xref: /freebsd/lib/libc/tests/secure/fortify_stdio_test.c (revision 5b56413d04e608379c9a306373554a8e4d321bc0)
1 /* @generated by `generate-fortify-tests.lua "stdio"` */
2 
3 #define	_FORTIFY_SOURCE	2
4 #define	TMPFILE_SIZE	(1024 * 32)
5 
6 #include <sys/param.h>
7 #include <sys/random.h>
8 #include <sys/resource.h>
9 #include <sys/select.h>
10 #include <sys/socket.h>
11 #include <sys/time.h>
12 #include <sys/uio.h>
13 #include <sys/wait.h>
14 #include <dirent.h>
15 #include <errno.h>
16 #include <fcntl.h>
17 #include <limits.h>
18 #include <poll.h>
19 #include <signal.h>
20 #include <stdio.h>
21 #include <stdlib.h>
22 #include <string.h>
23 #include <strings.h>
24 #include <sysexits.h>
25 #include <unistd.h>
26 #include <wchar.h>
27 #include <atf-c.h>
28 
29 static FILE * __unused
30 new_fp(size_t __len)
31 {
32 	static char fpbuf[LINE_MAX];
33 	FILE *fp;
34 
35 	ATF_REQUIRE(__len <= sizeof(fpbuf));
36 
37 	memset(fpbuf, 'A', sizeof(fpbuf) - 1);
38 	fpbuf[sizeof(fpbuf) - 1] = '\0';
39 
40 	fp = fmemopen(fpbuf, sizeof(fpbuf), "rb");
41 	ATF_REQUIRE(fp != NULL);
42 
43 	return (fp);
44 }
45 
46 /*
47  * Create a new symlink to use for readlink(2) style tests, we'll just use a
48  * random target name to have something interesting to look at.
49  */
50 static const char * __unused
51 new_symlink(size_t __len)
52 {
53 	static const char linkname[] = "link";
54 	char target[MAXNAMLEN];
55 	int error;
56 
57 	ATF_REQUIRE(__len <= sizeof(target));
58 
59 	arc4random_buf(target, sizeof(target));
60 
61 	error = unlink(linkname);
62 	ATF_REQUIRE(error == 0 || errno == ENOENT);
63 
64 	error = symlink(target, linkname);
65 	ATF_REQUIRE(error == 0);
66 
67 	return (linkname);
68 }
69 
70 /*
71  * For our purposes, first descriptor will be the reader; we'll send both
72  * raw data and a control message over it so that the result can be used for
73  * any of our recv*() tests.
74  */
75 static void __unused
76 new_socket(int sock[2])
77 {
78 	unsigned char ctrl[CMSG_SPACE(sizeof(int))] = { 0 };
79 	static char sockbuf[256];
80 	ssize_t rv;
81 	size_t total = 0;
82 	struct msghdr hdr = { 0 };
83 	struct cmsghdr *cmsg;
84 	int error, fd;
85 
86 	error = socketpair(AF_UNIX, SOCK_STREAM, 0, sock);
87 	ATF_REQUIRE(error == 0);
88 
89 	while (total != sizeof(sockbuf)) {
90 		rv = send(sock[1], &sockbuf[total], sizeof(sockbuf) - total, 0);
91 
92 		ATF_REQUIRE_MSG(rv > 0,
93 		    "expected bytes sent, got %zd with %zu left (size %zu, total %zu)",
94 		    rv, sizeof(sockbuf) - total, sizeof(sockbuf), total);
95 		ATF_REQUIRE_MSG(total + (size_t)rv <= sizeof(sockbuf),
96 		    "%zd exceeds total %zu", rv, sizeof(sockbuf));
97 		total += rv;
98 	}
99 
100 	hdr.msg_control = ctrl;
101 	hdr.msg_controllen = sizeof(ctrl);
102 
103 	cmsg = CMSG_FIRSTHDR(&hdr);
104 	cmsg->cmsg_level = SOL_SOCKET;
105 	cmsg->cmsg_type = SCM_RIGHTS;
106 	cmsg->cmsg_len = CMSG_LEN(sizeof(fd));
107 	fd = STDIN_FILENO;
108 	memcpy(CMSG_DATA(cmsg), &fd, sizeof(fd));
109 
110 	error = sendmsg(sock[1], &hdr, 0);
111 	ATF_REQUIRE(error != -1);
112 }
113 
114 /*
115  * Constructs a tmpfile that we can use for testing read(2) and friends.
116  */
117 static int __unused
118 new_tmpfile(void)
119 {
120 	char buf[1024];
121 	ssize_t rv;
122 	size_t written;
123 	int fd;
124 
125 	fd = open("tmpfile", O_RDWR | O_CREAT | O_TRUNC, 0644);
126 	ATF_REQUIRE(fd >= 0);
127 
128 	written = 0;
129 	while (written < TMPFILE_SIZE) {
130 		rv = write(fd, buf, sizeof(buf));
131 		ATF_REQUIRE(rv > 0);
132 
133 		written += rv;
134 	}
135 
136 	ATF_REQUIRE_EQ(0, lseek(fd, 0, SEEK_SET));
137 	return (fd);
138 }
139 
140 static void
141 disable_coredumps(void)
142 {
143 	struct rlimit rl = { 0 };
144 
145 	if (setrlimit(RLIMIT_CORE, &rl) == -1)
146 		_exit(EX_OSERR);
147 }
148 
149 /*
150  * Replaces stdin with a file that we can actually read from, for tests where
151  * we want a FILE * or fd that we can get data from.
