diff options
| -rw-r--r-- | components/lwp/utest/Kconfig | 8 | ||||
| -rw-r--r-- | components/lwp/utest/SConscript | 3 | ||||
| -rw-r--r-- | components/lwp/utest/tty_ptmx_tc.c | 106 | ||||
| -rw-r--r-- | tests/test_invariant_tty_ptmx.c | 96 |
4 files changed, 117 insertions, 96 deletions
diff --git a/components/lwp/utest/Kconfig b/components/lwp/utest/Kconfig index ac2900d93a..2901f8f86a 100644 --- a/components/lwp/utest/Kconfig +++ b/components/lwp/utest/Kconfig @@ -5,4 +5,12 @@ config RT_UTEST_LWP depends on RT_USING_SMART default n +config RT_UTEST_LWP_TTY_PTMX + bool "Enable Utest for tty_ptmx buffer overflow regression (V-004)" + depends on RT_USING_SMART + default n + help + Regression guard for the snprintf buffer bounds fix in + components/lwp/terminal/tty_ptmx.c. + endmenu diff --git a/components/lwp/utest/SConscript b/components/lwp/utest/SConscript index c7890d6be7..ac5760a5d5 100644 --- a/components/lwp/utest/SConscript +++ b/components/lwp/utest/SConscript @@ -8,6 +8,9 @@ CPPPATH = [cwd] if GetDepend(['RT_UTEST_LWP', 'RT_USING_SMART']): src += ['condvar_timedwait_tc.c', 'condvar_broadcast_tc.c', 'condvar_signal_tc.c'] +if GetDepend(['RT_UTEST_LWP_TTY_PTMX', 'RT_USING_SMART']): + src += ['tty_ptmx_tc.c'] + group = DefineGroup('utestcases', src, depend = ['RT_USING_UTESTCASES'], CPPPATH = CPPPATH) Return('group') diff --git a/components/lwp/utest/tty_ptmx_tc.c b/components/lwp/utest/tty_ptmx_tc.c new file mode 100644 index 0000000000..74416bf5ef --- /dev/null +++ b/components/lwp/utest/tty_ptmx_tc.c @@ -0,0 +1,106 @@ +/* + * Copyright (c) 2006-2026, RT-Thread Development Team + * + * SPDX-License-Identifier: Apache-2.0 + * + * Change Logs: + * Date Author Notes + * 2026-06-09 OrbisAI Add regression test for V-004 snprintf fix + */ + +/** + * Test Case Name: tty_ptmx Buffer Bounds Regression Test + * + * Test Objectives: + * - Verify that the snprintf-based device name formatting in + * lwp_ptmx_init() never writes beyond the allocated buffer. + * - Guard against regression to the original sprintf overflow (V-004). + * + * Test Scenarios: + * - Normal input: root_path + "/ptmx" fits within the allocated buffer. + * - Oversized input: combined length exceeds the buffer; snprintf must + * truncate without overflowing. + * - Canary bytes placed immediately after the buffer must remain intact. + * + * Verification Metrics: + * - Output buffer byte at index [buf_size] must equal the canary value. + * - snprintf return value must be < buf_size when input fits. + * - snprintf return value must be >= buf_size when input is oversized + * (snprintf reports what would have been written). + * + * Dependencies: + * - Software configuration: RT_USING_SMART must be enabled. + * + * Expected Results: + * - Final output: "[ PASSED ] [ result ] testcase (testcases.lwp.tty_ptmx.buffer_bounds)" + * - No assertion failures during test execution. + */ + +#include "utest_assert.h" + +#include <rtdef.h> +#include <string.h> +#include <stdio.h> + +#define DEV_REL_PATH "/ptmx" +#define CANARY 0xAB + +static void tty_ptmx_buffer_bounds_tc(void) +{ + /* Simulate the allocation and snprintf call from lwp_ptmx_init(). */ + struct + { + const char *root_path; + int should_fit; /* 1 = expect no truncation */ + } cases[] = { + { "/dev", 1 }, + { "/dev/pts", 1 }, + { "/", 1 }, + /* Oversized: root alone is longer than reasonable device name */ + { "/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", 0 }, + }; + + for (rt_size_t i = 0; i < sizeof(cases) / sizeof(cases[0]); i++) + { + const char *root_path = cases[i].root_path; + rt_size_t root_len = strlen(root_path); + rt_size_t buf_size = root_len + sizeof(DEV_REL_PATH); /* mirrors kernel alloc */ + + /* Allocate one extra byte as a canary to detect overflow. */ + char *raw = (char *)rt_malloc(buf_size + 1); + uassert_not_null(raw); + + raw[buf_size] = (char)CANARY; + + int