|
|
|
@ -1,258 +0,0 @@
|
|
|
|
|
/*
|
|
|
|
|
* Copyright (c) 2013-2019 Huawei Technologies Co., Ltd. All rights reserved.
|
|
|
|
|
* Copyright (c) 2020-2021 Huawei Device Co., Ltd. All rights reserved.
|
|
|
|
|
*
|
|
|
|
|
* Redistribution and use in source and binary forms, with or without modification,
|
|
|
|
|
* are permitted provided that the following conditions are met:
|
|
|
|
|
*
|
|
|
|
|
* 1. Redistributions of source code must retain the above copyright notice, this list of
|
|
|
|
|
* conditions and the following disclaimer.
|
|
|
|
|
*
|
|
|
|
|
* 2. Redistributions in binary form must reproduce the above copyright notice, this list
|
|
|
|
|
* of conditions and the following disclaimer in the documentation and/or other materials
|
|
|
|
|
* provided with the distribution.
|
|
|
|
|
*
|
|
|
|
|
* 3. Neither the name of the copyright holder nor the names of its contributors may be used
|
|
|
|
|
* to endorse or promote products derived from this software without specific prior written
|
|
|
|
|
* permission.
|
|
|
|
|
*
|
|
|
|
|
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
|
|
|
|
|
* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
|
|
|
|
|
* THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
|
|
|
|
|
* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR
|
|
|
|
|
* CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
|
|
|
|
|
* EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
|
|
|
|
|
* PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS;
|
|
|
|
|
* OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
|
|
|
|
|
* WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
|
|
|
|
|
* OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
|
|
|
|
|
* ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
|
|
|
|
*/
|
|
|
|
|
|
|
|
|
|
#include <stdio.h>
|
|
|
|
|
#include <stdlib.h>
|
|
|
|
|
#include <string.h>
|
|
|
|
|
//函数BufWriteTest用于向给定的缓冲区中写入字符'a',从指定的start位置开始,一直到end位置。
|
|
|
|
|
static void BufWriteTest(void *buf, int start, int end)
|
|
|
|
|
{
|
|
|
|
|
for (int i = start; i <= end; i++) {
|
|
|
|
|
((char *)buf)[i] = 'a';
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
//函数BufReadTest则是读取给定的缓冲区中的内容,从start位置开始,一直到end位置,但是读取的内容并未被使用。
|
|
|
|
|
static void BufReadTest(void *buf, int start, int end)
|
|
|
|
|
{
|
|
|
|
|
char tmp;
|
|
|
|
|
for (int i = start; i <= end; i++) {
|
|
|
|
|
tmp = ((char *)buf)[i];
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
//函数LmsMallocTest首先分配了一个大小为TEST_SIZE的内存块,然后尝试在[-1, TEST_SIZE]的范围内进行读写操作,预期是触发读写溢出的错误。然后它释放了这块内存。
|
|
|
|
|
static void LmsMallocTest(void)
|
|
|
|
|
{
|
|
|
|
|
#define TEST_SIZE 16
|
|
|
|
|
printf("\n-------- LmsMallocTest Start --------\n");
|
|
|
|
|
char *buf = (char *)malloc(TEST_SIZE);
|
|
|
|
|
if (buf == NULL) {
|
|
|
|
|
return;
|
|
|
|
|
}
|
|
|
|
|
printf("[LmsMallocTest] read overflow & underflow error should be triggered, read range[-1, TEST_SIZE]\n");
|
|
|
|
|
BufReadTest(buf, -1, TEST_SIZE);
