1/* $NetBSD: check-common.c,v 1.3 2023/06/19 21:41:42 christos Exp $ */ 2 3/* 4 * Copyright (c) 1999 - 2006 Kungliga Tekniska H��gskolan 5 * (Royal Institute of Technology, Stockholm, Sweden). 6 * All rights reserved. 7 * 8 * Portions Copyright (c) 2009 Apple Inc. All rights reserved. 9 * 10 * Redistribution and use in source and binary forms, with or without 11 * modification, are permitted provided that the following conditions 12 * are met: 13 * 14 * 1. Redistributions of source code must retain the above copyright 15 * notice, this list of conditions and the following disclaimer. 16 * 17 * 2. Redistributions in binary form must reproduce the above copyright 18 * notice, this list of conditions and the following disclaimer in the 19 * documentation and/or other materials provided with the distribution. 20 * 21 * 3. Neither the name of the Institute nor the names of its contributors 22 * may be used to endorse or promote products derived from this software 23 * without specific prior written permission. 24 * 25 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND 26 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 27 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 28 * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE 29 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 30 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 31 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 32 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 33 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 34 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 35 * SUCH DAMAGE. 36 */ 37 38#include <config.h> 39#ifdef HAVE_SYS_MMAN_H 40#include <sys/mman.h> 41#endif 42#include <stdio.h> 43#include <string.h> 44#include <err.h> 45#include <krb5/roken.h> 46 47#include <krb5/asn1-common.h> 48#include "check-common.h" 49 50struct map_page { 51 void *start; 52 size_t size; 53 void *data_start; 54 size_t data_size; 55 enum map_type type; 56}; 57 58/* #undef HAVE_MMAP */ 59 60void * 61map_alloc(enum map_type type, const void *buf, 62 size_t size, struct map_page **map) 63{ 64#ifndef HAVE_MMAP 65 unsigned char *p; 66 size_t len = size + sizeof(long) * 2; 67 int i; 68 69 *map = ecalloc(1, sizeof(**map)); 70 71 p = emalloc(len); 72 (*map)->type = type; 73 (*map)->start = p; 74 (*map)->size = len; 75 (*map)->data_start = p + sizeof(long); 76 for (i = sizeof(long); i > 0; i--) 77 p[sizeof(long) - i] = 0xff - i; 78 for (i = sizeof(long); i > 0; i--) 79 p[len - i] = 0xff - i; 80#else 81 unsigned char *p; 82 int flags, ret, fd; 83 size_t pagesize = getpagesize(); 84 85 *map = ecalloc(1, sizeof(**map)); 86 87 (*map)->type = type; 88 89#ifdef MAP_ANON 90 flags = MAP_ANON; 91 fd = -1; 92#else 93 flags = 0; 94 fd = open ("/dev/zero", O_RDONLY); 95 if(fd < 0) 96 err (1, "open /dev/zero"); 97#endif 98 flags |= MAP_PRIVATE; 99 100 (*map)->size = size + pagesize - (size % pagesize) + pagesize * 2; 101 102 p = (unsigned char *)mmap(0, (*map)->size, PROT_READ | PROT_WRITE, 103 flags, fd, 0); 104 if (p == (unsigned char *)MAP_FAILED) 105 err (1, "mmap"); 106 107 (*map)->start = p; 108 109 ret = mprotect (p, pagesize, 0); 110 if (ret < 0) 111 err (1, "mprotect"); 112 113 ret = mprotect (p + (*map)->size - pagesize, pagesize, 0); 114 if (ret < 0) 115 err (1, "mprotect"); 116 117 switch (type) { 118 case OVERRUN: 119 (*map)->data_start = p + (*map)->size - pagesize - size; 120 break; 121 case UNDERRUN: 122 (*map)->data_start = p + pagesize; 123 break; 124 default: 125 