OLD | NEW |
1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include <fcntl.h> | 5 #include <fcntl.h> |
6 #include <stdio.h> | 6 #include <stdio.h> |
7 #include <stdlib.h> | 7 #include <stdlib.h> |
8 #include <string.h> | 8 #include <string.h> |
9 #include <sys/stat.h> | 9 #include <sys/stat.h> |
10 #include <sys/types.h> | 10 #include <sys/types.h> |
(...skipping 195 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
206 bool CallocReturnsNull(size_t nmemb, size_t size) { | 206 bool CallocReturnsNull(size_t nmemb, size_t size) { |
207 scoped_ptr<char, base::FreeDeleter> array_pointer( | 207 scoped_ptr<char, base::FreeDeleter> array_pointer( |
208 static_cast<char*>(calloc(nmemb, size))); | 208 static_cast<char*>(calloc(nmemb, size))); |
209 // We need the call to HideValueFromCompiler(): we have seen LLVM | 209 // We need the call to HideValueFromCompiler(): we have seen LLVM |
210 // optimize away the call to calloc() entirely and assume | 210 // optimize away the call to calloc() entirely and assume |
211 // the pointer to not be NULL. | 211 // the pointer to not be NULL. |
212 return HideValueFromCompiler(array_pointer.get()) == NULL; | 212 return HideValueFromCompiler(array_pointer.get()) == NULL; |
213 } | 213 } |
214 | 214 |
215 // Test if calloc() can overflow. | 215 // Test if calloc() can overflow. |
216 // Fails on Mac under ASAN. http://crbug.com/304125 | 216 TEST(SecurityTest, CallocOverflow) { |
217 #if defined(OS_MACOSX) && defined(ADDRESS_SANITIZER) | |
218 #define MAYBE_CallocOverflow DISABLED_CallocOverflow | |
219 #else | |
220 #define MAYBE_CallocOverflow CallocOverflow | |
221 #endif | |
222 TEST(SecurityTest, MAYBE_CallocOverflow) { | |
223 const size_t kArraySize = 4096; | 217 const size_t kArraySize = 4096; |
224 const size_t kMaxSizeT = numeric_limits<size_t>::max(); | 218 const size_t kMaxSizeT = numeric_limits<size_t>::max(); |
225 const size_t kArraySize2 = kMaxSizeT / kArraySize + 10; | 219 const size_t kArraySize2 = kMaxSizeT / kArraySize + 10; |
226 if (!CallocDiesOnOOM()) { | 220 if (!CallocDiesOnOOM()) { |
227 EXPECT_TRUE(CallocReturnsNull(kArraySize, kArraySize2)); | 221 EXPECT_TRUE(CallocReturnsNull(kArraySize, kArraySize2)); |
228 EXPECT_TRUE(CallocReturnsNull(kArraySize2, kArraySize)); | 222 EXPECT_TRUE(CallocReturnsNull(kArraySize2, kArraySize)); |
229 } else { | 223 } else { |
230 // It's also ok for calloc to just terminate the process. | 224 // It's also ok for calloc to just terminate the process. |
231 #if defined(GTEST_HAS_DEATH_TEST) | 225 #if defined(GTEST_HAS_DEATH_TEST) |
232 EXPECT_DEATH(CallocReturnsNull(kArraySize, kArraySize2), ""); | 226 EXPECT_DEATH(CallocReturnsNull(kArraySize, kArraySize2), ""); |
(...skipping 67 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
300 // kRandomMask, so we use it as an additional detection mechanism. | 294 // kRandomMask, so we use it as an additional detection mechanism. |
301 const uintptr_t kRandomMask = 0x3fffffffffffULL; | 295 const uintptr_t kRandomMask = 0x3fffffffffffULL; |
302 bool impossible_random_address = | 296 bool impossible_random_address = |
303 reinterpret_cast<uintptr_t>(ptr.get()) & ~kRandomMask; | 297 reinterpret_cast<uintptr_t>(ptr.get()) & ~kRandomMask; |
304 EXPECT_FALSE(impossible_random_address); | 298 EXPECT_FALSE(impossible_random_address); |
305 } | 299 } |
306 | 300 |
307 #endif // (defined(OS_LINUX) || defined(OS_CHROMEOS)) && defined(__x86_64__) | 301 #endif // (defined(OS_LINUX) || defined(OS_CHROMEOS)) && defined(__x86_64__) |
308 | 302 |
309 } // namespace | 303 } // namespace |
OLD | NEW |