From 5df6ebcf44fd89d429c1fee78c893e280a551ee8 Mon Sep 17 00:00:00 2001
From: Raphael Moreira Zinsly <rzinsly@linux.ibm.com>
Date: Fri, 21 Aug 2020 12:10:22 -0300
Subject: [PATCH] string: test strncasecmp and strncpy near page boundaries

Add tests to check if strings placed at page boundaries are
handled correctly by strncasecmp and strncpy similar to tests
for strncmp and strnlen.
---
 string/test-strncasecmp.c | 43 +++++++++++++++++++++++++++++++++++++++
 string/test-strncpy.c     | 35 +++++++++++++++++++++++++++++++
 2 files changed, 78 insertions(+)

diff --git a/string/test-strncasecmp.c b/string/test-strncasecmp.c
index 6a9c27beae..502222ed1d 100644
--- a/string/test-strncasecmp.c
+++ b/string/test-strncasecmp.c
@@ -137,6 +137,48 @@ do_test (size_t align1, size_t align2, size_t n, size_t len, int max_char,
     do_one_test (impl, s1, s2, n, exp_result);
 }
 
+static void
+do_page_tests (void)
+{
+  char *s1, *s2;
+  int exp_result;
+  const size_t maxoffset = 64;
+
+  s1 = (char *) buf1 + BUF1PAGES * page_size - maxoffset;
+  memset (s1, 'a', maxoffset - 1);
+  s1[maxoffset - 1] = '\0';
+
+  s2 = (char *) buf2 + page_size - maxoffset;
+  memset (s2, 'a', maxoffset - 1);
+  s2[maxoffset - 1] = '\0';
+
+  /* At this point s1 and s2 point to distinct memory regions containing
+     "aa..." with size of 63 plus '\0'.  Also, both strings are bounded to a
+     page with read/write access and the next page is protected with PROT_NONE
+     (meaning that any access outside of the page regions will trigger an
+     invalid memory access).
+
+     The loop checks for all possible offsets up to maxoffset for both
+     inputs with a size larger than the string (so memory access outside
+     the expected memory regions might trigger invalid access).  */
+
+  for (size_t off1 = 0; off1 < maxoffset; off1++)
+    {
+      for (size_t off2 = 0; off2 < maxoffset; off2++)
+	{
+	  exp_result = (off1 == off2)
+			? 0
+			: off1 < off2
+			  ? 'a'
+			  : -'a';
+
+	  FOR_EACH_IMPL (impl, 0)
+	    check_result (impl, s1 + off1, s2 + off2, maxoffset + 1,
+			  exp_result);
+	}
+    }
+}
+
 static void
 do_random_tests (void)
 {
@@ -334,6 +376,7 @@ test_locale (const char *locale)
     }
 
   do_random_tests ();
+  do_page_tests ();
 }
 
 int
diff --git a/string/test-strncpy.c b/string/test-strncpy.c
index c978753ad8..e902c1764e 100644
--- a/string/test-strncpy.c
+++ b/string/test-strncpy.c
@@ -155,6 +155,40 @@ do_test (size_t align1, size_t align2, size_t len, size_t n, int max_char)
     do_one_test (impl, s2, s1, len, n);
 }
 
+static void
+do_page_tests (void)
+{
+  CHAR *s1, *s2;
+  const size_t maxoffset = 64;
+
+  /* Put s1 at the maxoffset from the edge of buf1's last page.  */
+  s1 = (CHAR *) buf1 + BUF1PAGES * page_size / sizeof(CHAR) - maxoffset;
+  /* s2 needs room to put a string with size of maxoffset + 1 at s2 +
+     (maxoffset - 1).  */
+  s2 = (CHAR *) buf2 + page_size / sizeof(CHAR) - maxoffset * 2;
+
+  MEMSET (s1, 'a', maxoffset - 1);
+  s1[maxoffset - 1] = '\0';
+
+  /* Both strings are bounded to a page with read/write access and the next
+     page is protected with PROT_NONE (meaning that any access outside of the
+     page regions will trigger an invalid memory access).
+
+     The loop copies the string s1 for all possible offsets up to maxoffset
+     for both inputs with a size larger than s1 (so memory access outside the
+     expected memory regions might trigger invalid access).  */
+
+  for (size_t off1 = 0; off1 < maxoffset; off1++)
+    {
+      for (size_t off2 = 0; off2 < maxoffset; off2++)
+	{
+	  FOR_EACH_IMPL (impl, 0)
+	    do_one_test (impl, s2 + off2, s1 + off1, maxoffset - off1 - 1,
+			 maxoffset + (maxoffset - off2));
+	}
+    }
+}
+
 static void
 do_random_tests (void)
 {
@@ -317,6 +351,7 @@ test_main (void)
     }
 
   do_random_tests ();
+  do_page_tests ();
   return ret;
 }