From f7d96bdf80129d95cf33f26a778ce2c94a818bd0 Mon Sep 17 00:00:00 2001 From: Havoc Pennington Date: Sun, 2 Mar 2003 17:34:30 +0000 Subject: 2003-03-02 Havoc Pennington * test/break-loader.c (randomly_set_extreme_ints): add test that sets really huge and small integers * dbus/dbus-marshal.c (_dbus_marshal_validate_arg): add check that length of boolean array fits in the string, and that string has room for boolean value in single-bool case. * dbus/dbus-message-builder.c (_dbus_message_data_load): add optional value to "ALIGN" command which is what to fill the alignment with. * test/data/valid-messages/no-padding.message: add regression test for the message padding problem --- test/break-loader.c | 83 ++++++++++++++++++++- .../boolean-array-length-too-long.message-raw | Bin 0 -> 27 bytes .../boolean-has-no-value.message-raw | Bin 0 -> 102 bytes test/data/valid-messages/no-padding.message | 19 +++++ 4 files changed, 101 insertions(+), 1 deletion(-) create mode 100644 test/data/invalid-messages/boolean-array-length-too-long.message-raw create mode 100644 test/data/invalid-messages/boolean-has-no-value.message-raw create mode 100644 test/data/valid-messages/no-padding.message (limited to 'test') diff --git a/test/break-loader.c b/test/break-loader.c index db9a14a1..f08f43d9 100644 --- a/test/break-loader.c +++ b/test/break-loader.c @@ -334,6 +334,67 @@ randomly_modify_length (const DBusString *orig_data, (unsigned) (orig + delta)); } +static void +randomly_set_extreme_ints (const DBusString *orig_data, + DBusString *mutated) +{ + int i; + int byte_order; + const char *d; + dbus_uint32_t orig; + static int which = 0; + unsigned int extreme_ints[] = { + _DBUS_INT_MAX, + _DBUS_UINT_MAX, + _DBUS_INT_MAX - 1, + _DBUS_UINT_MAX - 1, + _DBUS_INT_MAX - 2, + _DBUS_UINT_MAX - 2, + (unsigned int) (_DBUS_INT_MAX + 1), + (unsigned int) (_DBUS_UINT_MAX + 1), + _DBUS_INT_MAX + 2, + _DBUS_UINT_MAX + 2, + 0, 1, 2, 3, + (unsigned int) -1, + (unsigned int) -2, + (unsigned int) -3 + }; + + if (orig_data != mutated) + { + _dbus_string_set_length (mutated, 0); + + if (!_dbus_string_copy (orig_data, 0, mutated, 0)) + _dbus_assert_not_reached ("out of mem"); + } + + if (_dbus_string_get_length (mutated) < 12) + return; + + _dbus_string_get_const_data (mutated, &d); + + if (!(*d == DBUS_LITTLE_ENDIAN || + *d == DBUS_BIG_ENDIAN)) + return; + + byte_order = *d; + + i = random_int_in_range (4, _dbus_string_get_length (mutated) - 8); + i = _DBUS_ALIGN_VALUE (i, 4); + + orig = _dbus_demarshal_uint32 (mutated, byte_order, i, NULL); + + which = random_int_in_range (0, _DBUS_N_ELEMENTS (extreme_ints)); + + _dbus_assert (which >= 0); + _dbus_assert (which < _DBUS_N_ELEMENTS (extreme_ints)); + + _dbus_marshal_set_uint32 (mutated, byte_order, i, + extreme_ints[which]); +} + +static int times_we_did_each_thing[6] = { 0, }; + static void randomly_do_n_things (const DBusString *orig_data, DBusString *mutated, @@ -347,7 +408,8 @@ randomly_do_n_things (const DBusString *orig_data, randomly_change_one_byte, randomly_add_one_byte, randomly_remove_one_byte, - randomly_modify_length + randomly_modify_length, + randomly_set_extreme_ints }; _dbus_string_set_length (mutated, 0); @@ -363,6 +425,7 @@ randomly_do_n_things (const DBusString *orig_data, which = random_int_in_range (0, _DBUS_N_ELEMENTS (functions)); (* functions[which]) (mutated, mutated); + times_we_did_each_thing[which] += 1; ++i; } @@ -432,6 +495,15 @@ find_breaks_based_on (const DBusString *filename, ++i; } + + i = 0; + while (i < 50) + { + randomly_set_extreme_ints (&orig_data, &mutated); + try_mutated_data (&mutated); + + ++i; + } i = 0; while (i < 15) @@ -588,6 +660,15 @@ main (int argc, return 1; } + printf (" did %d random mutations: %d %d %d %d %d %d\n", + _DBUS_N_ELEMENTS (times_we_did_each_thing), + times_we_did_each_thing[0], + times_we_did_each_thing[1], + times_we_did_each_thing[2], + times_we_did_each_thing[3], + times_we_did_each_thing[4], + times_we_did_each_thing[5]); + printf ("Found %d failures with seed %u stored in %s\n", failures_this_iteration, seed, failure_dir_c); diff --git a/test/data/invalid-messages/boolean-array-length-too-long.message-raw b/test/data/invalid-messages/boolean-array-length-too-long.message-raw new file mode 100644 index 00000000..2326ec9d Binary files /dev/null and b/test/data/invalid-messages/boolean-array-length-too-long.message-raw differ diff --git a/test/data/invalid-messages/boolean-has-no-value.message-raw b/test/data/invalid-messages/boolean-has-no-value.message-raw new file mode 100644 index 00000000..cba9e839 Binary files /dev/null and b/test/data/invalid-messages/boolean-has-no-value.message-raw differ diff --git a/test/data/valid-messages/no-padding.message b/test/data/valid-messages/no-padding.message new file mode 100644 index 00000000..c21c84d3 --- /dev/null +++ b/test/data/valid-messages/no-padding.message @@ -0,0 +1,19 @@ +## Message with no header padding + +## VALID_HEADER includes a LENGTH Header and LENGTH Body +VALID_HEADER + +## this byte array is filled with zeros to the natural length +## of the header +FIELD_NAME unkn +TYPE BYTE_ARRAY +ALIGN 4 +LENGTH ThisByteArray +START_LENGTH ThisByteArray +BYTE 1 +ALIGN 8 1 +END_LENGTH ThisByteArray + +END_LENGTH Header +START_LENGTH Body +END_LENGTH Body -- cgit