Fix out-of-bound array accesses in libstdc++ testsuite

	* testsuite/21_strings/basic_string/modifiers/append/char/1.cc: Fix
	reads past the end of strings.
	* testsuite/21_strings/basic_string/operations/compare/char/1.cc:
	Likewise.
	* testsuite/21_strings/char_traits/requirements/short/1.cc: Fix
	invalid array accesses.
	* testsuite/experimental/string_view/operations/compare/char/1.cc:
	Fix read past the end of string.
	* testsuite/util/testsuite_character.cc: Fix out-of-bounds write.

From-SVN: r238609

diff --git a/libstdc++-v3/ChangeLog b/libstdc++-v3/ChangeLog
index 284ced622f83608fbee1a0baadf433fcac6bdd87..7ad94786bd74d01fb76f574d6752eb7184637af4 100644 (file)
--- a/libstdc++-v3/ChangeLog
+++ b/libstdc++-v3/ChangeLog
@@ -1,5 +1,15 @@
 2016-07-21  Jonathan Wakely  <jwakely@redhat.com>
 
+       * testsuite/21_strings/basic_string/modifiers/append/char/1.cc: Fix
+       reads past the end of strings.
+       * testsuite/21_strings/basic_string/operations/compare/char/1.cc:
+       Likewise.
+       * testsuite/21_strings/char_traits/requirements/short/1.cc: Fix
+       invalid array accesses.
+       * testsuite/experimental/string_view/operations/compare/char/1.cc:
+       Fix read past the end of string.
+       * testsuite/util/testsuite_character.cc: Fix out-of-bounds write.
+
        * testsuite/24_iterators/container_access.cc: Fix missing returns.
        * testsuite/24_iterators/range_access_cpp14.cc: Likewise.
 

diff --git a/libstdc++-v3/testsuite/21_strings/basic_string/modifiers/append/char/1.cc b/libstdc++-v3/testsuite/21_strings/basic_string/modifiers/append/char/1.cc
index 176c317a94e468ad361366c8d39a61760a06acd0..1ccb9da5fd6775f7f1573bf90466c55fc216b36e 100644 (file)
--- a/libstdc++-v3/testsuite/21_strings/basic_string/modifiers/append/char/1.cc
+++ b/libstdc++-v3/testsuite/21_strings/basic_string/modifiers/append/char/1.cc
@@ -118,7 +118,7 @@ bool test01(void)
   VERIFY( str06 == "corpus, corpus" );
 
   str06 = str02;
-  str06.append("corpus, ", 12);
+  str06.append("corpus, ", 9); // n=9 includes null terminator
   VERIFY( str06 != "corpus, corpus, " );
 
 

diff --git a/libstdc++-v3/testsuite/21_strings/basic_string/operations/compare/char/1.cc b/libstdc++-v3/testsuite/21_strings/basic_string/operations/compare/char/1.cc
index 55027b3b349ceb244fce5d9dfa9e1c391d0efc56..7fe30a7ea7f470635f2fb52485f9199a3e42b296 100644 (file)
--- a/libstdc++-v3/testsuite/21_strings/basic_string/operations/compare/char/1.cc
+++ b/libstdc++-v3/testsuite/21_strings/basic_string/operations/compare/char/1.cc
@@ -80,10 +80,10 @@ test01()
   test_value(strcmp(str_1.data(), str_0.data()), lt);
   test_value(strcmp(str_0.data(), str_1.data()), gt);
   test_value(strncmp(str_1.data(), str_0.data(), 6), z);
-  test_value(strncmp(str_1.data(), str_0.data(), 14), lt);
+  test_value(strncmp(str_1.data(), str_0.data(), 10), lt);
   test_value(memcmp(str_1.data(), str_0.data(), 6), z);
-  test_value(memcmp(str_1.data(), str_0.data(), 14), lt);
-  test_value(memcmp("costa marbella", "costa rica", 14), lt);
+  test_value(memcmp(str_1.data(), str_0.data(), 10), lt);
+  test_value(memcmp("costa marbella", "costa rica", 10), lt);
 