152  */
153 static void __unused
154 replace_stdin(void)
155 {
156 	int fd;
157 
158 	fd = new_tmpfile();
159 
160 	(void)dup2(fd, STDIN_FILENO);
161 	if (fd != STDIN_FILENO)
162 		close(fd);
163 }
164 
165 ATF_TC_WITHOUT_HEAD(ctermid_before_end);
166 ATF_TC_BODY(ctermid_before_end, tc)
167 {
168 #define BUF &__stack.__buf
169 	struct {
170 		uint8_t padding_l;
171 		unsigned char __buf[L_ctermid + 1];
172 		uint8_t padding_r;
173 	} __stack;
174 	const size_t __bufsz __unused = sizeof(__stack.__buf);
175 	const size_t __len = L_ctermid + 1;
176 	const size_t __idx __unused = __len - 1;
177 
178 	ctermid(__stack.__buf);
179 #undef BUF
180 
181 }
182 
183 ATF_TC_WITHOUT_HEAD(ctermid_end);
184 ATF_TC_BODY(ctermid_end, tc)
185 {
186 #define BUF &__stack.__buf
187 	struct {
188 		uint8_t padding_l;
189 		unsigned char __buf[L_ctermid];
190 		uint8_t padding_r;
191 	} __stack;
192 	const size_t __bufsz __unused = sizeof(__stack.__buf);
193 	const size_t __len = L_ctermid;
194 	const size_t __idx __unused = __len - 1;
195 
196 	ctermid(__stack.__buf);
197 #undef BUF
198 
199 }
200 
201 ATF_TC_WITHOUT_HEAD(ctermid_heap_before_end);
202 ATF_TC_BODY(ctermid_heap_before_end, tc)
203 {
204 #define BUF __stack.__buf
205 	struct {
206 		uint8_t padding_l;
207 		unsigned char * __buf;
208 		uint8_t padding_r;
209 	} __stack;
210 	const size_t __bufsz __unused = sizeof(*__stack.__buf) * (L_ctermid + 1);
211 	const size_t __len = L_ctermid + 1;
212 	const size_t __idx __unused = __len - 1;
213 
214 	__stack.__buf = malloc(__bufsz);
215 
216 	ctermid(__stack.__buf);
217 #undef BUF
218 
219 }
220 
221 ATF_TC_WITHOUT_HEAD(ctermid_heap_end);
222 ATF_TC_BODY(ctermid_heap_end, tc)
223 {
224 #define BUF __stack.__buf
225 	struct {
226 		uint8_t padding_l;
227 		unsigned char * __buf;
228 		uint8_t padding_r;
229 	} __stack;
230 	const size_t __bufsz __unused = sizeof(*__stack.__buf) * (L_ctermid);
231 	const size_t __len = L_ctermid;
232 	const size_t __idx __unused = __len - 1;
233 
234 	__stack.__buf = malloc(__bufsz);
235 
236 	ctermid(__stack.__buf);
237 #undef BUF
238 
239 }
240 
241 ATF_TC_WITHOUT_HEAD(ctermid_heap_after_end);
242 ATF_TC_BODY(ctermid_heap_after_end, tc)
243 {
244 #define BUF __stack.__buf
245 	struct {
246 		uint8_t padding_l;
247 		unsigned char * __buf;
248 		uint8_t padding_r;
249 	} __stack;
250 	const size_t __bufsz __unused = sizeof(*__stack.__buf) * (L_ctermid - 1);
251 	const size_t __len = L_ctermid - 1;
252 	const size_t __idx __unused = __len - 1;
253 	pid_t __child;
254 	int __status;
255 
256 	__child = fork();
257 	ATF_REQUIRE(__child >= 0);
258 	if (__child > 0)
259 		goto monitor;
260 
261 	/* Child */
262 	disable_coredumps();
263 	__stack.__buf = malloc(__bufsz);
264 
265 	ctermid(__stack.__buf);
266 	_exit(EX_SOFTWARE);	/* Should have aborted. */
267 
268 monitor:
269 	while (waitpid(__child, &__status, 0) != __child) {
270 		ATF_REQUIRE_EQ(EINTR, errno);
271 	}
272 
273 	if (!WIFSIGNALED(__status)) {
274 		switch (WEXITSTATUS(__status)) {
275 		case EX_SOFTWARE:
276 			atf_tc_fail("FORTIFY_SOURCE failed to abort");
277 			break;
278 		case EX_OSERR:
279 			atf_tc_fail("setrlimit(2) failed");
280 			break;
281 		default:
282 			atf_tc_fail("child exited with status %d",
283 			    WEXITSTATUS(__status));
284 		}
285 	} else {
286 		ATF_REQUIRE_EQ(SIGABRT, WTERMSIG(__status));
287 	}
288 #undef BUF
289 
290 }
291 
292 ATF_TC_WITHOUT_HEAD(ctermid_r_before_end);
293 ATF_TC_BODY(ctermid_r_before_end, tc)
294 {
295 #define BUF &__stack.__buf
296 	struct {
297 		uint8_t padding_l;
298 		unsigned char __buf[L_ctermid + 1];
299 		uint8_t padding_r;
300 	} __stack;
301 	const size_t __bufsz __unused = sizeof(__stack.__buf);
302 	const size_t __len = L_ctermid + 1;
303 	const size_t __idx __unused = __len - 1;
304 
305 	ctermid_r(__stack.__buf);
306 #undef BUF
307 
308 }
309 
310 ATF_TC_WITHOUT_HEAD(ctermid_r_end);
311 ATF_TC_BODY(ctermid_r_end, tc)
312 {
313 #define BUF &__stack.__buf
314 	struct {
315 		uint8_t padding_l;
316 		unsigned char __buf[L_ctermid];
317 		uint8_t padding_r;
318 	} __stack;
319 	const size_t __bufsz __unused = sizeof(__stack.__buf);
320 	const size_t __len = L_ctermid;
321 	const size_t __idx __unused = __len - 1;
322 
323 	ctermid_r(__stack.__buf);
324 #undef BUF
325 
326 }
327 
328 ATF_TC_WITHOUT_HEAD(ctermid_r_heap_before_end);
329 ATF_TC_BODY(ctermid_r_heap_before_end, tc)
330 {
331 #define BUF __stack.__buf
332 	struct {
333 		uint8_t padding_l;
334 		unsigned char * __buf;
335 		uint8_t padding_r;
336 	} __stack;
337 	const size_t __bufsz __unused = sizeof(*__stack.__buf) * (L_ctermid + 1);
338 	const size_t __len = L_ctermid + 1;
339 	const size_t __idx __unused = __len - 1;
340 
341 	__stack.__buf = malloc(__bufsz);
342 
