/* * Copyright (C) 2013 The Android Open Source Project * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * You may obtain a copy of the License at * * http://www.apache.org/licenses/LICENSE-2.0 * * Unless required by applicable law or agreed to in writing, software * distributed under the License is distributed on an "AS IS" BASIS, * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. * See the License for the specific language governing permissions and * limitations under the License. */ #undef _FORTIFY_SOURCE #define _FORTIFY_SOURCE 1 #include #include #if __BIONIC__ // We have to say "DeathTest" here so gtest knows to run this test (which exits) // in its own process. // multibyte target where we over fill (should fail) TEST(Fortify1_DeathTest, strcpy_fortified) { ::testing::FLAGS_gtest_death_test_style = "threadsafe"; char buf[10]; char *orig = strdup("0123456789"); ASSERT_EXIT(strcpy(buf, orig), testing::KilledBySignal(SIGABRT), ""); free(orig); } // zero sized target with "\0" source (should fail) TEST(Fortify1_DeathTest, strcpy2_fortified) { ::testing::FLAGS_gtest_death_test_style = "threadsafe"; char buf[0]; char *orig = strdup(""); ASSERT_EXIT(strcpy(buf, orig), testing::KilledBySignal(SIGABRT), ""); free(orig); } // zero sized target with longer source (should fail) TEST(Fortify1_DeathTest, strcpy3_fortified) { ::testing::FLAGS_gtest_death_test_style = "threadsafe"; char buf[0]; char *orig = strdup("1"); ASSERT_EXIT(strcpy(buf, orig), testing::KilledBySignal(SIGABRT), ""); free(orig); } // one byte target with longer source (should fail) TEST(Fortify1_DeathTest, strcpy4_fortified) { ::testing::FLAGS_gtest_death_test_style = "threadsafe"; char buf[1]; char *orig = strdup("12"); ASSERT_EXIT(strcpy(buf, orig), testing::KilledBySignal(SIGABRT), ""); free(orig); } TEST(Fortify1_DeathTest, strlen_fortified) { ::testing::FLAGS_gtest_death_test_style = "threadsafe"; char buf[10]; memcpy(buf, "0123456789", sizeof(buf)); ASSERT_EXIT(printf("%d", strlen(buf)), testing::KilledBySignal(SIGABRT), ""); } TEST(Fortify1_DeathTest, strchr_fortified) { ::testing::FLAGS_gtest_death_test_style = "threadsafe"; char buf[10]; memcpy(buf, "0123456789", sizeof(buf)); ASSERT_EXIT(printf("%s", strchr(buf, 'a')), testing::KilledBySignal(SIGABRT), ""); } TEST(Fortify1_DeathTest, strrchr_fortified) { ::testing::FLAGS_gtest_death_test_style = "threadsafe"; char buf[10]; memcpy(buf, "0123456789", sizeof(buf)); ASSERT_EXIT(printf("%s", strrchr(buf, 'a')), testing::KilledBySignal(SIGABRT), ""); } #endif TEST(Fortify1_DeathTest, sprintf_fortified) { ::testing::FLAGS_gtest_death_test_style = "threadsafe"; char buf[10]; char source_buf[15]; memcpy(source_buf, "12345678901234", 15); ASSERT_EXIT(sprintf(buf, "%s", source_buf), testing::KilledBySignal(SIGABRT), ""); } TEST(Fortify1_DeathTest, strncat_fortified) { ::testing::FLAGS_gtest_death_test_style = "threadsafe"; char buf[10]; size_t n = atoi("10"); // avoid compiler optimizations strncpy(buf, "012345678", n); ASSERT_EXIT(strncat(buf, "9", n), testing::KilledBySignal(SIGABRT), ""); } TEST(Fortify1_DeathTest, strncat2_fortified) { ::testing::FLAGS_gtest_death_test_style = "threadsafe"; char buf[10]; buf[0] = '\0'; size_t n = atoi("10"); // avoid compiler optimizations ASSERT_EXIT(strncat(buf, "0123456789", n), testing::KilledBySignal(SIGABRT), ""); } TEST(Fortify1_DeathTest, strcat_fortified) { ::testing::FLAGS_gtest_death_test_style = "threadsafe"; char src[11]; strcpy(src, "0123456789"); char buf[10]; buf[0] = '\0'; ASSERT_EXIT(strcat(buf, src), testing::KilledBySignal(SIGABRT), ""); } extern "C" char* __strncat_chk(char*, const char*, size_t, size_t); extern "C" char* __strcat_chk(char*, const char*, size_t); TEST(Fortify1, strncat) { char buf[10]; memset(buf, 'A', sizeof(buf)); buf[0] = 'a'; buf[1] = '\0'; char* res = __strncat_chk(buf, "01234", sizeof(buf) - strlen(buf) - 1, sizeof(buf)); ASSERT_EQ(buf, res); ASSERT_EQ('a', buf[0]); ASSERT_EQ('0', buf[1]); ASSERT_EQ('1', buf[2]); ASSERT_EQ('2', buf[3]); ASSERT_EQ('3', buf[4]); ASSERT_EQ('4', buf[5]); ASSERT_EQ('\0', buf[6]); ASSERT_EQ('A', buf[7]); ASSERT_EQ('A', buf[8]); ASSERT_EQ('A', buf[9]); } TEST(Fortify1, strncat2) { char buf[10]; memset(buf, 'A', sizeof(buf)); buf[0] = 'a'; buf[1] = '\0'; char* res = __strncat_chk(buf, "0123456789", 5, sizeof(buf)); ASSERT_EQ(buf, res); ASSERT_EQ('a', buf[0]); ASSERT_EQ('0', buf[1]); ASSERT_EQ('1', buf[2]); ASSERT_EQ('2', buf[3]); ASSERT_EQ('3', buf[4]); ASSERT_EQ('4', buf[5]); ASSERT_EQ('\0', buf[6]); ASSERT_EQ('A', buf[7]); ASSERT_EQ('A', buf[8]); ASSERT_EQ('A', buf[9]); } TEST(Fortify1, strncat3) { char buf[10]; memset(buf, 'A', sizeof(buf)); buf[0] = '\0'; char* res = __strncat_chk(buf, "0123456789", 5, sizeof(buf)); ASSERT_EQ(buf, res); ASSERT_EQ('0', buf[0]); ASSERT_EQ('1', buf[1]); ASSERT_EQ('2', buf[2]); ASSERT_EQ('3', buf[3]); ASSERT_EQ('4', buf[4]); ASSERT_EQ('\0', buf[5]); ASSERT_EQ('A', buf[6]); ASSERT_EQ('A', buf[7]); ASSERT_EQ('A', buf[8]); ASSERT_EQ('A', buf[9]); } TEST(Fortify1, strncat4) { char buf[10]; memset(buf, 'A', sizeof(buf)); buf[9] = '\0'; char* res = __strncat_chk(buf, "", 5, sizeof(buf)); ASSERT_EQ(buf, res); ASSERT_EQ('A', buf[0]); ASSERT_EQ('A', buf[1]); ASSERT_EQ('A', buf[2]); ASSERT_EQ('A', buf[3]); ASSERT_EQ('A', buf[4]); ASSERT_EQ('A', buf[5]); ASSERT_EQ('A', buf[6]); ASSERT_EQ('A', buf[7]); ASSERT_EQ('A', buf[8]); ASSERT_EQ('\0', buf[9]); } TEST(Fortify1, strncat5) { char buf[10]; memset(buf, 'A', sizeof(buf)); buf[0] = 'a'; buf[1] = '\0'; char* res = __strncat_chk(buf, "01234567", 8, sizeof(buf)); ASSERT_EQ(buf, res); ASSERT_EQ('a', buf[0]); ASSERT_EQ('0', buf[1]); ASSERT_EQ('1', buf[2]); ASSERT_EQ('2', buf[3]); ASSERT_EQ('3', buf[4]); ASSERT_EQ('4', buf[5]); ASSERT_EQ('5', buf[6]); ASSERT_EQ('6', buf[7]); ASSERT_EQ('7', buf[8]); ASSERT_EQ('\0', buf[9]); } TEST(Fortify1, strncat6) { char buf[10]; memset(buf, 'A', sizeof(buf)); buf[0] = 'a'; buf[1] = '\0'; char* res = __strncat_chk(buf, "01234567", 9, sizeof(buf)); ASSERT_EQ(buf, res); ASSERT_EQ('a', buf[0]); ASSERT_EQ('0', buf[1]); ASSERT_EQ('1', buf[2]); ASSERT_EQ('2', buf[3]); ASSERT_EQ('3', buf[4]); ASSERT_EQ('4', buf[5]); ASSERT_EQ('5', buf[6]); ASSERT_EQ('6', buf[7]); ASSERT_EQ('7', buf[8]); ASSERT_EQ('\0', buf[9]); } TEST(Fortify1, strcat) { char buf[10]; memset(buf, 'A', sizeof(buf)); buf[0] = 'a'; buf[1] = '\0'; char* res = __strcat_chk(buf, "01234", sizeof(buf)); ASSERT_EQ(buf, res); ASSERT_EQ('a', buf[0]); ASSERT_EQ('0', buf[1]); ASSERT_EQ('1', buf[2]); ASSERT_EQ('2', buf[3]); ASSERT_EQ('3', buf[4]); ASSERT_EQ('4', buf[5]); ASSERT_EQ('\0', buf[6]); ASSERT_EQ('A', buf[7]); ASSERT_EQ('A', buf[8]); ASSERT_EQ('A', buf[9]); } TEST(Fortify1, strcat2) { char buf[10]; memset(buf, 'A', sizeof(buf)); buf[0] = 'a'; buf[1] = '\0'; char* res = __strcat_chk(buf, "01234567", sizeof(buf)); ASSERT_EQ(buf, res); ASSERT_EQ('a', buf[0]); ASSERT_EQ('0', buf[1]); ASSERT_EQ('1', buf[2]); ASSERT_EQ('2', buf[3]); ASSERT_EQ('3', buf[4]); ASSERT_EQ('4', buf[5]); ASSERT_EQ('5', buf[6]); ASSERT_EQ('6', buf[7]); ASSERT_EQ('7', buf[8]); ASSERT_EQ('\0', buf[9]); }