stdio-common: Handle -1 buffer size in __sprintf_chk & co (bug 30039)

  This shows up as an assertion failure when sprintf is called with
a specifier like "%.8g" and libquadmath is linked in:

Fatal glibc error: printf_buffer_as_file.c:31
  (__printf_buffer_as_file_commit): assertion failed:
  file->stream._IO_write_ptr <= file->next->write_end

Fix this by detecting pointer wraparound in __vsprintf_internal
and saturate the addition to the end of the address space instead.

Tested on i686-linux-gnu, x86_64-linux-gnu.  Proposed as a release
blocker.

---
 debug/Makefile                        |   5 ++
 debug/tst-sprintf-fortify-unchecked.c | 126 ++++++++++++++++++++++++++++++++++
 include/printf_buffer.h               |  19 +++--
 libio/iovsprintf.c                    |  15 ++--
 4 files changed, 155 insertions(+), 10 deletions(-)


base-commit: 103a469dc7755fd9e8ccf362f3dd4c55dc761908
  

On 1/24/23 06:31, Florian Weimer via Libc-alpha wrote:
> This shows up as an assertion failure when sprintf is called with
> a specifier like "%.8g" and libquadmath is linked in:
> 
> Fatal glibc error: printf_buffer_as_file.c:31
>   (__printf_buffer_as_file_commit): assertion failed:
>   file->stream._IO_write_ptr <= file->next->write_end
> 
> Fix this by detecting pointer wraparound in __vsprintf_internal
> and saturate the addition to the end of the address space instead.
> 
> Tested on i686-linux-gnu, x86_64-linux-gnu.  Proposed as a release
> blocker.

OK for immediate commit to master for 2.37 release.

Thanks for looking into this and resolving it so quickly.

The testing coverage looks good too, particularly both paths.

Reviewed-by: Carlos O'Donell <carlos@redhat.com>
Tested-by: Carlos O'Donell <carlos@redhat.com>
 
> ---
>  debug/Makefile                        |   5 ++
>  debug/tst-sprintf-fortify-unchecked.c | 126 ++++++++++++++++++++++++++++++++++
>  include/printf_buffer.h               |  19 +++--
>  libio/iovsprintf.c                    |  15 ++--
>  4 files changed, 155 insertions(+), 10 deletions(-)
> 
> diff --git a/debug/Makefile b/debug/Makefile
> index 13f15d15d3..52f9a7852c 100644
> --- a/debug/Makefile
> +++ b/debug/Makefile
> @@ -200,6 +200,10 @@ LDFLAGS-tst-backtrace6 = -rdynamic
>  
>  CFLAGS-tst-ssp-1.c += -fstack-protector-all
>  
> +# Disable compiler optimizations around vsprintf (the function under test).
> +CFLAGS-tst-sprintf-fortify-unchecked.c = \
> +  -fno-builtin-vsprintf -fno-builtin-__vsprintf_chk

OK. First use of these for any test in glibc. Though we use the heavier hammer of -fno-builtin
in several other tests.

> +
>  tests = backtrace-tst \
>  	tst-longjmp_chk \
>  	test-strcpy_chk \
> @@ -211,6 +215,7 @@ tests = backtrace-tst \
>  	tst-backtrace5 \
>  	tst-backtrace6 \
>  	tst-realpath-chk \
> +	tst-sprintf-fortify-unchecked \

OK. In alapha order? Yes.

>  	$(tests-all-chk)
>  
>  tests-time64 += \
> diff --git a/debug/tst-sprintf-fortify-unchecked.c b/debug/tst-sprintf-fortify-unchecked.c
> new file mode 100644
> index 0000000000..7c7bd1b5e4
> --- /dev/null
> +++ b/debug/tst-sprintf-fortify-unchecked.c
> @@ -0,0 +1,126 @@
> +/* Tests for fortified sprintf with unknown buffer bounds (bug 30039).

OK. 30039.

> +   Copyright (C) 2023 Free Software Foundation, Inc.

OK. Right year.

> +   This file is part of the GNU C Library.
> +
> +   The GNU C Library is free software; you can redistribute it and/or
> +   modify it under the terms of the GNU Lesser General Public
> +   License as published by the Free Software Foundation; either
> +   version 2.1 of the License, or (at your option) any later version.
> +
> +   The GNU C Library is distributed in the hope that it will be useful,
> +   but WITHOUT ANY WARRANTY; without even the implied warranty of
> +   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
> +   Lesser General Public License for more details.
> +
> +   You should have received a copy of the GNU Lesser General Public
> +   License along with the GNU C Library; if not, see
> +   <https://www.gnu.org/licenses/>.  */
> +
> +#include <printf.h>
> +#include <stdarg.h>
> +#include <stdio.h>
> +#include <string.h>
> +#include <support/check.h>
> +
> +/* This test is not built with _FORTIFY_SOURCE.  Instead it calls the
> +   appropriate implementation directly.  The fortify mode is specified
> +   in this variable.  */
> +static int fortify_mode;

OK.