343 	ctermid_r(__stack.__buf);
344 #undef BUF
345 
346 }
347 
348 ATF_TC_WITHOUT_HEAD(ctermid_r_heap_end);
349 ATF_TC_BODY(ctermid_r_heap_end, tc)
350 {
351 #define BUF __stack.__buf
352 	struct {
353 		uint8_t padding_l;
354 		unsigned char * __buf;
355 		uint8_t padding_r;
356 	} __stack;
357 	const size_t __bufsz __unused = sizeof(*__stack.__buf) * (L_ctermid);
358 	const size_t __len = L_ctermid;
359 	const size_t __idx __unused = __len - 1;
360 
361 	__stack.__buf = malloc(__bufsz);
362 
363 	ctermid_r(__stack.__buf);
364 #undef BUF
365 
366 }
367 
368 ATF_TC_WITHOUT_HEAD(ctermid_r_heap_after_end);
369 ATF_TC_BODY(ctermid_r_heap_after_end, tc)
370 {
371 #define BUF __stack.__buf
372 	struct {
373 		uint8_t padding_l;
374 		unsigned char * __buf;
375 		uint8_t padding_r;
376 	} __stack;
377 	const size_t __bufsz __unused = sizeof(*__stack.__buf) * (L_ctermid - 1);
378 	const size_t __len = L_ctermid - 1;
379 	const size_t __idx __unused = __len - 1;
380 	pid_t __child;
381 	int __status;
382 
383 	__child = fork();
384 	ATF_REQUIRE(__child >= 0);
385 	if (__child > 0)
386 		goto monitor;
387 
388 	/* Child */
389 	disable_coredumps();
390 	__stack.__buf = malloc(__bufsz);
391 
392 	ctermid_r(__stack.__buf);
393 	_exit(EX_SOFTWARE);	/* Should have aborted. */
394 
395 monitor:
396 	while (waitpid(__child, &__status, 0) != __child) {
397 		ATF_REQUIRE_EQ(EINTR, errno);
398 	}
399 
400 	if (!WIFSIGNALED(__status)) {
401 		switch (WEXITSTATUS(__status)) {
402 		case EX_SOFTWARE:
403 			atf_tc_fail("FORTIFY_SOURCE failed to abort");
404 			break;
405 		case EX_OSERR:
406 			atf_tc_fail("setrlimit(2) failed");
407 			break;
408 		default:
409 			atf_tc_fail("child exited with status %d",
410 			    WEXITSTATUS(__status));
411 		}
412 	} else {
413 		ATF_REQUIRE_EQ(SIGABRT, WTERMSIG(__status));
414 	}
415 #undef BUF
416 
417 }
418 
419 ATF_TC_WITHOUT_HEAD(fread_before_end);
420 ATF_TC_BODY(fread_before_end, tc)
421 {
422 #define BUF &__stack.__buf
423 	struct {
424 		uint8_t padding_l;
425 		unsigned char __buf[42];
426 		uint8_t padding_r;
427 	} __stack;
428 	const size_t __bufsz __unused = sizeof(__stack.__buf);
429 	const size_t __len = 42 - 1;
430 	const size_t __idx __unused = __len - 1;
431 
432 	replace_stdin();
433 
434 	fread(__stack.__buf, __len, 1, stdin);
435 #undef BUF
436 
437 }
438 
439 ATF_TC_WITHOUT_HEAD(fread_end);
440 ATF_TC_BODY(fread_end, tc)
441 {
442 #define BUF &__stack.__buf
443 	struct {
444 		uint8_t padding_l;
445 		unsigned char __buf[42];
446 		uint8_t padding_r;
447 	} __stack;
448 	const size_t __bufsz __unused = sizeof(__stack.__buf);
449 	const size_t __len = 42;
450 	const size_t __idx __unused = __len - 1;
451 
452 	replace_stdin();
453 
454 	fread(__stack.__buf, __len, 1, stdin);
455 #undef BUF
456 
457 }
458 
459 ATF_TC_WITHOUT_HEAD(fread_heap_before_end);
460 ATF_TC_BODY(fread_heap_before_end, tc)
461 {
462 #define BUF __stack.__buf
463 	struct {
464 		uint8_t padding_l;
465 		unsigned char * __buf;
466 		uint8_t padding_r;
467 	} __stack;
468 	const size_t __bufsz __unused = sizeof(*__stack.__buf) * (42);
469 	const size_t __len = 42 - 1;
470 	const size_t __idx __unused = __len - 1;
471 
472 	__stack.__buf = malloc(__bufsz);
473 	replace_stdin();
474 
475 	fread(__stack.__buf, __len, 1, stdin);
476 #undef BUF
477 
478 }
479 
480 ATF_TC_WITHOUT_HEAD(fread_heap_end);
481 ATF_TC_BODY(fread_heap_end, tc)
482 {
483 #define BUF __stack.__buf
484 	struct {
485 		uint8_t padding_l;
486 		unsigned char * __buf;
487 		uint8_t padding_r;
488 	} __stack;
489 	const size_t __bufsz __unused = sizeof(*__stack.__buf) * (42);
490 	const size_t __len = 42;
491 	const size_t __idx __unused = __len - 1;
492 
493 	__stack.__buf = malloc(__bufsz);
494 	replace_stdin();
495 
496 	fread(__stack.__buf, __len, 1, stdin);
497 #undef BUF
498 
499 }
500 
501 ATF_TC_WITHOUT_HEAD(fread_heap_after_end);
502 ATF_TC_BODY(fread_heap_after_end, tc)
503 {
504 #define BUF __stack.__buf
505 	struct {
506 		uint8_t padding_l;
507 		unsigned char * __buf;
508 		uint8_t padding_r;
509 	} __stack;
510 	const size_t __bufsz __unused = sizeof(*__stack.__buf) * (42);
511 	const size_t __len = 42 + 1;
512 	const size_t __idx __unused = __len - 1;
513 	pid_t __child;
514 	int __status;
515 
516 	__child = fork();
517 	ATF_REQUIRE(__child >= 0);
518 	if (__child > 0)
519 		goto monitor;
520 
521 	/* Child */
522 	disable_coredumps();
523 	__stack.__buf = malloc(__bufsz);
524 	replace_stdin();
525 
526 	fread(__stack.__buf, __len, 1, stdin);
527 	_exit(EX_SOFTWARE);	/* Should have aborted. */
528 
529 monitor:
530 	while (waitpid(__child, &__status, 0) != __child) {
531 		ATF_REQUIRE_EQ(EINTR, errno);
532 	}
533 
534 	if (!WIFSIGNALED(__status)) {
535 		switch (WEXITSTATUS(__status)) {
