iconv cannot open selects
39  * best_effort_strncat_in_locale() with sc->same == 0.  If a platform's
40  * iconv unexpectedly accepts the name the conversion still succeeds and
41  * the assertions hold, so this never yields a false failure.
42  */
DEFINE_TEST(test_archive_string_conversion_overread)43 DEFINE_TEST(test_archive_string_conversion_overread)
44 {
45 	struct archive *a;
46 	struct archive_string_conv *sc;
47 
48 	assert((a = archive_read_new()) != NULL);
49 	sc = archive_string_conversion_from_charset(a, "NO-SUCH-CHARSET-8859", 1);
50 	assert(sc != NULL);
51 
52 	/*
53 	 * The buffer declares 8 bytes but is followed by 4 more non-NUL
54 	 * bytes and then a NUL.  A converter that honors the declared length
55 	 * copies 8 bytes; the over-read walks on to the NUL and copies 12.
56 	 */
57 	{
58 		struct archive_string as;
59 		static const char data[] = "AAAAAAAABBBB"; /* 8 + 4, then NUL */
60 
61 		archive_string_init(&as);
62 		assertEqualInt(0, archive_strncpy_l(&as, data, 8, sc));
63 		assertEqualInt(8, (int)as.length);
64 		assertEqualMem(as.s, "AAAAAAAA", 8);
65 		archive_string_free(&as);
66 	}
67 
68 	/*
69 	 * Exact-length heap buffer with no trailing NUL: any read past the
70 	 * end is out of bounds and observable to AddressSanitizer.
71 	 */
72 	{
73 		struct archive_string as;
74 		size_t n = 8;
75 		char *buf = malloc(n);
76 
77 		assert(buf != NULL);
78 		memset(buf, 'A', n);
79 		archive_string_init(&as);
80 		assertEqualInt(0, archive_strncpy_l(&as, buf, n, sc)); /* must not read buf[n] */
81 		assertEqualInt(8, (int)as.length);
82 		archive_string_free(&as);
83 		free(buf);
84 	}
85 
86 	assertEqualInt(ARCHIVE_OK, archive_read_free(a));
87 }
88