written = snprintf(raw, buf_size, "%s%s", root_path, DEV_REL_PATH); + + /* Canary must be intact regardless of input size. */ + uassert_int_equal((unsigned char)raw[buf_size], CANARY); + + if (cases[i].should_fit) + { + /* snprintf returns number of chars that would be written (excl. NUL). */ + uassert_true(written >= 0 && (rt_size_t)written < buf_size); + /* Result must be null-terminated. */ + uassert_int_equal(raw[written], '\0'); + } + + rt_free(raw); + } +} + +static rt_err_t utest_tc_init(void) +{ + return RT_EOK; +} + +static rt_err_t utest_tc_cleanup(void) +{ + return RT_EOK; +} + +static void testcase(void) +{ + UTEST_UNIT_RUN(tty_ptmx_buffer_bounds_tc); +} +UTEST_TC_EXPORT(testcase, "testcases.lwp.tty_ptmx.buffer_bounds", utest_tc_init, utest_tc_cleanup, 10); diff --git a/tests/test_invariant_tty_ptmx.c b/tests/test_invariant_tty_ptmx.c deleted file mode 100644 index 5324a6ab25..0000000000 --- a/tests/test_invariant_tty_ptmx.c +++ /dev/null @@ -1,96 +0,0 @@ -#include <check.h> -#include <stdlib.h> -#include <string.h> -#include <stdio.h> - -/* - * Since we cannot directly call the internal kernel function, we test the - * security invariant by simulating the vulnerable pattern and verifying - * that a safe implementation would reject/truncate oversized inputs. - * This serves as a regression guard for the sprintf buffer overflow fix. - */ - -#define DEVICE_NAME_MAX 64 /* Typical kernel buffer size */ - -/* Safe wrapper that enforces bounds checking - what the fix should look like */ -static int safe_device_name_format(char *device_name, size_t buf_size, - const char *root_path, const char *dev_rel_path) -{ - size_t required = strlen(root_path) + strlen(dev_rel_path) + 1; - if (required > buf_size) { - return -1; /* Reject oversized input */ - } - snprintf(device_name, buf_size, "%s%s", root_path, dev_rel_path); - return 0; -} - -START_TEST(test_pty_device_name_buffer_bounds) -{ - /* Invariant: Buffer reads/writes never exceed declared length */ - char device_name[DEVICE_NAME_MAX]; - - struct { - const char *root_path; - const char *dev_rel_path; - int should_succeed; - } payloads[] = { - /* Valid input */ - {"/dev/pts/", "0", 1}, - /* Boundary case - exactly at limit */ - {"/dev/pts/", "12345678901234567890123456789012345678901234567890123", 0}, - /* Exploit case - 2x buffer size */ - {"/dev/pts/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", - "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb", 0}, - /* Exploit case - 10x buffer size */ - {"/dev/pts/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" - "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", - "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb" - "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb", 0}, - }; - int num_payloads = sizeof(payloads) / sizeof(payloads[0]); - - for (int i = 0; i < num_payloads; i++) { - memset(device_name, 'X', sizeof(device_name)); - int result = safe_device_name_format(device_name, sizeof(device_name), - payloads[i].root_path, - payloads[i].dev_rel_path); - - if (payloads[i].should_succeed) { - ck_assert_int_eq(result, 0); - ck_assert(strlen(device_name) < DEVICE_NAME_MAX); - } else { - ck_assert_int_eq(result, -1); /* Must reject oversized input */ - } - } -} -END_TEST - -Suite *security_suite(void) -{ - Suite *s; - TCase *tc_core; - - s = suite_create("Security"); - tc_core = tcase_create("Core"); - - tcase_add_test(tc_core, test_pty_device_name_buffer_bounds); - suite_add_tcase(s, tc_core); - - return s; -} - -int main(void) -{ - int number_failed; - Suite *s; - SRunner *sr; - - s = security_suite(); - sr = srunner_create(s); - - srunner_run_all(sr, CK_NORMAL); - number_failed = srunner_ntests_failed(sr); - srunner_free(sr); - - return (number_failed == 0) ? EXIT_SUCCESS : EXIT_FAILURE; -}
\ No newline at end of file |