536 		case EX_SOFTWARE:
537 			atf_tc_fail("FORTIFY_SOURCE failed to abort");
538 			break;
539 		case EX_OSERR:
540 			atf_tc_fail("setrlimit(2) failed");
541 			break;
542 		default:
543 			atf_tc_fail("child exited with status %d",
544 			    WEXITSTATUS(__status));
545 		}
546 	} else {
547 		ATF_REQUIRE_EQ(SIGABRT, WTERMSIG(__status));
548 	}
549 #undef BUF
550 
551 }
552 
553 ATF_TC_WITHOUT_HEAD(fread_unlocked_before_end);
554 ATF_TC_BODY(fread_unlocked_before_end, tc)
555 {
556 #define BUF &__stack.__buf
557 	struct {
558 		uint8_t padding_l;
559 		unsigned char __buf[42];
560 		uint8_t padding_r;
561 	} __stack;
562 	const size_t __bufsz __unused = sizeof(__stack.__buf);
563 	const size_t __len = 42 - 1;
564 	const size_t __idx __unused = __len - 1;
565 
566 	replace_stdin();
567 
568 	fread_unlocked(__stack.__buf, __len, 1, stdin);
569 #undef BUF
570 
571 }
572 
573 ATF_TC_WITHOUT_HEAD(fread_unlocked_end);
574 ATF_TC_BODY(fread_unlocked_end, tc)
575 {
576 #define BUF &__stack.__buf
577 	struct {
578 		uint8_t padding_l;
579 		unsigned char __buf[42];
580 		uint8_t padding_r;
581 	} __stack;
582 	const size_t __bufsz __unused = sizeof(__stack.__buf);
583 	const size_t __len = 42;
584 	const size_t __idx __unused = __len - 1;
585 
586 	replace_stdin();
587 
588 	fread_unlocked(__stack.__buf, __len, 1, stdin);
589 #undef BUF
590 
591 }
592 
593 ATF_TC_WITHOUT_HEAD(fread_unlocked_heap_before_end);
594 ATF_TC_BODY(fread_unlocked_heap_before_end, tc)
595 {
596 #define BUF __stack.__buf
597 	struct {
598 		uint8_t padding_l;
599 		unsigned char * __buf;
600 		uint8_t padding_r;
601 	} __stack;
602 	const size_t __bufsz __unused = sizeof(*__stack.__buf) * (42);
603 	const size_t __len = 42 - 1;
604 	const size_t __idx __unused = __len - 1;
605 
606 	__stack.__buf = malloc(__bufsz);
607 	replace_stdin();
608 
609 	fread_unlocked(__stack.__buf, __len, 1, stdin);
610 #undef BUF
611 
612 }
613 
614 ATF_TC_WITHOUT_HEAD(fread_unlocked_heap_end);
615 ATF_TC_BODY(fread_unlocked_heap_end, tc)
616 {
617 #define BUF __stack.__buf
618 	struct {
619 		uint8_t padding_l;
620 		unsigned char * __buf;
621 		uint8_t padding_r;
622 	} __stack;
623 	const size_t __bufsz __unused = sizeof(*__stack.__buf) * (42);
624 	const size_t __len = 42;
625 	const size_t __idx __unused = __len - 1;
626 
627 	__stack.__buf = malloc(__bufsz);
628 	replace_stdin();
629 
630 	fread_unlocked(__stack.__buf, __len, 1, stdin);
631 #undef BUF
632 
633 }
634 
635 ATF_TC_WITHOUT_HEAD(fread_unlocked_heap_after_end);
636 ATF_TC_BODY(fread_unlocked_heap_after_end, tc)
637 {
638 #define BUF __stack.__buf
639 	struct {
640 		uint8_t padding_l;
641 		unsigned char * __buf;
642 		uint8_t padding_r;
643 	} __stack;
644 	const size_t __bufsz __unused = sizeof(*__stack.__buf) * (42);
645 	const size_t __len = 42 + 1;
646 	const size_t __idx __unused = __len - 1;
647 	pid_t __child;
648 	int __status;
649 
650 	__child = fork();
651 	ATF_REQUIRE(__child >= 0);
652 	if (__child > 0)
653 		goto monitor;
654 
655 	/* Child */
656 	disable_coredumps();
657 	__stack.__buf = malloc(__bufsz);
658 	replace_stdin();
659 
660 	fread_unlocked(__stack.__buf, __len, 1, stdin);
661 	_exit(EX_SOFTWARE);	/* Should have aborted. */
662 
663 monitor:
664 	while (waitpid(__child, &__status, 0) != __child) {
665 		ATF_REQUIRE_EQ(EINTR, errno);
666 	}
667 
668 	if (!WIFSIGNALED(__status)) {
669 		switch (WEXITSTATUS(__status)) {
670 		case EX_SOFTWARE:
671 			atf_tc_fail("FORTIFY_SOURCE failed to abort");
672 			break;
673 		case EX_OSERR:
674 			atf_tc_fail("setrlimit(2) failed");
675 			break;
676 		default:
677 			atf_tc_fail("child exited with status %d",
678 			    WEXITSTATUS(__status));
679 		}
680 	} else {
681 		ATF_REQUIRE_EQ(SIGABRT, WTERMSIG(__status));
682 	}
683 #undef BUF
684 
685 }
686 
687 ATF_TC_WITHOUT_HEAD(gets_s_before_end);
688 ATF_TC_BODY(gets_s_before_end, tc)
689 {
690 #define BUF &__stack.__buf
691 	struct {
692 		uint8_t padding_l;
693 		unsigned char __buf[42];
694 		uint8_t padding_r;
695 	} __stack;
696 	const size_t __bufsz __unused = sizeof(__stack.__buf);
697 	const size_t __len = 42 - 1;
698 	const size_t __idx __unused = __len - 1;
699 
700 	replace_stdin();
701 
702 	gets_s(__stack.__buf, __len);
703 #undef BUF
704 
705 }
706 
707 ATF_TC_WITHOUT_HEAD(gets_s_end);
708 ATF_TC_BODY(gets_s_end, tc)
709 {
710 #define BUF &__stack.__buf
711 	struct {
712 		uint8_t padding_l;
713 		unsigned char __buf[42];
714 		uint8_t padding_r;
715 	} __stack;
716 	const size_t __bufsz __unused = sizeof(__stack.__buf);
717 	const size_t __len = 42;
718 	const size_t __idx __unused = __len - 1;
719 
720 	replace_stdin();
721 
722 	gets_s(__stack.__buf, __len);
723 #undef BUF
724 
725 }
726 
727 ATF_TC_WITHOUT_HEAD(gets_s_heap_before_end);
