1 /* $NetBSD: check-common.c,v 1.1.1.2 2014/04/24 12:45:28 pettai Exp $ */ 2 3 /* 4 * Copyright (c) 1999 - 2006 Kungliga Tekniska Högskolan 5 * (Royal Institute of Technology, Stockholm, Sweden). 6 * All rights reserved. 7 * 8 * Portions Copyright (c) 2009 Apple Inc. All rights reserved. 9 * 10 * Redistribution and use in source and binary forms, with or without 11 * modification, are permitted provided that the following conditions 12 * are met: 13 * 14 * 1. Redistributions of source code must retain the above copyright 15 * notice, this list of conditions and the following disclaimer. 16 * 17 * 2. Redistributions in binary form must reproduce the above copyright 18 * notice, this list of conditions and the following disclaimer in the 19 * documentation and/or other materials provided with the distribution. 20 * 21 * 3. Neither the name of the Institute nor the names of its contributors 22 * may be used to endorse or promote products derived from this software 23 * without specific prior written permission. 24 * 25 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND 26 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 27 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 28 * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE 29 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 30 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 31 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 32 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 33 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 34 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 35 * SUCH DAMAGE. 36 */ 37 38 #ifdef HAVE_CONFIG_H 39 #include <config.h> 40 #endif 41 #ifdef HAVE_SYS_MMAN_H 42 #include <sys/mman.h> 43 #endif 44 #include <stdio.h> 45 #include <string.h> 46 #include <err.h> 47 #include <krb5/roken.h> 48 49 #include <krb5/asn1-common.h> 50 #include "check-common.h" 51 52 __RCSID("NetBSD"); 53 54 struct map_page { 55 void *start; 56 size_t size; 57 void *data_start; 58 size_t data_size; 59 enum map_type type; 60 }; 61 62 /* #undef HAVE_MMAP */ 63 64 void * 65 map_alloc(enum map_type type, const void *buf, 66 size_t size, struct map_page **map) 67 { 68 #ifndef HAVE_MMAP 69 unsigned char *p; 70 size_t len = size + sizeof(long) * 2; 71 int i; 72 73 *map = ecalloc(1, sizeof(**map)); 74 75 p = emalloc(len); 76 (*map)->type = type; 77 (*map)->start = p; 78 (*map)->size = len; 79 (*map)->data_start = p + sizeof(long); 80 for (i = sizeof(long); i > 0; i--) 81 p[sizeof(long) - i] = 0xff - i; 82 for (i = sizeof(long); i > 0; i--) 83 p[len - i] = 0xff - i; 84 #else 85 unsigned char *p; 86 int flags, ret, fd; 87 size_t pagesize = getpagesize(); 88 89 *map = ecalloc(1, sizeof(**map)); 90 91 (*map)->type = type; 92 93 #ifdef MAP_ANON 94 flags = MAP_ANON; 95 fd = -1; 96 #else 97 flags = 0; 98 fd = open ("/dev/zero", O_RDONLY); 99 if(fd < 0) 100 err (1, "open /dev/zero"); 101 #endif 102 flags |= MAP_PRIVATE; 103 104 (*map)->size = size + pagesize - (size % pagesize) + pagesize * 2; 105 106 p = (unsigned char *)mmap(0, (*map)->size, PROT_READ | PROT_WRITE, 107 flags, fd, 0); 108 if (p == (unsigned char *)MAP_FAILED) 109 err (1, "mmap"); 110 111 (*map)->start = p; 112 113 ret = mprotect (p, pagesize, 0); 114 if (ret < 0) 115 err (1, "mprotect"); 116 117 ret = mprotect (p + (*map)->size - pagesize, pagesize, 0); 118 if (ret < 0) 119 err (1, "mprotect"); 120 121 switch (type) { 122 case OVERRUN: 123 (*map)->data_start = p + (*map)->size - pagesize - size; 124 break; 125 case UNDERRUN: 126 (*map)->data_start = p + pagesize; 127 break; 128 default: 129 