From 0c7d3eda0a25a2e94fd30b5494ecc97c766d9814 Mon Sep 17 00:00:00 2001 From: Gilles Peskine Date: Wed, 22 Nov 2023 18:22:07 +0100 Subject: [PATCH] Memory poisoning: meta-test writes as well as reads Signed-off-by: Gilles Peskine --- programs/test/metatest.c | 41 ++++++++++++++++++++++++++++------------ 1 file changed, 29 insertions(+), 12 deletions(-) diff --git a/programs/test/metatest.c b/programs/test/metatest.c index 6e476b7b3..0910798e1 100644 --- a/programs/test/metatest.c +++ b/programs/test/metatest.c @@ -150,18 +150,22 @@ void memory_leak(const char *name) /* Leak of a heap object */ } -/* name = "test_memory_poison_%(start)_%(offset)_%(count)" +/* name = "test_memory_poison_%(start)_%(offset)_%(count)_%(direction)" * Poison a region starting at start from an 8-byte aligned origin, * encompassing count bytes. Access the region at offset from the start. + * %(start), %(offset) and %(count) are decimal integers. + * %(direction) is either the character 'r' for read or 'w' for write. */ void test_memory_poison(const char *name) { size_t start = 0, offset = 0, count = 0; + char direction = 'r'; if (sscanf(name, "%*[^0-9]%" MBEDTLS_PRINTF_SIZET "%*[^0-9]%" MBEDTLS_PRINTF_SIZET - "%*[^0-9]%" MBEDTLS_PRINTF_SIZET, - &start, &offset, &count) != 3) { + "%*[^0-9]%" MBEDTLS_PRINTF_SIZET + "_%c", + &start, &offset, &count, &direction) != 4) { mbedtls_fprintf(stderr, "%s: Bad name format: %s\n", __func__, name); return; } @@ -195,7 +199,12 @@ void test_memory_poison(const char *name) } MBEDTLS_TEST_MEMORY_POISON(aligned.buf + start, count); - mbedtls_printf("%u\n", (unsigned) aligned.buf[start + offset]); + + if (direction == 'w') { + aligned.buf[start + offset] = 'b'; + } else { + mbedtls_printf("%u\n", (unsigned) aligned.buf[start + offset]); + } } @@ -346,14 +355,22 @@ metatest_t metatests[] = { { "double_free", "asan", double_free }, { "read_uninitialized_stack", "msan", read_uninitialized_stack }, { "memory_leak", "asan", memory_leak }, - { "test_memory_poison_0_0_8", "asan", test_memory_poison }, - { "test_memory_poison_0_7_8", "asan", test_memory_poison }, - { "test_memory_poison_0_0_1", "asan", test_memory_poison }, - { "test_memory_poison_0_1_2", "asan", test_memory_poison }, - { "test_memory_poison_7_0_8", "asan", test_memory_poison }, - { "test_memory_poison_7_7_8", "asan", test_memory_poison }, - { "test_memory_poison_7_0_1", "asan", test_memory_poison }, - { "test_memory_poison_7_1_2", "asan", test_memory_poison }, + { "test_memory_poison_0_0_8_r", "asan", test_memory_poison }, + { "test_memory_poison_0_0_8_w", "asan", test_memory_poison }, + { "test_memory_poison_0_7_8_r", "asan", test_memory_poison }, + { "test_memory_poison_0_7_8_w", "asan", test_memory_poison }, + { "test_memory_poison_0_0_1_r", "asan", test_memory_poison }, + { "test_memory_poison_0_0_1_w", "asan", test_memory_poison }, + { "test_memory_poison_0_1_2_r", "asan", test_memory_poison }, + { "test_memory_poison_0_1_2_w", "asan", test_memory_poison }, + { "test_memory_poison_7_0_8_r", "asan", test_memory_poison }, + { "test_memory_poison_7_0_8_w", "asan", test_memory_poison }, + { "test_memory_poison_7_7_8_r", "asan", test_memory_poison }, + { "test_memory_poison_7_7_8_w", "asan", test_memory_poison }, + { "test_memory_poison_7_0_1_r", "asan", test_memory_poison }, + { "test_memory_poison_7_0_1_w", "asan", test_memory_poison }, + { "test_memory_poison_7_1_2_r", "asan", test_memory_poison }, + { "test_memory_poison_7_1_2_w", "asan", test_memory_poison }, { "mutex_lock_not_initialized", "pthread", mutex_lock_not_initialized }, { "mutex_unlock_not_initialized", "pthread", mutex_unlock_not_initialized }, { "mutex_free_not_initialized", "pthread", mutex_free_not_initialized },