Path: blob/main/lib/libc/tests/secure/fortify_string_test.c
39553 views
/* @generated by `generate-fortify-tests.lua "string"` */12#define _FORTIFY_SOURCE 23#define TMPFILE_SIZE (1024 * 32)45#include <sys/param.h>6#include <sys/jail.h>7#include <sys/random.h>8#include <sys/resource.h>9#include <sys/select.h>10#include <sys/socket.h>11#include <sys/time.h>12#include <sys/uio.h>13#include <sys/wait.h>14#include <dirent.h>15#include <errno.h>16#include <fcntl.h>17#include <limits.h>18#include <poll.h>19#include <signal.h>20#include <stdio.h>21#include <stdlib.h>22#include <string.h>23#include <strings.h>24#include <sysexits.h>25#include <unistd.h>26#include <wchar.h>27#include <atf-c.h>2829static FILE * __unused30new_fp(size_t __len)31{32static char fpbuf[LINE_MAX];33FILE *fp;3435ATF_REQUIRE(__len <= sizeof(fpbuf));3637memset(fpbuf, 'A', sizeof(fpbuf) - 1);38fpbuf[sizeof(fpbuf) - 1] = '\0';3940fp = fmemopen(fpbuf, sizeof(fpbuf), "rb");41ATF_REQUIRE(fp != NULL);4243return (fp);44}4546/*47* Create a new symlink to use for readlink(2) style tests, we'll just use a48* random target name to have something interesting to look at.49*/50static const char * __unused51new_symlink(size_t __len)52{53static const char linkname[] = "link";54char target[MAXNAMLEN];55int error;5657ATF_REQUIRE(__len <= sizeof(target));5859arc4random_buf(target, sizeof(target));6061error = unlink(linkname);62ATF_REQUIRE(error == 0 || errno == ENOENT);6364error = symlink(target, linkname);65ATF_REQUIRE(error == 0);6667return (linkname);68}6970/*71* For our purposes, first descriptor will be the reader; we'll send both72* raw data and a control message over it so that the result can be used for73* any of our recv*() tests.74*/75static void __unused76new_socket(int sock[2])77{78unsigned char ctrl[CMSG_SPACE(sizeof(int))] = { 0 };79static char sockbuf[256];80ssize_t rv;81size_t total = 0;82struct msghdr hdr = { 0 };83struct cmsghdr *cmsg;84int error, fd;8586error = socketpair(AF_UNIX, SOCK_STREAM, 0, sock);87ATF_REQUIRE(error == 0);8889while (total != sizeof(sockbuf)) {90rv = send(sock[1], &sockbuf[total], sizeof(sockbuf) - total, 0);9192ATF_REQUIRE_MSG(rv > 0,93"expected bytes sent, got %zd with %zu left (size %zu, total %zu)",94rv, sizeof(sockbuf) - total, sizeof(sockbuf), total);95ATF_REQUIRE_MSG(total + (size_t)rv <= sizeof(sockbuf),96"%zd exceeds total %zu", rv, sizeof(sockbuf));97total += rv;98}99100hdr.msg_control = ctrl;101hdr.msg_controllen = sizeof(ctrl);102103cmsg = CMSG_FIRSTHDR(&hdr);104cmsg->cmsg_level = SOL_SOCKET;105cmsg->cmsg_type = SCM_RIGHTS;106cmsg->cmsg_len = CMSG_LEN(sizeof(fd));107fd = STDIN_FILENO;108memcpy(CMSG_DATA(cmsg), &fd, sizeof(fd));109110error = sendmsg(sock[1], &hdr, 0);111ATF_REQUIRE(error != -1);112}113114/*115* Constructs a tmpfile that we can use for testing read(2) and friends.116*/117static int __unused118new_tmpfile(void)119{120char buf[1024];121ssize_t rv;122size_t written;123int fd;124125fd = open("tmpfile", O_RDWR | O_CREAT | O_TRUNC, 0644);126ATF_REQUIRE(fd >= 0);127128written = 0;129while (written < TMPFILE_SIZE) {130rv = write(fd, buf, sizeof(buf));131ATF_REQUIRE(rv > 0);132133written += rv;134}135136ATF_REQUIRE_EQ(0, lseek(fd, 0, SEEK_SET));137return (fd);138}139140static void141disable_coredumps(void)142{143struct rlimit rl = { 0 };144145if (setrlimit(RLIMIT_CORE, &rl) == -1)146_exit(EX_OSERR);147}148149/*150* Replaces stdin with a file that we can actually read from, for tests where151* we want a FILE * or fd that we can get data from.152*/153static void __unused154replace_stdin(void)155{156int fd;157158fd = new_tmpfile();159160(void)dup2(fd, STDIN_FILENO);161if (fd != STDIN_FILENO)162close(fd);163}164165ATF_TC(memcpy_before_end);166ATF_TC_HEAD(memcpy_before_end, tc)167{168}169ATF_TC_BODY(memcpy_before_end, tc)170{171#define BUF &__stack.__buf172struct {173uint8_t padding_l;174unsigned char __buf[42];175uint8_t padding_r;176} __stack;177const size_t __bufsz __unused = sizeof(__stack.__buf);178const size_t __len = 42 - 1;179const size_t __idx __unused = __len - 1;180char src[__len + 10];181182memcpy(__stack.__buf, src, __len);183#undef BUF184185}186187ATF_TC(memcpy_end);188ATF_TC_HEAD(memcpy_end, tc)189{190}191ATF_TC_BODY(memcpy_end, tc)192{193#define BUF &__stack.__buf194struct {195uint8_t padding_l;196unsigned char __buf[42];197uint8_t padding_r;198} __stack;199const size_t __bufsz __unused = sizeof(__stack.__buf);200const size_t __len = 42;201const size_t __idx __unused = __len - 1;202char src[__len + 10];203204memcpy(__stack.__buf, src, __len);205#undef BUF206207}208209ATF_TC(memcpy_heap_before_end);210ATF_TC_HEAD(memcpy_heap_before_end, tc)211{212}213ATF_TC_BODY(memcpy_heap_before_end, tc)214{215#define BUF __stack.__buf216struct {217uint8_t padding_l;218unsigned char * __buf;219uint8_t padding_r;220} __stack;221const size_t __bufsz __unused = sizeof(*__stack.__buf) * (42);222const size_t __len = 42 - 1;223const size_t __idx __unused = __len - 1;224char src[__len + 10];225226__stack.__buf = malloc(__bufsz);227228memcpy(__stack.__buf, src, __len);229#undef BUF230231}232233ATF_TC(memcpy_heap_end);234ATF_TC_HEAD(memcpy_heap_end, tc)235{236}237ATF_TC_BODY(memcpy_heap_end, tc)238{239#define BUF __stack.__buf240struct {241uint8_t padding_l;242unsigned char * __buf;243uint8_t padding_r;244} __stack;245const size_t __bufsz __unused = sizeof(*__stack.__buf) * (42);246const size_t __len = 42;247const size_t __idx __unused = __len - 1;248char src[__len + 10];249250__stack.__buf = malloc(__bufsz);251252memcpy(__stack.__buf, src, __len);253#undef BUF254255}256257ATF_TC(memcpy_heap_after_end);258ATF_TC_HEAD(memcpy_heap_after_end, tc)259{260}261ATF_TC_BODY(memcpy_heap_after_end, tc)262{263#define BUF __stack.__buf264struct {265uint8_t padding_l;266unsigned char * __buf;267uint8_t padding_r;268} __stack;269const size_t __bufsz __unused = sizeof(*__stack.__buf) * (42);270const size_t __len = 42 + 1;271const size_t __idx __unused = __len - 1;272pid_t __child;273int __status;274char src[__len + 10];275276__child = fork();277ATF_REQUIRE(__child >= 0);278if (__child > 0)279goto monitor;280281/* Child */282disable_coredumps();283__stack.__buf = malloc(__bufsz);284285memcpy(__stack.