7350 wcsncasecmp reads data from buffers when count is zero

7344 wcsncasecmp shouldn't take one for the road
Reviewed by: Dan McDonald <danmcd@omniti.com>
Reviewed by: Ryan Zezeski <ryan@zinascii.com>
Reviewed by: James Blachly <james.blachly@gmail.com>
Approved by: Richard Lowe <richlowe@richlowe.net>

7 files changed, 194 insertions, 7 deletions

diff --git a/usr/src/lib/libc/port/locale/wcscasecmp.c b/usr/src/lib/libc/port/locale/wcscasecmp.c
index ef0b734435..b0f70ae849 100644
--- a/usr/src/lib/libc/port/locale/wcscasecmp.c
+++ b/usr/src/lib/libc/port/locale/wcscasecmp.c
@@ -22,6 +22,7 @@
 /*
  * Copyright (c) 1992, 2010, Oracle and/or its affiliates. All rights reserved.
  * Copyright 2013 Garrett D'Amore <garrett@damore.org>
+ * Copyright 2016 Joyent, Inc.
  */
 
 /*
@@ -64,10 +65,10 @@ wcscasecmp(const wchar_t *s1, const wchar_t *s2)
 int
 wcsncasecmp_l(const wchar_t *s1, const wchar_t *s2, size_t n, locale_t loc)
 {
-	if (s1 == s2)
+	if (s1 == s2 || n == 0)
 		return (0);
 
-	while ((towlower_l(*s1, loc) == towlower_l(*s2, loc)) && n--) {
+	while ((towlower_l(*s1, loc) == towlower_l(*s2, loc)) && --n) {
 		if (*s1 == 0)
 			return (0);
 		s1++;
diff --git a/usr/src/pkg/manifests/system-test-libctest.mf b/usr/src/pkg/manifests/system-test-libctest.mf
index c2ae2bcf0f..db39430af6 100644
--- a/usr/src/pkg/manifests/system-test-libctest.mf
+++ b/usr/src/pkg/manifests/system-test-libctest.mf
@@ -125,6 +125,12 @@ file path=opt/libc-tests/tests/symbols/symbols_test.$(ARCH) mode=0555
 file path=opt/libc-tests/tests/symbols/symbols_test.$(ARCH64) mode=0555
 file path=opt/libc-tests/tests/timespec_get.32 mode=0555
 file path=opt/libc-tests/tests/timespec_get.64 mode=0555
+file path=opt/libc-tests/tests/wcsncasecmp-7344.32 mode=0555
+file path=opt/libc-tests/tests/wcsncasecmp-7344.64 mode=0555
+file path=opt/libc-tests/tests/wcsncasecmp-7350.32 mode=0555
+file path=opt/libc-tests/tests/wcsncasecmp-7350.64 mode=0555
+file path=opt/libc-tests/tests/wcsncasecmp.32 mode=0555
+file path=opt/libc-tests/tests/wcsncasecmp.64 mode=0555
 file path=opt/libc-tests/tests/wcsrtombs_test mode=0555
 file path=opt/libc-tests/tests/wcsrtombs_test.$(ARCH) mode=0555
 file path=opt/libc-tests/tests/wcsrtombs_test.$(ARCH64) mode=0555
diff --git a/usr/src/test/libc-tests/runfiles/default.run b/usr/src/test/libc-tests/runfiles/default.run
index d78253eb7f..5880329fd1 100644
--- a/usr/src/test/libc-tests/runfiles/default.run
+++ b/usr/src/test/libc-tests/runfiles/default.run
@@ -12,6 +12,7 @@
 #
 # Copyright (c) 2012 by Delphix. All rights reserved.
 # Copyright 2014 Garrett D'Amore <garrett@damore.org>
+# Copyright 2016 Joyent, Inc.
 #
 
 [DEFAULT]
@@ -23,14 +24,16 @@ post =
 outputdir = /var/tmp/test_results
 
 [/opt/libc-tests/tests/fpround_test]
-
 [/opt/libc-tests/tests/newlocale_test]
-
 [/opt/libc-tests/tests/nl_langinfo_test]
-
 [/opt/libc-tests/tests/wcsrtombs_test]
-
 [/opt/libc-tests/tests/wctype_test]
+[/opt/libc-tests/tests/wcsncasecmp.32]
+[/opt/libc-tests/tests/wcsncasecmp.64]
+[/opt/libc-tests/tests/wcsncasecm-7344.32]
+[/opt/libc-tests/tests/wcsncasecmp-7344.64]
+[/opt/libc-tests/tests/wcsncasecm-7350.32]
+[/opt/libc-tests/tests/wcsncasecmp-7350.64]
 
 [/opt/libc-tests/tests/random/getrandom]
 [/opt/libc-tests/tests/random/getentropy]
diff --git a/usr/src/test/libc-tests/tests/Makefile b/usr/src/test/libc-tests/tests/Makefile
index 966ee00348..a259d28c89 100644
--- a/usr/src/test/libc-tests/tests/Makefile
+++ b/usr/src/test/libc-tests/tests/Makefile
@@ -37,7 +37,10 @@ PROGS = \
 	env-7076 \
 	quick_exit_order \
 	quick_exit_status \
-	timespec_get
+	timespec_get \
+	wcsncasecmp \
+	wcsncasecmp-7344 \
+	wcsncasecmp-7350
 
