1  /* Test for vfprintf nargs allocation overflow (BZ #13656).
       2     Copyright (C) 2012-2023 Free Software Foundation, Inc.
       3     This file is part of the GNU C Library.
       4  
       5     The GNU C Library is free software; you can redistribute it and/or
       6     modify it under the terms of the GNU Lesser General Public
       7     License as published by the Free Software Foundation; either
       8     version 2.1 of the License, or (at your option) any later version.
       9  
      10     The GNU C Library is distributed in the hope that it will be useful,
      11     but WITHOUT ANY WARRANTY; without even the implied warranty of
      12     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
      13     Lesser General Public License for more details.
      14  
      15     You should have received a copy of the GNU Lesser General Public
      16     License along with the GNU C Library; if not, see
      17     <https://www.gnu.org/licenses/>.  */
      18  
      19  #include <stdio.h>
      20  #include <stdlib.h>
      21  #include <stdint.h>
      22  #include <unistd.h>
      23  #include <inttypes.h>
      24  #include <string.h>
      25  #include <signal.h>
      26  
      27  static int
      28  format_failed (const char *fmt, const char *expected)
      29  {
      30    char output[80];
      31  
      32    printf ("%s : ", fmt);
      33  
      34    memset (output, 0, sizeof output);
      35    /* Having sprintf itself detect a failure is good.  */
      36    if (sprintf (output, fmt, 1, 2, 3, "test") > 0
      37        && strcmp (output, expected) != 0)
      38      {
      39        printf ("FAIL (output '%s' != expected '%s')\n", output, expected);
      40        return 1;
      41      }
      42    puts ("ok");
      43    return 0;
      44  }
      45  
      46  static int
      47  do_test (void)
      48  {
      49    int rc = 0;
      50    char buf[64];
      51  
      52    /* Regular positionals work.  */
      53    if (format_failed ("%1$d", "1") != 0)
      54      rc = 1;
      55  
      56    /* Regular width positionals work.  */
      57    if (format_failed ("%1$*2$d", " 1") != 0)
      58      rc = 1;
      59  
      60    /* Positional arguments are constructed via read_int, so nargs can only
      61       overflow on 32-bit systems.  On 64-bit systems, it will attempt to
      62       allocate a giant amount of memory and possibly crash, which is the
      63       expected situation.  Since the 64-bit behavior is arch-specific, only
      64       test this on 32-bit systems.  */
      65    if (sizeof (long int) == 4)
      66      {
      67        sprintf (buf, "%%1$d %%%" PRIdPTR "$d",
      68  	       (intptr_t) (UINT32_MAX / sizeof (int)));
      69        if (format_failed (buf, "1 %$d") != 0)
      70          rc = 1;
      71      }
      72  
      73    return rc;
      74  }
      75  
      76  #define TEST_FUNCTION do_test ()
      77  #include "../test-skeleton.c"