__buf, src, __len);286_exit(EX_SOFTWARE); /* Should have aborted. */287288monitor:289while (waitpid(__child, &__status, 0) != __child) {290ATF_REQUIRE_EQ(EINTR, errno);291}292293if (!WIFSIGNALED(__status)) {294switch (WEXITSTATUS(__status)) {295case EX_SOFTWARE:296atf_tc_fail("FORTIFY_SOURCE failed to abort");297break;298case EX_OSERR:299atf_tc_fail("setrlimit(2) failed");300break;301default:302atf_tc_fail("child exited with status %d",303WEXITSTATUS(__status));304}305} else {306ATF_REQUIRE_EQ(SIGABRT, WTERMSIG(__status));307}308#undef BUF309310}311312ATF_TC(mempcpy_before_end);313ATF_TC_HEAD(mempcpy_before_end, tc)314{315}316ATF_TC_BODY(mempcpy_before_end, tc)317{318#define BUF &__stack.__buf319struct {320uint8_t padding_l;321unsigned char __buf[42];322uint8_t padding_r;323} __stack;324const size_t __bufsz __unused = sizeof(__stack.__buf);325const size_t __len = 42 - 1;326const size_t __idx __unused = __len - 1;327char src[__len + 10];328329mempcpy(__stack.__buf, src, __len);330#undef BUF331332}333334ATF_TC(mempcpy_end);335ATF_TC_HEAD(mempcpy_end, tc)336{337}338ATF_TC_BODY(mempcpy_end, tc)339{340#define BUF &__stack.__buf341struct {342uint8_t padding_l;343unsigned char __buf[42];344uint8_t padding_r;345} __stack;346const size_t __bufsz __unused = sizeof(__stack.__buf);347const size_t __len = 42;348const size_t __idx __unused = __len - 1;349char src[__len + 10];350351mempcpy(__stack.__buf, src, __len);352#undef BUF353354}355356ATF_TC(mempcpy_heap_before_end);357ATF_TC_HEAD(mempcpy_heap_before_end, tc)358{359}360ATF_TC_BODY(mempcpy_heap_before_end, tc)361{362#define BUF __stack.__buf363struct {364uint8_t padding_l;365unsigned char * __buf;366uint8_t padding_r;367} __stack;368const size_t __bufsz __unused = sizeof(*__stack.__buf) * (42);369const size_t __len = 42 - 1;370const size_t __idx __unused = __len - 1;371char src[__len + 10];372373__stack.__buf = malloc(__bufsz);374375mempcpy(__stack.__buf, src, __len);376#undef BUF377378}379380ATF_TC(mempcpy_heap_end);381ATF_TC_HEAD(mempcpy_heap_end, tc)382{383}384ATF_TC_BODY(mempcpy_heap_end, tc)385{386#define BUF __stack.__buf387struct {388uint8_t padding_l;389unsigned char * __buf;390uint8_t padding_r;391} __stack;392const size_t __bufsz __unused = sizeof(*__stack.__buf) * (42);393const size_t __len = 42;394const size_t __idx __unused = __len - 1;395char src[__len + 10];396397__stack.__buf = malloc(__bufsz);398399mempcpy(__stack.__buf, src, __len);400#undef BUF401402}403404ATF_TC(mempcpy_heap_after_end);405ATF_TC_HEAD(mempcpy_heap_after_end, tc)406{407}408ATF_TC_BODY(mempcpy_heap_after_end, tc)409{410#define BUF __stack.__buf411struct {412uint8_t padding_l;413unsigned char * __buf;414uint8_t padding_r;415} __stack;416const size_t __bufsz __unused = sizeof(*__stack.__buf) * (42);417const size_t __len = 42 + 1;418const size_t __idx __unused = __len - 1;419pid_t __child;420int __status;421char src[__len + 10];422423__child = fork();424ATF_REQUIRE(__child >= 0);425if (__child > 0)426goto monitor;427428/* Child */429disable_coredumps();430__stack.__buf = malloc(__bufsz);431432mempcpy(__stack.__buf, src, __len);433_exit(EX_SOFTWARE); /* Should have aborted. */434435monitor:436while (waitpid(__child, &__status, 0) != __child) {437ATF_REQUIRE_EQ(EINTR, errno);438}439440if (!WIFSIGNALED(__status)) {441switch (WEXITSTATUS(__status)) {442case EX_SOFTWARE:443atf_tc_fail("FORTIFY_SOURCE failed to abort");444break;445case EX_OSERR:446atf_tc_fail("setrlimit(2) failed");447break;448default:449atf_tc_fail("child exited with status %d",450WEXITSTATUS(__status));451}452} else {453ATF_REQUIRE_EQ(SIGABRT, WTERMSIG(__status));454}455#undef BUF456457}458459ATF_TC(memmove_before_end);460ATF_TC_HEAD(memmove_before_end, tc)461{462}463ATF_TC_BODY(memmove_before_end, tc)464{465#define BUF &__stack.__buf466struct {467uint8_t padding_l;468unsigned char __buf[42];469uint8_t padding_r;470} __stack;471const size_t __bufsz __unused = sizeof(__stack.__buf);472const size_t __len = 42 - 1;473const size_t __idx __unused = __len - 1;474char src[__len + 10];475476memmove(__stack.__buf, src, __len);477#undef BUF478479}480481ATF_TC(memmove_end);482ATF_TC_HEAD(memmove_end, tc)483{484}485ATF_TC_BODY(memmove_end, tc)486{487#define BUF &__stack.__buf488struct {489uint8_t padding_l;490unsigned char __buf[42];491uint8_t padding_r;492} __stack;493const size_t __bufsz __unused = sizeof(__stack.__buf);494const size_t __len = 42;495const size_t __idx __unused = __len - 1;496char src[__len + 10];497498memmove(__stack.__buf, src, __len);499#undef BUF500501}502503ATF_TC(memmove_heap_before_end);504ATF_TC_HEAD(memmove_heap_before_end, tc)505{506}507ATF_TC_BODY(memmove_heap_before_end, tc)508{509#define BUF __stack.__buf510struct {511uint8_t padding_l;512unsigned char * __buf;513uint8_t padding_r;514} __stack;515const size_t __bufsz __unused = sizeof(*__stack.__buf) * (42);516const size_t __len = 42 - 1;517const size_t __idx __unused = __len - 1;518char src[__len + 10];519520__stack.__buf = malloc(__bufsz);521522memmove(__stack.__buf, src, __len);523#undef BUF524525}526527ATF_TC(memmove_heap_end);528ATF_TC_HEAD(memmove_heap_end, tc)529{530}531ATF_TC_BODY(memmove_heap_end, tc)532{533#define BUF __stack.__buf534struct {535uint8_t padding_l;536unsigned char * __buf;537uint8_t padding_r;538} __stack;539const size_t __bufsz __unused = sizeof(*__stack.__buf) * (42);540const size_t __len = 42;541const size_t __idx __unused = __len - 1;542char src[__len + 10];543544__stack.__buf = malloc(__bufsz);545546memmove(__stack.__buf, src, __len);547#undef BUF548549}550551ATF_TC(memmove_heap_after_end);552ATF_TC_HEAD(memmove_heap_after_end, tc)553{554}555ATF_TC_BODY(memmove_heap_after_end, tc)556{557#define BUF __stack.__buf558struct {559uint8_t padding_l;560unsigned char * __buf;561uint8_t padding_r;562} __stack;563const size_t __bufsz __unused = sizeof(*__stack.__buf) * (42);564const size_t __len = 42 + 1;565const size_t __idx __unused = __len - 1;566pid_t __child;567int __status;568char src[__len + 10];569570__child = fork();571ATF_REQUIRE(__child >= 0);572if (__child > 0)573goto monitor;574575/* Child */576disable_coredumps();577__stack.__buf = malloc(__bufsz);578579memmove(__stack.__buf, src, __len);580_exit(EX_SOFTWARE); /* Should have aborted. */581582monitor:583while (waitpid(__child, &__status, 0) != __child) {584ATF_REQUIRE_EQ(EINTR, errno);585}586587if (!WIFSIGNALED(__status)) {588switch (WEXITSTATUS(__status)) {589case EX_SOFTWARE:590atf_tc_fail("FORTIFY_SOURCE failed to abort");591break;592case EX_OSERR:593atf_tc_fail("setrlimit(2) failed");594break;595default:596atf_tc_fail("child exited with status %d",597WEXITSTATUS(__status));598}599} else {600ATF_REQUIRE_EQ(SIGABRT, WTERMSIG(__status));601}602#undef BUF603604}605606ATF_TC(memset_before_end);607ATF_TC_HEAD(memset_before_end, tc)608{609}610ATF_TC_BODY(memset_before_end, tc)611{612#define BUF &__stack.