Check that memchr does not read past the first occurrence of the byte.

diff --git a/ChangeLog b/ChangeLog
index e08b1e51ca618eb898aab2030a91b382e55b79e4..aacc63af7c787478c7e55b8c2d974435e5c6e99c 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,11 @@
+2009-05-31  Bruno Haible  <bruno@clisp.org>
+
+       * tests/zerosize-ptr.h (zerosize_ptr): Specify more details.
+       * tests/test-memchr.c (main): Check that memchr does not read past the
+       first occurrence of the byte.
+       * tests/test-strstr.c (main): Update comment.
+       Suggested by Eric Blake.
+
 2009-05-30  Bruno Haible  <bruno@clisp.org>
 
        * doc/ld-output-def.texi (Visual Studio Compatibility): Explain in more

diff --git a/tests/test-memchr.c b/tests/test-memchr.c
index bf99a82edb71dc304cc6eded614fb4ca396b5d9c..1124f8b5871362e1bec3f5d8b6bbd0fa6446b581 100644 (file)
--- a/tests/test-memchr.c
+++ b/tests/test-memchr.c
@@ -94,6 +94,36 @@ main ()
       }
   }
 
+  /* Check that memchr() does not read past the first occurrence of the
+     byte being searched.  See the Austin Group's clarification
+     <http://www.opengroup.org/austin/docs/austin_454.txt>.  */
+  {
+    char *page_boundary = (char *) zerosize_ptr ();
+
+    if (page_boundary != NULL)
+      {
+       int n;
+
+       for (n = 1; n <= 500; n++)
+         {
+           char *mem = page_boundary - n;
+           memset (mem, 'X', n);
+           ASSERT (MEMCHR (mem, 'U', n) == NULL);
+
+           {
+             int i;
+
+             for (i = 0; i < n; i++)
+               {
+                 mem[i] = 'U';
+                 ASSERT (MEMCHR (mem, 'U', 4000) == mem + i);
+                 mem[i] = 'X';
+               }
+           }
+         }
+      }
+  }
+
   free (input);
 
   return 0;

diff --git a/tests/test-strstr.c b/tests/test-strstr.c
index 600f7c7869859f2dd0592adf01cd4861933d7338..f7bc4cb91d7133a75d9d455f506a51fd4ff50568 100644 (file)
--- a/tests/test-strstr.c
+++ b/tests/test-strstr.c
@@ -61,7 +61,12 @@ main (int argc, char *argv[])
   }
 
   {
-    /* See http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=521737 */
+    /* On some platforms, the memchr() functions reads past the first
+       occurrence of the byte to be searched, leading to an out-of-bounds
+       read access for strstr().
+       See <http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=521737>.
+       This is a bug in memchr(), see the Austin Group's clarification
+       <http://www.opengroup.org/austin/docs/austin_454.txt>.  */
     const char *fix = "aBaaaaaaaaaaax";
     char *input = malloc (strlen (fix) + 1);
     const char *result;

diff --git a/tests/zerosize-ptr.h b/tests/zerosize-ptr.h
index 9918ac7210e0d858a9b3eeecd78956898d771d2d..a38a2cf4941ab810d59019f69b9458f8d66bcebe 100644 (file)
--- a/tests/zerosize-ptr.h
+++ b/tests/zerosize-ptr.h
@@ -35,7 +35,9 @@
 # endif
 #endif
 
-/* Return a pointer to a zero-size object in memory, if possible.
+/* Return a pointer to a zero-size object in memory (that is, actually, a
+   pointer to a page boundary where the previous page is readable and writable
+   and the next page is neither readable not writable), if possible.
    Return NULL otherwise.  */
 
 static void *