diff options
| -rw-r--r-- | ChangeLog | 5 | ||||
| -rw-r--r-- | string/Makefile | 4 | ||||
| -rw-r--r-- | string/bug-stpncpy-offend.c | 53 |
3 files changed, 60 insertions, 2 deletions
diff --git a/ChangeLog b/ChangeLog index e47cf4dfe8..f2eee03660 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,8 @@ +2002-09-22 Roland McGrath <roland@redhat.com> + + * string/bug-stpncpy-offend.c: New file. + * string/Makefile (tests): Add it. + 2002-09-21 Carlos O'Donell <carlos@baldric.uwo.ca> * sysdeps/hppa/abort-instr.h: New file. diff --git a/string/Makefile b/string/Makefile index 5d5b09e861..b0f55718b7 100644 --- a/string/Makefile +++ b/string/Makefile @@ -1,4 +1,4 @@ -# Copyright (C) 1991-1999, 2000, 2001 Free Software Foundation, Inc. +# Copyright (C) 1991-1999,2000,2001,2002 Free Software Foundation, Inc. # This file is part of the GNU C Library. # The GNU C Library is free software; you can redistribute it and/or @@ -48,7 +48,7 @@ o-objects.ob := memcpy.o memset.o memchr.o tests := tester inl-tester noinl-tester testcopy test-ffs \ tst-strlen stratcliff tst-svc tst-inlcall \ bug-strncat1 bug-strspn1 bug-strpbrk1 tst-bswap \ - tst-strtok tst-strxfrm bug-strcoll1 + tst-strtok tst-strxfrm bug-strcoll1 bug-stpncpy-offend distribute := memcopy.h pagecopy.h tst-svc.expect diff --git a/string/bug-stpncpy-offend.c b/string/bug-stpncpy-offend.c new file mode 100644 index 0000000000..3a782f7cd7 --- /dev/null +++ b/string/bug-stpncpy-offend.c @@ -0,0 +1,53 @@ +/* Test program for stpncpy reading off the end of the source string. */ + +#include <string.h> +#include <sys/mman.h> +#include <unistd.h> + +static int do_test (void); +#define TEST_FUNCTION do_test () +#include <test-skeleton.c> + +static int +do_test (void) +{ + /* We get two pages of memory and then protect the second one so + we are sure to fault if we access past the end of the first page. + Then we test the odd-size string ending just on the page boundary. */ + + static const char test_string[] = "Seven."; + const size_t pagesz = getpagesize (); + char *buf = mmap (NULL, pagesz * 2, + PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANON, -1, 0); + char *s1, *r; + volatile size_t len = sizeof test_string; + + if (buf == MAP_FAILED) + { + perror ("mmap"); + return 1; + } + if (mprotect (buf + pagesz, pagesz, PROT_NONE) != 0) + { + perror ("mprotect"); + return 2; + } + + s1 = buf + pagesz - sizeof test_string; + memcpy (s1, test_string, sizeof test_string); + + r = stpncpy (buf, s1, len); + if (r != buf + len - 1) + { + printf ("r = buf + %d != %zu\n", r - buf, len - 1); + return 3; + } + r = stpncpy (s1, buf, len); + if (r != s1 + len - 1) + { + printf ("r = s1 + %d != %zu\n", r - s1, len - 1); + return 3; + } + + return 0; +} |