__buf613struct {614uint8_t padding_l;615unsigned char __buf[42];616uint8_t padding_r;617} __stack;618const size_t __bufsz __unused = sizeof(__stack.__buf);619const size_t __len = 42 - 1;620const size_t __idx __unused = __len - 1;621622memset(__stack.__buf, 0, __len);623#undef BUF624625}626627ATF_TC(memset_end);628ATF_TC_HEAD(memset_end, tc)629{630}631ATF_TC_BODY(memset_end, tc)632{633#define BUF &__stack.__buf634struct {635uint8_t padding_l;636unsigned char __buf[42];637uint8_t padding_r;638} __stack;639const size_t __bufsz __unused = sizeof(__stack.__buf);640const size_t __len = 42;641const size_t __idx __unused = __len - 1;642643memset(__stack.__buf, 0, __len);644#undef BUF645646}647648ATF_TC(memset_heap_before_end);649ATF_TC_HEAD(memset_heap_before_end, tc)650{651}652ATF_TC_BODY(memset_heap_before_end, tc)653{654#define BUF __stack.__buf655struct {656uint8_t padding_l;657unsigned char * __buf;658uint8_t padding_r;659} __stack;660const size_t __bufsz __unused = sizeof(*__stack.__buf) * (42);661const size_t __len = 42 - 1;662const size_t __idx __unused = __len - 1;663664__stack.__buf = malloc(__bufsz);665666memset(__stack.__buf, 0, __len);667#undef BUF668669}670671ATF_TC(memset_heap_end);672ATF_TC_HEAD(memset_heap_end, tc)673{674}675ATF_TC_BODY(memset_heap_end, tc)676{677#define BUF __stack.__buf678struct {679uint8_t padding_l;680unsigned char * __buf;681uint8_t padding_r;682} __stack;683const size_t __bufsz __unused = sizeof(*__stack.__buf) * (42);684const size_t __len = 42;685const size_t __idx __unused = __len - 1;686687__stack.__buf = malloc(__bufsz);688689memset(__stack.__buf, 0, __len);690#undef BUF691692}693694ATF_TC(memset_heap_after_end);695ATF_TC_HEAD(memset_heap_after_end, tc)696{697}698ATF_TC_BODY(memset_heap_after_end, tc)699{700#define BUF __stack.__buf701struct {702uint8_t padding_l;703unsigned char * __buf;704uint8_t padding_r;705} __stack;706const size_t __bufsz __unused = sizeof(*__stack.__buf) * (42);707const size_t __len = 42 + 1;708const size_t __idx __unused = __len - 1;709pid_t __child;710int __status;711712__child = fork();713ATF_REQUIRE(__child >= 0);714if (__child > 0)715goto monitor;716717/* Child */718disable_coredumps();719__stack.__buf = malloc(__bufsz);720721memset(__stack.__buf, 0, __len);722_exit(EX_SOFTWARE); /* Should have aborted. */723724monitor:725while (waitpid(__child, &__status, 0) != __child) {726ATF_REQUIRE_EQ(EINTR, errno);727}728729if (!WIFSIGNALED(__status)) {730switch (WEXITSTATUS(__status)) {731case EX_SOFTWARE:732atf_tc_fail("FORTIFY_SOURCE failed to abort");733break;734case EX_OSERR:735atf_tc_fail("setrlimit(2) failed");736break;737default:738atf_tc_fail("child exited with status %d",739WEXITSTATUS(__status));740}741} else {742ATF_REQUIRE_EQ(SIGABRT, WTERMSIG(__status));743}744#undef BUF745746}747748ATF_TC(memset_explicit_before_end);749ATF_TC_HEAD(memset_explicit_before_end, tc)750{751}752ATF_TC_BODY(memset_explicit_before_end, tc)753{754#define BUF &__stack.__buf755struct {756uint8_t padding_l;757unsigned char __buf[42];758uint8_t padding_r;759} __stack;760const size_t __bufsz __unused = sizeof(__stack.__buf);761const size_t __len = 42 - 1;762const size_t __idx __unused = __len - 1;763764memset_explicit(__stack.__buf, 0, __len);765#undef BUF766767}768769ATF_TC(memset_explicit_end);770ATF_TC_HEAD(memset_explicit_end, tc)771{772}773ATF_TC_BODY(memset_explicit_end, tc)774{775#define BUF &__stack.__buf776struct {777uint8_t padding_l;778unsigned char __buf[42];779uint8_t padding_r;780} __stack;781const size_t __bufsz __unused = sizeof(__stack.__buf);782const size_t __len = 42;783const size_t __idx __unused = __len - 1;784785memset_explicit(__stack.__buf, 0, __len);786#undef BUF787788}789790ATF_TC(memset_explicit_heap_before_end);791ATF_TC_HEAD(memset_explicit_heap_before_end, tc)792{793}794ATF_TC_BODY(memset_explicit_heap_before_end, tc)795{796#define BUF __stack.__buf797struct {798uint8_t padding_l;799unsigned char * __buf;800uint8_t padding_r;801} __stack;802const size_t __bufsz __unused = sizeof(*__stack.__buf) * (42);803const size_t __len = 42 - 1;804const size_t __idx __unused = __len - 1;805806__stack.__buf = malloc(__bufsz);807808memset_explicit(__stack.__buf, 0, __len);809#undef BUF810811}812813ATF_TC(memset_explicit_heap_end);814ATF_TC_HEAD(memset_explicit_heap_end, tc)815{816}817ATF_TC_BODY(memset_explicit_heap_end, tc)818{819#define BUF __stack.__buf820struct {821uint8_t padding_l;822unsigned char * __buf;823uint8_t padding_r;824} __stack;825const size_t __bufsz __unused = sizeof(*__stack.__buf) * (42);826const size_t __len = 42;827const size_t __idx __unused = __len - 1;828829__stack.__buf = malloc(__bufsz);830831memset_explicit(__stack.__buf, 0, __len);832#undef BUF833834}835836ATF_TC(memset_explicit_heap_after_end);837ATF_TC_HEAD(memset_explicit_heap_after_end, tc)838{839}840ATF_TC_BODY(memset_explicit_heap_after_end, tc)841{842#define BUF __stack.__buf843struct {844uint8_t padding_l;845unsigned char * __buf;846uint8_t padding_r;847} __stack;848const size_t __bufsz __unused = sizeof(*__stack.__buf) * (42);849const size_t __len = 42 + 1;850const size_t __idx __unused = __len - 1;851pid_t __child;852int __status;853854__child = fork();855ATF_REQUIRE(__child >= 0);856if (__child > 0)857goto monitor;858859/* Child */860disable_coredumps();861__stack.__buf = malloc(__bufsz);862863memset_explicit(__stack.__buf, 0, __len);864_exit(EX_SOFTWARE); /* Should have aborted. */865866monitor:867while (waitpid(__child, &__status, 0) != __child) {868ATF_REQUIRE_EQ(EINTR, errno);869}870871if (!WIFSIGNALED(__status)) {872switch (WEXITSTATUS(__status)) {873case EX_SOFTWARE:874atf_tc_fail("FORTIFY_SOURCE failed to abort");875break;876case EX_OSERR:877atf_tc_fail("setrlimit(2) failed");878break;879default:880atf_tc_fail("child exited with status %d",881WEXITSTATUS(__status));882}883} else {884ATF_REQUIRE_EQ(SIGABRT, WTERMSIG(__status));885}886#undef BUF887888}889890ATF_TC(stpcpy_before_end);891ATF_TC_HEAD(stpcpy_before_end, tc)892{893}894ATF_TC_BODY(stpcpy_before_end, tc)895{896#define BUF &__stack.