abort(); 126 } 127#endif 128 (*map)->data_size = size; 129 if (buf) 130 memcpy((*map)->data_start, buf, size); 131 return (*map)->data_start; 132} 133 134void 135map_free(struct map_page *map, const char *test_name, const char *map_name) 136{ 137#ifndef HAVE_MMAP 138 unsigned char *p = map->start; 139 int i; 140 141 for (i = sizeof(long); i > 0; i--) 142 if (p[sizeof(long) - i] != 0xff - i) 143 errx(1, "%s: %s underrun %d\n", test_name, map_name, i); 144 for (i = sizeof(long); i > 0; i--) 145 if (p[map->size - i] != 0xff - i) 146 errx(1, "%s: %s overrun %lu\n", test_name, map_name, 147 (unsigned long)map->size - i); 148 free(map->start); 149#else 150 int ret; 151 152 ret = munmap (map->start, map->size); 153 if (ret < 0) 154 err (1, "munmap"); 155#endif 156 free(map); 157} 158 159static void 160print_bytes (unsigned const char *buf, size_t len) 161{ 162 int i; 163 164 for (i = 0; i < len; ++i) 165 printf ("%02x ", buf[i]); 166} 167 168#ifndef MAP_FAILED 169#define MAP_FAILED (-1) 170#endif 171 172static char *current_test = "<uninit>"; 173static char *current_state = "<uninit>"; 174 175static RETSIGTYPE 176segv_handler(int sig) 177{ 178 int fd; 179 char msg[] = "SIGSEGV i current test: "; 180 181 fd = open("/dev/stdout", O_WRONLY, 0600); 182 if (fd >= 0) { 183 write(fd, msg, sizeof(msg)); 184 write(fd, current_test, strlen(current_test)); 185 write(fd, " ", 1); 186 write(fd, current_state, strlen(current_state)); 187 write(fd, "\n", 1); 188 close(fd); 189 } 190 _exit(1); 191} 192 193int 194generic_test (const struct test_case *tests, 195 unsigned ntests, 196 size_t data_size, 197 generic_encode encode, 198 generic_length length, 199 generic_decode decode, 200 generic_free free_data, 201 int (*cmp)(void *a, void *b), 202 generic_copy copy) 203{ 204 unsigned char *buf, *buf2; 205 int i; 206 int failures = 0; 207 void *data; 208 struct map_page *data_map, *buf_map, *buf2_map; 209 210#ifdef HAVE_SIGACTION 211 struct sigaction sa, osa; 212#endif 213 214 for (i = 0; i < ntests; ++i) { 215 int ret; 216 size_t sz, consumed_sz, length_sz, buf_sz; 217 void *to = NULL; 218 219 current_test = tests[i].name; 220 221 current_state = "init"; 222 223#ifdef HAVE_SIGACTION 224 sigemptyset (&sa.sa_mask); 225 sa.sa_flags = 0; 226#ifdef SA_RESETHAND 227 sa.sa_flags |= SA_RESETHAND; 228#endif 229 sa.sa_handler = segv_handler; 230 sigaction (SIGSEGV, &sa, &osa); 231#endif 232 233 data = map_alloc(OVERRUN, NULL, data_size, &data_map); 234 235 buf_sz = tests[i].byte_len; 236 buf = map_alloc(UNDERRUN, NULL, buf_sz, &buf_map); 237 238 current_state = "encode"; 239 ret = (*encode) (buf + buf_sz - 1, buf_sz, 240 tests[i].val, &sz); 241 if (ret != 0) { 242 printf ("encoding of %s failed %d\n", tests[i].name, ret); 243 ++failures; 244 continue; 245 } 246 if (sz != tests[i].byte_len) { 247 printf ("encoding of %s has wrong len (%lu != %lu)\n", 248 tests[i].name, 249 (unsigned long)sz, (unsigned long)tests[i].byte_len); 250 ++failures; 251 continue; 252 } 253 254 current_state = "length"; 255 length_sz = (*length) (tests[i].val); 256 if (sz != length_sz) { 257 printf ("length for %s is bad (%lu != %lu)\n", 258 tests[i].name, (unsigned long)length_sz, (unsigned long)sz); 259 ++failures; 260 continue; 261 } 262 263 current_state = "memcmp"; 264 if (memcmp (buf, tests[i].bytes, tests[i].byte_len) != 0) { 265 printf ("encoding of %s has bad bytes:\n" 266 "correct: ", tests[i].name); 267 print_bytes ((unsigned char *)tests[i].bytes, tests[i].byte_len); 268 printf ("\nactual: "); 269 