The ar-getarsym-mem test for reading an ar header and zero entries to
not crash. Tweak the test a little so it also tests for just having an
ar header without an entry count. This used to crash before commit
3a122a068285 "libelf: Bounds-check archive symbol index count on the
mmap path".

        * tests/ar-getarsym-mem.c (build_archive): Add just the
        archive header.
        (build_archive_count): New function to add the four byte
        count.
        (main): Add result2. Call build_archive_count for first
        test. Add second test with 4 byte smaller image.

Signed-off-by: Mark Wielaard <[email protected]>
---
 tests/ar-getarsym-mem.c | 38 ++++++++++++++++++++++++++++++++++++--
 1 file changed, 36 insertions(+), 2 deletions(-)

diff --git a/tests/ar-getarsym-mem.c b/tests/ar-getarsym-mem.c
index 63f39137e6f3..d9ccc6acda9c 100644
--- a/tests/ar-getarsym-mem.c
+++ b/tests/ar-getarsym-mem.c
@@ -51,7 +51,7 @@
 static void
 build_archive (unsigned char *p)
 {
-  memset (p, 0, ARSZ);
+  memset (p, 0, ARSZ - 4);
   memcpy (p, "!<arch>\n", 8);
 
   struct ar_hdr *hdr = (struct ar_hdr *) (p + 8);
@@ -63,7 +63,11 @@ build_archive (unsigned char *p)
   memcpy (hdr->ar_mode, "100644  ", 8);
   memcpy (hdr->ar_size, "4         ", 10);
   memcpy (hdr->ar_fmag, "`\n", 2);
+}
 
+static void
+build_archive_count (unsigned char *p)
+{
   /* 4-byte count, stored big-endian as on disk; zero entries.  */
   p[68] = 0;
   p[69] = 0;
@@ -75,6 +79,7 @@ int
 main (void)
 {
   int result = 1;
+  int result2 = 1;
 
   long pgsz = sysconf (_SC_PAGESIZE);
   if (pgsz <= 0 || (size_t) pgsz < ARSZ)
@@ -103,6 +108,7 @@ main (void)
 
   unsigned char *buf = map + pgsz - ARSZ;
   build_archive (buf);
+  build_archive_count (buf);
 
   if (elf_version (EV_CURRENT) == EV_NONE)
     {
@@ -137,7 +143,35 @@ main (void)
 
   elf_end (elf);
 
+  /* Again, but without the index member.  Will fail, but shouldn't
+     crash.  */
+  buf = map + pgsz - ARSZ + 4;
+  build_archive (buf);
+
+  elf = elf_memory ((char *) buf, ARSZ - 4);
+  if (elf == NULL)
+    {
+      printf ("FAIL: elf_memory: %s\n", elf_errmsg (-1));
+      goto out;
+    }
+
+  arsym = elf_getarsym (elf, &narsym);
+
+  if (arsym != NULL)
+    {
+      printf ("FAIL: 2 unexpected arsym (narsym=%zu, arsym=%p)\n",
+         narsym, (void *) arsym);
+      result2 = 1;
+    }
+  else
+    {
+      printf ("PASS: 2 read archive header within bounds\n");
+      result2 = 0;
+    }
+
+  elf_end (elf);
+
 out:
   munmap (map, (size_t) pgsz * 2);
-  return result;
+  return result + result2;
 }
-- 
2.54.0

Reply via email to