__buf897struct {898uint8_t padding_l;899unsigned char __buf[42];900uint8_t padding_r;901} __stack;902const size_t __bufsz __unused = sizeof(__stack.__buf);903const size_t __len = 42 - 1;904const size_t __idx __unused = __len - 1;905char src[__len];906907memset(__stack.__buf, 0, __len);908memset(src, 'A', __len - 1);909src[__len - 1] = '\0';910911stpcpy(__stack.__buf, src);912#undef BUF913914}915916ATF_TC(stpcpy_end);917ATF_TC_HEAD(stpcpy_end, tc)918{919}920ATF_TC_BODY(stpcpy_end, tc)921{922#define BUF &__stack.__buf923struct {924uint8_t padding_l;925unsigned char __buf[42];926uint8_t padding_r;927} __stack;928const size_t __bufsz __unused = sizeof(__stack.__buf);929const size_t __len = 42;930const size_t __idx __unused = __len - 1;931char src[__len];932933memset(__stack.__buf, 0, __len);934memset(src, 'A', __len - 1);935src[__len - 1] = '\0';936937stpcpy(__stack.__buf, src);938#undef BUF939940}941942ATF_TC(stpcpy_heap_before_end);943ATF_TC_HEAD(stpcpy_heap_before_end, tc)944{945}946ATF_TC_BODY(stpcpy_heap_before_end, tc)947{948#define BUF __stack.__buf949struct {950uint8_t padding_l;951unsigned char * __buf;952uint8_t padding_r;953} __stack;954const size_t __bufsz __unused = sizeof(*__stack.__buf) * (42);955const size_t __len = 42 - 1;956const size_t __idx __unused = __len - 1;957char src[__len];958959__stack.__buf = malloc(__bufsz);960memset(__stack.__buf, 0, __len);961memset(src, 'A', __len - 1);962src[__len - 1] = '\0';963964stpcpy(__stack.__buf, src);965#undef BUF966967}968969ATF_TC(stpcpy_heap_end);970ATF_TC_HEAD(stpcpy_heap_end, tc)971{972}973ATF_TC_BODY(stpcpy_heap_end, tc)974{975#define BUF __stack.__buf976struct {977uint8_t padding_l;978unsigned char * __buf;979uint8_t padding_r;980} __stack;981const size_t __bufsz __unused = sizeof(*__stack.__buf) * (42);982const size_t __len = 42;983const size_t __idx __unused = __len - 1;984char src[__len];985986__stack.__buf = malloc(__bufsz);987memset(__stack.__buf, 0, __len);988memset(src, 'A', __len - 1);989src[__len - 1] = '\0';990991stpcpy(__stack.__buf, src);992#undef BUF993994}995996ATF_TC(stpcpy_heap_after_end);997ATF_TC_HEAD(stpcpy_heap_after_end, tc)998{999}1000ATF_TC_BODY(stpcpy_heap_after_end, tc)1001{1002#define BUF __stack.__buf1003struct {1004uint8_t padding_l;1005unsigned char * __buf;1006uint8_t padding_r;1007} __stack;1008const size_t __bufsz __unused = sizeof(*__stack.__buf) * (42);1009const size_t __len = 42 + 1;1010const size_t __idx __unused = __len - 1;1011pid_t __child;1012int __status;1013char src[__len];10141015__child = fork();1016ATF_REQUIRE(__child >= 0);1017if (__child > 0)1018goto monitor;10191020/* Child */1021disable_coredumps();1022__stack.__buf = malloc(__bufsz);1023memset(__stack.__buf, 0, __len);1024memset(src, 'A', __len - 1);1025src[__len - 1] = '\0';10261027stpcpy(__stack.__buf, src);1028_exit(EX_SOFTWARE); /* Should have aborted. */10291030monitor:1031while (waitpid(__child, &__status, 0) != __child) {1032ATF_REQUIRE_EQ(EINTR, errno);1033}10341035if (!WIFSIGNALED(__status)) {1036switch (WEXITSTATUS(__status)) {1037case EX_SOFTWARE:1038atf_tc_fail("FORTIFY_SOURCE failed to abort");1039break;1040case EX_OSERR:1041atf_tc_fail("setrlimit(2) failed");1042break;1043default:1044atf_tc_fail("child exited with status %d",1045WEXITSTATUS(__status));1046}1047} else {1048ATF_REQUIRE_EQ(SIGABRT, WTERMSIG(__status));1049}1050#undef BUF10511052}10531054ATF_TC(stpncpy_before_end);1055ATF_TC_HEAD(stpncpy_before_end, tc)1056{1057}1058ATF_TC_BODY(stpncpy_before_end, tc)1059{1060#define BUF &__stack.__buf1061struct {1062uint8_t padding_l;1063unsigned char __buf[42];1064uint8_t padding_r;1065} __stack;1066const size_t __bufsz __unused = sizeof(__stack.__buf);1067const size_t __len = 42 - 1;1068const size_t __idx __unused = __len - 1;1069char src[__len];10701071memset(__stack.__buf, 0, __len);1072memset(src, 'A', __len - 1);1073src[__len - 1] = '\0';10741075stpncpy(__stack.__buf, src, __len);1076#undef BUF10771078}10791080ATF_TC(stpncpy_end);1081ATF_TC_HEAD(stpncpy_end, tc)1082{1083}1084ATF_TC_BODY(stpncpy_end, tc)1085{1086#define BUF &__stack.__buf1087struct {1088uint8_t padding_l;1089unsigned char __buf[42];1090uint8_t padding_r;1091} __stack;1092const size_t __bufsz __unused = sizeof(__stack.__buf);1093const size_t __len = 42;1094const size_t __idx __unused = __len - 1;1095char src[__len];10961097memset(__stack.__buf, 0, __len);1098memset(src, 'A', __len - 1);1099src[__len - 1] = '\0';11001101stpncpy(__stack.__buf, src, __len);1102#undef BUF11031104}11051106ATF_TC(stpncpy_heap_before_end);1107ATF_TC_HEAD(stpncpy_heap_before_end, tc)1108{1109}1110ATF_TC_BODY(stpncpy_heap_before_end, tc)1111{1112#define BUF __stack.__buf1113struct {1114uint8_t padding_l;1115unsigned char * __buf;1116uint8_t padding_r;1117} __stack;1118const size_t __bufsz __unused = sizeof(*__stack.__buf) * (42);1119const size_t __len = 42 - 1;1120const size_t __idx __unused = __len - 1;1121char src[__len];11221123__stack.__buf = malloc(__bufsz);1124memset(__stack.__buf, 0, __len);1125memset(src, 'A', __len - 1);1126src[__len - 1] = '\0';11271128stpncpy(__stack.__buf, src, __len);1129#undef BUF11301131}11321133ATF_TC(stpncpy_heap_end);1134ATF_TC_HEAD(stpncpy_heap_end, tc)1135{1136}1137ATF_TC_BODY(stpncpy_heap_end, tc)1138{1139#define BUF __stack.__buf1140struct {1141uint8_t padding_l;1142unsigned char * __buf;1143uint8_t padding_r;1144} __stack;1145const size_t __bufsz __unused = sizeof(*__stack.__buf) * (42);1146const size_t __len = 42;1147const size_t __idx __unused = __len - 1;1148char src[__len];11491150__stack.__buf = malloc(__bufsz);1151memset(__stack.__buf, 0, __len);1152memset(src, 'A', __len - 1);1153src[__len - 1] = '\0';11541155stpncpy(__stack.__buf, src, __len);1156#undef BUF11571158}11591160ATF_TC(stpncpy_heap_after_end);1161ATF_TC_HEAD(stpncpy_heap_after_end, tc)1162{1163}1164ATF_TC_BODY(stpncpy_heap_after_end, tc)1165{1166#define BUF __stack.__buf1167struct {1168uint8_t padding_l;1169unsigned char * __buf;1170uint8_t padding_r;1171} __stack;1172const size_t __bufsz __unused = sizeof(*__stack.__buf) * (42);1173const size_t __len = 42 + 1;1174const size_t __idx __unused = __len - 1;1175pid_t __child;1176int __status;1177char src[__len];11781179__child = fork();1180ATF_REQUIRE(__child >= 0);1181if (__child > 0)1182goto monitor;11831184/* Child */1185disable_coredumps();1186__stack.__buf = malloc(__bufsz);1187memset(__stack.