728 ATF_TC_BODY(gets_s_heap_before_end, tc)
729 {
730 #define BUF __stack.__buf
731 	struct {
732 		uint8_t padding_l;
733 		unsigned char * __buf;
734 		uint8_t padding_r;
735 	} __stack;
736 	const size_t __bufsz __unused = sizeof(*__stack.__buf) * (42);
737 	const size_t __len = 42 - 1;
738 	const size_t __idx __unused = __len - 1;
739 
740 	__stack.__buf = malloc(__bufsz);
741 	replace_stdin();
742 
743 	gets_s(__stack.__buf, __len);
744 #undef BUF
745 
746 }
747 
748 ATF_TC_WITHOUT_HEAD(gets_s_heap_end);
749 ATF_TC_BODY(gets_s_heap_end, tc)
750 {
751 #define BUF __stack.__buf
752 	struct {
753 		uint8_t padding_l;
754 		unsigned char * __buf;
755 		uint8_t padding_r;
756 	} __stack;
757 	const size_t __bufsz __unused = sizeof(*__stack.__buf) * (42);
758 	const size_t __len = 42;
759 	const size_t __idx __unused = __len - 1;
760 
761 	__stack.__buf = malloc(__bufsz);
762 	replace_stdin();
763 
764 	gets_s(__stack.__buf, __len);
765 #undef BUF
766 
767 }
768 
769 ATF_TC_WITHOUT_HEAD(gets_s_heap_after_end);
770 ATF_TC_BODY(gets_s_heap_after_end, tc)
771 {
772 #define BUF __stack.__buf
773 	struct {
774 		uint8_t padding_l;
775 		unsigned char * __buf;
776 		uint8_t padding_r;
777 	} __stack;
778 	const size_t __bufsz __unused = sizeof(*__stack.__buf) * (42);
779 	const size_t __len = 42 + 1;
780 	const size_t __idx __unused = __len - 1;
781 	pid_t __child;
782 	int __status;
783 
784 	__child = fork();
785 	ATF_REQUIRE(__child >= 0);
786 	if (__child > 0)
787 		goto monitor;
788 
789 	/* Child */
790 	disable_coredumps();
791 	__stack.__buf = malloc(__bufsz);
792 	replace_stdin();
793 
794 	gets_s(__stack.__buf, __len);
795 	_exit(EX_SOFTWARE);	/* Should have aborted. */
796 
797 monitor:
798 	while (waitpid(__child, &__status, 0) != __child) {
799 		ATF_REQUIRE_EQ(EINTR, errno);
800 	}
801 
802 	if (!WIFSIGNALED(__status)) {
803 		switch (WEXITSTATUS(__status)) {
804 		case EX_SOFTWARE:
805 			atf_tc_fail("FORTIFY_SOURCE failed to abort");
806 			break;
807 		case EX_OSERR:
808 			atf_tc_fail("setrlimit(2) failed");
809 			break;
810 		default:
811 			atf_tc_fail("child exited with status %d",
812 			    WEXITSTATUS(__status));
813 		}
814 	} else {
815 		ATF_REQUIRE_EQ(SIGABRT, WTERMSIG(__status));
816 	}
817 #undef BUF
818 
819 }
820 
821 ATF_TC_WITHOUT_HEAD(sprintf_before_end);
822 ATF_TC_BODY(sprintf_before_end, tc)
823 {
824 #define BUF &__stack.__buf
825 	struct {
826 		uint8_t padding_l;
827 		unsigned char __buf[42];
828 		uint8_t padding_r;
829 	} __stack;
830 	const size_t __bufsz __unused = sizeof(__stack.__buf);
831 	const size_t __len = 42 - 1;
832 	const size_t __idx __unused = __len - 1;
833 	char srcvar[__len + 10];
834 
835 	memset(srcvar, 'A', sizeof(srcvar) - 1);
836 	srcvar[sizeof(srcvar) - 1] = '\0';
837 
838 	sprintf(__stack.__buf, "%.*s", (int)__len - 1, srcvar);
839 #undef BUF
840 
841 }
842 
843 ATF_TC_WITHOUT_HEAD(sprintf_end);
844 ATF_TC_BODY(sprintf_end, tc)
845 {
846 #define BUF &__stack.__buf
847 	struct {
848 		uint8_t padding_l;
849 		unsigned char __buf[42];
850 		uint8_t padding_r;
851 	} __stack;
852 	const size_t __bufsz __unused = sizeof(__stack.__buf);
853 	const size_t __len = 42;
854 	const size_t __idx __unused = __len - 1;
855 	char srcvar[__len + 10];
856 
857 	memset(srcvar, 'A', sizeof(srcvar) - 1);
858 	srcvar[sizeof(srcvar) - 1] = '\0';
859 
860 	sprintf(__stack.__buf, "%.*s", (int)__len - 1, srcvar);
861 #undef BUF
862 
863 }
864 
865 ATF_TC_WITHOUT_HEAD(sprintf_heap_before_end);
866 ATF_TC_BODY(sprintf_heap_before_end, tc)
867 {
868 #define BUF __stack.__buf
869 	struct {
870 		uint8_t padding_l;
871 		unsigned char * __buf;
872 		uint8_t padding_r;
873 	} __stack;
874 	const size_t __bufsz __unused = sizeof(*__stack.__buf) * (42);
875 	const size_t __len = 42 - 1;
876 	const size_t __idx __unused = __len - 1;
877 	char srcvar[__len + 10];
878 
879 	__stack.__buf = malloc(__bufsz);
880 	memset(srcvar, 'A', sizeof(srcvar) - 1);
881 	srcvar[sizeof(srcvar) - 1] = '\0';
882 
883 	sprintf(__stack.__buf, "%.*s", (int)__len - 1, srcvar);
884 #undef BUF
885 
886 }
887 
888 ATF_TC_WITHOUT_HEAD(sprintf_heap_end);
889 ATF_TC_BODY(sprintf_heap_end, tc)
890 {
891 #define BUF __stack.__buf
892 	struct {
893 		uint8_t padding_l;
894 		unsigned char * __buf;
895 		uint8_t padding_r;
896 	} __stack;
897 	const size_t __bufsz __unused = sizeof(*__stack.__buf) * (42);
898 	const size_t __len = 42;
899 	const size_t __idx __unused = __len - 1;
900 	char srcvar[__len + 10];
901 
902 	__stack.__buf = malloc(__bufsz);
903 	memset(srcvar, 'A', sizeof(srcvar) - 1);
904 	srcvar[sizeof(srcvar) - 1] = '\0';
905 
906 	sprintf(__stack.__buf, "%.*s", (int)__len - 1, srcvar);
907 #undef BUF
908 
909 }
910 
911 ATF_TC_WITHOUT_HEAD(sprintf_heap_after_end);