abort(); 130 } 131 #endif 132 (*map)->data_size = size; 133 if (buf) 134 memcpy((*map)->data_start, buf, size); 135 return (*map)->data_start; 136 } 137 138 void 139 map_free(struct map_page *map, const char *test_name, const char *map_name) 140 { 141 #ifndef HAVE_MMAP 142 unsigned char *p = map->start; 143 int i; 144 145 for (i = sizeof(long); i > 0; i--) 146 if (p[sizeof(long) - i] != 0xff - i) 147 errx(1, "%s: %s underrun %d\n", test_name, map_name, i); 148 for (i = sizeof(long); i > 0; i--) 149 if (p[map->size - i] != 0xff - i) 150 errx(1, "%s: %s overrun %lu\n", test_name, map_name, 151 (unsigned long)map->size - i); 152 free(map->start); 153 #else 154 int ret; 155 156 ret = munmap (map->start, map->size); 157 if (ret < 0) 158 err (1, "munmap"); 159 #endif 160 free(map); 161 } 162 163 static void 164 print_bytes (unsigned const char *buf, size_t len) 165 { 166 int i; 167 168 for (i = 0; i < len; ++i) 169 printf ("%02x ", buf[i]); 170 } 171 172 #ifndef MAP_FAILED 173 #define MAP_FAILED (-1) 174 #endif 175 176 static char *current_test = "<uninit>"; 177 static char *current_state = "<uninit>"; 178 179 static RETSIGTYPE 180 segv_handler(int sig) 181 { 182 int fd; 183 char msg[] = "SIGSEGV i current test: "; 184 185 fd = open("/dev/stdout", O_WRONLY, 0600); 186 if (fd >= 0) { 187 write(fd, msg, sizeof(msg)); 188 write(fd, current_test, strlen(current_test)); 189 write(fd, " ", 1); 190 write(fd, current_state, strlen(current_state)); 191 write(fd, "\n", 1); 192 close(fd); 193 } 194 _exit(1); 195 } 196 197 int 198 generic_test (const struct test_case *tests, 199 unsigned ntests, 200 size_t data_size, 201 int (ASN1CALL *encode)(unsigned char *, size_t, void *, size_t *), 202 int (ASN1CALL *length)(void *), 203 int (ASN1CALL *decode)(unsigned char *, size_t, void *, size_t *), 204 int (ASN1CALL *free_data)(void *), 205 int (*cmp)(void *a, void *b), 206 int (ASN1CALL *copy)(const void *from, void *to)) 207 { 208 unsigned char *buf, *buf2; 209 int i; 210 int failures = 0; 211 void *data; 212 struct map_page *data_map, *buf_map, *buf2_map; 213 214 #ifdef HAVE_SIGACTION 215 struct sigaction sa, osa; 216 #endif 217 218 for (i = 0; i < ntests; ++i) { 219 int ret; 220 size_t sz, consumed_sz, length_sz, buf_sz; 221 void *to = NULL; 222 223 current_test = tests[i].name; 224 225 current_state = "init"; 226 227 #ifdef HAVE_SIGACTION 228 sigemptyset (&sa.sa_mask); 229 sa.sa_flags = 0; 230 #ifdef SA_RESETHAND 231 sa.sa_flags |= SA_RESETHAND; 232 #endif 233 sa.sa_handler = segv_handler; 234 sigaction (SIGSEGV, &sa, &osa); 235 #endif 236 237 data = map_alloc(OVERRUN, NULL, data_size, &data_map); 238 239 buf_sz = tests[i].byte_len; 240 buf = map_alloc(UNDERRUN, NULL, buf_sz, &buf_map); 241 242 current_state = "encode"; 243 ret = (*encode) (buf + buf_sz - 1, buf_sz, 244 tests[i].val, &sz); 245 if (ret != 0) { 246 printf ("encoding of %s failed %d\n", tests[i].name, ret); 247 ++failures; 248 continue; 249 } 250 if (sz != tests[i].byte_len) { 251 printf ("encoding of %s has wrong len (%lu != %lu)\n", 252 tests[i].name, 253 (unsigned long)sz, (unsigned long)tests[i].byte_len); 254 ++failures; 255 continue; 256 } 257 258 current_state = "length"; 259 length_sz = (*length) (tests[i].val); 260 if (sz != length_sz) { 261 printf ("length for %s is bad (%lu != %lu)\n", 262 tests[i].name, (unsigned long)length_sz, (unsigned long)sz); 263 ++failures; 264 continue; 265 } 266 267 current_state = "memcmp"; 268 if (memcmp (buf, tests[i].bytes, tests[i].byte_len) != 0) { 269 printf ("encoding of %s has bad bytes:\n" 270 "correct: ", tests[i].name); 271 print_bytes ((unsigned char *)tests[i].bytes, tests[i].byte_len); 272 printf ("\nactual: "); 273 print_bytes (buf, sz); 274 printf ("\n"); 275 #if 0 276 rk_dumpdata("correct", tests[i].bytes, tests[i].byte_len); 277 rk_dumpdata("actual", buf, sz); 278 exit (1); 279 #endif 280 ++failures; 281 continue; 282 } 283 284 buf2 = map_alloc(OVERRUN, buf, sz, &buf2_map); 285 286 current_state = "decode"; 287 ret = (*decode) (buf2, sz, data, &consumed_sz); 288 if (ret != 0) { 289 printf ("decoding of %s failed %d\n", tests[i].name, ret); 290 ++failures; 291 continue; 292 } 293 if (sz != consumed_sz) { 294 printf ("different length decoding %s (%ld != %ld)\n", 295 tests[i].name, 296 (unsigned long)sz, (unsigned long)consumed_sz); 297 ++failures; 298 continue; 299 } 300 current_state = "cmp"; 301 if ((*cmp)(data, tests[i].val) != 0) { 302 printf ("%s: comparison failed\n", tests[i].name); 303 ++failures; 304 continue; 305 } 306 307 current_state = "copy"; 308 if (copy) { 309 to = emalloc(data_size); 310 ret = (*copy)(data, to); 311 if (ret != 0) { 312 printf ("copy of %s failed %d\n", tests[i].name, ret); 313 ++failures; 314 continue; 315 } 316 317 current_state = "cmp-copy"; 318 if ((*cmp)(data, to) != 0) { 319 printf ("%s: copy comparison failed\n", tests[i].name); 320 ++failures; 321 continue; 322 } 323 } 324 325 current_state = "free"; 326 if (free_data) { 327 (*free_data)(data); 328 if (to) { 329 (*free_data)(to); 330 free(to); 331 } 332 } 333 334 current_state = "free"; 335 map_free(buf_map, tests[i].name, "encode"); 336 map_free(buf2_map, tests[i].name, "decode"); 337 map_free(data_map, tests[i].name, "data"); 338 339 #ifdef HAVE_SIGACTION 340 sigaction (SIGSEGV, &osa, NULL); 341 #endif 342 } 343 current_state = "done"; 344 return failures; 345 } 346 347 /* 348 * check for failures 349 * 350 * a test size (byte_len) of -1 means that the test tries to trigger a 351 * integer overflow (and later a malloc of to little memory), just 352 * allocate some memory and hope that is enough for that test. 353 */ 354 355 int 356 generic_decode_fail (const struct test_case *tests, 357 unsigned ntests, 358 size_t data_size, 359 int (ASN1CALL *decode)(unsigned char *, size_t, void *, size_t *)) 360 { 361 unsigned char *buf; 362 int i; 363 int failures = 0; 364 void *data; 365 struct map_page *data_map, *buf_map; 366 367 #ifdef HAVE_SIGACTION 368 struct sigaction sa, osa; 369 #endif 370 371 for (i = 0; i < ntests; ++i) { 372 int ret; 373 size_t sz; 374 const void *bytes; 375 376 current_test = tests[i].name; 377 378 current_state = "init"; 379 380 #ifdef HAVE_SIGACTION 381 sigemptyset (&sa.sa_mask); 382 sa.sa_flags = 0; 383 #ifdef SA_RESETHAND 384 sa.sa_flags |= SA_RESETHAND; 385 #endif 386 sa.sa_handler = segv_handler; 387 sigaction (SIGSEGV, &sa, &osa); 388 #endif 389 390 data = map_alloc(OVERRUN, NULL, data_size, &data_map); 391 392 if (tests[i].byte_len < 0xffffff && tests[i].byte_len >= 0) { 393 sz = tests[i].byte_len; 394 bytes = tests[i].bytes; 395 } else { 396 sz = 4096; 397 bytes = NULL; 398 } 399 400 buf = map_alloc(OVERRUN, bytes, sz, &buf_map); 401 402 if (tests[i].byte_len == -1) 403 memset(buf, 0, sz); 404 405 current_state = "decode"; 406 ret = (*decode) (buf, tests[i].byte_len, data, &sz); 407 if (ret == 0) { 408 printf ("sucessfully decoded %s\n", tests[i].name); 409 ++failures; 410 continue; 411 } 412 413 current_state = "free"; 414 if (buf) 415 map_free(buf_map, tests[i].name, "encode"); 416 map_free(data_map, tests[i].name, "data"); 417 418 #ifdef HAVE_SIGACTION 419 sigaction (SIGSEGV, &osa, NULL); 420 #endif 421 } 422 current_state = "done"; 423 return failures; 424 } 425