__buf, 0, __len);1188memset(src, 'A', __len - 1);1189src[__len - 1] = '\0';11901191stpncpy(__stack.__buf, src, __len);1192_exit(EX_SOFTWARE); /* Should have aborted. */11931194monitor:1195while (waitpid(__child, &__status, 0) != __child) {1196ATF_REQUIRE_EQ(EINTR, errno);1197}11981199if (!WIFSIGNALED(__status)) {1200switch (WEXITSTATUS(__status)) {1201case EX_SOFTWARE:1202atf_tc_fail("FORTIFY_SOURCE failed to abort");1203break;1204case EX_OSERR:1205atf_tc_fail("setrlimit(2) failed");1206break;1207default:1208atf_tc_fail("child exited with status %d",1209WEXITSTATUS(__status));1210}1211} else {1212ATF_REQUIRE_EQ(SIGABRT, WTERMSIG(__status));1213}1214#undef BUF12151216}12171218ATF_TC(strcat_before_end);1219ATF_TC_HEAD(strcat_before_end, tc)1220{1221}1222ATF_TC_BODY(strcat_before_end, tc)1223{1224#define BUF &__stack.__buf1225struct {1226uint8_t padding_l;1227unsigned char __buf[42];1228uint8_t padding_r;1229} __stack;1230const size_t __bufsz __unused = sizeof(__stack.__buf);1231const size_t __len = 42 - 1;1232const size_t __idx __unused = __len - 1;1233char src[__len];12341235memset(__stack.__buf, 0, __len);1236memset(src, 'A', __len - 1);1237src[__len - 1] = '\0';12381239strcat(__stack.__buf, src);1240#undef BUF12411242}12431244ATF_TC(strcat_end);1245ATF_TC_HEAD(strcat_end, tc)1246{1247}1248ATF_TC_BODY(strcat_end, tc)1249{1250#define BUF &__stack.__buf1251struct {1252uint8_t padding_l;1253unsigned char __buf[42];1254uint8_t padding_r;1255} __stack;1256const size_t __bufsz __unused = sizeof(__stack.__buf);1257const size_t __len = 42;1258const size_t __idx __unused = __len - 1;1259char src[__len];12601261memset(__stack.__buf, 0, __len);1262memset(src, 'A', __len - 1);1263src[__len - 1] = '\0';12641265strcat(__stack.__buf, src);1266#undef BUF12671268}12691270ATF_TC(strcat_heap_before_end);1271ATF_TC_HEAD(strcat_heap_before_end, tc)1272{1273}1274ATF_TC_BODY(strcat_heap_before_end, tc)1275{1276#define BUF __stack.__buf1277struct {1278uint8_t padding_l;1279unsigned char * __buf;1280uint8_t padding_r;1281} __stack;1282const size_t __bufsz __unused = sizeof(*__stack.__buf) * (42);1283const size_t __len = 42 - 1;1284const size_t __idx __unused = __len - 1;1285char src[__len];12861287__stack.__buf = malloc(__bufsz);1288memset(__stack.__buf, 0, __len);1289memset(src, 'A', __len - 1);1290src[__len - 1] = '\0';12911292strcat(__stack.__buf, src);1293#undef BUF12941295}12961297ATF_TC(strcat_heap_end);1298ATF_TC_HEAD(strcat_heap_end, tc)1299{1300}1301ATF_TC_BODY(strcat_heap_end, tc)1302{1303#define BUF __stack.__buf1304struct {1305uint8_t padding_l;1306unsigned char * __buf;1307uint8_t padding_r;1308} __stack;1309const size_t __bufsz __unused = sizeof(*__stack.__buf) * (42);1310const size_t __len = 42;1311const size_t __idx __unused = __len - 1;1312char src[__len];13131314__stack.__buf = malloc(__bufsz);1315memset(__stack.__buf, 0, __len);1316memset(src, 'A', __len - 1);1317src[__len - 1] = '\0';13181319strcat(__stack.__buf, src);1320#undef BUF13211322}13231324ATF_TC(strcat_heap_after_end);1325ATF_TC_HEAD(strcat_heap_after_end, tc)1326{1327}1328ATF_TC_BODY(strcat_heap_after_end, tc)1329{1330#define BUF __stack.__buf1331struct {1332uint8_t padding_l;1333unsigned char * __buf;1334uint8_t padding_r;1335} __stack;1336const size_t __bufsz __unused = sizeof(*__stack.__buf) * (42);1337const size_t __len = 42 + 1;1338const size_t __idx __unused = __len - 1;1339pid_t __child;1340int __status;1341char src[__len];13421343__child = fork();1344ATF_REQUIRE(__child >= 0);1345if (__child > 0)1346goto monitor;13471348/* Child */1349disable_coredumps();1350__stack.__buf = malloc(__bufsz);1351memset(__stack.__buf, 0, __len);1352memset(src, 'A', __len - 1);1353src[__len - 1] = '\0';13541355strcat(__stack.__buf, src);1356_exit(EX_SOFTWARE); /* Should have aborted. */13571358monitor:1359while (waitpid(__child, &__status, 0) != __child) {1360ATF_REQUIRE_EQ(EINTR, errno);1361}13621363if (!WIFSIGNALED(__status)) {1364switch (WEXITSTATUS(__status)) {1365case EX_SOFTWARE:1366atf_tc_fail("FORTIFY_SOURCE failed to abort");1367break;1368case EX_OSERR:1369atf_tc_fail("setrlimit(2) failed");1370break;1371default:1372atf_tc_fail("child exited with status %d",1373WEXITSTATUS(__status));1374}1375} else {1376ATF_REQUIRE_EQ(SIGABRT, WTERMSIG(__status));1377}1378#undef BUF13791380}13811382ATF_TC(strlcat_before_end);1383ATF_TC_HEAD(strlcat_before_end, tc)1384{1385}1386ATF_TC_BODY(strlcat_before_end, tc)1387{1388#define BUF &__stack.__buf1389struct {1390uint8_t padding_l;1391unsigned char __buf[42];1392uint8_t padding_r;1393} __stack;1394const size_t __bufsz __unused = sizeof(__stack.__buf);1395const size_t __len = 42 - 1;1396const size_t __idx __unused = __len - 1;1397char src[__len];13981399memset(__stack.__buf, 0, __len);1400memset(src, 'A', __len - 1);1401src[__len - 1] = '\0';14021403strlcat(__stack.__buf, src, __len);1404#undef BUF14051406}14071408ATF_TC(strlcat_end);1409ATF_TC_HEAD(strlcat_end, tc)1410{1411}1412ATF_TC_BODY(strlcat_end, tc)1413{1414#define BUF &__stack.__buf1415struct {1416uint8_t padding_l;1417unsigned char __buf[42];1418uint8_t padding_r;1419} __stack;1420const size_t __bufsz __unused = sizeof(__stack.__buf);1421const size_t __len = 42;1422const size_t __idx __unused = __len - 1;1423char src[__len];14241425memset(__stack.__buf, 0, __len);1426memset(src, 'A', __len - 1);1427src[__len - 1] = '\0';14281429strlcat(__stack.__buf, src, __len);1430#undef BUF14311432}14331434ATF_TC(strlcat_heap_before_end);1435ATF_TC_HEAD(strlcat_heap_before_end, tc)1436{1437}1438ATF_TC_BODY(strlcat_heap_before_end, tc)1439{1440#define BUF __stack.__buf1441struct {1442uint8_t padding_l;1443unsigned char * __buf;1444uint8_t padding_r;1445} __stack;1446const size_t __bufsz __unused = sizeof(*__stack.__buf) * (42);1447const size_t __len = 42 - 1;1448const size_t __idx __unused = __len - 1;1449char src[__len];14501451__stack.__buf = malloc(__bufsz);1452memset(__stack.__buf, 0, __len);1453memset(src, 'A', __len - 1);1454src[__len - 1] = '\0';14551456strlcat(__stack.__buf, src, __len);1457#undef BUF14581459}14601461ATF_TC(strlcat_heap_end);1462ATF_TC_HEAD(strlcat_heap_end, tc)1463{1464}1465ATF_TC_BODY(strlcat_heap_end, tc)1466{1467#define BUF __stack.__buf1468struct {1469uint8_t padding_l;1470unsigned char * __buf;1471uint8_t padding_r;1472} __stack;1473const size_t __bufsz __unused = sizeof(*__stack.