1 /*- 2 * Copyright (c) 2009 David Schultz <das@FreeBSD.org> 3 * Copyright (c) 2023, 2024 The FreeBSD Foundation 4 * All rights reserved. 5 * 6 * Portions of this software were developed by Robert Clausecker 7 * <fuz@FreeBSD.org> under sponsorship from the FreeBSD Foundation. 8 * 9 * Redistribution and use in source and binary forms, with or without 10 * modification, are permitted provided that the following conditions 11 * are met: 12 * 1. Redistributions of source code must retain the above copyright 13 * notice, this list of conditions and the following disclaimer. 14 * 2. Redistributions in binary form must reproduce the above copyright 15 * notice, this list of conditions and the following disclaimer in the 16 * documentation and/or other materials provided with the distribution. 17 * 18 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 19 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 20 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 21 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 22 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 23 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 24 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 25 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 26 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 27 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 28 * SUCH DAMAGE. 29 */ 30 31 #include <sys/cdefs.h> 32 #include <sys/param.h> 33 #include <sys/mman.h> 34 #include <assert.h> 35 #include <dlfcn.h> 36 #include <limits.h> 37 #include <stdio.h> 38 #include <stdlib.h> 39 #include <string.h> 40 41 #include <atf-c.h> 42 43 void *(*memccpy_fn)(void *restrict, const void *restrict, int, size_t); 44 45 static char * 46 makebuf(size_t len, int guard_at_end) 47 { 48 char *buf; 49 size_t alloc_size, page_size; 50 51 page_size = getpagesize(); 52 alloc_size = roundup2(len, page_size) + page_size; 53 54 buf = mmap(NULL, alloc_size, PROT_READ | PROT_WRITE, MAP_ANON, -1, 0); 55 assert(buf); 56 if (guard_at_end) { 57 assert(mprotect(buf + alloc_size - page_size, page_size, PROT_NONE) == 0); 58 return (buf + alloc_size - page_size - len); 59 } else { 60 assert(mprotect(buf, page_size, PROT_NONE) == 0); 61 return (buf + page_size); 62 } 63 } 64 65 static void 66 freebuf(char * buf, size_t len, int guard_at_end) 67 { 68 size_t alloc_size, page_size; 69 70 page_size = getpagesize(); 71 alloc_size = roundup2(len, page_size) + page_size; 72 73 if (guard_at_end) 74 munmap(buf + len + page_size - alloc_size, alloc_size); 75 else 76 munmap(buf - page_size, alloc_size); 77 } 78 79 static void 80 test_memccpy(const char *s, size_t size) 81 { 82 char *src, *dst, *expected; 83 size_t bufsize, x; 84 int i, j; 85 86 for (i = 0; i <= 1; i++) { 87 for (j = 0; j <= 1; j++) { 88 for (bufsize = 0; bufsize <= size + 32; bufsize++) { 89 dst = makebuf(bufsize, j); 90 if (bufsize < size) { 91 src = makebuf(bufsize, i); 92 memcpy(src, s, bufsize); 93 expected = NULL; 94 } else { 95 src = makebuf(size, i); 96 memcpy(src, s, size); 97 expected = dst + size; 98 } 99 100 memset(dst, 'X', bufsize); 101 assert(memccpy_fn(dst, src, s[size-1], bufsize) == expected); 102 assert(memcmp(src, dst, MIN(bufsize, size)) == 0); 103 for (x = size; x < bufsize; x++) 104 assert(dst[x] == 'X'); 105 106 freebuf(dst, bufsize, j); 107 freebuf(src, bufsize < size ? bufsize : size, i); 