912 ATF_TC_BODY(sprintf_heap_after_end, tc)
913 {
914 #define BUF __stack.__buf
915 	struct {
916 		uint8_t padding_l;
917 		unsigned char * __buf;
918 		uint8_t padding_r;
919 	} __stack;
920 	const size_t __bufsz __unused = sizeof(*__stack.__buf) * (42);
921 	const size_t __len = 42 + 1;
922 	const size_t __idx __unused = __len - 1;
923 	pid_t __child;
924 	int __status;
925 	char srcvar[__len + 10];
926 
927 	__child = fork();
928 	ATF_REQUIRE(__child >= 0);
929 	if (__child > 0)
930 		goto monitor;
931 
932 	/* Child */
933 	disable_coredumps();
934 	__stack.__buf = malloc(__bufsz);
935 	memset(srcvar, 'A', sizeof(srcvar) - 1);
936 	srcvar[sizeof(srcvar) - 1] = '\0';
937 
938 	sprintf(__stack.__buf, "%.*s", (int)__len - 1, srcvar);
939 	_exit(EX_SOFTWARE);	/* Should have aborted. */
940 
941 monitor:
942 	while (waitpid(__child, &__status, 0) != __child) {
943 		ATF_REQUIRE_EQ(EINTR, errno);
944 	}
945 
946 	if (!WIFSIGNALED(__status)) {
947 		switch (WEXITSTATUS(__status)) {
948 		case EX_SOFTWARE:
949 			atf_tc_fail("FORTIFY_SOURCE failed to abort");
950 			break;
951 		case EX_OSERR:
952 			atf_tc_fail("setrlimit(2) failed");
953 			break;
954 		default:
955 			atf_tc_fail("child exited with status %d",
956 			    WEXITSTATUS(__status));
957 		}
958 	} else {
959 		ATF_REQUIRE_EQ(SIGABRT, WTERMSIG(__status));
960 	}
961 #undef BUF
962 
963 }
964 
965 ATF_TC_WITHOUT_HEAD(snprintf_before_end);
966 ATF_TC_BODY(snprintf_before_end, tc)
967 {
968 #define BUF &__stack.__buf
969 	struct {
970 		uint8_t padding_l;
971 		unsigned char __buf[42];
972 		uint8_t padding_r;
973 	} __stack;
974 	const size_t __bufsz __unused = sizeof(__stack.__buf);
975 	const size_t __len = 42 - 1;
976 	const size_t __idx __unused = __len - 1;
977 	char srcvar[__len + 10];
978 
979 	memset(srcvar, 'A', sizeof(srcvar) - 1);
980 	srcvar[sizeof(srcvar) - 1] = '\0';
981 
982 	snprintf(__stack.__buf, __len, "%.*s", (int)__len - 1, srcvar);
983 #undef BUF
984 
985 }
986 
987 ATF_TC_WITHOUT_HEAD(snprintf_end);
988 ATF_TC_BODY(snprintf_end, tc)
989 {
990 #define BUF &__stack.__buf
991 	struct {
992 		uint8_t padding_l;
993 		unsigned char __buf[42];
994 		uint8_t padding_r;
995 	} __stack;
996 	const size_t __bufsz __unused = sizeof(__stack.__buf);
997 	const size_t __len = 42;
998 	const size_t __idx __unused = __len - 1;
999 	char srcvar[__len + 10];
1000 
1001 	memset(srcvar, 'A', sizeof(srcvar) - 1);
1002 	srcvar[sizeof(srcvar) - 1] = '\0';
1003 
1004 	snprintf(__stack.__buf, __len, "%.*s", (int)__len - 1, srcvar);
1005 #undef BUF
1006 
1007 }
1008 
1009 ATF_TC_WITHOUT_HEAD(snprintf_heap_before_end);
1010 ATF_TC_BODY(snprintf_heap_before_end, tc)
1011 {
1012 #define BUF __stack.__buf
1013 	struct {
1014 		uint8_t padding_l;
1015 		unsigned char * __buf;
1016 		uint8_t padding_r;
1017 	} __stack;
1018 	const size_t __bufsz __unused = sizeof(*__stack.__buf) * (42);
1019 	const size_t __len = 42 - 1;
1020 	const size_t __idx __unused = __len - 1;
1021 	char srcvar[__len + 10];
1022 
1023 	__stack.__buf = malloc(__bufsz);
1024 	memset(srcvar, 'A', sizeof(srcvar) - 1);
1025 	srcvar[sizeof(srcvar) - 1] = '\0';
1026 
1027 	snprintf(__stack.__buf, __len, "%.*s", (int)__len - 1, srcvar);
1028 #undef BUF
1029 
1030 }
1031 
1032 ATF_TC_WITHOUT_HEAD(snprintf_heap_end);
1033 ATF_TC_BODY(snprintf_heap_end, tc)
1034 {
1035 #define BUF __stack.__buf
1036 	struct {
1037 		uint8_t padding_l;
1038 		unsigned char * __buf;
1039 		uint8_t padding_r;
1040 	} __stack;
1041 	const size_t __bufsz __unused = sizeof(*__stack.__buf) * (42);
1042 	const size_t __len = 42;
1043 	const size_t __idx __unused = __len - 1;
1044 	char srcvar[__len + 10];
1045 
1046 	__stack.__buf = malloc(__bufsz);
1047 	memset(srcvar, 'A', sizeof(srcvar) - 1);
1048 	srcvar[sizeof(srcvar) - 1] = '\0';
1049 
1050 	snprintf(__stack.__buf, __len, "%.*s", (int)__len - 1, srcvar);
1051 #undef BUF
1052 
1053 }
1054 
1055 ATF_TC_WITHOUT_HEAD(snprintf_heap_after_end);
1056 ATF_TC_BODY(snprintf_heap_after_end, tc)
1057 {
1058 #define BUF __stack.__buf
1059 	struct {
1060 		uint8_t padding_l;
1061 		unsigned char * __buf;
1062 		uint8_t padding_r;
1063 	} __stack;
1064 	const size_t __bufsz __unused = sizeof(*__stack.__buf) * (42);
1065 	const size_t __len = 42 + 1;
1066 	const size_t __idx __unused = __len - 1;
1067 	pid_t __child;
1068 	int __status;
1069 	char srcvar[__len + 10];
1070 
1071 	__child = fork();
1072 	ATF_REQUIRE(__child >= 0);
1073 	if (__child > 0)
1074 		goto monitor;
1075 
1076 	/* Child */
1077 	disable_coredumps();
1078 	__stack.__buf = malloc(__bufsz);
1079 	memset(srcvar, 'A', sizeof(srcvar) - 1);
1080 	srcvar[sizeof(srcvar) - 1] = '\0';
1081 
1082 	snprintf(__stack.__buf, __len, "%.*s", (int)__len - 1, srcvar);