 SCRIPTS = \
 	quick_exit
diff --git a/usr/src/test/libc-tests/tests/wcsncasecmp-7344.c b/usr/src/test/libc-tests/tests/wcsncasecmp-7344.c
new file mode 100644
index 0000000000..a297a463dd
--- /dev/null
+++ b/usr/src/test/libc-tests/tests/wcsncasecmp-7344.c
@@ -0,0 +1,40 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2016 Joyent, Inc.
+ */
+
+/*
+ * Regression test for illumos#7344. Make sure that wcsncasecmp() only checks
+ * the specified number of bytes.
+ */
+
+#include <wchar.h>
+#include <string.h>
+#include <strings.h>
+#include <stdlib.h>
+#include <sys/debug.h>
+
+int
+main(void)
+{
+	wchar_t a[8], b[8];
+
+	(void) memset(a, 'a', sizeof (a));
+	(void) memset(b, 'a', sizeof (b));
+
+	a[7] = 'n';
+	b[7] = 'o';
+
+	VERIFY0(wcsncasecmp(a, b, 7));
+	return (0);
+}
diff --git a/usr/src/test/libc-tests/tests/wcsncasecmp-7350.c b/usr/src/test/libc-tests/tests/wcsncasecmp-7350.c
new file mode 100644
index 0000000000..632c17fb08
--- /dev/null
+++ b/usr/src/test/libc-tests/tests/wcsncasecmp-7350.c
@@ -0,0 +1,32 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2016 Joyent, Inc.
+ */
+
+/*
+ * Regression test for illumos#7350. Make sure that wcsncasecmp() doesn't read
+ * data from the data buffer when zero characters are specified.
+ */
+
+#include <wchar.h>
+#include <sys/debug.h>
+
+int
+main(void)
+{
+	wchar_t *a = (void *)(uintptr_t)0x8;
+	wchar_t *b = (void *)(uintptr_t)0x40;
+
+	VERIFY0(wcsncasecmp(a, b, 0));
+	return (0);
+}
diff --git a/usr/src/test/libc-tests/tests/wcsncasecmp.c b/usr/src/test/libc-tests/tests/wcsncasecmp.c
new file mode 100644
index 0000000000..ca82692f3a
--- /dev/null
+++ b/usr/src/test/libc-tests/tests/wcsncasecmp.c
@@ -0,0 +1,102 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2016 Joyent, Inc.
+ */
+
+/*
+ * General tests for wcsncasecmp(). Test to make sure that the following are
+ * true:
+ *
+ *   o Two identical strings are equal
+ *   o Two strings with the same contents are equal
+ *   o Case insensitive in ASCII works
+ *   o Basic cases where strings aren't equal
+ *   o An ASCII string that would compare greater due to case is properly less
+ *   o Comparing with zero characters succeeds even if different strings
+ *   o Characters in a locale / language that don't have a notion of case are
+ *     consistent
+ */
+
+#include <wchar.h>
+#include <string.h>
+#include <strings.h>
+#include <stdlib.h>
+#include <locale.h>
+#include <sys/debug.h>
+
+int
+main(void)
+{
+	int ret;
+	wchar_t a[32], b[32];
+	const char *str = "kefka";
+	const char *caps = "KEFKA";
+	const char *less = "celes";
+	const char *more = "terra";
+	const char *hikari = "光";
+	const char *awake = "目覚め";
+	size_t len = strlen(str);
+
+	/*
+	 * Start in en_US.UTF-8, which the test suites deps guarantee is
+	 * present.
+	 */
+	(void) setlocale(LC_ALL, "en_US.UTF-8");
+	(void) memset(a, 'a', sizeof (a));
+	(void) memset(b, 'b', sizeof (b));
+
+	ret = mbstowcs(a, str, len);
+	VERIFY3U(ret, ==, len);
+	ret = mbstowcs(b, str, len);
+	VERIFY3U(ret, ==, len);
+
+	VERIFY0(wcsncasecmp(a, a, len));
+	VERIFY0(wcsncasecmp(a, b, len));
+
+	ret = mbstowcs(b, caps, len);
+	VERIFY3U(ret, ==, len);
+	VERIFY0(wcsncasecmp(a, b, len));
+
+	ret = mbstowcs(b, less, len);
+	VERIFY3U(ret, ==, len);
+	VERIFY3S(wcsncasecmp(a, b, len), >, 0);
+
+	ret = mbstowcs(b, more, len);
+	VERIFY3U(ret, ==, len);
+	VERIFY3S(wcsncasecmp(a, b, len), <, 0);
+
+	ret = mbstowcs(a, caps, len);
+	VERIFY3U(ret, ==, len);
+	ret = mbstowcs(b, less, len);
+	VERIFY3U(ret, ==, len);
+	VERIFY3S(wcsncmp(a, b, len), <, 0);
+	VERIFY3S(wcsncasecmp(a, b, len), >, 0);
+
+	VERIFY3S(wcsncasecmp(a, b, 0), ==, 0);
+
+	/*
+	 * This locale is also guaranteed by the test suite.
+	 */
+	(void) setlocale(LC_ALL, "ja_JP.UTF-8");
+	ret = mbstowcs(a, hikari, sizeof (a));
+	VERIFY3U(ret, >, 0);
+	ret = mbstowcs(b, hikari, sizeof (b));
+	VERIFY3U(ret, >, 0);
+	VERIFY3S(wcsncasecmp(a, b, 1), ==, 0);
+
+	ret = mbstowcs(b, awake, sizeof (b));
+	VERIFY3U(ret, >, 0);
+	VERIFY3S(wcsncasecmp(a, b, 1), !=, 0);
+
+	return (0);
+}