diff mbox series

[3/9] string: Add Kunit tests for strcat() family

Message ID 20230406000212.3442647-3-keescook@chromium.org
State New
Headers
Series fortify: Add KUnit tests for runtime overflows |

Commit Message

Kees Cook April 6, 2023, 12:02 a.m. UTC 
  From: Kees Cook <kees@outflux.net>

Add tests to make sure the strcat() family of functions behave
correctly.

Signed-off-by: Kees Cook <kees@outflux.net>
---
 MAINTAINERS        |   1 +
 lib/Kconfig.debug  |   5 +++
 lib/Makefile       |   1 +
 lib/strcat_kunit.c | 100 +++++++++++++++++++++++++++++++++++++++++++++
 4 files changed, 107 insertions(+)
 create mode 100644 lib/strcat_kunit.c

Comments

Alexander Potapenko April 6, 2023, 9:11 a.m. UTC | #1 
> +static void strncat_test(struct kunit *test)
> +{
> +       char dest[8];
> +
> +       /* Destination is terminated. */
> +       memset(dest, 0, sizeof(dest));
> +       KUNIT_EXPECT_EQ(test, strlen(dest), 0);
> +       /* Empty copy of size 0 does nothing. */
> +       KUNIT_EXPECT_TRUE(test, strncat(dest, "", 0) == dest);
> +       KUNIT_EXPECT_STREQ(test, dest, "");
> +       /* Empty copy of size 1 does nothing too. */
> +       KUNIT_EXPECT_TRUE(test, strncat(dest, "", 1) == dest);
> +       KUNIT_EXPECT_STREQ(test, dest, "");
> +       /* Copy of max 0 characters should do nothing. */
> +       KUNIT_EXPECT_TRUE(test, strncat(dest, "asdf", 0) == dest);
> +       KUNIT_EXPECT_STREQ(test, dest, "");
> +
> +       /* 4 characters copied in, even if max is 8. */
> +       KUNIT_EXPECT_TRUE(test, strncat(dest, "four\000123", 8) == dest);
> +       KUNIT_EXPECT_STREQ(test, dest, "four");
> +       KUNIT_EXPECT_EQ(test, dest[5], '\0');

Maybe also add a test case for strncat(dest, "four", 4) that checks
that the fourth byte of dest is not 0?
Kees Cook April 6, 2023, 11:07 p.m. UTC | #2 
On Thu, Apr 06, 2023 at 11:11:09AM +0200, Alexander Potapenko wrote:
> > +static void strncat_test(struct kunit *test)
> > +{
> > +       char dest[8];
> > +
> > +       /* Destination is terminated. */
> > +       memset(dest, 0, sizeof(dest));
> > +       KUNIT_EXPECT_EQ(test, strlen(dest), 0);
> > +       /* Empty copy of size 0 does nothing. */
> > +       KUNIT_EXPECT_TRUE(test, strncat(dest, "", 0) == dest);
> > +       KUNIT_EXPECT_STREQ(test, dest, "");
> > +       /* Empty copy of size 1 does nothing too. */
> > +       KUNIT_EXPECT_TRUE(test, strncat(dest, "", 1) == dest);
> > +       KUNIT_EXPECT_STREQ(test, dest, "");
> > +       /* Copy of max 0 characters should do nothing. */
> > +       KUNIT_EXPECT_TRUE(test, strncat(dest, "asdf", 0) == dest);
> > +       KUNIT_EXPECT_STREQ(test, dest, "");
> > +
> > +       /* 4 characters copied in, even if max is 8. */
> > +       KUNIT_EXPECT_TRUE(test, strncat(dest, "four\000123", 8) == dest);
> > +       KUNIT_EXPECT_STREQ(test, dest, "four");
> > +       KUNIT_EXPECT_EQ(test, dest[5], '\0');
> 
> Maybe also add a test case for strncat(dest, "four", 4) that checks
> that the fourth byte of dest is not 0?

I think I don't understand what state you want to test for? The line
above (STREQ is checking dest is "four". Maybe I should check for
dest[6] being 0 as well as dest[5]. But if that's not what you mean, I'm
not sure. Is it something here:

char dest[16];
memset(dest, 0, sizeof(dest));
// dest == ""
strncat(dest, "four", 4);
// dest == "four"
strncat(dest, "four", 4);
// dest == "fourfour"

