tests: prefer dynamically allocated buffers

Help detecting Valgrind OOB reads and other issues.

 Conditional jump or move depends on uninitialised value(s)
   at 0x5452886: blobmsg_parse (blobmsg.c:203)
   by 0x400A8E: test_blobmsg (tests/test-blobmsg-parse.c:66)
   by 0x400A8E: main (tests/test-blobmsg-parse.c:82)

 Conditional jump or move depends on uninitialised value(s)
   at 0x545247F: blobmsg_check_name (blobmsg.c:39)
   by 0x545247F: blobmsg_check_attr_len (blobmsg.c:79)
   by 0x5452710: blobmsg_parse_array (blobmsg.c:159)
   by 0x400AB8: test_blobmsg (tests/test-blobmsg-parse.c:69)
   by 0x400AB8: main (tests/test-blobmsg-parse.c:82)

 Conditional jump or move depends on uninitialised value(s)
   at 0x54524A0: blobmsg_check_name (blobmsg.c:42)
   by 0x54524A0: blobmsg_check_attr_len (blobmsg.c:79)
   by 0x5452710: blobmsg_parse_array (blobmsg.c:159)
   by 0x400AB8: test_blobmsg (tests/test-blobmsg-parse.c:69)
   by 0x400AB8: main (tests/test-blobmsg-parse.c:82)

Ref: http://lists.infradead.org/pipermail/openwrt-devel/2020-January/021204.html
Signed-off-by: Petr Štetiar <ynezz@true.cz>

diff --git a/tests/fuzz/test-fuzz.c b/tests/fuzz/test-fuzz.c
index 4dc13a8d8a3b66ea93fe7145f01f2aeacf391646..026a3fd53a73b3c2645ea6a3cc8a606c75a1a5d7 100644 (file)
--- a/tests/fuzz/test-fuzz.c
+++ b/tests/fuzz/test-fuzz.c
@@ -91,10 +91,18 @@ static void fuzz_blob_parse(const uint8_t *data, size_t size)
        blob_parse_untrusted(buf, size, foo, foo_policy, __FOO_ATTR_MAX);
 }
 
        blob_parse_untrusted(buf, size, foo, foo_policy, __FOO_ATTR_MAX);
 }
 

-int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
+int LLVMFuzzerTestOneInput(const uint8_t *input, size_t size)

 {
 {

+       uint8_t *data;
+
+       data = malloc(size);
+       if (!data)
+               return -1;
+
+       memcpy(data, input, size);

        fuzz_blob_parse(data, size);
        fuzz_blobmsg_parse(data, size);
        fuzz_blob_parse(data, size);
        fuzz_blobmsg_parse(data, size);

+       free(data);

 
        return 0;
 }
 
        return 0;
 }

diff --git a/tests/test-b64.c b/tests/test-b64.c
index c29b4e2c73a36a1cc02bc10ccf9c47347e098abc..d33ad0dea86c54824c08beacbeefd33587696345 100644 (file)
--- a/tests/test-b64.c
+++ b/tests/test-b64.c
@@ -1,20 +1,25 @@
 #include <stdio.h>
 #include <string.h>
 #include <stdio.h>
 #include <string.h>

+#include <stdlib.h>

 
 #include "utils.h"
 
 
 #include "utils.h"
 

+#define BUF_LEN 255
+

 static void test_b64_encode(const char *src)
 {
 static void test_b64_encode(const char *src)
 {

-       char dst[255] = {0};
-       int r = b64_encode(src, strlen(src), dst, sizeof(dst));
+       char *dst = malloc(BUF_LEN+1);
+       int r = b64_encode(src, strlen(src), dst, BUF_LEN);

        fprintf(stdout, "%d %s\n", r, dst);
        fprintf(stdout, "%d %s\n", r, dst);

+       free(dst);

 }
 
 static void test_b64_decode(const char *src)
 {
 }
 
 static void test_b64_decode(const char *src)
 {

-       char dst[255] = {0};
-       int r = b64_decode(src, dst, sizeof(dst));
+       char *dst = malloc(BUF_LEN+1);
+       int r = b64_decode(src, dst, BUF_LEN);

        fprintf(stdout, "%d %s\n", r, dst);
        fprintf(stdout, "%d %s\n", r, dst);