__buf) * (42);1474const size_t __len = 42;1475const size_t __idx __unused = __len - 1;1476char src[__len];14771478__stack.__buf = malloc(__bufsz);1479memset(__stack.__buf, 0, __len);1480memset(src, 'A', __len - 1);1481src[__len - 1] = '\0';14821483strlcat(__stack.__buf, src, __len);1484#undef BUF14851486}14871488ATF_TC(strlcat_heap_after_end);1489ATF_TC_HEAD(strlcat_heap_after_end, tc)1490{1491}1492ATF_TC_BODY(strlcat_heap_after_end, tc)1493{1494#define BUF __stack.__buf1495struct {1496uint8_t padding_l;1497unsigned char * __buf;1498uint8_t padding_r;1499} __stack;1500const size_t __bufsz __unused = sizeof(*__stack.__buf) * (42);1501const size_t __len = 42 + 1;1502const size_t __idx __unused = __len - 1;1503pid_t __child;1504int __status;1505char src[__len];15061507__child = fork();1508ATF_REQUIRE(__child >= 0);1509if (__child > 0)1510goto monitor;15111512/* Child */1513disable_coredumps();1514__stack.__buf = malloc(__bufsz);1515memset(__stack.__buf, 0, __len);1516memset(src, 'A', __len - 1);1517src[__len - 1] = '\0';15181519strlcat(__stack.__buf, src, __len);1520_exit(EX_SOFTWARE); /* Should have aborted. */15211522monitor:1523while (waitpid(__child, &__status, 0) != __child) {1524ATF_REQUIRE_EQ(EINTR, errno);1525}15261527if (!WIFSIGNALED(__status)) {1528switch (WEXITSTATUS(__status)) {1529case EX_SOFTWARE:1530atf_tc_fail("FORTIFY_SOURCE failed to abort");1531break;1532case EX_OSERR:1533atf_tc_fail("setrlimit(2) failed");1534break;1535default:1536atf_tc_fail("child exited with status %d",1537WEXITSTATUS(__status));1538}1539} else {1540ATF_REQUIRE_EQ(SIGABRT, WTERMSIG(__status));1541}1542#undef BUF15431544}15451546ATF_TC(strncat_before_end);1547ATF_TC_HEAD(strncat_before_end, tc)1548{1549}1550ATF_TC_BODY(strncat_before_end, tc)1551{1552#define BUF &__stack.__buf1553struct {1554uint8_t padding_l;1555unsigned char __buf[42];1556uint8_t padding_r;1557} __stack;1558const size_t __bufsz __unused = sizeof(__stack.__buf);1559const size_t __len = 42 - 1;1560const size_t __idx __unused = __len - 1;1561char src[__len];15621563memset(__stack.__buf, 0, __len);1564memset(src, 'A', __len - 1);1565src[__len - 1] = '\0';15661567strncat(__stack.__buf, src, __len);1568#undef BUF15691570}15711572ATF_TC(strncat_end);1573ATF_TC_HEAD(strncat_end, tc)1574{1575}1576ATF_TC_BODY(strncat_end, tc)1577{1578#define BUF &__stack.__buf1579struct {1580uint8_t padding_l;1581unsigned char __buf[42];1582uint8_t padding_r;1583} __stack;1584const size_t __bufsz __unused = sizeof(__stack.__buf);1585const size_t __len = 42;1586const size_t __idx __unused = __len - 1;1587char src[__len];15881589memset(__stack.__buf, 0, __len);1590memset(src, 'A', __len - 1);1591src[__len - 1] = '\0';15921593strncat(__stack.__buf, src, __len);1594#undef BUF15951596}15971598ATF_TC(strncat_heap_before_end);1599ATF_TC_HEAD(strncat_heap_before_end, tc)1600{1601}1602ATF_TC_BODY(strncat_heap_before_end, tc)1603{1604#define BUF __stack.__buf1605struct {1606uint8_t padding_l;1607unsigned char * __buf;1608uint8_t padding_r;1609} __stack;1610const size_t __bufsz __unused = sizeof(*__stack.__buf) * (42);1611const size_t __len = 42 - 1;1612const size_t __idx __unused = __len - 1;1613char src[__len];16141615__stack.__buf = malloc(__bufsz);1616memset(__stack.__buf, 0, __len);1617memset(src, 'A', __len - 1);1618src[__len - 1] = '\0';16191620strncat(__stack.__buf, src, __len);1621#undef BUF16221623}16241625ATF_TC(strncat_heap_end);1626ATF_TC_HEAD(strncat_heap_end, tc)1627{1628}1629ATF_TC_BODY(strncat_heap_end, tc)1630{1631#define BUF __stack.__buf1632struct {1633uint8_t padding_l;1634unsigned char * __buf;1635uint8_t padding_r;1636} __stack;1637const size_t __bufsz __unused = sizeof(*__stack.__buf) * (42);1638const size_t __len = 42;1639const size_t __idx __unused = __len - 1;1640char src[__len];16411642__stack.__buf = malloc(__bufsz);1643memset(__stack.__buf, 0, __len);1644memset(src, 'A', __len - 1);1645src[__len - 1] = '\0';16461647strncat(__stack.__buf, src, __len);1648#undef BUF16491650}16511652ATF_TC(strncat_heap_after_end);1653ATF_TC_HEAD(strncat_heap_after_end, tc)1654{1655}1656ATF_TC_BODY(strncat_heap_after_end, tc)1657{1658#define BUF __stack.__buf1659struct {1660uint8_t padding_l;1661unsigned char * __buf;1662uint8_t padding_r;1663} __stack;1664const size_t __bufsz __unused = sizeof(*__stack.__buf) * (42);1665const size_t __len = 42 + 1;1666const size_t __idx __unused = __len - 1;1667pid_t __child;1668int __status;1669char src[__len];16701671__child = fork();1672ATF_REQUIRE(__child >= 0);1673if (__child > 0)1674goto monitor;16751676/* Child */1677disable_coredumps();1678__stack.__buf = malloc(__bufsz);1679memset(__stack.__buf, 0, __len);1680memset(src, 'A', __len - 1);1681src[__len - 1] = '\0';16821683strncat(__stack.__buf, src, __len);1684_exit(EX_SOFTWARE); /* Should have aborted. */16851686monitor:1687while (waitpid(__child, &__status, 0) != __child) {1688ATF_REQUIRE_EQ(EINTR, errno);1689}16901691if (!WIFSIGNALED(__status)) {1692switch (WEXITSTATUS(__status)) {1693case EX_SOFTWARE:1694atf_tc_fail("FORTIFY_SOURCE failed to abort");1695break;1696case EX_OSERR:1697atf_tc_fail("setrlimit(2) failed");1698break;1699default:1700atf_tc_fail("child exited with status %d",1701WEXITSTATUS(__status));1702}1703} else {1704ATF_REQUIRE_EQ(SIGABRT, WTERMSIG(__status));1705}1706#undef BUF17071708}17091710ATF_TC(strcpy_before_end);1711ATF_TC_HEAD(strcpy_before_end, tc)1712{1713}1714ATF_TC_BODY(strcpy_before_end, tc)1715{1716#define BUF &__stack.__buf1717struct {1718uint8_t padding_l;1719unsigned char __buf[42];1720uint8_t padding_r;1721} __stack;1722const size_t __bufsz __unused = sizeof(__stack.__buf);1723const size_t __len = 42 - 1;1724const size_t __idx __unused = __len - 1;1725char src[__len];17261727memset(__stack.__buf, 0, __len);1728memset(src, 'A', __len - 1);1729src[__len - 1] = '\0';17301731strcpy(__stack.__buf, src);1732#undef BUF17331734}17351736ATF_TC(strcpy_end);1737ATF_TC_HEAD(strcpy_end, tc)1738{1739}1740ATF_TC_BODY(strcpy_end, tc)1741{1742#define BUF &__stack.__buf1743struct {1744uint8_t padding_l;1745unsigned char __buf[42];1746uint8_t padding_r;1747} __stack;1748const size_t __bufsz __unused = sizeof(__stack.__buf);1749const size_t __len = 42;1750const size_t __idx __unused = __len - 1;1751char src[__len];17521753memset(__stack.__buf, 0, __len);1754memset(src, 'A', __len - 1);1755src[__len - 1] = '\0';17561757strcpy(__stack.