print_bytes (buf, sz); 270 printf ("\n"); 271#if 0 272 rk_dumpdata("correct", tests[i].bytes, tests[i].byte_len); 273 rk_dumpdata("actual", buf, sz); 274 exit (1); 275#endif 276 ++failures; 277 continue; 278 } 279 280 buf2 = map_alloc(OVERRUN, buf, sz, &buf2_map); 281 282 current_state = "decode"; 283 ret = (*decode) (buf2, sz, data, &consumed_sz); 284 if (ret != 0) { 285 printf ("decoding of %s failed %d\n", tests[i].name, ret); 286 ++failures; 287 continue; 288 } 289 if (sz != consumed_sz) { 290 printf ("different length decoding %s (%ld != %ld)\n", 291 tests[i].name, 292 (unsigned long)sz, (unsigned long)consumed_sz); 293 ++failures; 294 continue; 295 } 296 current_state = "cmp"; 297 if ((*cmp)(data, tests[i].val) != 0) { 298 printf ("%s: comparison failed\n", tests[i].name); 299 ++failures; 300 continue; 301 } 302 303 current_state = "copy"; 304 if (copy) { 305 to = emalloc(data_size); 306 ret = (*copy)(data, to); 307 if (ret != 0) { 308 printf ("copy of %s failed %d\n", tests[i].name, ret); 309 ++failures; 310 continue; 311 } 312 313 current_state = "cmp-copy"; 314 if ((*cmp)(data, to) != 0) { 315 printf ("%s: copy comparison failed\n", tests[i].name); 316 ++failures; 317 continue; 318 } 319 } 320 321 current_state = "free"; 322 if (free_data) { 323 (*free_data)(data); 324 if (to) { 325 (*free_data)(to); 326 free(to); 327 } 328 } 329 330 current_state = "free"; 331 map_free(buf_map, tests[i].name, "encode"); 332 map_free(buf2_map, tests[i].name, "decode"); 333 map_free(data_map, tests[i].name, "data"); 334 335#ifdef HAVE_SIGACTION 336 sigaction (SIGSEGV, &osa, NULL); 337#endif 338 } 339 current_state = "done"; 340 return failures; 341} 342 343/* 344 * check for failures 345 * 346 * a test size (byte_len) of -1 means that the test tries to trigger a 347 * integer overflow (and later a malloc of to little memory), just 348 * allocate some memory and hope that is enough for that test. 349 */ 350 351int 352generic_decode_fail (const struct test_case *tests, 353 unsigned ntests, 354 size_t data_size, 355 int (ASN1CALL *decode)(unsigned char *, size_t, void *, size_t *)) 356{ 357 unsigned char *buf; 358 int i; 359 int failures = 0; 360 void *data; 361 struct map_page *data_map, *buf_map; 362 363#ifdef HAVE_SIGACTION 364 struct sigaction sa, osa; 365#endif 366 367 for (i = 0; i < ntests; ++i) { 368 int ret; 369 size_t sz; 370 const void *bytes; 371 372 current_test = tests[i].name; 373 374 current_state = "init"; 375 376#ifdef HAVE_SIGACTION 377 sigemptyset (&sa.sa_mask); 378 sa.sa_flags = 0; 379#ifdef SA_RESETHAND 380 sa.sa_flags |= SA_RESETHAND; 381#endif 382 sa.sa_handler = segv_handler; 383 sigaction (SIGSEGV, &sa, &osa); 384#endif 385 386 data = map_alloc(OVERRUN, NULL, data_size, &data_map); 387 388 if (tests[i].byte_len < 0xffffff && tests[i].byte_len >= 0) { 389 sz = tests[i].byte_len; 390 bytes = tests[i].bytes; 391 } else { 392 sz = 4096; 393 bytes = NULL; 394 } 395 396 buf = map_alloc(OVERRUN, bytes, sz, &buf_map); 397 398 if (tests[i].byte_len == -1) 399 memset(buf, 0, sz); 400 401 current_state = "decode"; 402 ret = (*decode) (buf, tests[i].byte_len, data, &sz); 403 if (ret == 0) { 404 printf ("sucessfully decoded %s\n", tests[i].name); 405 ++failures; 406 continue; 407 } 408 409 current_state = "free"; 410 if (buf) 411 map_free(buf_map, tests[i].name, "encode"); 412 map_free(data_map, tests[i].name, "data"); 413 414#ifdef HAVE_SIGACTION 415 sigaction (SIGSEGV, &osa, NULL); 416#endif 417 } 418 current_state = "done"; 419 return failures; 420} 421