2 * Copyright (c) 1999 - 2006 Kungliga Tekniska Högskolan
3 * (Royal Institute of Technology, Stockholm, Sweden).
6 * Portions Copyright (c) 2009 Apple Inc. All rights reserved.
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in the
17 * documentation and/or other materials provided with the distribution.
19 * 3. Neither the name of the Institute nor the names of its contributors
20 * may be used to endorse or promote products derived from this software
21 * without specific prior written permission.
23 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
24 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
25 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
26 * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
27 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
28 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
29 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
30 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
31 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
32 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
39 #ifdef HAVE_SYS_MMAN_H
47 #include "asn1-common.h"
48 #include "check-common.h"
60 /* #undef HAVE_MMAP */
63 map_alloc(enum map_type type, const void *buf,
64 size_t size, struct map_page **map)
68 size_t len = size + sizeof(long) * 2;
71 *map = ecalloc(1, sizeof(**map));
77 (*map)->data_start = p + sizeof(long);
78 for (i = sizeof(long); i > 0; i--)
79 p[sizeof(long) - i] = 0xff - i;
80 for (i = sizeof(long); i > 0; i--)
81 p[len - i] = 0xff - i;
85 size_t pagesize = getpagesize();
87 *map = ecalloc(1, sizeof(**map));
96 fd = open ("/dev/zero", O_RDONLY);
98 err (1, "open /dev/zero");
100 flags |= MAP_PRIVATE;
102 (*map)->size = size + pagesize - (size % pagesize) + pagesize * 2;
104 p = (unsigned char *)mmap(0, (*map)->size, PROT_READ | PROT_WRITE,
106 if (p == (unsigned char *)MAP_FAILED)
111 ret = mprotect (p, pagesize, 0);
115 ret = mprotect (p + (*map)->size - pagesize, pagesize, 0);
121 (*map)->data_start = p + (*map)->size - pagesize - size;
124 (*map)->data_start = p + pagesize;
130 (*map)->data_size = size;
132 memcpy((*map)->data_start, buf, size);
133 return (*map)->data_start;
137 map_free(struct map_page *map, const char *test_name, const char *map_name)
140 unsigned char *p = map->start;
143 for (i = sizeof(long); i > 0; i--)
144 if (p[sizeof(long) - i] != 0xff - i)
145 errx(1, "%s: %s underrun %d\n", test_name, map_name, i);
146 for (i = sizeof(long); i > 0; i--)
147 if (p[map->size - i] != 0xff - i)
148 errx(1, "%s: %s overrun %lu\n", test_name, map_name,
149 (unsigned long)map->size - i);
154 ret = munmap (map->start, map->size);
162 print_bytes (unsigned const char *buf, size_t len)
166 for (i = 0; i < len; ++i)
167 printf ("%02x ", buf[i]);
171 #define MAP_FAILED (-1)
174 static char *current_test = "<uninit>";
175 static char *current_state = "<uninit>";
178 segv_handler(int sig)
181 char msg[] = "SIGSEGV i current test: ";
183 fd = open("/dev/stdout", O_WRONLY, 0600);
185 write(fd, msg, sizeof(msg));
186 write(fd, current_test, strlen(current_test));
188 write(fd, current_state, strlen(current_state));
196 generic_test (const struct test_case *tests,
199 int (ASN1CALL *encode)(unsigned char *, size_t, void *, size_t *),
200 int (ASN1CALL *length)(void *),
201 int (ASN1CALL *decode)(unsigned char *, size_t, void *, size_t *),
202 int (ASN1CALL *free_data)(void *),
203 int (*cmp)(void *a, void *b),
204 int (ASN1CALL *copy)(const void *from, void *to))
206 unsigned char *buf, *buf2;
210 struct map_page *data_map, *buf_map, *buf2_map;
212 #ifdef HAVE_SIGACTION
213 struct sigaction sa, osa;
216 for (i = 0; i < ntests; ++i) {