__buf, src);1758#undef BUF17591760}17611762ATF_TC(strcpy_heap_before_end);1763ATF_TC_HEAD(strcpy_heap_before_end, tc)1764{1765}1766ATF_TC_BODY(strcpy_heap_before_end, tc)1767{1768#define BUF __stack.__buf1769struct {1770uint8_t padding_l;1771unsigned char * __buf;1772uint8_t padding_r;1773} __stack;1774const size_t __bufsz __unused = sizeof(*__stack.__buf) * (42);1775const size_t __len = 42 - 1;1776const size_t __idx __unused = __len - 1;1777char src[__len];17781779__stack.__buf = malloc(__bufsz);1780memset(__stack.__buf, 0, __len);1781memset(src, 'A', __len - 1);1782src[__len - 1] = '\0';17831784strcpy(__stack.__buf, src);1785#undef BUF17861787}17881789ATF_TC(strcpy_heap_end);1790ATF_TC_HEAD(strcpy_heap_end, tc)1791{1792}1793ATF_TC_BODY(strcpy_heap_end, tc)1794{1795#define BUF __stack.__buf1796struct {1797uint8_t padding_l;1798unsigned char * __buf;1799uint8_t padding_r;1800} __stack;1801const size_t __bufsz __unused = sizeof(*__stack.__buf) * (42);1802const size_t __len = 42;1803const size_t __idx __unused = __len - 1;1804char src[__len];18051806__stack.__buf = malloc(__bufsz);1807memset(__stack.__buf, 0, __len);1808memset(src, 'A', __len - 1);1809src[__len - 1] = '\0';18101811strcpy(__stack.__buf, src);1812#undef BUF18131814}18151816ATF_TC(strcpy_heap_after_end);1817ATF_TC_HEAD(strcpy_heap_after_end, tc)1818{1819}1820ATF_TC_BODY(strcpy_heap_after_end, tc)1821{1822#define BUF __stack.__buf1823struct {1824uint8_t padding_l;1825unsigned char * __buf;1826uint8_t padding_r;1827} __stack;1828const size_t __bufsz __unused = sizeof(*__stack.__buf) * (42);1829const size_t __len = 42 + 1;1830const size_t __idx __unused = __len - 1;1831pid_t __child;1832int __status;1833char src[__len];18341835__child = fork();1836ATF_REQUIRE(__child >= 0);1837if (__child > 0)1838goto monitor;18391840/* Child */1841disable_coredumps();1842__stack.__buf = malloc(__bufsz);1843memset(__stack.__buf, 0, __len);1844memset(src, 'A', __len - 1);1845src[__len - 1] = '\0';18461847strcpy(__stack.__buf, src);1848_exit(EX_SOFTWARE); /* Should have aborted. */18491850monitor:1851while (waitpid(__child, &__status, 0) != __child) {1852ATF_REQUIRE_EQ(EINTR, errno);1853}18541855if (!WIFSIGNALED(__status)) {1856switch (WEXITSTATUS(__status)) {1857case EX_SOFTWARE:1858atf_tc_fail("FORTIFY_SOURCE failed to abort");1859break;1860case EX_OSERR:1861atf_tc_fail("setrlimit(2) failed");1862break;1863default:1864atf_tc_fail("child exited with status %d",1865WEXITSTATUS(__status));1866}1867} else {1868ATF_REQUIRE_EQ(SIGABRT, WTERMSIG(__status));1869}1870#undef BUF18711872}18731874ATF_TC(strlcpy_before_end);1875ATF_TC_HEAD(strlcpy_before_end, tc)1876{1877}1878ATF_TC_BODY(strlcpy_before_end, tc)1879{1880#define BUF &__stack.__buf1881struct {1882uint8_t padding_l;1883unsigned char __buf[42];1884uint8_t padding_r;1885} __stack;1886const size_t __bufsz __unused = sizeof(__stack.__buf);1887const size_t __len = 42 - 1;1888const size_t __idx __unused = __len - 1;1889char src[__len];18901891memset(__stack.__buf, 0, __len);1892memset(src, 'A', __len - 1);1893src[__len - 1] = '\0';18941895strlcpy(__stack.__buf, src, __len);1896#undef BUF18971898}18991900ATF_TC(strlcpy_end);1901ATF_TC_HEAD(strlcpy_end, tc)1902{1903}1904ATF_TC_BODY(strlcpy_end, tc)1905{1906#define BUF &__stack.__buf1907struct {1908uint8_t padding_l;1909unsigned char __buf[42];1910uint8_t padding_r;1911} __stack;1912const size_t __bufsz __unused = sizeof(__stack.__buf);1913const size_t __len = 42;1914const size_t __idx __unused = __len - 1;1915char src[__len];19161917memset(__stack.__buf, 0, __len);1918memset(src, 'A', __len - 1);1919src[__len - 1] = '\0';19201921strlcpy(__stack.__buf, src, __len);1922#undef BUF19231924}19251926ATF_TC(strlcpy_heap_before_end);1927ATF_TC_HEAD(strlcpy_heap_before_end, tc)1928{1929}1930ATF_TC_BODY(strlcpy_heap_before_end, tc)1931{1932#define BUF __stack.__buf1933struct {1934uint8_t padding_l;1935unsigned char * __buf;1936uint8_t padding_r;1937} __stack;1938const size_t __bufsz __unused = sizeof(*__stack.__buf) * (42);1939const size_t __len = 42 - 1;1940const size_t __idx __unused = __len - 1;1941char src[__len];19421943__stack.__buf = malloc(__bufsz);1944memset(__stack.__buf, 0, __len);1945memset(src, 'A', __len - 1);1946src[__len - 1] = '\0';19471948strlcpy(__stack.__buf, src, __len);1949#undef BUF19501951}19521953ATF_TC(strlcpy_heap_end);1954ATF_TC_HEAD(strlcpy_heap_end, tc)1955{1956}1957ATF_TC_BODY(strlcpy_heap_end, tc)1958{1959#define BUF __stack.__buf1960struct {1961uint8_t padding_l;1962unsigned char * __buf;1963uint8_t padding_r;1964} __stack;1965const size_t __bufsz __unused = sizeof(*__stack.__buf) * (42);1966const size_t __len = 42;1967const size_t __idx __unused = __len - 1;1968char src[__len];19691970__stack.__buf = malloc(__bufsz);1971memset(__stack.__buf, 0, __len);1972memset(src, 'A', __len - 1);1973src[__len - 1] = '\0';19741975strlcpy(__stack.__buf, src, __len);1976#undef BUF19771978}19791980ATF_TC(strlcpy_heap_after_end);1981ATF_TC_HEAD(strlcpy_heap_after_end, tc)1982{1983}1984ATF_TC_BODY(strlcpy_heap_after_end, tc)1985{1986#define BUF __stack.__buf1987struct {1988uint8_t padding_l;1989unsigned char * __buf;1990uint8_t padding_r;1991} __stack;1992const size_t __bufsz __unused = sizeof(*__stack.__buf) * (42);1993const size_t __len = 42 + 1;1994const size_t __idx __unused = __len - 1;1995pid_t __child;1996int __status;1997char src[__len];19981999__child = fork();2000ATF_REQUIRE(__child >= 0);2001if (__child > 0)2002goto monitor;20032004/* Child */2005disable_coredumps();2006__stack.__buf = malloc(__bufsz);2007memset(__stack.__buf, 0, __len);2008memset(src, 'A', __len - 1);2009src[__len - 1] = '\0';20102011strlcpy(__stack.__buf, src, __len);2012_exit(EX_SOFTWARE); /* Should have aborted. */20132014monitor:2015while (waitpid(__child, &__status, 0) != __child) {2016ATF_REQUIRE_EQ(EINTR, errno);2017}20182019if (!WIFSIGNALED(__status)) {2020switch (WEXITSTATUS(__status)) {2021case EX_SOFTWARE:2022atf_tc_fail("FORTIFY_SOURCE failed to abort");2023break;2024case EX_OSERR:2025atf_tc_fail("setrlimit(2) failed");2026break;2027default:2028atf_tc_fail("child exited with status %d",2029WEXITSTATUS(__status));2030}2031} else {2032ATF_REQUIRE_EQ(SIGABRT, WTERMSIG(__status));2033}2034#undef BUF20352036}20372038ATF_TC(strncpy_before_end);2039ATF_TC_HEAD(strncpy_before_end, tc)2040{2041}2042ATF_TC_BODY(strncpy_before_end, tc)2043{2044#define BUF &__stack.