|
|
|
|
|
printf("[LmsMallocTest] write overflow error should be triggered, write range[0, TEST_SIZE]\n");
|
|
|
|
|
BufWriteTest(buf, 0, TEST_SIZE);
|
|
|
|
|
|
|
|
|
|
free(buf);
|
|
|
|
|
printf("\n-------- LmsMallocTest End --------\n");
|
|
|
|
|
}
|
|
|
|
|
//函数LmsReallocTest首先分配了一个大小为TEST_SIZE的内存块,然后在[-1, TEST_SIZE]的范围内进行读操作,预期是触发读写溢出的错误。然后它尝试将这块内存的大小调整为TEST_SIZE_MIN,并再次在[-1, TEST_SIZE_MIN]的范围内进行读操作,预期同样是触发读写溢出的错误。最后,它释放了这块内存
|
|
|
|
|
static void LmsReallocTest(void)
|
|
|
|
|
{
|
|
|
|
|
#define TEST_SIZE 64
|
|
|
|
|
#define TEST_SIZE_MIN 32
|
|
|
|
|
printf("\n-------- LmsReallocTest Start --------\n");
|
|
|
|
|
char *buf = (char *)malloc(TEST_SIZE);
|
|
|
|
|
printf("[LmsReallocTest] read overflow & underflow error should be triggered, read range[-1, TEST_SIZE]\n");
|
|
|
|
|
BufReadTest(buf, -1, TEST_SIZE);
|
|
|
|
|
char *buf1 = (char *)realloc(buf, TEST_SIZE_MIN);
|
|
|
|
|
if (buf1 == NULL) {
|
|
|
|
|
free(buf);
|
|
|
|
|
return;
|
|
|
|
|
}
|
|
|
|
|
buf = NULL;
|
|
|
|
|
printf("[LmsReallocTest] read overflow & underflow error should be triggered, read range[-1, TEST_SIZE_MIN]\n");
|
|
|
|
|
BufReadTest(buf1, -1, TEST_SIZE_MIN);
|
|
|
|
|
free(buf1);
|
|
|
|
|
printf("\n-------- LmsReallocTest End --------\n");
|
|
|
|
|
}
|
|
|
|
|
// 此函数使用calloc函数分配内存,calloc会初始化分配的内存为零。然后它调用BufReadTest函数来读取分配的内存范围,但实际上并未使用这块内存。如果内存分配失败,则calloc返回NULL,函数会直接返回。最后,使用free释放内存。
|
|
|
|
|
static void LmsCallocTest(void)
|
|
|
|
|
{
|
|
|
|
|
#define TEST_SIZE 16
|
|
|
|
|
printf("\n-------- LmsCallocTest Start --------\n");
|
|
|
|
|
char *buf = (char *)calloc(4, 4); /* 4: test size */
|
|
|
|
|
if (buf == NULL) {
|
|
|
|
|
return;
|
|
|
|
|
}
|
|
|
|
|
printf("[LmsCallocTest] read overflow & underflow error should be triggered, read range[-1, TEST_SIZE]\n");
|
|
|
|
|
BufReadTest(buf, -1, TEST_SIZE);
|
|
|
|
|
free(buf);
|
|
|
|
|
printf("\n-------- LmsCallocTest End --------\n");
|
|
|
|
|
}
|
|
|
|
|
//LmsVallocTest: 此函数使用valloc函数分配内存,valloc会根据页的边界来分配内存。然后它调用BufReadTest函数来读取分配的内存范围。如果内存分配失败,则valloc返回NULL,函数会直接返回。最后,使用free释放内存。
|
|
|
|
|
static void LmsVallocTest(void)
|
|
|
|
|
{
|
|
|
|
|
#define TEST_SIZE 4096
|
|
|
|
|
printf("\n-------- LmsVallocTest Start --------\n");
|
|
|
|
|
char *buf = (char *)valloc(TEST_SIZE);
|
|
|
|
|
if (buf == NULL) {
|
|
|
|
|
return;
|
|
|
|
|
}
|
|
|
|
|
printf("[LmsVallocTest] read overflow & underflow error should be triggered, read range[-1, TEST_SIZE]\n");
|
|
|
|
|
BufReadTest(buf, -1, TEST_SIZE);
|
|
|
|
|
free(buf);
|
|
|
|
|
printf("\n-------- LmsVallocTest End --------\n");
|
|
|
|
|
}
|
|
|
|
|
//LmsAlignedAllocTest: 此函数使用aligned_alloc函数分配内存,aligned_alloc会分配一块特定对齐的内存。然后它调用BufReadTest函数来读取分配的内存范围。如果内存分配失败,则aligned_alloc返回NULL,函数会直接返回。最后,使用free释放内存。
|
|
|
|
|
static void LmsAlignedAllocTest(void)
|
|
|
|
|
{
|
|
|
|
|
#define TEST_ALIGN_SIZE 64
|
|
|
|
|
#define TEST_SIZE 128
|
|
|
|
|
printf("\n-------- LmsAlignedAllocTest Start --------\n");
|
|
|
|
|