> +
> +/* This does not handle long-double redirects etc., but we test only
> +   format strings that stay within the confines of the base
> +   implementation.  */
> +int __vsprintf_chk (char *s, int flag, size_t slen, const char *format,
> +                    va_list ap);

OK.

> +
> +/* Invoke vsprintf or __vsprintf_chk according to fortify_mode.  */
> +static int
> +my_vsprintf (char *buf, const char *format, va_list ap)
> +{
> +  int result;
> +  if (fortify_mode == 0)
> +    result = vsprintf (buf, format, ap);

OK.

> +  else
> +    /* Call the fortified version with an unspecified length.  */
> +    result = __vsprintf_chk (buf, fortify_mode - 1, -1, format, ap);

OK. Args are: buffer, flag, size, format, va_list. We are consciously passing
size of -1, and a 0 value for fortify_mode == 1, otherwise >1, which has an
impact on PRINTF_FORTIFY being put in mode.

> +  return result;
> +}
> +
> +/* Run one test, with the specified expected output.  */
> +static void __attribute ((format (printf, 2, 3)))
> +do_check (const char *expected, const char *format, ...)
> +{
> +  va_list ap;
> +  va_start (ap, format);
> +
> +  char buf_expected[24];

OK. Largest test with XXX string has 23 chars and a NULL, so 24, and then
later TEST_VERIFY asserted.

> +  memset (buf_expected, '@', sizeof (buf_expected));
> +  TEST_VERIFY (strlen (expected) < sizeof (buf_expected));
> +  strcpy (buf_expected, expected);
> +
> +  char buf[sizeof (buf_expected)];
> +  memset (buf, '@', sizeof (buf));
> +
> +  int ret = my_vsprintf (buf, format, ap);
> +  TEST_COMPARE_BLOB (buf_expected, sizeof (buf_expected), buf, sizeof (buf));

OK. Compare the expected and output buffers.

> +  TEST_COMPARE (ret, strlen (expected));

OK. Likewise the expected return results.

> +
> +  va_end (ap);
> +}
> +
> +/* Run the tests in all fortify modes.  */
> +static void
> +do_tests (void)
> +{
> +  for (fortify_mode = 0; fortify_mode <= 3; ++fortify_mode)

OK.
fortify_mode = 0, no _chk call, just sanity case.
fortify_mode = 1, call _chk, PRINTF_CHK set, PRINTF_FORTIFY not set.
fortify_mode = 2, call _chk, PRINTF_CHK set, PRINTF_FORTIFY set.
fortify_mode = 3, same as 2 (in the current impl).


> +    {
> +      do_check ("0", "%d", 0);
> +      do_check ("-2147483648", "%d", -2147483647 - 1);
> +      do_check ("-9223372036854775808", "%lld", -9223372036854775807LL - 1);
> +      do_check ("", "%s", "");
> +      do_check ("                      ", "%22s", "");
> +      do_check ("XXXXXXXXXXXXXXXXXXXXXX", "%s", "XXXXXXXXXXXXXXXXXXXXXX");
> +      do_check ("1.125000", "%f", 1.125);
> +      do_check ("1.125", "%g", 1.125);
> +      do_check ("1.125", "%.8g", 1.125);
> +    }
> +}
> +
> +/* printf callback that falls back to the glibc-supplied
> +   implementation.  */
> +static int
> +dummy_printf_function (FILE *__stream,
> +                       const struct printf_info *__info,
> +                       const void *const *__args)
> +{
> +  return -2;                    /* Request fallback.  */

OK. Magic -2 return instructs printf_positional to fall back to JUMP
call to handle spec.

> +}
> +
> +/* Likewise for the type information.  */
> +static int
> +dummy_arginfo_function (const struct printf_info *info,
> +                        size_t n, int *argtypes, int *size)
> +{
> +  return -1;                    /* Request fallback.  */

OK. Magic < 0 return instructs __parse_one_specmb to fall back to normal
specifiers.