   // int compare(const basic_string& str) const;
   test_value(str_0.compare(str_1), gt); //because r>m

diff --git a/libstdc++-v3/testsuite/21_strings/char_traits/requirements/short/1.cc b/libstdc++-v3/testsuite/21_strings/char_traits/requirements/short/1.cc
index 5b715a01f9e75ed0a27e0df9a9ee0bd44df41141..0a2d2ee1dc57324eb1d3bc1af6960bee9fe77102 100644 (file)
--- a/libstdc++-v3/testsuite/21_strings/char_traits/requirements/short/1.cc
+++ b/libstdc++-v3/testsuite/21_strings/char_traits/requirements/short/1.cc
@@ -75,10 +75,11 @@ void test02(void)
 
   const char_type str_lit1[] = {'m', 'o', 'n', 't', 'a', 'r', 'a', ' ', 'a', 'n', 'd', ' ', 'o', 'c', 'e', 'a', 'n', ' ', 'b', 'e', 'a', 'c', 'h', 0};
 
-  int len = sizeof(str_lit1)/sizeof(char_type) + sizeof(array1)/sizeof(char_type) - 1;
+  const int array2_len = sizeof(str_lit1)/sizeof(char_type) + sizeof(array1)/sizeof(char_type) - 1;
   // two terminating chars
   char_type array3[] = {'b', 'o', 'r', 'a', 'c', 'a', 'y', ',', ' ', 'p', 'h', 'i', 'l', 'i', 'p', 'p', 'i', 'n', 'e', 's', 0};
-  char_type array2[len];
+  char_type array2[array2_len];
+  int len = std::min<int>(array2_len, sizeof(array3)/sizeof(char_type));
   std::char_traits<char_type>::copy(array2, array3, len);
 
   VERIFY( str_lit1[0] == 'm' );
@@ -139,13 +140,12 @@ void test02(void)
   VERIFY( pc4 == 0 );
 
   // char_type* X::assign(char_type* s, size_t n, char_type c)
-  len = sizeof(array2) / sizeof(char_type);
-  std::memset(array2, 0xaf, len * sizeof(char_type));
+  std::memset(array2, 0xaf, array2_len * sizeof(char_type));
   VERIFY( array2[0] != 0x15a8 );
 
-  pc1 = std::char_traits<char_type>::assign (array2, len, 0x15a8);
+  pc1 = std::char_traits<char_type>::assign (array2, array2_len, 0x15a8);
   VERIFY( pc1 == array2 );
-  for (int i = 0; i < len; ++i)
+  for (int i = 0; i < array2_len; ++i)
     VERIFY( array2[i] == 0x15a8 );
 
   // char_type* X::copy(char_type* s, const char_type* p, size_t n)

diff --git a/libstdc++-v3/testsuite/experimental/string_view/operations/compare/char/1.cc b/libstdc++-v3/testsuite/experimental/string_view/operations/compare/char/1.cc
index 565f2b137d9abbea1bea4fa3a7353a6e8cd25a18..e4d733fe6f1e53eb2aa8f75433fb744452755da2 100644 (file)
--- a/libstdc++-v3/testsuite/experimental/string_view/operations/compare/char/1.cc
+++ b/libstdc++-v3/testsuite/experimental/string_view/operations/compare/char/1.cc
@@ -82,8 +82,8 @@ test01()
   test_value(strncmp(str_1.data(), str_0.data(), 6), z);
   test_value(strncmp(str_1.data(), str_0.data(), 14), lt);
   test_value(memcmp(str_1.data(), str_0.data(), 6), z);
-  test_value(memcmp(str_1.data(), str_0.data(), 14), lt);
-  test_value(memcmp("costa marbella", "costa rica", 14), lt);
+  test_value(memcmp(str_1.data(), str_0.data(), 10), lt);
+  test_value(memcmp("costa marbella", "costa rica", 10), lt);
 
   // int compare(const basic_string_view& str) const;
   test_value(str_0.compare(str_1), gt); //because r>m

diff --git a/libstdc++-v3/testsuite/util/testsuite_character.cc b/libstdc++-v3/testsuite/util/testsuite_character.cc
index 7e6d7a589ad16391ecebaacaf5fc8d3f25d2b094..e4fea0e771d27f728a041b22063c3848346b4671 100644 (file)
--- a/libstdc++-v3/testsuite/util/testsuite_character.cc
+++ b/libstdc++-v3/testsuite/util/testsuite_character.cc
@@ -154,11 +154,9 @@ namespace std
          value_type v = __num_base::_S_atoms_out[i];
          _M_data->_M_atoms_out[i].value = v;
        }
-      _M_data->_M_atoms_out[__num_base::_S_oend] = pod_ushort();
 
       for (size_t j = 0; j < __num_base::_S_iend; ++j)
        _M_data->_M_atoms_in[j].value = value_type(__num_base::_S_atoms_in[j]);
-      _M_data->_M_atoms_in[__num_base::_S_iend] = pod_ushort();
 
       // "true"
       pod_ushort* __truename = new pod_ushort[4 + 1];