218 size_t sz, consumed_sz, length_sz, buf_sz;
221 current_test = tests[i].name;
223 current_state = "init";
225 #ifdef HAVE_SIGACTION
226 sigemptyset (&sa.sa_mask);
229 sa.sa_flags |= SA_RESETHAND;
231 sa.sa_handler = segv_handler;
232 sigaction (SIGSEGV, &sa, &osa);
235 data = map_alloc(OVERRUN, NULL, data_size, &data_map);
237 buf_sz = tests[i].byte_len;
238 buf = map_alloc(UNDERRUN, NULL, buf_sz, &buf_map);
240 current_state = "encode";
241 ret = (*encode) (buf + buf_sz - 1, buf_sz,
244 printf ("encoding of %s failed %d\n", tests[i].name, ret);
248 if (sz != tests[i].byte_len) {
249 printf ("encoding of %s has wrong len (%lu != %lu)\n",
251 (unsigned long)sz, (unsigned long)tests[i].byte_len);
256 current_state = "length";
257 length_sz = (*length) (tests[i].val);
258 if (sz != length_sz) {
259 printf ("length for %s is bad (%lu != %lu)\n",
260 tests[i].name, (unsigned long)length_sz, (unsigned long)sz);
265 current_state = "memcmp";
266 if (memcmp (buf, tests[i].bytes, tests[i].byte_len) != 0) {
267 printf ("encoding of %s has bad bytes:\n"
268 "correct: ", tests[i].name);
269 print_bytes ((unsigned char *)tests[i].bytes, tests[i].byte_len);
270 printf ("\nactual: ");
271 print_bytes (buf, sz);
274 rk_dumpdata("correct", tests[i].bytes, tests[i].byte_len);
275 rk_dumpdata("actual", buf, sz);
282 buf2 = map_alloc(OVERRUN, buf, sz, &buf2_map);
284 current_state = "decode";
285 ret = (*decode) (buf2, sz, data, &consumed_sz);
287 printf ("decoding of %s failed %d\n", tests[i].name, ret);
291 if (sz != consumed_sz) {
292 printf ("different length decoding %s (%ld != %ld)\n",
294 (unsigned long)sz, (unsigned long)consumed_sz);
298 current_state = "cmp";
299 if ((*cmp)(data, tests[i].val) != 0) {
300 printf ("%s: comparison failed\n", tests[i].name);
305 current_state = "copy";
307 to = emalloc(data_size);
308 ret = (*copy)(data, to);
310 printf ("copy of %s failed %d\n", tests[i].name, ret);
315 current_state = "cmp-copy";
316 if ((*cmp)(data, to) != 0) {
317 printf ("%s: copy comparison failed\n", tests[i].name);
323 current_state = "free";
332 current_state = "free";
333 map_free(buf_map, tests[i].name, "encode");
334 map_free(buf2_map, tests[i].name, "decode");
335 map_free(data_map, tests[i].name, "data");
337 #ifdef HAVE_SIGACTION
338 sigaction (SIGSEGV, &osa, NULL);
341 current_state = "done";
348 * a test size (byte_len) of -1 means that the test tries to trigger a
349 * integer overflow (and later a malloc of to little memory), just
350 * allocate some memory and hope that is enough for that test.
354 generic_decode_fail (const struct test_case *tests,
357 int (ASN1CALL *decode)(unsigned char *, size_t, void *, size_t *))
363 struct map_page *data_map, *buf_map;
365 #ifdef HAVE_SIGACTION
366 struct sigaction sa, osa;
369 for (i = 0; i < ntests; ++i) {
374 current_test = tests[i].name;
376 current_state = "init";
378 #ifdef HAVE_SIGACTION
379 sigemptyset (&sa.sa_mask);
382 sa.sa_flags |= SA_RESETHAND;
384 sa.sa_handler = segv_handler;
385 sigaction (SIGSEGV, &sa, &osa);
388 data = map_alloc(OVERRUN, NULL, data_size, &data_map);
390 if (tests[i].byte_len < 0xffffff && tests[i].byte_len >= 0) {
391 sz = tests[i].byte_len;
392 bytes = tests[i].bytes;
398 buf = map_alloc(OVERRUN, bytes, sz, &buf_map);
400 if (tests[i].byte_len == -1)
403 current_state = "decode";
404 ret = (*decode) (buf, tests[i].byte_len, data, &sz);
406 printf ("sucessfully decoded %s\n", tests[i].name);
411 current_state = "free";
413 map_free(buf_map, tests[i].name, "encode");
414 map_free(data_map, tests[i].name, "data");
416 #ifdef HAVE_SIGACTION
417 sigaction (SIGSEGV, &osa, NULL);
420 current_state = "done";