about summary refs log tree commit diff
path: root/string/bug-stpncpy-offend.c
blob: 3a782f7cd7cc17816f67c365ca3b64f9e6d65ba5 (plain) (blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
/* Test program for stpncpy reading off the end of the source string.  */

#include <string.h>
#include <sys/mman.h>
#include <unistd.h>

static int do_test (void);
#define TEST_FUNCTION do_test ()
#include <test-skeleton.c>

static int
do_test (void)
{
  /* We get two pages of memory and then protect the second one so
     we are sure to fault if we access past the end of the first page.
     Then we test the odd-size string ending just on the page boundary.  */

  static const char test_string[] = "Seven.";
  const size_t pagesz = getpagesize ();
  char *buf = mmap (NULL, pagesz * 2,
		    PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANON, -1, 0);
  char *s1, *r;
  volatile size_t len = sizeof test_string;

  if (buf == MAP_FAILED)
    {
      perror ("mmap");
      return 1;
    }
  if (mprotect (buf + pagesz, pagesz, PROT_NONE) != 0)
    {
      perror ("mprotect");
      return 2;
    }

  s1 = buf + pagesz - sizeof test_string;
  memcpy (s1, test_string, sizeof test_string);

  r = stpncpy (buf, s1, len);
  if (r != buf + len - 1)
    {
      printf ("r = buf + %d != %zu\n", r - buf, len - 1);
      return 3;
    }
  r = stpncpy (s1, buf, len);
  if (r != s1 + len - 1)
    {
      printf ("r = s1 + %d != %zu\n", r - s1, len - 1);
      return 3;
    }

  return 0;
}