Page MenuHomeFreeBSD
Files F166339712

D58289.diff
No OneTemporary
Actions

D58289.diff
View Options

diff --git a/lib/libc/tests/secure/fortify_uio_test.c b/lib/libc/tests/secure/fortify_uio_test.c
--- a/lib/libc/tests/secure/fortify_uio_test.c
+++ b/lib/libc/tests/secure/fortify_uio_test.c
@@ -181,6 +181,11 @@
replace_stdin();
+ for (size_t __i = 0; __i < 2; __i++) {
+ __stack.__buf[__i].iov_base = &__stack.padding_l;
+ __stack.__buf[__i].iov_len = 1;
+ }
+
readv(STDIN_FILENO, __stack.__buf, __len);
#undef BUF
@@ -204,6 +209,11 @@
replace_stdin();
+ for (size_t __i = 0; __i < 2; __i++) {
+ __stack.__buf[__i].iov_base = &__stack.padding_l;
+ __stack.__buf[__i].iov_len = 1;
+ }
+
readv(STDIN_FILENO, __stack.__buf, __len);
#undef BUF
@@ -236,6 +246,11 @@
disable_coredumps();
replace_stdin();
+ for (size_t __i = 0; __i < 2; __i++) {
+ __stack.__buf[__i].iov_base = &__stack.padding_l;
+ __stack.__buf[__i].iov_len = 1;
+ }
+
readv(STDIN_FILENO, __stack.__buf, __len);
_exit(EX_SOFTWARE); /* Should have aborted. */
@@ -282,6 +297,11 @@
__stack.__buf = malloc(__bufsz);
replace_stdin();
+ for (size_t __i = 0; __i < 2; __i++) {
+ __stack.__buf[__i].iov_base = &__stack.padding_l;
+ __stack.__buf[__i].iov_len = 1;
+ }
+
readv(STDIN_FILENO, __stack.__buf, __len);
#undef BUF
@@ -306,6 +326,11 @@
__stack.__buf = malloc(__bufsz);
replace_stdin();
+ for (size_t __i = 0; __i < 2; __i++) {
+ __stack.__buf[__i].iov_base = &__stack.padding_l;
+ __stack.__buf[__i].iov_len = 1;
+ }
+
readv(STDIN_FILENO, __stack.__buf, __len);
#undef BUF
@@ -339,6 +364,11 @@
__stack.__buf = malloc(__bufsz);
replace_stdin();
+ for (size_t __i = 0; __i < 2; __i++) {
+ __stack.__buf[__i].iov_base = &__stack.padding_l;
+ __stack.__buf[__i].iov_len = 1;
+ }
+
readv(STDIN_FILENO, __stack.__buf, __len);
_exit(EX_SOFTWARE); /* Should have aborted. */
@@ -383,11 +413,11 @@
const size_t __idx __unused = __len - 1;
struct iovec iov[1];
+ replace_stdin();
+
iov[0].iov_base = __stack.__buf;
iov[0].iov_len = __len;
- replace_stdin();
-
readv(STDIN_FILENO, iov, nitems(iov));
#undef BUF
@@ -410,11 +440,11 @@
const size_t __idx __unused = __len - 1;
struct iovec iov[1];
+ replace_stdin();
+
iov[0].iov_base = __stack.__buf;
iov[0].iov_len = __len;
- replace_stdin();
-
readv(STDIN_FILENO, iov, nitems(iov));
#undef BUF
@@ -438,11 +468,11 @@
struct iovec iov[1];
__stack.__buf = malloc(__bufsz);
+ replace_stdin();
+
iov[0].iov_base = __stack.__buf;
iov[0].iov_len = __len;
- replace_stdin();
-
readv(STDIN_FILENO, iov, nitems(iov));
#undef BUF
@@ -466,11 +496,11 @@
struct iovec iov[1];
__stack.__buf = malloc(__bufsz);
+ replace_stdin();
+
iov[0].iov_base = __stack.__buf;
iov[0].iov_len = __len;
- replace_stdin();
-
readv(STDIN_FILENO, iov, nitems(iov));
#undef BUF
@@ -503,11 +533,11 @@
/* Child */
disable_coredumps();
__stack.__buf = malloc(__bufsz);
+ replace_stdin();
+
iov[0].iov_base = __stack.__buf;
iov[0].iov_len = __len;
- replace_stdin();
-
readv(STDIN_FILENO, iov, nitems(iov));
_exit(EX_SOFTWARE); /* Should have aborted. */
@@ -553,6 +583,11 @@
replace_stdin();
+ for (size_t __i = 0; __i < 2; __i++) {
+ __stack.__buf[__i].iov_base = &__stack.padding_l;
+ __stack.__buf[__i].iov_len = 1;
+ }
+
preadv(STDIN_FILENO, __stack.__buf, __len, 0);
#undef BUF
@@ -576,6 +611,11 @@
replace_stdin();
+ for (size_t __i = 0; __i < 2; __i++) {
+ __stack.__buf[__i].iov_base = &__stack.padding_l;
+ __stack.__buf[__i].iov_len = 1;
+ }
+
preadv(STDIN_FILENO, __stack.__buf, __len, 0);
#undef BUF
@@ -608,6 +648,11 @@
disable_coredumps();
replace_stdin();
+ for (size_t __i = 0; __i < 2; __i++) {
+ __stack.__buf[__i].iov_base = &__stack.padding_l;
+ __stack.__buf[__i].iov_len = 1;
+ }
+
preadv(STDIN_FILENO, __stack.__buf, __len, 0);