char *buf = (char *)aligned_alloc(TEST_ALIGN_SIZE, TEST_SIZE);
|
|
|
|
|
if (buf == NULL) {
|
|
|
|
|
return;
|
|
|
|
|
}
|
|
|
|
|
printf("[LmsAlignedAllocTest] read overflow & underflow error should be triggered, read range[-1,128]\n");
|
|
|
|
|
BufReadTest(buf, -1, 128);
|
|
|
|
|
free(buf);
|
|
|
|
|
printf("\n-------- LmsAlignedAllocTest End --------\n");
|
|
|
|
|
}
|
|
|
|
|
//LmsMemsetTest: 此函数使用malloc函数分配内存,然后使用memset函数将该内存块设置为0。注意,这里的memset被用于填充比分配的内存还要多的字节(TEST_SIZE + 1),这可能会导致溢出错误。然后使用free释放内存。
|
|
|
|
|
static void LmsMemsetTest(void)
|
|
|
|
|
{
|
|
|
|
|
#define TEST_SIZE 32
|
|
|
|
|
printf("\n-------- LmsMemsetTest Start --------\n");
|
|
|
|
|
char *buf = (char *)malloc(TEST_SIZE);
|
|
|
|
|
if (buf == NULL) {
|
|
|
|
|
return;
|
|
|
|
|
}
|
|
|
|
|
printf("[LmsMemsetTest] memset overflow & underflow error should be triggered, memset size:%d\n", TEST_SIZE + 1);
|
|
|
|
|
memset(buf, 0, TEST_SIZE + 1);
|
|
|
|
|
free(buf);
|
|
|
|
|
printf("\n-------- LmsMemsetTest End --------\n");
|
|
|
|
|
}
|
|
|
|
|
//: 该函数旨在测试memcpy函数的功能。首先,它使用malloc分配一块内存,然后尝试使用memcpy将一个数组的内容复制到这块内存中,复制的大小超过分配的内存大小,从而触发溢出错误。
|
|
|
|
|
|
|
|
|
|
static void LmsMemcpyTest(void)
|
|
|
|
|
{
|
|
|
|
|
#define TEST_SIZE 20
|
|
|
|
|
printf("\n-------- LmsMemcpyTest Start --------\n");
|
|
|
|
|
char *buf = (char *)malloc(TEST_SIZE);
|
|
|
|
|
if (buf == NULL) {
|
|
|
|
|
return;
|
|
|
|
|
}
|
|
|
|
|
char localBuf[32] = {0}; /* 32: test size */
|
|
|
|
|
printf("[LmsMemcpyTest] memcpy overflow error should be triggered, memcpy size:%d\n", TEST_SIZE + 1);
|
|
|
|
|
memcpy(buf, localBuf, TEST_SIZE + 1);
|
|
|
|
|
free(buf);
|
|
|
|
|
printf("\n-------- LmsMemcpyTest End --------\n");
|
|
|
|
|
}
|
|
|
|
|
//LmsMemmoveTest: 该函数测试memmove函数的功能。memmove函数用于复制一定数量的字节从一个位置到另一个位置,即使这两个位置是重叠的。该函数尝试复制的内容超过了分配的内存大小,从而触发溢出错误。
|
|
|
|
|
static void LmsMemmoveTest(void)
|
|
|
|
|
{
|
|
|
|
|
#define TEST_SIZE 20
|
|
|
|
|
printf("\n-------- LmsMemmoveTest Start --------\n");
|
|
|
|
|
char *buf = (char *)malloc(TEST_SIZE);
|
|
|
|
|
if (buf == NULL) {
|
|
|
|
|
return;
|
|
|
|
|
}
|
|
|
|
|
printf("[LmsMemmoveTest] memmove overflow error should be triggered\n");
|
|
|
|
|
memmove(buf + 12, buf, 10); /* 12 and 10: test size */
|
|
|
|
|
free(buf);
|
|
|
|
|
printf("\n-------- LmsMemmoveTest End --------\n");
|
|
|
|
|
}
|
|
|
|
|
LmsStrcpyTest: 该函数测试strcpy函数的功能。strcpy函数用于将一个字符串复制到另一个字符串。该函数尝试复制一个字符串到分配的内存中,复制的字符串长度超过了分配的内存大小,从而触发溢出错误。
|
|
|
|
|
static void LmsStrcpyTest(void)
|
|
|
|
|
{
|
|
|
|
|
#define TEST_SIZE 16
|
|
|
|
|
printf("\n-------- LmsStrcpyTest Start --------\n");
|
|
|
|
|
char *buf = (char *)malloc(TEST_SIZE);
|
|
|
|
|
if (buf == NULL) {
|
|
|
|
|
return;
|
|
|
|
|
}
|
|
|
|
|
char *testStr = "bbbbbbbbbbbbbbbbb";
|
|
|
|
|
printf("[LmsStrcpyTest] strcpy overflow error should be triggered, src string buf size:%d\n", strlen(testStr) + 1);
|
|
|
|
|
strcpy(buf, testStr);
|
|
|
|
|
free(buf);
|
|
|
|
|
printf("\n-------- LmsStrcpyTest End --------\n");
