root/maint/gnulib/tests/test-explicit_bzero.c

/* */

DEFINITIONS

1. test_static
2. vma_iterate_callback
3. is_range_mapped
4. is_range_mapped
5. test_heap
6. do_secret_stuff
7. test_stack
8. main

   1 /* Test of explicit_bzero() function.
   2    Copyright (C) 2020-2021 Free Software Foundation, Inc.
   3 
   4    This program is free software: you can redistribute it and/or modify
   5    it under the terms of the GNU General Public License as published by
   6    the Free Software Foundation; either version 3 of the License, or
   7    (at your option) any later version.
   8 
   9    This program is distributed in the hope that it will be useful,
  10    but WITHOUT ANY WARRANTY; without even the implied warranty of
  11    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  12    GNU General Public License for more details.
  13 
  14    You should have received a copy of the GNU General Public License
  15    along with this program.  If not, see <https://www.gnu.org/licenses/>.  */
  16 
  17 /* Written by Bruno Haible <bruno@clisp.org>, 2020.  */
  18 
  19 #include <config.h>
  20 
  21 /* Specification.  */
  22 #include <string.h>
  23 
  24 #include "signature.h"
  25 SIGNATURE_CHECK (explicit_bzero, void, (void *, size_t));
  26 
  27 #include <stdbool.h>
  28 #include <stdio.h>
  29 #include <stdint.h>
  30 #include <stdlib.h>
  31 
  32 #include "vma-iter.h"
  33 #include "macros.h"
  34 
  35 /* Suppress GCC warning that do_secret_stuff (2) reads uninitialized
  36    local storage.  */
  37 #if 4 < __GNUC__ + (3 <= __GNUC_MINOR__)
  38 # pragma GCC diagnostic ignored "-Wmaybe-uninitialized"
  39 #endif
  40 
  41 #define SECRET "xyzzy1729"
  42 #define SECRET_SIZE 9
  43 
  44 static char zero[SECRET_SIZE] = { 0 };
  45 
  46 /* Enable this to verify that the test is effective.  */
  47 #if 0
  48 # define explicit_bzero(a, n)  memset (a, '\0', n)
  49 #endif
  50 
  51 /* =================== Verify operation on static memory =================== */
  52 
  53 static char stbuf[SECRET_SIZE];
  54 
  55 static void
  56 test_static (void)
     /*  */
  57 {
  58   memcpy (stbuf, SECRET, SECRET_SIZE);
  59   explicit_bzero (stbuf, SECRET_SIZE);
  60   ASSERT (memcmp (zero, stbuf, SECRET_SIZE) == 0);
  61 }
  62 
  63 /* =============== Verify operation on heap-allocated memory =============== */
  64 
  65 /* Test whether an address range is mapped in memory.  */
  66 #if VMA_ITERATE_SUPPORTED
  67 
  68 struct locals
  69 {
  70   uintptr_t range_start;
  71   uintptr_t range_end;
  72 };
  73 
  74 static int
  75 vma_iterate_callback (void *data, uintptr_t start, uintptr_t end,
     /*  */
  76                       unsigned int flags)
  77 {
  78   struct locals *lp = (struct locals *) data;
  79 
  80   /* Remove from [range_start, range_end) the part at the beginning or at the
  81      end that is covered by [start, end).  */
  82   if (start <= lp->range_start && end > lp->range_start)
  83     lp->range_start = (end < lp->range_end ? end : lp->range_end);
  84   if (start < lp->range_end && end >= lp->range_end)
  85     lp->range_end = (start > lp->range_start ? start : lp->range_start);
  86 
  87   return 0;
  88 }
  89 
  90 static bool
  91 is_range_mapped (uintptr_t range_start, uintptr_t range_end)
     /*  */
  92 {
  93   struct locals l;
  94 
  95   l.range_start = range_start;
  96   l.range_end = range_end;
  97   vma_iterate (vma_iterate_callback, &l);
  98   return l.range_start == l.range_end;
  99 }
 100 
 101 #else
 102 
 103 static bool
 104 is_range_mapped (uintptr_t range_start, uintptr_t range_end)
     /*  */
 105 {
 106   return true;
 107 }
 108 
 109 #endif
 110 
 111 static void
 112 test_heap (void)
     /*  */
 113 {
 114   char *heapbuf = (char *) malloc (SECRET_SIZE);
 115   uintptr_t addr = (uintptr_t) heapbuf;
 116   memcpy (heapbuf, SECRET, SECRET_SIZE);
 117   explicit_bzero (heapbuf, SECRET_SIZE);
 118   free (heapbuf);
 119   if (is_range_mapped (addr, addr + SECRET_SIZE))
 120     {
 121       /* some implementation could override freed memory by canaries so
 122          compare against secret */
 123       ASSERT (memcmp (heapbuf, SECRET, SECRET_SIZE) != 0);
 124       printf ("test_heap: address range is still mapped after free().\n");
 125     }
 126   else
 127     printf ("test_heap: address range is unmapped after free().\n");
 128 }
 129 
 130 /* =============== Verify operation on stack-allocated memory =============== */
 131 
 132 /* There are two passes:
 133      1. Put a secret in memory and invoke explicit_bzero on it.
 134      2. Verify that the memory has been erased.
 135    Implement them in the same function, so that they access the same memory
 136    range on the stack.  That way, the test verifies that the compiler
 137    does not eliminate a call to explicit_bzero, even if data flow analysis
 138    reveals that the stack area is dead at the end of the function.  */
 139 static int _GL_ATTRIBUTE_NOINLINE
 140 do_secret_stuff (volatile int pass)
     /*  */
 141 {
 142   static char *last_stackbuf;
 143   char stackbuf[SECRET_SIZE];
 144   if (pass == 1)
 145     {
 146       memcpy (stackbuf, SECRET, SECRET_SIZE);
 147       explicit_bzero (stackbuf, SECRET_SIZE);
 148       last_stackbuf = stackbuf;
 149       return 0;
 150     }
 151   else /* pass == 2 */
 152     {
 153       /* Use last_stackbuf here, because stackbuf may be allocated at a
 154          different address than last_stackbuf.  This can happen
 155          when the compiler splits this function into different functions,
 156          one for pass == 1 and one for pass != 1.  */
 157       return memcmp (zero, last_stackbuf, SECRET_SIZE) != 0;
 158     }
 159 }
 160 
 161 static void
 162 test_stack (void)
     /*  */
 163 {
 164   int count = 0;
 165   int repeat;
 166 
 167   for (repeat = 2 * 1000; repeat > 0; repeat--)
 168     {
 169       /* This odd way of writing two consecutive statements
 170            do_secret_stuff (1);
 171            count += do_secret_stuff (2);
 172          ensures that the two do_secret_stuff calls are performed with the same
 173          stack pointer value, on m68k.  */
 174       if ((repeat % 2) == 0)
 175         do_secret_stuff (1);
 176       else
 177         count += do_secret_stuff (2);
 178     }
 179   /* If explicit_bzero works, count is near 0.  (It may be > 0 if there were
 180      some asynchronous signal invocations between the two calls of
 181      do_secret_stuff.)
 182      If explicit_bzero is optimized away by the compiler, count comes out as
 183      approximately 1000.  */
 184   printf ("test_stack: count = %d\n", count);
 185   ASSERT (count < 50);
 186 }
 187 
 188 /* ========================================================================== */
 189 
 190 int
 191 main ()
     /*  */
 192 {
 193   test_static ();
 194   test_heap ();
 195   test_stack ();
 196 
 197   return 0;
 198 }

/* */