_exit(EX_SOFTWARE); /* Should have aborted. */
@@ -654,6 +699,11 @@
__stack.__buf = malloc(__bufsz);
replace_stdin();
+ for (size_t __i = 0; __i < 2; __i++) {
+ __stack.__buf[__i].iov_base = &__stack.padding_l;
+ __stack.__buf[__i].iov_len = 1;
+ }
+
preadv(STDIN_FILENO, __stack.__buf, __len, 0);
#undef BUF
@@ -678,6 +728,11 @@
__stack.__buf = malloc(__bufsz);
replace_stdin();
+ for (size_t __i = 0; __i < 2; __i++) {
+ __stack.__buf[__i].iov_base = &__stack.padding_l;
+ __stack.__buf[__i].iov_len = 1;
+ }
+
preadv(STDIN_FILENO, __stack.__buf, __len, 0);
#undef BUF
@@ -711,6 +766,11 @@
__stack.__buf = malloc(__bufsz);
replace_stdin();
+ for (size_t __i = 0; __i < 2; __i++) {
+ __stack.__buf[__i].iov_base = &__stack.padding_l;
+ __stack.__buf[__i].iov_len = 1;
+ }
+
preadv(STDIN_FILENO, __stack.__buf, __len, 0);
_exit(EX_SOFTWARE); /* Should have aborted. */
@@ -755,11 +815,11 @@
const size_t __idx __unused = __len - 1;
struct iovec iov[1];
+ replace_stdin();
+
iov[0].iov_base = __stack.__buf;
iov[0].iov_len = __len;
- replace_stdin();
-
preadv(STDIN_FILENO, iov, nitems(iov), 0);
#undef BUF
@@ -782,11 +842,11 @@
const size_t __idx __unused = __len - 1;
struct iovec iov[1];
+ replace_stdin();
+
iov[0].iov_base = __stack.__buf;
iov[0].iov_len = __len;
- replace_stdin();
-
preadv(STDIN_FILENO, iov, nitems(iov), 0);
#undef BUF
@@ -810,11 +870,11 @@
struct iovec iov[1];
__stack.__buf = malloc(__bufsz);
+ replace_stdin();
+
iov[0].iov_base = __stack.__buf;
iov[0].iov_len = __len;
- replace_stdin();
-
preadv(STDIN_FILENO, iov, nitems(iov), 0);
#undef BUF
@@ -838,11 +898,11 @@
struct iovec iov[1];
__stack.__buf = malloc(__bufsz);
+ replace_stdin();
+
iov[0].iov_base = __stack.__buf;
iov[0].iov_len = __len;
- replace_stdin();
-
preadv(STDIN_FILENO, iov, nitems(iov), 0);
#undef BUF
@@ -875,11 +935,11 @@
/* Child */
disable_coredumps();
__stack.__buf = malloc(__bufsz);
+ replace_stdin();
+
iov[0].iov_base = __stack.__buf;
iov[0].iov_len = __len;
- replace_stdin();
-
preadv(STDIN_FILENO, iov, nitems(iov), 0);
_exit(EX_SOFTWARE); /* Should have aborted. */
diff --git a/lib/libc/tests/secure/generate-fortify-tests.lua b/lib/libc/tests/secure/generate-fortify-tests.lua
--- a/lib/libc/tests/secure/generate-fortify-tests.lua
+++ b/lib/libc/tests/secure/generate-fortify-tests.lua
@@ -113,12 +113,21 @@
srcvar[sizeof(srcvar) - 1] = '\0';
]]
-local readv_stackvars = "\tstruct iovec iov[1];\n"
local readv_init = [[
- iov[0].iov_base = __stack.__buf;
- iov[0].iov_len = __len;
+ replace_stdin();
+
+ for (size_t __i = 0; __i < 2; __i++) {
+ __stack.__buf[__i].iov_base = &__stack.padding_l;
+ __stack.__buf[__i].iov_len = 1;
+ }
+]]
+local readv_iov_stackvars = "\tstruct iovec iov[1];\n"
+local readv_iov_init = [[
replace_stdin();
+
+ iov[0].iov_base = __stack.__buf;
+ iov[0].iov_len = __len;
]]
local socket_stackvars = "\tint sock[2] = { -1, -1 };\n"
@@ -411,7 +420,7 @@
"__buf",
"__len",
},
- init = stdio_init,
+ init = readv_init,
},
{
func = "readv",
@@ -422,8 +431,8 @@
"nitems(iov)",
},
exclude = excludes_stack_overflow,
- stackvars = readv_stackvars,
- init = readv_init,
+ stackvars = readv_iov_stackvars,
+ init = readv_iov_init,
uses_len = true,
},
{
@@ -436,7 +445,7 @@
"__len",
"0",
},
- init = stdio_init,
+ init = readv_init,
},
{
func = "preadv",
@@ -448,8 +457,8 @@
"0",
},
exclude = excludes_stack_overflow,
- stackvars = readv_stackvars,
- init = readv_init,
+ stackvars = readv_iov_stackvars,
+ init = readv_iov_init,
uses_len = true,
},
},

File Metadata

Mime Type
text/plain
Expires
Fri, Aug 14, 12:22 AM (7 h, 23 m)
Storage Engine
blob
Storage Format
Raw Data
Storage Handle
36689938
Default Alt Text
D58289.diff (7 KB)

Event Timeline