__buf2045struct {2046uint8_t padding_l;2047unsigned char __buf[42];2048uint8_t padding_r;2049} __stack;2050const size_t __bufsz __unused = sizeof(__stack.__buf);2051const size_t __len = 42 - 1;2052const size_t __idx __unused = __len - 1;2053char src[__len];20542055memset(__stack.__buf, 0, __len);2056memset(src, 'A', __len - 1);2057src[__len - 1] = '\0';20582059strncpy(__stack.__buf, src, __len);2060#undef BUF20612062}20632064ATF_TC(strncpy_end);2065ATF_TC_HEAD(strncpy_end, tc)2066{2067}2068ATF_TC_BODY(strncpy_end, tc)2069{2070#define BUF &__stack.__buf2071struct {2072uint8_t padding_l;2073unsigned char __buf[42];2074uint8_t padding_r;2075} __stack;2076const size_t __bufsz __unused = sizeof(__stack.__buf);2077const size_t __len = 42;2078const size_t __idx __unused = __len - 1;2079char src[__len];20802081memset(__stack.__buf, 0, __len);2082memset(src, 'A', __len - 1);2083src[__len - 1] = '\0';20842085strncpy(__stack.__buf, src, __len);2086#undef BUF20872088}20892090ATF_TC(strncpy_heap_before_end);2091ATF_TC_HEAD(strncpy_heap_before_end, tc)2092{2093}2094ATF_TC_BODY(strncpy_heap_before_end, tc)2095{2096#define BUF __stack.__buf2097struct {2098uint8_t padding_l;2099unsigned char * __buf;2100uint8_t padding_r;2101} __stack;2102const size_t __bufsz __unused = sizeof(*__stack.__buf) * (42);2103const size_t __len = 42 - 1;2104const size_t __idx __unused = __len - 1;2105char src[__len];21062107__stack.__buf = malloc(__bufsz);2108memset(__stack.__buf, 0, __len);2109memset(src, 'A', __len - 1);2110src[__len - 1] = '\0';21112112strncpy(__stack.__buf, src, __len);2113#undef BUF21142115}21162117ATF_TC(strncpy_heap_end);2118ATF_TC_HEAD(strncpy_heap_end, tc)2119{2120}2121ATF_TC_BODY(strncpy_heap_end, tc)2122{2123#define BUF __stack.__buf2124struct {2125uint8_t padding_l;2126unsigned char * __buf;2127uint8_t padding_r;2128} __stack;2129const size_t __bufsz __unused = sizeof(*__stack.__buf) * (42);2130const size_t __len = 42;2131const size_t __idx __unused = __len - 1;2132char src[__len];21332134__stack.__buf = malloc(__bufsz);2135memset(__stack.__buf, 0, __len);2136memset(src, 'A', __len - 1);2137src[__len - 1] = '\0';21382139strncpy(__stack.__buf, src, __len);2140#undef BUF21412142}21432144ATF_TC(strncpy_heap_after_end);2145ATF_TC_HEAD(strncpy_heap_after_end, tc)2146{2147}2148ATF_TC_BODY(strncpy_heap_after_end, tc)2149{2150#define BUF __stack.__buf2151struct {2152uint8_t padding_l;2153unsigned char * __buf;2154uint8_t padding_r;2155} __stack;2156const size_t __bufsz __unused = sizeof(*__stack.__buf) * (42);2157const size_t __len = 42 + 1;2158const size_t __idx __unused = __len - 1;2159pid_t __child;2160int __status;2161char src[__len];21622163__child = fork();2164ATF_REQUIRE(__child >= 0);2165if (__child > 0)2166goto monitor;21672168/* Child */2169disable_coredumps();2170__stack.__buf = malloc(__bufsz);2171memset(__stack.__buf, 0, __len);2172memset(src, 'A', __len - 1);2173src[__len - 1] = '\0';21742175strncpy(__stack.__buf, src, __len);2176_exit(EX_SOFTWARE); /* Should have aborted. */21772178monitor:2179while (waitpid(__child, &__status, 0) != __child) {2180ATF_REQUIRE_EQ(EINTR, errno);2181}21822183if (!WIFSIGNALED(__status)) {2184switch (WEXITSTATUS(__status)) {2185case EX_SOFTWARE:2186atf_tc_fail("FORTIFY_SOURCE failed to abort");2187break;2188case EX_OSERR:2189atf_tc_fail("setrlimit(2) failed");2190break;2191default:2192atf_tc_fail("child exited with status %d",2193WEXITSTATUS(__status));2194}2195} else {2196ATF_REQUIRE_EQ(SIGABRT, WTERMSIG(__status));2197}2198#undef BUF21992200}22012202ATF_TP_ADD_TCS(tp)2203{2204ATF_TP_ADD_TC(tp, memcpy_before_end);2205ATF_TP_ADD_TC(tp, memcpy_end);2206ATF_TP_ADD_TC(tp, memcpy_heap_before_end);2207ATF_TP_ADD_TC(tp, memcpy_heap_end);2208ATF_TP_ADD_TC(tp, memcpy_heap_after_end);2209ATF_TP_ADD_TC(tp, mempcpy_before_end);2210ATF_TP_ADD_TC(tp, mempcpy_end);2211ATF_TP_ADD_TC(tp, mempcpy_heap_before_end);2212ATF_TP_ADD_TC(tp, mempcpy_heap_end);2213ATF_TP_ADD_TC(tp, mempcpy_heap_after_end);2214ATF_TP_ADD_TC(tp, memmove_before_end);2215ATF_TP_ADD_TC(tp, memmove_end);2216ATF_TP_ADD_TC(tp, memmove_heap_before_end);2217ATF_TP_ADD_TC(tp, memmove_heap_end);2218ATF_TP_ADD_TC(tp, memmove_heap_after_end);2219ATF_TP_ADD_TC(tp, memset_before_end);2220ATF_TP_ADD_TC(tp, memset_end);2221ATF_TP_ADD_TC(tp, memset_heap_before_end);2222ATF_TP_ADD_TC(tp, memset_heap_end);2223ATF_TP_ADD_TC(tp, memset_heap_after_end);2224ATF_TP_ADD_TC(tp, memset_explicit_before_end);2225ATF_TP_ADD_TC(tp, memset_explicit_end);2226ATF_TP_ADD_TC(tp, memset_explicit_heap_before_end);2227ATF_TP_ADD_TC(tp, memset_explicit_heap_end);2228ATF_TP_ADD_TC(tp, memset_explicit_heap_after_end);2229ATF_TP_ADD_TC(tp, stpcpy_before_end);2230ATF_TP_ADD_TC(tp, stpcpy_end);2231ATF_TP_ADD_TC(tp, stpcpy_heap_before_end);2232ATF_TP_ADD_TC(tp, stpcpy_heap_end);2233ATF_TP_ADD_TC(tp, stpcpy_heap_after_end);2234ATF_TP_ADD_TC(tp, stpncpy_before_end);2235ATF_TP_ADD_TC(tp, stpncpy_end);2236ATF_TP_ADD_TC(tp, stpncpy_heap_before_end);2237ATF_TP_ADD_TC(tp, stpncpy_heap_end);2238ATF_TP_ADD_TC(tp, stpncpy_heap_after_end);2239ATF_TP_ADD_TC(tp, strcat_before_end);2240ATF_TP_ADD_TC(tp, strcat_end);2241ATF_TP_ADD_TC(tp, strcat_heap_before_end);2242ATF_TP_ADD_TC(tp, strcat_heap_end);2243ATF_TP_ADD_TC(tp, strcat_heap_after_end);2244ATF_TP_ADD_TC(tp, strlcat_before_end);2245ATF_TP_ADD_TC(tp, strlcat_end);2246ATF_TP_ADD_TC(tp, strlcat_heap_before_end);2247ATF_TP_ADD_TC(tp, strlcat_heap_end);2248ATF_TP_ADD_TC(tp, strlcat_heap_after_end);2249ATF_TP_ADD_TC(tp, strncat_before_end);2250ATF_TP_ADD_TC(tp, strncat_end);2251ATF_TP_ADD_TC(tp, strncat_heap_before_end);2252ATF_TP_ADD_TC(tp, strncat_heap_end);2253ATF_TP_ADD_TC(tp, strncat_heap_after_end);2254ATF_TP_ADD_TC(tp, strcpy_before_end);2255ATF_TP_ADD_TC(tp, strcpy_end);2256ATF_TP_ADD_TC(tp, strcpy_heap_before_end);2257ATF_TP_ADD_TC(tp, strcpy_heap_end);2258ATF_TP_ADD_TC(tp, strcpy_heap_after_end);2259ATF_TP_ADD_TC(tp, strlcpy_before_end);2260ATF_TP_ADD_TC(tp, strlcpy_end);2261ATF_TP_ADD_TC(tp, strlcpy_heap_before_end);2262ATF_TP_ADD_TC(tp, strlcpy_heap_end);2263ATF_TP_ADD_TC(tp, strlcpy_heap_after_end);2264ATF_TP_ADD_TC(tp, strncpy_before_end);2265ATF_TP_ADD_TC(tp, strncpy_end);2266ATF_TP_ADD_TC(tp, strncpy_heap_before_end);2267ATF_TP_ADD_TC(tp, strncpy_heap_end);2268ATF_TP_ADD_TC(tp, strncpy_heap_after_end);2269return (atf_no_error());2270}227122722273