108 } 109 } 110 } 111 } 112 113 static void 114 test_sentinel(char *dest, char *src, size_t destlen, size_t srclen) 115 { 116 size_t i, effective_len; 117 void *res, *wantres; 118 const char *fail = NULL; 119 char terminator; 120 121 for (i = 0; i < srclen; i++) 122 /* src will never include (){} */ 123 src[i] = '0' + i; 124 125 /* source sentinels: not to be copied */ 126 src[-1] = '('; 127 src[srclen] = ')'; 128 129 memset(dest, '\xee', destlen); 130 131 /* destination sentinels: not to be touched */ 132 dest[-1] = '{'; 133 dest[destlen] = '}'; 134 135 effective_len = srclen < destlen ? srclen : destlen; 136 wantres = srclen <= destlen ? dest + srclen : NULL; 137 terminator = src[srclen-1]; 138 res = memccpy_fn(dest, src, terminator, destlen); 139 140 if (dest[-1] != '{') 141 fail = "start sentinel overwritten"; 142 else if (dest[destlen] != '}') 143 fail = "end sentinel overwritten"; 144 else if (res != wantres) 145 fail = "incorrect return value"; 146 else if (destlen > 0 && memcmp(src, dest, effective_len) != 0) 147 fail = "string not copied correctly"; 148 else for (i = srclen; i < destlen; i++) 149 if (dest[i] != '\xee') { 150 fail = "buffer mutilated behind string"; 151 break; 152 } 153 154 if (fail) 155 atf_tc_fail_nonfatal("%s\n" 156 "memccpy(%p \"%s\", %p \"%s\", %u '%c', %zu) = %p (want %p)\n", 157 fail, dest, dest, src, src, terminator, terminator, destlen, res, wantres); 158 } 159 160 ATF_TC_WITHOUT_HEAD(null); 161 ATF_TC_BODY(null, tc) 162 { 163 ATF_CHECK_EQ(memccpy_fn(NULL, "foo", 42, 0), NULL); 164 } 165 166 ATF_TC(zero_extension); 167 ATF_TC_HEAD(zero_extension, tc) 168 { 169 atf_tc_set_md_var(tc, "descr", 170 "Ensure the upper bits of the terminator are ignored"); 171 } 172 ATF_TC_BODY(zero_extension, tc) 173 { 174 int mask = -1 & ~UCHAR_MAX; 175 char buf[16]; 176 177 memset(buf, 0xcc, sizeof(buf)); 178 ATF_CHECK_EQ(memccpy(buf, "foobar", 'r', sizeof(buf)), buf + sizeof("foobar") - 1); 179 ATF_CHECK_EQ(memcmp(buf, "foobar", sizeof("foobar") - 1), 0); 180 181 memset(buf, 0xcc, sizeof(buf)); 182 ATF_CHECK_EQ(memccpy(buf, "foobar", mask | 'r', sizeof(buf)), buf + sizeof("foobar") - 1); 183 ATF_CHECK_EQ(memcmp(buf, "foobar", sizeof("foobar") - 1), 0); 184 } 185 186 ATF_TC_WITHOUT_HEAD(bounds); 187 ATF_TC_BODY(bounds, tc) 188 { 189 size_t i; 190 char buf[64]; 191 192 for (i = 0; i < sizeof(buf) - 1; i++) { 193 buf[i] = ' ' + i; 194 buf[i+1] = '\0'; 195 test_memccpy(buf, i + 1); 196 } 197 } 198 199 ATF_TC_WITHOUT_HEAD(alignments); 200 ATF_TC_BODY(alignments, tc) 201 { 202 size_t srcalign, destalign, srclen, destlen; 203 char src[15+2+64]; /* 15 offsets + 64 max length + sentinels */ 204 char dest[15+2+64]; /* 15 offsets + 64 max length + sentinels */ 205 206 for (srcalign = 0; srcalign < 16; srcalign++) 207 for (destalign = 0; destalign < 16; destalign++) 208 for (srclen = 1; srclen < 64; srclen++) 209 for (destlen = 0; destlen < 64; destlen++) 210 test_sentinel(dest+destalign+1, 211 src+srcalign+1, destlen, srclen); 212 } 213 214 ATF_TP_ADD_TCS(tp) 215 { 216 void *dl_handle; 217 218 dl_handle = dlopen(NULL, RTLD_LAZY); 219 memccpy_fn = dlsym(dl_handle, "test_memccpy"); 220 if (memccpy_fn == NULL) 221 memccpy_fn = memccpy; 222 223 ATF_TP_ADD_TC(tp, null); 224 ATF_TP_ADD_TC(tp, zero_extension); 225 ATF_TP_ADD_TC(tp, bounds); 226 ATF_TP_ADD_TC(tp, alignments); 227 228 return (atf_no_error()); 229 } 230