diff options
author | Daniel Baumann <daniel.baumann@progress-linux.org> | 2024-04-19 17:20:00 +0000 |
---|---|---|
committer | Daniel Baumann <daniel.baumann@progress-linux.org> | 2024-04-19 17:20:00 +0000 |
commit | 8daa83a594a2e98f39d764422bfbdbc62c9efd44 (patch) | |
tree | 4099e8021376c7d8c05bdf8503093d80e9c7bad0 /third_party/heimdal/lib/asn1/check-common.c | |
parent | Initial commit. (diff) | |
download | samba-8daa83a594a2e98f39d764422bfbdbc62c9efd44.tar.xz samba-8daa83a594a2e98f39d764422bfbdbc62c9efd44.zip |
Adding upstream version 2:4.20.0+dfsg.upstream/2%4.20.0+dfsg
Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>
Diffstat (limited to 'third_party/heimdal/lib/asn1/check-common.c')
-rw-r--r-- | third_party/heimdal/lib/asn1/check-common.c | 422 |
1 files changed, 422 insertions, 0 deletions
diff --git a/third_party/heimdal/lib/asn1/check-common.c b/third_party/heimdal/lib/asn1/check-common.c new file mode 100644 index 0000000..8a6b5da --- /dev/null +++ b/third_party/heimdal/lib/asn1/check-common.c @@ -0,0 +1,422 @@ +/* + * Copyright (c) 1999 - 2006 Kungliga Tekniska Högskolan + * (Royal Institute of Technology, Stockholm, Sweden). + * All rights reserved. + * + * Portions Copyright (c) 2009 Apple Inc. All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * + * 3. Neither the name of the Institute nor the names of its contributors + * may be used to endorse or promote products derived from this software + * without specific prior written permission. + * + * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND + * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE + * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE + * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL + * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS + * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT + * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY + * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF + * SUCH DAMAGE. + */ + +#include <config.h> +#ifdef HAVE_SYS_MMAN_H +#include <sys/mman.h> +#endif +#include <stdio.h> +#include <string.h> +#include <err.h> +#include <roken.h> + +#include "asn1-common.h" +#include "check-common.h" + +struct map_page { + void *start; + size_t size; + void *data_start; + size_t data_size; + enum map_type type; +}; + +/* #undef HAVE_MMAP */ + +void * +map_alloc(enum map_type type, const void *buf, + size_t size, struct map_page **map) +{ +#ifndef HAVE_MMAP + unsigned char *p; + size_t len = size + sizeof(long) * 2; + int i; + + *map = ecalloc(1, sizeof(**map)); + + p = emalloc(len); + (*map)->type = type; + (*map)->start = p; + (*map)->size = len; + (*map)->data_start = p + sizeof(long); + for (i = sizeof(long); i > 0; i--) + p[sizeof(long) - i] = 0xff - i; + for (i = sizeof(long); i > 0; i--) + p[len - i] = 0xff - i; +#else + unsigned char *p; + int flags, ret, fd; + size_t pagesize = getpagesize(); + + *map = ecalloc(1, sizeof(**map)); + + (*map)->type = type; + +#ifdef MAP_ANON + flags = MAP_ANON; + fd = -1; +#else + flags = 0; + fd = open ("/dev/zero", O_RDONLY); + if(fd < 0) + err (1, "open /dev/zero"); +#endif + flags |= MAP_PRIVATE; + + (*map)->size = size + pagesize - (size % pagesize) + pagesize * 2; + + p = (unsigned char *)mmap(0, (*map)->size, PROT_READ | PROT_WRITE, + flags, fd, 0); + if (p == (unsigned char *)MAP_FAILED) + err (1, "mmap"); + + (*map)->start = p; + + ret = mprotect (p, pagesize, 0); + if (ret < 0) + err (1, "mprotect"); + + ret = mprotect (p + (*map)->size - pagesize, pagesize, 0); + if (ret < 0) + err (1, "mprotect"); + + switch (type) { + case OVERRUN: + (*map)->data_start = p + (*map)->size - pagesize - size; + break; + case UNDERRUN: + (*map)->data_start = p + pagesize; + break; + default: + abort(); + } +#endif + (*map)->data_size = size; + if (buf) + memcpy((*map)->data_start, buf, size); + return (*map)->data_start; +} + +void +map_free(struct map_page *map, const char *test_name, const char *map_name) +{ +#ifndef HAVE_MMAP + unsigned char *p = map->start; + int i; + + for (i = sizeof(long); i > 0; i--) + if (p[sizeof(long) - i] != 0xff - i) + errx(1, "%s: %s underrun %d\n", test_name, map_name, i); + for (i = sizeof(long); i > 0; i--) + if (p[map->size - i] != 0xff - i) + errx(1, "%s: %s overrun %lu\n", test_name, map_name, + (unsigned long)map->size - i); + free(map->start); +#else + int ret; + + ret = munmap (map->start, map->size); + if (ret < 0) + err (1, "munmap"); +#endif + free(map); +} + +static void +print_bytes (unsigned const char *buf, size_t len) +{ + int i; + + for (i = 0; i < len; ++i) + printf ("%02x ", buf[i]); +} + +#ifndef MAP_FAILED +#define MAP_FAILED (-1) +#endif + +static char *current_test = "<uninit>"; +static char *current_state = "<uninit>"; + +static RETSIGTYPE +segv_handler(int sig) +{ + int fd; + char msg[] = "SIGSEGV i current test: "; + /* For compilers that insist we check write(2)'s result here */ + int e = 1; + + fd = open("/dev/stdout", O_WRONLY, 0600); + if (fd >= 0) { + + if (write(fd, msg, sizeof(msg)) == -1 || + write(fd, current_test, strlen(current_test)) == -1 || + write(fd, " ", 1) == -1 || + write(fd, current_state, strlen(current_state)) == -1 || + write(fd, "\n", 1) == -1) + e = 2; + (void) close(fd); + } + _exit(e); +} + +int +generic_test (const struct test_case *tests, + unsigned ntests, + size_t data_size, + int (ASN1CALL *encode)(unsigned char *, size_t, void *, size_t *), + size_t (ASN1CALL *length)(void *), + int (ASN1CALL *decode)(unsigned char *, size_t, void *, size_t *), + void (ASN1CALL *free_data)(void *), + int (*cmp)(void *a, void *b), + int (ASN1CALL *copy)(const void *from, void *to)) +{ + unsigned char *buf, *buf2; + int i; + int failures = 0; + void *data; + struct map_page *data_map, *buf_map, *buf2_map; + +#ifdef HAVE_SIGACTION + struct sigaction sa, osa; +#endif + + for (i = 0; i < ntests; ++i) { + int ret; + size_t sz, consumed_sz, length_sz, buf_sz; + void *to = NULL; + + current_test = tests[i].name; + + current_state = "init"; + +#ifdef HAVE_SIGACTION + sigemptyset (&sa.sa_mask); + sa.sa_flags = 0; +#ifdef SA_RESETHAND + sa.sa_flags |= SA_RESETHAND; +#endif + sa.sa_handler = segv_handler; + sigaction (SIGSEGV, &sa, &osa); +#endif + + data = map_alloc(OVERRUN, NULL, data_size, &data_map); + + buf_sz = tests[i].byte_len; + buf = map_alloc(UNDERRUN, NULL, buf_sz, &buf_map); + + current_state = "encode"; + ret = (*encode) (buf + buf_sz - 1, buf_sz, + tests[i].val, &sz); + if (ret != 0) { + printf ("encoding of %s failed %d\n", tests[i].name, ret); + ++failures; + continue; + } + if (sz != tests[i].byte_len) { + printf ("encoding of %s has wrong len (%lu != %lu)\n", + tests[i].name, + (unsigned long)sz, (unsigned long)tests[i].byte_len); + ++failures; + continue; + } + + current_state = "length"; + length_sz = (*length) (tests[i].val); + if (sz != length_sz) { + printf ("length for %s is bad (%lu != %lu)\n", + tests[i].name, (unsigned long)length_sz, (unsigned long)sz); + ++failures; + continue; + } + + current_state = "memcmp"; + if (memcmp (buf, tests[i].bytes, tests[i].byte_len) != 0) { + printf ("encoding of %s has bad bytes:\n" + "correct: ", tests[i].name); + print_bytes ((unsigned char *)tests[i].bytes, tests[i].byte_len); + printf ("\nactual: "); + print_bytes (buf, sz); + printf ("\n"); +#if 0 + rk_dumpdata("correct", tests[i].bytes, tests[i].byte_len); + rk_dumpdata("actual", buf, sz); + exit (1); +#endif + ++failures; + continue; + } + + buf2 = map_alloc(OVERRUN, buf, sz, &buf2_map); + + current_state = "decode"; + ret = (*decode) (buf2, sz, data, &consumed_sz); + if (ret != 0) { + printf ("decoding of %s failed %d\n", tests[i].name, ret); + ++failures; + continue; + } + if (sz != consumed_sz) { + printf ("different length decoding %s (%ld != %ld)\n", + tests[i].name, + (unsigned long)sz, (unsigned long)consumed_sz); + ++failures; + continue; + } + current_state = "cmp"; + if ((*cmp)(data, tests[i].val) != 0) { + printf ("%s: comparison failed\n", tests[i].name); + ++failures; + continue; + } + + current_state = "copy"; + if (copy) { + to = emalloc(data_size); + ret = (*copy)(data, to); + if (ret != 0) { + printf ("copy of %s failed %d\n", tests[i].name, ret); + ++failures; + continue; + } + + current_state = "cmp-copy"; + if ((*cmp)(data, to) != 0) { + printf ("%s: copy comparison failed\n", tests[i].name); + ++failures; + continue; + } + } + + current_state = "free"; + if (free_data) { + (*free_data)(data); + if (to) { + (*free_data)(to); + free(to); + } + } + + current_state = "free"; + map_free(buf_map, tests[i].name, "encode"); + map_free(buf2_map, tests[i].name, "decode"); + map_free(data_map, tests[i].name, "data"); + +#ifdef HAVE_SIGACTION + sigaction (SIGSEGV, &osa, NULL); +#endif + } + current_state = "done"; + return failures; +} + +/* + * check for failures + * + * a test size (byte_len) of -1 means that the test tries to trigger a + * integer overflow (and later a malloc of to little memory), just + * allocate some memory and hope that is enough for that test. + */ + +int +generic_decode_fail (const struct test_case *tests, + unsigned ntests, + size_t data_size, + int (ASN1CALL *decode)(unsigned char *, size_t, void *, size_t *)) +{ + unsigned char *buf; + int i; + int failures = 0; + void *data; + struct map_page *data_map, *buf_map; + +#ifdef HAVE_SIGACTION + struct sigaction sa, osa; +#endif + + for (i = 0; i < ntests; ++i) { + int ret; + size_t sz; + const void *bytes; + + current_test = tests[i].name; + + current_state = "init"; + +#ifdef HAVE_SIGACTION + sigemptyset (&sa.sa_mask); + sa.sa_flags = 0; +#ifdef SA_RESETHAND + sa.sa_flags |= SA_RESETHAND; +#endif + sa.sa_handler = segv_handler; + sigaction (SIGSEGV, &sa, &osa); +#endif + + data = map_alloc(OVERRUN, NULL, data_size, &data_map); + + if (tests[i].byte_len < 0xffffff && tests[i].byte_len >= 0) { + sz = tests[i].byte_len; + bytes = tests[i].bytes; + } else { + sz = 4096; + bytes = NULL; + } + + buf = map_alloc(OVERRUN, bytes, sz, &buf_map); + + if (tests[i].byte_len == -1) + memset(buf, 0, sz); + + current_state = "decode"; + ret = (*decode) (buf, tests[i].byte_len, data, &sz); + if (ret == 0) { + printf ("sucessfully decoded %s\n", tests[i].name); + ++failures; + continue; + } + + current_state = "free"; + if (buf) + map_free(buf_map, tests[i].name, "encode"); + map_free(data_map, tests[i].name, "data"); + +#ifdef HAVE_SIGACTION + sigaction (SIGSEGV, &osa, NULL); +#endif + } + current_state = "done"; + return failures; +} |