+       free(dst);

 }
 
 int main()
 }
 
 int main()

diff --git a/tests/test-blob-parse.c b/tests/test-blob-parse.c
index 6d65eb4995b579ac5aa4069a6b031a056bed28ae..5f582011b753627e06809019333a41297eb68c6d 100644 (file)
--- a/tests/test-blob-parse.c
+++ b/tests/test-blob-parse.c
@@ -68,7 +68,7 @@ static int cert_load(const char *certfile, struct list_head *chain)
        struct blob_attr *certtb[CERT_ATTR_MAX];
        struct blob_attr *bufpt;
        struct cert_object *cobj;
        struct blob_attr *certtb[CERT_ATTR_MAX];
        struct blob_attr *bufpt;
        struct cert_object *cobj;

-       char filebuf[CERT_BUF_LEN];
+       char *filebuf = NULL;

        int ret = 0, pret = 0;
        size_t len, pos = 0;
 
        int ret = 0, pret = 0;
        size_t len, pos = 0;
 


@@ -76,14 +76,22 @@ static int cert_load(const char *certfile, struct list_head *chain)
        if (!f)
                return 1;
 
        if (!f)
                return 1;
 

-       len = fread(&filebuf, 1, CERT_BUF_LEN - 1, f);
-       if (len < 64)
+       filebuf = malloc(CERT_BUF_LEN+1);
+       if (!filebuf)

                return 1;
 
                return 1;
 

+       len = fread(filebuf, 1, CERT_BUF_LEN, f);
+       if (len < 64) {
+               free(filebuf);
+               return 1;
+       }
+

        ret = ferror(f) || !feof(f);
        fclose(f);
        ret = ferror(f) || !feof(f);
        fclose(f);

-       if (ret)
+       if (ret) {
+               free(filebuf);

                return 1;
                return 1;

+       }

 
        bufpt = (struct blob_attr *)filebuf;
        do {
 
        bufpt = (struct blob_attr *)filebuf;
        do {


@@ -112,6 +120,7 @@ static int cert_load(const char *certfile, struct list_head *chain)
        /* repeat parsing while there is still enough remaining data in buffer */
        } while(len > pos + sizeof(struct blob_attr) && (bufpt = blob_next(bufpt)));
 
        /* repeat parsing while there is still enough remaining data in buffer */
        } while(len > pos + sizeof(struct blob_attr) && (bufpt = blob_next(bufpt)));
 

+       free(filebuf);

        return (ret <= 0);
 }
 
        return (ret <= 0);
 }
 

diff --git a/tests/test-blobmsg-parse.c b/tests/test-blobmsg-parse.c
index ca710fd5866348e98fe084242151afe7f7fa089d..b2844f397f0dcdebef071134f4b7aa2428e809cd 100644 (file)
--- a/tests/test-blobmsg-parse.c
+++ b/tests/test-blobmsg-parse.c
@@ -40,18 +40,22 @@ static void test_blobmsg(const char *filename)
 {
 #define BUF_LEN 256
        int r = 0;
 {
 #define BUF_LEN 256
        int r = 0;

-       FILE *fd = NULL;

        size_t len = 0;
        size_t len = 0;

-       char buf[BUF_LEN+1] = { 0 };
+       FILE *fd = NULL;
+       char *buf = NULL;

        struct blob_attr *tb[__FOO_MAX];
 
        fd = fopen(filename, "r");
        if (!fd) {
        struct blob_attr *tb[__FOO_MAX];
 
        fd = fopen(filename, "r");
        if (!fd) {

-               fprintf(stderr, "unable to open %s", filename);
+               fprintf(stderr, "unable to open %s\n", filename);

                return;
        }
 
                return;
        }
 

-       len = fread(&buf, 1, BUF_LEN, fd);
+       buf = malloc(BUF_LEN+1);
+       if (!buf)
+               return;
+
+       len = fread(buf, 1, BUF_LEN, fd);

        fclose(fd);
 
        r = blobmsg_parse(foo_policy, ARRAY_SIZE(foo_policy), tb, buf, len);
        fclose(fd);
 
        r = blobmsg_parse(foo_policy, ARRAY_SIZE(foo_policy), tb, buf, len);


