mirrors/glibc
1
0
Fork 0
mirror of https://sourceware.org/git/glibc.git synced 2024-12-03 22:53:37 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

stdlib: Add testcase for BZ #26241

Browse Source 
Old implementation of realpath allocates a PATH_MAX using alloca for
each symlink in the path, leading to MAXSYMLINKS times PATH_MAX
maximum stack usage.

The test create a symlink with __eloop_threshold() loops and creates
a thread with minimum stack size (obtained through
support_small_stack_thread_attribute).  The thread issues a stack
allocations that fill the thread allocated stack minus some slack
plus and the realpath usage (which assumes a bounded stack usage).
If realpath uses more than about 2 * PATH_MAX plus some slack it
triggers a stackoverflow.

Checked on x86_64-linux-gnu and i686-linux-gnu.

Reviewed-by: DJ Delorie <dj@redhat.com>
This commit is contained in:
Adhemerval Zanella 2020-12-29 12:24:28 -03:00
parent 1006250ea2
commit 961d7cff51
2 changed files with 103 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
stdlib/Makefile
View File

@ -86,7 +86,7 @@ tests := tst-strtol tst-strtod testmb testrand testsort testdiv \
tst-makecontext-align test-bz22786 tst-strtod-nan-sign \
tst-swapcontext1 tst-setcontext4 tst-setcontext5 \
tst-setcontext6 tst-setcontext7 tst-setcontext8 \
tst-setcontext9 tst-bz20544
tst-setcontext9 tst-bz20544 tst-canon-bz26341
tests-internal := tst-strtod1i tst-strtod3 tst-strtod4 tst-strtod5i \
tst-tls-atexit tst-tls-atexit-nodelete
@ -101,6 +101,7 @@ LDLIBS-test-atexit-race = $(shared-thread-library)
LDLIBS-test-at_quick_exit-race = $(shared-thread-library)
LDLIBS-test-cxa_atexit-race = $(shared-thread-library)
LDLIBS-test-on_exit-race = $(shared-thread-library)
LDLIBS-tst-canon-bz26341 = $(shared-thread-library)
LDLIBS-test-dlclose-exit-race = $(shared-thread-library) $(libdl)
LDFLAGS-test-dlclose-exit-race = $(LDFLAGS-rdynamic)

101
stdlib/tst-canon-bz26341.c Normal file
View File

@ -0,0 +1,101 @@
/* Check if realpath does not consume extra stack space based on symlink
existance in the path (BZ #26341)
Copyright (C) 2021 Free Software Foundation, Inc.
This file is part of the GNU C Library.
The GNU C Library is free software; you can redistribute it and/or
modify it under the terms of the GNU Lesser General Public
License as published by the Free Software Foundation; either
version 2.1 of the License, or (at your option) any later version.
The GNU C Library is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
Lesser General Public License for more details.
You should have received a copy of the GNU Lesser General Public
License along with the GNU C Library; if not, see
<https://www.gnu.org/licenses/>. */
#include <stdlib.h>
#include <string.h>
#include <sys/param.h>
#include <unistd.h>
#define __sysconf sysconf
#include <eloop-threshold.h>
#include <support/check.h>
#include <support/support.h>
#include <support/temp_file.h>
#include <support/xunistd.h>
#include <support/xthread.h>
static char *filename;
static size_t filenamelen;
static char *linkname;
#ifndef PATH_MAX
# define PATH_MAX 1024
#endif
static void
create_link (void)
{
int fd = create_temp_file ("tst-canon-bz26341", &filename);
TEST_VERIFY_EXIT (fd != -1);
xclose (fd);
/* Create MAXLINKS symbolic links to the temporary filename.
On exit, linkname has the last link created. */
char *prevlink = filename;
int maxlinks = __eloop_threshold ();
for (int i = 0; i < maxlinks; i++)
{
linkname = xasprintf ("%s%d", filename, i);
xsymlink (prevlink, linkname);
add_temp_file (linkname);
prevlink = linkname;
}
filenamelen = strlen (filename);
}
static void *
do_realpath (void *arg)
{
/* Old implementation of realpath allocates a PATH_MAX using alloca
for each symlink in the path, leading to MAXSYMLINKS times PATH_MAX
maximum stack usage.
This stack allocations tries fill the thread allocated stack minus
both the resolved path (plus some slack) and the realpath (plus some
slack).
If realpath uses more than 2 * PATH_MAX plus some slack it will trigger
a stackoverflow. */
const size_t realpath_usage = 2 * PATH_MAX + 1024;
const size_t thread_usage = 1 * PATH_MAX + 1024;
size_t stack_size = support_small_thread_stack_size ()
- realpath_usage - thread_usage;
char stack[stack_size];
char *resolved = stack + stack_size - thread_usage + 1024;
char *p = realpath (linkname, resolved);
TEST_VERIFY (p != NULL);
TEST_COMPARE_BLOB (resolved, filenamelen, filename, filenamelen);
return NULL;
}
static int
do_test (void)
{
create_link ();
pthread_t th = xpthread_create (support_small_stack_thread_attribute (),
do_realpath, NULL);
xpthread_join (th);
return 0;
}
#include <support/test-driver.c>