[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <20260805141033.841558-1-matthias.goergens@gmail.com>
Date: Wed, 5 Aug 2026 22:10:23 +0800
From: Matthias Goergens <matthias.goergens@...il.com>
To: musl@...ts.openwall.com
Cc: Matthias Goergens <matthias.goergens@...il.com>
Subject: [PATCH 00/10] regression tests for the posted musl overflow fixes
This series adds libc-test regression tests for the functionally
testable defects covered by the musl patches posted to the list on
5 August 2026. Each test encodes the fixed behavior, so the fixes
stay easy to recreate or re-verify even if the corresponding musl
patches still await review. These tests are intended to be applied together
with or after the corresponding musl patches.
Every test was run against unpatched musl master (b306b16a) and
against a tree with all ten fixes applied: each test fails on
unpatched musl (wrong result, or a crash for the glob and TZif
cases) and passes on the patched tree. The allocated scanf buffer
test exercises the 32-bit size_t wrap and was verified against
i386 builds of both trees; it is a no-op where size_t is wider
than 32 bits.
Notes on individual tests:
- scanf-alloc-size-overflow: the wrap needs a 32-bit size_t, so
the body is compiled out elsewhere.
- aio-suspend-timeout-overflow: the wrapped deadline is not
publicly observable (the timed-wait subtraction overflows back
into a wait), so the distinguishing assertions are the EINVAL
rejection of invalid relative timeouts plus the requirement
that a huge valid timeout keeps waiting.
- sem-timedwait-expired-deadline and aio-suspend-timeout-overflow
arm a short alarm so a broken implementation fails within
milliseconds instead of hanging the suite.
- tzif-version-footer runs each crafted file in a child process
so the segfaults produced by unpatched musl fail the case
instead of aborting the test.
Some tests also fail on current glibc (fseeko/ftello, strptime,
and the aio_suspend overflow cases show the same defects; glibc
scanf rejects even valid huge widths and does not validate
aio_suspend nanoseconds); they encode the behavior required by
the musl fixes.
Matthias Goergens (10):
regression: test fseeko SEEK_CUR offset underflow
regression: test ftello overflow with buffered output
regression: test scanf field width overflow
regression: test allocated scanf buffer size overflow
regression: test glob GLOB_DOOFFS vector overflow
regression: test aio_suspend timeout overflow
regression: test expired deadline in timed waits
regression: test strptime year overflow
regression: test mktime with extreme tm_mday
regression: test TZif version and footer parsing
src/regression/aio-suspend-timeout-overflow.c | 159 ++++++++++++++++++
src/regression/fseeko-seek-cur-underflow.c | 113 +++++++++++++
src/regression/ftello-buffered-overflow.c | 115 +++++++++++++
src/regression/glob-dooffs-overflow.c | 54 ++++++
src/regression/mktime-mday-overflow.c | 46 +++++
src/regression/scanf-alloc-size-overflow.c | 102 +++++++++++
src/regression/scanf-field-width-overflow.c | 59 +++++++
.../sem-timedwait-expired-deadline.c | 61 +++++++
src/regression/strptime-year-overflow.c | 59 +++++++
src/regression/tzif-version-footer.c | 140 +++++++++++++++
10 files changed, 908 insertions(+)
create mode 100644 src/regression/aio-suspend-timeout-overflow.c
create mode 100644 src/regression/fseeko-seek-cur-underflow.c
create mode 100644 src/regression/ftello-buffered-overflow.c
create mode 100644 src/regression/glob-dooffs-overflow.c
create mode 100644 src/regression/mktime-mday-overflow.c
create mode 100644 src/regression/scanf-alloc-size-overflow.c
create mode 100644 src/regression/scanf-field-width-overflow.c
create mode 100644 src/regression/sem-timedwait-expired-deadline.c
create mode 100644 src/regression/strptime-year-overflow.c
create mode 100644 src/regression/tzif-version-footer.c
--
2.55.0
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