@@ -59,6 +63,8 @@ static void test_blobmsg(const char *filename)
 
        r = blobmsg_parse_array(foo_policy, ARRAY_SIZE(foo_policy), tb, buf, len);
        dump_result("blobmsg_parse_array", r, filename, tb);
 
        r = blobmsg_parse_array(foo_policy, ARRAY_SIZE(foo_policy), tb, buf, len);
        dump_result("blobmsg_parse_array", r, filename, tb);

+
+       free(buf);

 }
 
 int main(int argc, char *argv[])
 }
 
 int main(int argc, char *argv[])

diff --git a/tests/test-blobmsg-procd-instance.c b/tests/test-blobmsg-procd-instance.c
index a5b470620223f1a6e554448215032a10f45e761e..d6d905f47f5d3ded39c645058cfb84fd3b6be777 100644 (file)
--- a/tests/test-blobmsg-procd-instance.c
+++ b/tests/test-blobmsg-procd-instance.c
@@ -63,9 +63,9 @@ static void test_blobmsg_procd_instance(const char *filename)
 {
 #define BUF_LEN 2048
        int r = 0;
 {
 #define BUF_LEN 2048
        int r = 0;

-       FILE *fd = NULL;

        size_t len = 0;
        size_t len = 0;

-       char buf[BUF_LEN+1] = { 0 };
+       FILE *fd = NULL;
+       char *buf = NULL;

        struct blob_attr *tb[__INSTANCE_ATTR_MAX];
        const char *fname = basename((char *) filename);
 
        struct blob_attr *tb[__INSTANCE_ATTR_MAX];
        const char *fname = basename((char *) filename);
 


@@ -75,26 +75,32 @@ static void test_blobmsg_procd_instance(const char *filename)
                return;
        }
 
                return;
        }
 

-       len = fread(&buf, 1, BUF_LEN, fd);
+       buf = malloc(BUF_LEN+1);
+       if (!buf)
+               return;
+
+       len = fread(buf, 1, BUF_LEN, fd);

        fclose(fd);
 
        r = blobmsg_parse(instance_attr, __INSTANCE_ATTR_MAX, tb, buf, len);
        if (r)
        fclose(fd);
 
        r = blobmsg_parse(instance_attr, __INSTANCE_ATTR_MAX, tb, buf, len);
        if (r)

-               return;
+               goto out;

 
        if (!tb[INSTANCE_ATTR_COMMAND] || !tb[INSTANCE_ATTR_NICE] || !tb[INSTANCE_ATTR_STDERR])
 
        if (!tb[INSTANCE_ATTR_COMMAND] || !tb[INSTANCE_ATTR_NICE] || !tb[INSTANCE_ATTR_STDERR])

-               return;
+               goto out;

 
        if (!blobmsg_check_attr_list(tb[INSTANCE_ATTR_COMMAND], BLOBMSG_TYPE_STRING))
 
        if (!blobmsg_check_attr_list(tb[INSTANCE_ATTR_COMMAND], BLOBMSG_TYPE_STRING))

-               return;
+               goto out;

 
        if (blobmsg_get_u32(tb[INSTANCE_ATTR_NICE]) != 19)
 
        if (blobmsg_get_u32(tb[INSTANCE_ATTR_NICE]) != 19)

-               return;
+               goto out;

 
        if (!blobmsg_get_bool(tb[INSTANCE_ATTR_STDERR]))
 
        if (!blobmsg_get_bool(tb[INSTANCE_ATTR_STDERR]))

-               return;
+               goto out;

 
        fprintf(stderr, "%s: OK\n", fname);
 
        fprintf(stderr, "%s: OK\n", fname);

+out:
+       free(buf);

 }
 
 int main(int argc, char *argv[])
 }
 
 int main(int argc, char *argv[])