1083 	_exit(EX_SOFTWARE);	/* Should have aborted. */
1084 
1085 monitor:
1086 	while (waitpid(__child, &__status, 0) != __child) {
1087 		ATF_REQUIRE_EQ(EINTR, errno);
1088 	}
1089 
1090 	if (!WIFSIGNALED(__status)) {
1091 		switch (WEXITSTATUS(__status)) {
1092 		case EX_SOFTWARE:
1093 			atf_tc_fail("FORTIFY_SOURCE failed to abort");
1094 			break;
1095 		case EX_OSERR:
1096 			atf_tc_fail("setrlimit(2) failed");
1097 			break;
1098 		default:
1099 			atf_tc_fail("child exited with status %d",
1100 			    WEXITSTATUS(__status));
1101 		}
1102 	} else {
1103 		ATF_REQUIRE_EQ(SIGABRT, WTERMSIG(__status));
1104 	}
1105 #undef BUF
1106 
1107 }
1108 
1109 ATF_TC_WITHOUT_HEAD(tmpnam_before_end);
1110 ATF_TC_BODY(tmpnam_before_end, tc)
1111 {
1112 #define BUF &__stack.__buf
1113 	struct {
1114 		uint8_t padding_l;
1115 		unsigned char __buf[L_tmpnam + 1];
1116 		uint8_t padding_r;
1117 	} __stack;
1118 	const size_t __bufsz __unused = sizeof(__stack.__buf);
1119 	const size_t __len = L_tmpnam + 1;
1120 	const size_t __idx __unused = __len - 1;
1121 
1122 	tmpnam(__stack.__buf);
1123 #undef BUF
1124 
1125 }
1126 
1127 ATF_TC_WITHOUT_HEAD(tmpnam_end);
1128 ATF_TC_BODY(tmpnam_end, tc)
1129 {
1130 #define BUF &__stack.__buf
1131 	struct {
1132 		uint8_t padding_l;
1133 		unsigned char __buf[L_tmpnam];
1134 		uint8_t padding_r;
1135 	} __stack;
1136 	const size_t __bufsz __unused = sizeof(__stack.__buf);
1137 	const size_t __len = L_tmpnam;
1138 	const size_t __idx __unused = __len - 1;
1139 
1140 	tmpnam(__stack.__buf);
1141 #undef BUF
1142 
1143 }
1144 
1145 ATF_TC_WITHOUT_HEAD(tmpnam_heap_before_end);
1146 ATF_TC_BODY(tmpnam_heap_before_end, tc)
1147 {
1148 #define BUF __stack.__buf
1149 	struct {
1150 		uint8_t padding_l;
1151 		unsigned char * __buf;
1152 		uint8_t padding_r;
1153 	} __stack;
1154 	const size_t __bufsz __unused = sizeof(*__stack.__buf) * (L_tmpnam + 1);
1155 	const size_t __len = L_tmpnam + 1;
1156 	const size_t __idx __unused = __len - 1;
1157 
1158 	__stack.__buf = malloc(__bufsz);
1159 
1160 	tmpnam(__stack.__buf);
1161 #undef BUF
1162 
1163 }
1164 
1165 ATF_TC_WITHOUT_HEAD(tmpnam_heap_end);
1166 ATF_TC_BODY(tmpnam_heap_end, tc)
1167 {
1168 #define BUF __stack.__buf
1169 	struct {
1170 		uint8_t padding_l;
1171 		unsigned char * __buf;
1172 		uint8_t padding_r;
1173 	} __stack;
1174 	const size_t __bufsz __unused = sizeof(*__stack.__buf) * (L_tmpnam);
1175 	const size_t __len = L_tmpnam;
1176 	const size_t __idx __unused = __len - 1;
1177 
1178 	__stack.__buf = malloc(__bufsz);
1179 
1180 	tmpnam(__stack.__buf);
1181 #undef BUF
1182 
1183 }
1184 
1185 ATF_TC_WITHOUT_HEAD(tmpnam_heap_after_end);
1186 ATF_TC_BODY(tmpnam_heap_after_end, tc)
1187 {
1188 #define BUF __stack.__buf
1189 	struct {
1190 		uint8_t padding_l;
1191 		unsigned char * __buf;
1192 		uint8_t padding_r;
1193 	} __stack;
1194 	const size_t __bufsz __unused = sizeof(*__stack.__buf) * (L_tmpnam - 1);
1195 	const size_t __len = L_tmpnam - 1;
1196 	const size_t __idx __unused = __len - 1;
1197 	pid_t __child;
1198 	int __status;
1199 
1200 	__child = fork();
1201 	ATF_REQUIRE(__child >= 0);
1202 	if (__child > 0)
1203 		goto monitor;
1204 
1205 	/* Child */
1206 	disable_coredumps();
1207 	__stack.__buf = malloc(__bufsz);
1208 
1209 	tmpnam(__stack.__buf);
1210 	_exit(EX_SOFTWARE);	/* Should have aborted. */
1211 
1212 monitor:
1213 	while (waitpid(__child, &__status, 0) != __child) {
1214 		ATF_REQUIRE_EQ(EINTR, errno);
1215 	}
1216 
1217 	if (!WIFSIGNALED(__status)) {
1218 		switch (WEXITSTATUS(__status)) {
1219 		case EX_SOFTWARE:
1220 			atf_tc_fail("FORTIFY_SOURCE failed to abort");
1221 			break;
1222 		case EX_OSERR:
1223 			atf_tc_fail("setrlimit(2) failed");
1224 			break;
1225 		default:
1226 			atf_tc_fail("child exited with status %d",
1227 			    WEXITSTATUS(__status));
1228 		}
1229 	} else {
1230 		ATF_REQUIRE_EQ(SIGABRT, WTERMSIG(__status));
1231 	}
1232 #undef BUF
1233 
1234 }
1235 
1236 ATF_TC_WITHOUT_HEAD(fgets_before_end);
1237 ATF_TC_BODY(fgets_before_end, tc)
1238 {
1239 #define BUF &__stack.__buf
1240 	struct {
1241 		uint8_t padding_l;
1242 		unsigned char __buf[42];
1243 		uint8_t padding_r;
1244 	} __stack;
1245 	const size_t __bufsz __unused = sizeof(__stack.__buf);
1246 	const size_t __len = 42 - 1;
1247 	const size_t __idx __unused = __len - 1;
1248 	FILE *fp;
1249 
1250 	fp = new_fp(__len);
1251 
1252 	fgets(__stack.__buf, __len, fp);
1253 #undef BUF
1254 
1255 }
1256 
1257 ATF_TC_WITHOUT_HEAD(fgets_end);
1258 ATF_TC_BODY(fgets_end, tc)
1259 {
1260 #define BUF &__stack.__buf
1261 	struct {
1262 		uint8_t padding_l;
1263 		unsigned char __buf[42];
1264 		uint8_t padding_r;
1265 	} __stack;
1266 	const size_t __bufsz __unused = sizeof(__stack.__buf);
1267 	const size_t __len = 42;
