1 /* Test of explicit_bzero() function.
2 Copyright (C) 2020 Free Software Foundation, Inc.
3
4 This program is free software: you can redistribute it and/or modify
5 it under the terms of the GNU General Public License as published by
6 the Free Software Foundation; either version 3 of the License, or
7 (at your option) any later version.
8
9 This program is distributed in the hope that it will be useful,
10 but WITHOUT ANY WARRANTY; without even the implied warranty of
11 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12 GNU General Public License for more details.
13
14 You should have received a copy of the GNU General Public License
15 along with this program. If not, see <https://www.gnu.org/licenses/>. */
16
17 /* Written by Bruno Haible <bruno@clisp.org>, 2020. */
18
19 #include <config.h>
20
21 /* Specification. */
22 #include <string.h>
23
24 #include "signature.h"
25 SIGNATURE_CHECK (explicit_bzero, void, (void *, size_t));
26
27 #include <stdbool.h>
28 #include <stdio.h>
29 #include <stdint.h>
30 #include <stdlib.h>
31
32 #include "vma-iter.h"
33 #include "macros.h"
34
35 #define SECRET "xyzzy1729"
36 #define SECRET_SIZE 9
37
38 static char zero[SECRET_SIZE] = { 0 };
39
40 /* Enable this to verify that the test is effective. */
41 #if 0
42 # define explicit_bzero(a, n) memset (a, '\0', n)
43 #endif
44
45 /* =================== Verify operation on static memory =================== */
46
47 static char stbuf[SECRET_SIZE];
48
49 static void
test_static(void)50 test_static (void)
51 {
52 memcpy (stbuf, SECRET, SECRET_SIZE);
53 explicit_bzero (stbuf, SECRET_SIZE);
54 ASSERT (memcmp (zero, stbuf, SECRET_SIZE) == 0);
55 }
56
57 /* =============== Verify operation on heap-allocated memory =============== */
58
59 /* Test whether an address range is mapped in memory. */
60 #if VMA_ITERATE_SUPPORTED
61
62 struct locals
63 {
64 uintptr_t range_start;
65 uintptr_t range_end;
66 };
67
68 static int
vma_iterate_callback(void * data,uintptr_t start,uintptr_t end,unsigned int flags)69 vma_iterate_callback (void *data, uintptr_t start, uintptr_t end,
70 unsigned int flags)
71 {
72 struct locals *lp = (struct locals *) data;
73
74 /* Remove from [range_start, range_end) the part at the beginning or at the
75 end that is covered by [start, end). */
76 if (start <= lp->range_start && end > lp->range_start)
77 lp->range_start = (end < lp->range_end ? end : lp->range_end);
78 if (start < lp->range_end && end >= lp->range_end)
79 lp->range_end = (start > lp->range_start ? start : lp->range_start);
80
81 return 0;
82 }
83
84 static bool
is_range_mapped(uintptr_t range_start,uintptr_t range_end)85 is_range_mapped (uintptr_t range_start, uintptr_t range_end)
86 {
87 struct locals l;
88
89 l.range_start = range_start;
90 l.range_end = range_end;
91 vma_iterate (vma_iterate_callback, &l);
92 return l.range_start == l.range_end;
93 }
94
95 #else
96
97 static bool
is_range_mapped(uintptr_t range_start,uintptr_t range_end)98 is_range_mapped (uintptr_t range_start, uintptr_t range_end)
99 {
100 return true;
101 }
102
103 #endif
104
105 static void
test_heap(void)106 test_heap (void)
107 {
108 char *heapbuf = (char *) malloc (SECRET_SIZE);
109 uintptr_t addr = (uintptr_t) heapbuf;
110 memcpy (heapbuf, SECRET, SECRET_SIZE);
111 explicit_bzero (heapbuf, SECRET_SIZE);
112 free (heapbuf);
113 if (is_range_mapped (addr, addr + SECRET_SIZE))
114 {
115 /* some implementation could override freed memory by canaries so
116 compare against secret */
117 ASSERT (memcmp (heapbuf, SECRET, SECRET_SIZE) != 0);
118 printf ("test_heap: address range is still mapped after free().\n");
119 }
120 else
121 printf ("test_heap: address range is unmapped after free().\n");
122 }
123
124 /* =============== Verify operation on stack-allocated memory =============== */
125
126 /* There are two passes:
127 1. Put a secret in memory and invoke explicit_bzero on it.
128 2. Verify that the memory has been erased.
129 Implement them in the same function, so that they access the same memory
130 range on the stack. */
131 static int _GL_ATTRIBUTE_NOINLINE
do_secret_stuff(volatile int pass)132 do_secret_stuff (volatile int pass)
133 {
134 char stackbuf[SECRET_SIZE];
135 if (pass == 1)
136 {
137 memcpy (stackbuf, SECRET, SECRET_SIZE);
138 explicit_bzero (stackbuf, SECRET_SIZE);
139 return 0;
140 }
141 else /* pass == 2 */
142 {
143 return memcmp (zero, stackbuf, SECRET_SIZE) != 0;
144 }
145 }
146
147 static void
test_stack(void)148 test_stack (void)
149 {
150 int count = 0;
151 int repeat;
152
153 for (repeat = 1000; repeat > 0; repeat--)
154 {
155 do_secret_stuff (1);
156 count += do_secret_stuff (2);
157 }
158 /* If explicit_bzero works, count is near 0. (It may be > 0 if there were
159 some asynchronous signal invocations between the two calls of
160 do_secret_stuff.)
161 If explicit_bzero is optimized away by the compiler, count comes out as
162 approximately 1000. */
163 printf ("test_stack: count = %d\n", count);
164 ASSERT (count < 50);
165 }
166
167 /* ========================================================================== */
168
169 int
main()170 main ()
171 {
172 test_static ();
173 test_heap ();
174 test_stack ();
175
176 return 0;
177 }
178