> +}
> +
> +static int
> +do_test (void)
> +{
> +  do_tests ();
> +
> +  /* Activate __printf_function_invoke mode.  */
> +  register_printf_specifier ('d', dummy_printf_function,
> +                             dummy_arginfo_function);
> +  register_printf_specifier ('g', dummy_printf_function,
> +                             dummy_arginfo_function);
> +  register_printf_specifier ('s', dummy_printf_function,
> +                             dummy_arginfo_function);

OK. Xprintf_buffer will fall back to the slow do_positional version if these
functions are present. This tests the functionality of both parts of vfprintf.

> +
> +  /* Rerun the tests with callback functions.  */
> +  do_tests ();
> +
> +  return 0;
> +}
> +
> +#include <support/test-driver.c>
> diff --git a/include/printf_buffer.h b/include/printf_buffer.h
> index 55feebf279..4d787e4b2c 100644
> --- a/include/printf_buffer.h
> +++ b/include/printf_buffer.h
> @@ -115,17 +115,26 @@ __printf_buffer_has_failed (struct __printf_buffer *buf)
>    return buf->mode == __printf_buffer_mode_failed;
>  }
>  
> +/* Initialization of a buffer, using the memory region from [BASE,
> +   END) as the initial buffer contents.  */
> +static inline void
> +__printf_buffer_init_end (struct __printf_buffer *buf, char *base, char *end,
> +                          enum __printf_buffer_mode mode)
> +{
> +  buf->write_base = base;
> +  buf->write_ptr = base;
> +  buf->write_end = end;
> +  buf->written = 0;
> +  buf->mode = mode;
> +}

OK. Helper (uses base and end, maybe without length being known).

> +
>  /* Initialization of a buffer, using the memory region from [BASE, BASE +LEN)
>     as the initial buffer contents.  LEN can be zero.  */
>  static inline void
>  __printf_buffer_init (struct __printf_buffer *buf, char *base, size_t len,
>                        enum __printf_buffer_mode mode)
>  {
> -  buf->write_base = base;
> -  buf->write_ptr = base;
> -  buf->write_end = base + len;
> -  buf->written = 0;
> -  buf->mode = mode;
> +  __printf_buffer_init_end (buf, base, base + len, mode);

OK. Refactor (length known).

>  }
>  
>  /* Called by printf_buffer_putc for a full buffer.  */
> diff --git a/libio/iovsprintf.c b/libio/iovsprintf.c
> index 8d53e401cc..9a4f59a06e 100644
> --- a/libio/iovsprintf.c
> +++ b/libio/iovsprintf.c
> @@ -45,14 +45,19 @@ __vsprintf_internal (char *string, size_t maxlen,
>    if ((mode_flags & PRINTF_CHK) != 0)
>      {
>        string[0] = '\0';
> -      __printf_buffer_init (&buf, string, maxlen,
> +      /* In some cases, __sprintf_chk is called with an unknown buffer
> +	 size (the special value -1).  Prevent pointer wraparound in
> +	 this case and saturate to the end of the address space.  */
> +      uintptr_t end;
> +      if (__builtin_add_overflow ((uintptr_t) string, maxlen, &end))
> +	end = -1;

OK. Compute string + maxlen and store in &end, but if we overflow then set end to -1.
This is the core fix for 30039.

Other uses of __printf_buffer_init that might need fixing?

* libio/vsnprintf.c - Could suffer from the same overflow?
  - Yes, but the user provides the size.
* libio/iovdprintf.c - No fix needed, since the known size is used.
* libio/obprintf.c - Likewise.
* libio/vasprintf.c - Likewise.
* stdio-common/printf_fphex.c - Likewise.
* stdio-common/printf_fp.c - Likewise.
* stdio-common/printf_buffer_to_file.c - Likewise.
* stdlib/strfmon_l.c - Likewise.

> +      __printf_buffer_init_end (&buf, string, (char *) end,

OK, use the new __printf_buffer_init_end helper.

>  			    __printf_buffer_mode_sprintf_chk);
>      }
>    else
> -    {
> -      __printf_buffer_init (&buf, string, 0, __printf_buffer_mode_sprintf);
> -      buf.write_end = (char *) ~(uintptr_t) 0; /* End of address space.  */
> -    }
> +    /* Use end of address space.  */
> +    __printf_buffer_init_end (&buf, string, (char *) ~(uintptr_t) 0,
> +			      __printf_buffer_mode_sprintf);

OK. Refactored helper allows cleaning this up.

>  
>    __printf_buffer (&buf, format, args, mode_flags);
>  
> 
> base-commit: 103a469dc7755fd9e8ccf362f3dd4c55dc761908
>