aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
-rw-r--r--debug/Makefile5
-rw-r--r--debug/tst-sprintf-fortify-unchecked.c126
-rw-r--r--include/printf_buffer.h19
-rw-r--r--libio/iovsprintf.c15
4 files changed, 155 insertions, 10 deletions
diff --git a/debug/Makefile b/debug/Makefile
index 13f15d1..52f9a78 100644
--- a/debug/Makefile
+++ b/debug/Makefile
@@ -200,6 +200,10 @@ LDFLAGS-tst-backtrace6 = -rdynamic
CFLAGS-tst-ssp-1.c += -fstack-protector-all
+# Disable compiler optimizations around vsprintf (the function under test).
+CFLAGS-tst-sprintf-fortify-unchecked.c = \
+ -fno-builtin-vsprintf -fno-builtin-__vsprintf_chk
+
tests = backtrace-tst \
tst-longjmp_chk \
test-strcpy_chk \
@@ -211,6 +215,7 @@ tests = backtrace-tst \
tst-backtrace5 \
tst-backtrace6 \
tst-realpath-chk \
+ tst-sprintf-fortify-unchecked \
$(tests-all-chk)
tests-time64 += \
diff --git a/debug/tst-sprintf-fortify-unchecked.c b/debug/tst-sprintf-fortify-unchecked.c
new file mode 100644
index 0000000..7c7bd1b
--- /dev/null
+++ b/debug/tst-sprintf-fortify-unchecked.c
@@ -0,0 +1,126 @@
+/* Tests for fortified sprintf with unknown buffer bounds (bug 30039).
+ Copyright (C) 2023 Free Software Foundation, Inc.
+ This file is part of the GNU C Library.
+
+ The GNU C Library is free software; you can redistribute it and/or
+ modify it under the terms of the GNU Lesser General Public
+ License as published by the Free Software Foundation; either
+ version 2.1 of the License, or (at your option) any later version.
+
+ The GNU C Library is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ Lesser General Public License for more details.
+
+ You should have received a copy of the GNU Lesser General Public
+ License along with the GNU C Library; if not, see
+ <https://www.gnu.org/licenses/>. */
+
+#include <printf.h>
+#include <stdarg.h>
+#include <stdio.h>
+#include <string.h>
+#include <support/check.h>
+
+/* This test is not built with _FORTIFY_SOURCE. Instead it calls the
+ appropriate implementation directly. The fortify mode is specified
+ in this variable. */
+static int fortify_mode;
+
+/* This does not handle long-double redirects etc., but we test only
+ format strings that stay within the confines of the base
+ implementation. */
+int __vsprintf_chk (char *s, int flag, size_t slen, const char *format,
+ va_list ap);
+
+/* Invoke vsprintf or __vsprintf_chk according to fortify_mode. */
+static int
+my_vsprintf (char *buf, const char *format, va_list ap)
+{
+ int result;
+ if (fortify_mode == 0)
+ result = vsprintf (buf, format, ap);
+ else
+ /* Call the fortified version with an unspecified length. */
+ result = __vsprintf_chk (buf, fortify_mode - 1, -1, format, ap);
+ return result;
+}
+
+/* Run one test, with the specified expected output. */
+static void __attribute ((format (printf, 2, 3)))
+do_check (const char *expected, const char *format, ...)