strncat's "n" is how much to reach from source -- dest will always be
terminated.
Alexander Potapenko April 12, 2023, 12:34 p.m. UTC | #3 
On Fri, Apr 7, 2023 at 1:07 AM Kees Cook <keescook@chromium.org> wrote:
>
> On Thu, Apr 06, 2023 at 11:11:09AM +0200, Alexander Potapenko wrote:
> > > +static void strncat_test(struct kunit *test)
> > > +{
> > > +       char dest[8];
> > > +
> > > +       /* Destination is terminated. */
> > > +       memset(dest, 0, sizeof(dest));
> > > +       KUNIT_EXPECT_EQ(test, strlen(dest), 0);
> > > +       /* Empty copy of size 0 does nothing. */
> > > +       KUNIT_EXPECT_TRUE(test, strncat(dest, "", 0) == dest);
> > > +       KUNIT_EXPECT_STREQ(test, dest, "");
> > > +       /* Empty copy of size 1 does nothing too. */
> > > +       KUNIT_EXPECT_TRUE(test, strncat(dest, "", 1) == dest);
> > > +       KUNIT_EXPECT_STREQ(test, dest, "");
> > > +       /* Copy of max 0 characters should do nothing. */
> > > +       KUNIT_EXPECT_TRUE(test, strncat(dest, "asdf", 0) == dest);
> > > +       KUNIT_EXPECT_STREQ(test, dest, "");
> > > +
> > > +       /* 4 characters copied in, even if max is 8. */
> > > +       KUNIT_EXPECT_TRUE(test, strncat(dest, "four\000123", 8) == dest);
> > > +       KUNIT_EXPECT_STREQ(test, dest, "four");
> > > +       KUNIT_EXPECT_EQ(test, dest[5], '\0');
> >
> > Maybe also add a test case for strncat(dest, "four", 4) that checks
> > that the fourth byte of dest is not 0?
>
> I think I don't understand what state you want to test for? The line
> above (STREQ is checking dest is "four". Maybe I should check for
> dest[6] being 0 as well as dest[5]. But if that's not what you mean, I'm
> not sure. Is it something here:

Sorry, not sure why I wrote "strncat" here, I was thinking about
strncpy, which is handled in a different patch.
Please disregard.

> char dest[16];
> memset(dest, 0, sizeof(dest));
> // dest == ""
> strncat(dest, "four", 4);
> // dest == "four"
> strncat(dest, "four", 4);
> // dest == "fourfour"
>
> strncat's "n" is how much to reach from source -- dest will always be
> terminated.
>
> --
> Kees Cook
diff mbox series

Patch

diff --git a/MAINTAINERS b/MAINTAINERS
index ec57c42ed544..86c0012b5130 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -8021,6 +8021,7 @@  T:	git git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux.git for-next/har
 F:	include/linux/fortify-string.h
 F:	lib/fortify_kunit.c
 F:	lib/memcpy_kunit.c
+F:	lib/strcat_kunit.c
 F:	lib/strscpy_kunit.c
 F:	lib/test_fortify/*
 F:	scripts/test_fortify.sh
diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug
index d48a5f4b471e..86157aa5e979 100644
--- a/lib/Kconfig.debug
+++ b/lib/Kconfig.debug
@@ -2631,6 +2631,11 @@  config HW_BREAKPOINT_KUNIT_TEST
 
 	  If unsure, say N.
 
+config STRCAT_KUNIT_TEST
+	tristate "Test strcat() family of functions at runtime" if !KUNIT_ALL_TESTS
+	depends on KUNIT
+	default KUNIT_ALL_TESTS
+
 config STRSCPY_KUNIT_TEST
 	tristate "Test strscpy*() family of functions at runtime" if !KUNIT_ALL_TESTS
 	depends on KUNIT
diff --git a/lib/Makefile b/lib/Makefile
index baf2821f7a00..6582d8fe1a77 100644
--- a/lib/Makefile
+++ b/lib/Makefile
@@ -389,6 +389,7 @@  obj-$(CONFIG_STACKINIT_KUNIT_TEST) += stackinit_kunit.o
 CFLAGS_fortify_kunit.o += $(call cc-disable-warning, unsequenced)
 CFLAGS_fortify_kunit.o += $(DISABLE_STRUCTLEAK_PLUGIN)
 obj-$(CONFIG_FORTIFY_KUNIT_TEST) += fortify_kunit.o
+obj-$(CONFIG_STRCAT_KUNIT_TEST) += strcat_kunit.o
 obj-$(CONFIG_STRSCPY_KUNIT_TEST) += strscpy_kunit.o
 obj-$(CONFIG_SIPHASH_KUNIT_TEST) += siphash_kunit.o
 