1268 	const size_t __idx __unused = __len - 1;
1269 	FILE *fp;
1270 
1271 	fp = new_fp(__len);
1272 
1273 	fgets(__stack.__buf, __len, fp);
1274 #undef BUF
1275 
1276 }
1277 
1278 ATF_TC_WITHOUT_HEAD(fgets_heap_before_end);
1279 ATF_TC_BODY(fgets_heap_before_end, tc)
1280 {
1281 #define BUF __stack.__buf
1282 	struct {
1283 		uint8_t padding_l;
1284 		unsigned char * __buf;
1285 		uint8_t padding_r;
1286 	} __stack;
1287 	const size_t __bufsz __unused = sizeof(*__stack.__buf) * (42);
1288 	const size_t __len = 42 - 1;
1289 	const size_t __idx __unused = __len - 1;
1290 	FILE *fp;
1291 
1292 	__stack.__buf = malloc(__bufsz);
1293 	fp = new_fp(__len);
1294 
1295 	fgets(__stack.__buf, __len, fp);
1296 #undef BUF
1297 
1298 }
1299 
1300 ATF_TC_WITHOUT_HEAD(fgets_heap_end);
1301 ATF_TC_BODY(fgets_heap_end, tc)
1302 {
1303 #define BUF __stack.__buf
1304 	struct {
1305 		uint8_t padding_l;
1306 		unsigned char * __buf;
1307 		uint8_t padding_r;
1308 	} __stack;
1309 	const size_t __bufsz __unused = sizeof(*__stack.__buf) * (42);
1310 	const size_t __len = 42;
1311 	const size_t __idx __unused = __len - 1;
1312 	FILE *fp;
1313 
1314 	__stack.__buf = malloc(__bufsz);
1315 	fp = new_fp(__len);
1316 
1317 	fgets(__stack.__buf, __len, fp);
1318 #undef BUF
1319 
1320 }
1321 
1322 ATF_TC_WITHOUT_HEAD(fgets_heap_after_end);
1323 ATF_TC_BODY(fgets_heap_after_end, tc)
1324 {
1325 #define BUF __stack.__buf
1326 	struct {
1327 		uint8_t padding_l;
1328 		unsigned char * __buf;
1329 		uint8_t padding_r;
1330 	} __stack;
1331 	const size_t __bufsz __unused = sizeof(*__stack.__buf) * (42);
1332 	const size_t __len = 42 + 1;
1333 	const size_t __idx __unused = __len - 1;
1334 	pid_t __child;
1335 	int __status;
1336 	FILE *fp;
1337 
1338 	__child = fork();
1339 	ATF_REQUIRE(__child >= 0);
1340 	if (__child > 0)
1341 		goto monitor;
1342 
1343 	/* Child */
1344 	disable_coredumps();
1345 	__stack.__buf = malloc(__bufsz);
1346 	fp = new_fp(__len);
1347 
1348 	fgets(__stack.__buf, __len, fp);
1349 	_exit(EX_SOFTWARE);	/* Should have aborted. */
1350 
1351 monitor:
1352 	while (waitpid(__child, &__status, 0) != __child) {
1353 		ATF_REQUIRE_EQ(EINTR, errno);
1354 	}
1355 
1356 	if (!WIFSIGNALED(__status)) {
1357 		switch (WEXITSTATUS(__status)) {
1358 		case EX_SOFTWARE:
1359 			atf_tc_fail("FORTIFY_SOURCE failed to abort");
1360 			break;
1361 		case EX_OSERR:
1362 			atf_tc_fail("setrlimit(2) failed");
1363 			break;
1364 		default:
1365 			atf_tc_fail("child exited with status %d",
1366 			    WEXITSTATUS(__status));
1367 		}
1368 	} else {
1369 		ATF_REQUIRE_EQ(SIGABRT, WTERMSIG(__status));
1370 	}
1371 #undef BUF
1372 
1373 }
1374 
1375 ATF_TP_ADD_TCS(tp)
1376 {
1377 	ATF_TP_ADD_TC(tp, ctermid_before_end);
1378 	ATF_TP_ADD_TC(tp, ctermid_end);
1379 	ATF_TP_ADD_TC(tp, ctermid_heap_before_end);
1380 	ATF_TP_ADD_TC(tp, ctermid_heap_end);
1381 	ATF_TP_ADD_TC(tp, ctermid_heap_after_end);
1382 	ATF_TP_ADD_TC(tp, ctermid_r_before_end);
1383 	ATF_TP_ADD_TC(tp, ctermid_r_end);
1384 	ATF_TP_ADD_TC(tp, ctermid_r_heap_before_end);
1385 	ATF_TP_ADD_TC(tp, ctermid_r_heap_end);
1386 	ATF_TP_ADD_TC(tp, ctermid_r_heap_after_end);
1387 	ATF_TP_ADD_TC(tp, fread_before_end);
1388 	ATF_TP_ADD_TC(tp, fread_end);
1389 	ATF_TP_ADD_TC(tp, fread_heap_before_end);
1390 	ATF_TP_ADD_TC(tp, fread_heap_end);
1391 	ATF_TP_ADD_TC(tp, fread_heap_after_end);
1392 	ATF_TP_ADD_TC(tp, fread_unlocked_before_end);
1393 	ATF_TP_ADD_TC(tp, fread_unlocked_end);
1394 	ATF_TP_ADD_TC(tp, fread_unlocked_heap_before_end);
1395 	ATF_TP_ADD_TC(tp, fread_unlocked_heap_end);
1396 	ATF_TP_ADD_TC(tp, fread_unlocked_heap_after_end);
1397 	ATF_TP_ADD_TC(tp, gets_s_before_end);
1398 	ATF_TP_ADD_TC(tp, gets_s_end);
1399 	ATF_TP_ADD_TC(tp, gets_s_heap_before_end);
1400 	ATF_TP_ADD_TC(tp, gets_s_heap_end);
1401 	ATF_TP_ADD_TC(tp, gets_s_heap_after_end);
1402 	ATF_TP_ADD_TC(tp, sprintf_before_end);
1403 	ATF_TP_ADD_TC(tp, sprintf_end);
1404 	ATF_TP_ADD_TC(tp, sprintf_heap_before_end);
1405 	ATF_TP_ADD_TC(tp, sprintf_heap_end);
1406 	ATF_TP_ADD_TC(tp, sprintf_heap_after_end);
1407 	ATF_TP_ADD_TC(tp, snprintf_before_end);
1408 	ATF_TP_ADD_TC(tp, snprintf_end);
1409 	ATF_TP_ADD_TC(tp, snprintf_heap_before_end);
1410 	ATF_TP_ADD_TC(tp, snprintf_heap_end);
1411 	ATF_TP_ADD_TC(tp, snprintf_heap_after_end);
1412 	ATF_TP_ADD_TC(tp, tmpnam_before_end);
1413 	ATF_TP_ADD_TC(tp, tmpnam_end);
1414 	ATF_TP_ADD_TC(tp, tmpnam_heap_before_end);
1415 	ATF_TP_ADD_TC(tp, tmpnam_heap_end);
1416 	ATF_TP_ADD_TC(tp, tmpnam_heap_after_end);
1417 	ATF_TP_ADD_TC(tp, fgets_before_end);
1418 	ATF_TP_ADD_TC(tp, fgets_end);
1419 	ATF_TP_ADD_TC(tp, fgets_heap_before_end);
1420 	ATF_TP_ADD_TC(tp, fgets_heap_end);
1421 	ATF_TP_ADD_TC(tp, fgets_heap_after_end);
1422 	return (atf_no_error());
1423 }
1424