+{
+ va_list ap;
+ va_start (ap, format);
+
+ char buf_expected[24];
+ memset (buf_expected, '@', sizeof (buf_expected));
+ TEST_VERIFY (strlen (expected) < sizeof (buf_expected));
+ strcpy (buf_expected, expected);
+
+ char buf[sizeof (buf_expected)];
+ memset (buf, '@', sizeof (buf));
+
+ int ret = my_vsprintf (buf, format, ap);
+ TEST_COMPARE_BLOB (buf_expected, sizeof (buf_expected), buf, sizeof (buf));
+ TEST_COMPARE (ret, strlen (expected));
+
+ va_end (ap);
+}
+
+/* Run the tests in all fortify modes. */
+static void
+do_tests (void)
+{
+ for (fortify_mode = 0; fortify_mode <= 3; ++fortify_mode)
+ {
+ do_check ("0", "%d", 0);
+ do_check ("-2147483648", "%d", -2147483647 - 1);
+ do_check ("-9223372036854775808", "%lld", -9223372036854775807LL - 1);
+ do_check ("", "%s", "");
+ do_check (" ", "%22s", "");
+ do_check ("XXXXXXXXXXXXXXXXXXXXXX", "%s", "XXXXXXXXXXXXXXXXXXXXXX");
+ do_check ("1.125000", "%f", 1.125);
+ do_check ("1.125", "%g", 1.125);
+ do_check ("1.125", "%.8g", 1.125);
+ }
+}
+
+/* printf callback that falls back to the glibc-supplied
+ implementation. */
+static int
+dummy_printf_function (FILE *__stream,
+ const struct printf_info *__info,
+ const void *const *__args)
+{
+ return -2; /* Request fallback. */
+}
+
+/* Likewise for the type information. */
+static int
+dummy_arginfo_function (const struct printf_info *info,
+ size_t n, int *argtypes, int *size)
+{
+ return -1; /* Request fallback. */
+}
+
+static int
+do_test (void)
+{
+ do_tests ();
+
+ /* Activate __printf_function_invoke mode. */
+ register_printf_specifier ('d', dummy_printf_function,
+ dummy_arginfo_function);
+ register_printf_specifier ('g', dummy_printf_function,
+ dummy_arginfo_function);
+ register_printf_specifier ('s', dummy_printf_function,
+ dummy_arginfo_function);
+
+ /* Rerun the tests with callback functions. */
+ do_tests ();
+
+ return 0;
+}
+
+#include <support/test-driver.c>
diff --git a/include/printf_buffer.h b/include/printf_buffer.h
index 55feebf..4d787e4 100644
--- a/include/printf_buffer.h
+++ b/include/printf_buffer.h
@@ -115,19 +115,28 @@ __printf_buffer_has_failed (struct __printf_buffer *buf)
return buf->mode == __printf_buffer_mode_failed;
}
-/* Initialization of a buffer, using the memory region from [BASE, BASE +LEN)
- as the initial buffer contents. LEN can be zero. */
+/* Initialization of a buffer, using the memory region from [BASE,
+ END) as the initial buffer contents. */
static inline void
-__printf_buffer_init (struct __printf_buffer *buf, char *base, size_t len,
- enum __printf_buffer_mode mode)
+__printf_buffer_init_end (struct __printf_buffer *buf, char *base, char *end,
+ enum __printf_buffer_mode mode)
{
buf->write_base = base;
buf->write_ptr = base;
- buf->write_end = base + len;
+ buf->write_end = end;
buf->written = 0;
buf->mode = mode;
}
+/* Initialization of a buffer, using the memory region from [BASE, BASE +LEN)
+ as the initial buffer contents. LEN can be zero. */
+static inline void
+__printf_buffer_init (struct __printf_buffer *buf, char *base, size_t len,
+ enum __printf_buffer_mode mode)
+{
+ __printf_buffer_init_end (buf, base, base + len, mode);
+}
+
/* Called by printf_buffer_putc for a full buffer. */
void __printf_buffer_putc_1 (struct __printf_buffer *buf, char ch)
attribute_hidden;
diff --git a/libio/iovsprintf.c b/libio/iovsprintf.c
index 8d53e40..9a4f59a 100644
--- a/libio/iovsprintf.c
+++ b/libio/iovsprintf.c
@@ -45,14 +45,19 @@ __vsprintf_internal (char *string, size_t maxlen,
if ((mode_flags & PRINTF_CHK) != 0)
{
string[0] = '\0';
- __printf_buffer_init (&buf, string, maxlen,
+ /* In some cases, __sprintf_chk is called with an unknown buffer
+ size (the special value -1). Prevent pointer wraparound in
+ this case and saturate to the end of the address space. */
+ uintptr_t end;
+ if (__builtin_add_overflow ((uintptr_t) string, maxlen, &end))
+ end = -1;
+ __printf_buffer_init_end (&buf, string, (char *) end,
__printf_buffer_mode_sprintf_chk);
}
else
- {
- __printf_buffer_init (&buf, string, 0, __printf_buffer_mode_sprintf);
- buf.write_end = (char *) ~(uintptr_t) 0; /* End of address space. */
- }
+ /* Use end of address space. */
+ __printf_buffer_init_end (&buf, string, (char *) ~(uintptr_t) 0,
+ __printf_buffer_mode_sprintf);
__printf_buffer (&buf, format, args, mode_flags);