diff --git a/lib/strcat_kunit.c b/lib/strcat_kunit.c
new file mode 100644
index 000000000000..b6428c3a557f
--- /dev/null
+++ b/lib/strcat_kunit.c
@@ -0,0 +1,100 @@ 
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Kernel module for testing 'strcat' family of functions.
+ */
+
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
+#include <kunit/test.h>
+#include <linux/string.h>
+
+static void strcat_test(struct kunit *test)
+{
+	char dest[8];
+
+	/* Destination is terminated. */
+	memset(dest, 0, sizeof(dest));
+	KUNIT_EXPECT_EQ(test, strlen(dest), 0);
+	/* Empty copy does nothing. */
+	KUNIT_EXPECT_TRUE(test, strcat(dest, "") == dest);
+	KUNIT_EXPECT_STREQ(test, dest, "");
+	/* 4 characters copied in, stops at %NUL. */
+	KUNIT_EXPECT_TRUE(test, strcat(dest, "four\000123") == dest);
+	KUNIT_EXPECT_STREQ(test, dest, "four");
+	KUNIT_EXPECT_EQ(test, dest[5], '\0');
+	/* 2 more characters copied in okay. */
+	KUNIT_EXPECT_TRUE(test, strcat(dest, "AB") == dest);
+	KUNIT_EXPECT_STREQ(test, dest, "fourAB");
+}
+
+static void strncat_test(struct kunit *test)
+{
+	char dest[8];
+
+	/* Destination is terminated. */
+	memset(dest, 0, sizeof(dest));
+	KUNIT_EXPECT_EQ(test, strlen(dest), 0);
+	/* Empty copy of size 0 does nothing. */
+	KUNIT_EXPECT_TRUE(test, strncat(dest, "", 0) == dest);
+	KUNIT_EXPECT_STREQ(test, dest, "");
+	/* Empty copy of size 1 does nothing too. */
+	KUNIT_EXPECT_TRUE(test, strncat(dest, "", 1) == dest);
+	KUNIT_EXPECT_STREQ(test, dest, "");
+	/* Copy of max 0 characters should do nothing. */
+	KUNIT_EXPECT_TRUE(test, strncat(dest, "asdf", 0) == dest);
+	KUNIT_EXPECT_STREQ(test, dest, "");
+
+	/* 4 characters copied in, even if max is 8. */
+	KUNIT_EXPECT_TRUE(test, strncat(dest, "four\000123", 8) == dest);
+	KUNIT_EXPECT_STREQ(test, dest, "four");
+	KUNIT_EXPECT_EQ(test, dest[5], '\0');
+	/* 2 characters copied in okay, 2 ignored. */
+	KUNIT_EXPECT_TRUE(test, strncat(dest, "ABCD", 2) == dest);
+	KUNIT_EXPECT_STREQ(test, dest, "fourAB");
+}
+
+static void strlcat_test(struct kunit *test)
+{
+	char dest[8] = "";
+
+	/* Destination is terminated. */
+	KUNIT_EXPECT_EQ(test, strlen(dest), 0);
+	/* Empty copy is size 0. */
+	KUNIT_EXPECT_EQ(test, strlcat(dest, "", sizeof(dest)), 0);
+	KUNIT_EXPECT_STREQ(test, dest, "");
+	/* Size 1 should keep buffer terminated, report size of source only. */
+	KUNIT_EXPECT_EQ(test, strlcat(dest, "four", 1), 4);
+	KUNIT_EXPECT_STREQ(test, dest, "");
+
+	/* 4 characters copied in. */
+	KUNIT_EXPECT_EQ(test, strlcat(dest, "four", sizeof(dest)), 4);
+	KUNIT_EXPECT_STREQ(test, dest, "four");
+	/* 2 characters copied in okay, gets to 6 total. */
+	KUNIT_EXPECT_EQ(test, strlcat(dest, "AB", sizeof(dest)), 6);
+	KUNIT_EXPECT_STREQ(test, dest, "fourAB");
+	/* 2 characters ignored if max size (7) reached. */
+	KUNIT_EXPECT_EQ(test, strlcat(dest, "CD", 7), 8);
+	KUNIT_EXPECT_STREQ(test, dest, "fourAB");
+	/* 1 of 2 characters skipped, now at true max size. */
+	KUNIT_EXPECT_EQ(test, strlcat(dest, "EFG", sizeof(dest)), 9);
+	KUNIT_EXPECT_STREQ(test, dest, "fourABE");
+	/* Everything else ignored, now at full size. */
+	KUNIT_EXPECT_EQ(test, strlcat(dest, "1234", sizeof(dest)), 11);
+	KUNIT_EXPECT_STREQ(test, dest, "fourABE");
+}
+
+static struct kunit_case strcat_test_cases[] = {
+	KUNIT_CASE(strcat_test),
+	KUNIT_CASE(strncat_test),
+	KUNIT_CASE(strlcat_test),
+	{}
+};
+
+static struct kunit_suite strcat_test_suite = {
+	.name = "strcat",
+	.test_cases = strcat_test_cases,
+};
+
+kunit_test_suite(strcat_test_suite);
+
+MODULE_LICENSE("GPL");