|
|
|
|
|
}
|
|
|
|
|
//LmsStrcatTest: 该函数测试strcat函数的功能。strcat函数用于将一个字符串连接到另一个字符串的末尾。该函数首先分配一块内存,并尝试将一个字符串连接到这块内存的末尾,连接后的字符串长度超过了分配的内存大小,从而触发溢出错误。
|
|
|
|
|
static void LmsStrcatTest(void)
|
|
|
|
|
{
|
|
|
|
|
#define TEST_SIZE 16
|
|
|
|
|
printf("\n-------- LmsStrcatTest Start --------\n");
|
|
|
|
|
char *buf = (char *)malloc(TEST_SIZE);
|
|
|
|
|
if (buf == NULL) {
|
|
|
|
|
return;
|
|
|
|
|
}
|
|
|
|
|
buf[0] = 'a';
|
|
|
|
|
buf[1] = 'b';
|
|
|
|
|
buf[2] = 0;
|
|
|
|
|
char *testStr = "cccccccccccccc";
|
|
|
|
|
printf("[LmsStrcatTest] strcat overflow error should be triggered, src string:%s dest string:%s"
|
|
|
|
|
"total buf size:%d\n",
|
|
|
|
|
testStr, buf, strlen(testStr) + strlen(buf) + 1);
|
|
|
|
|
strcat(buf, testStr);
|
|
|
|
|
free(buf);
|
|
|
|
|
printf("\n-------- LmsStrcatTest End --------\n");
|
|
|
|
|
}
|
|
|
|
|
//static void LmsFreeTest(void): 这是一个静态函数,名为LmsFreeTest,不接受任何参数并且没有返回值。该函数主要用于测试free函数的功能。
|
|
|
|
|
static void LmsFreeTest(void)
|
|
|
|
|
{
|
|
|
|
|
#define TEST_SIZE 16
|
|
|
|
|
printf("\n-------- LmsFreeTest Start --------\n");
|
|
|
|
|
char *buf = (char *)malloc(TEST_SIZE);
|
|
|
|
|
if (buf == NULL) {
|
|
|
|
|
return;
|
|
|
|
|
}
|
|
|
|
|
printf("[LmsFreeTest] free size:%d\n", TEST_SIZE);
|
|
|
|
|
free(buf);
|
|
|
|
|
printf("[LmsFreeTest] Use after free error should be triggered, read range[1,1]\n");
|
|
|
|
|
BufReadTest(buf, 1, 1);
|
|
|
|
|
printf("[LmsFreeTest] double free error should be triggered\n");
|
|
|
|
|
free(buf);
|
|
|
|
|
printf("\n-------- LmsFreeTest End --------\n");
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
int main(int argc, char * const *argv)
|
|
|
|
|
{
|
|
|
|
|
(void)argc;
|
|
|
|
|
(void)argv;
|
|
|
|
|
printf("\n############### Lms Test start ###############\n");
|
|
|
|
|
char *tmp = (char *)malloc(5000); /* 5000: test mem size */
|
|
|
|
|
if (tmp == NULL) {
|
|
|
|
|
return;
|
|
|
|
|
}
|
|
|
|
|
LmsMallocTest();
|
|
|
|
|
LmsReallocTest();
|
|
|
|
|
LmsCallocTest();
|
|
|
|
|
LmsVallocTest();
|
|
|
|
|
LmsAlignedAllocTest();
|
|
|
|
|
LmsMemsetTest();
|
|
|
|
|
LmsMemcpyTest();
|
|
|
|
|
LmsMemmoveTest();
|
|
|
|
|
LmsStrcpyTest();
|
|
|
|
|
LmsStrcatTest();
|
|
|
|
|
LmsFreeTest();
|
|
|
|
|
free(tmp);
|
|
|
|
|
printf("\n############### Lms Test End ###############\n");
|
|
|
|
|
}
|
|
|
|
|
//int main(int argc, char * const *argv): 定义主函数,接受命令行参数。
|
|
|
|
|
//(void)argc; (void)argv;: 这两行代码忽略了命令行参数,实际上它们没有用到。
|
|
|
|
|
//printf("\n############### Lms Test start ###############\n");: 打印一条消息,表示Lms测试开始。
|
|
|
|
|
// *tmp = (char *)malloc(5000);: 分配一块大小为5000的内存,用于后续的测试函数。
|
|
|
|
|
//if (tmp == NULL) { return; }: 检查malloc是否成功分配了内存。如果分配失败,主函数直接返回。
|
|
|
|
|
//调用多个内存管理测试函数,例如LmsMallocTest()、LmsReallocTest()等。这些函数的具体实现没有在给出的代码中给出,因此我无法对它们进行注释。
|
|
|
|
|
//LmsFreeTest();: 调用LmsFreeTest函数,进行free函数的测试。
|
|
|
|
|
//free(tmp);: 释放之前使用malloc分配的内存。
|
|
|
|
|
//printf("\n############### Lms Test End ###############\n");: 打印一条消息,表示Lms测试结束
|