13665439908

Committed 04 Mar 2025 09:54PM UTC coverage: 71.855% (+0.04%) from 71.819%

Build # 13665439908

Build Type

push

github

Committed by

poettering

Commit Message

dirent-util: add several assertions in posix_getdents()

Follow-up for e86a492ff.

Coverage Stats

4 of 4 new or added lines in 1 file covered. (100.0%)

8029 existing lines in 84 files now uncovered.

294783 of 410245 relevant lines covered (71.86%)

717882.44 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

95.12

/src/basic/alloc-util.h

/* SPDX-License-Identifier: LGPL-2.1-or-later */
#pragma once

#include <alloca.h>
#include <malloc.h>
#include <stddef.h>
#include <stdlib.h>
#include <string.h>

#include "macro.h"

#if HAS_FEATURE_MEMORY_SANITIZER
#  include <sanitizer/msan_interface.h>
#endif

typedef void (*free_func_t)(void *p);
typedef void* (*mfree_func_t)(void *p);

/* If for some reason more than 4M are allocated on the stack, let's abort immediately. It's better than
 * proceeding and smashing the stack limits. Note that by default RLIMIT_STACK is 8M on Linux. */
#define ALLOCA_MAX (4U*1024U*1024U)

#define new(t, n) ((t*) malloc_multiply(n, sizeof(t)))

#define new0(t, n) ((t*) calloc((n) ?: 1, sizeof(t)))

#define alloca_safe(n)                                                  \
        ({                                                              \
                size_t _nn_ = (n);                                      \
                assert(_nn_ <= ALLOCA_MAX);                             \
                alloca(_nn_ == 0 ? 1 : _nn_);                           \
        })                                                              \

#define newa(t, n)                                                      \
        ({                                                              \
                size_t _n_ = (n);                                       \
                assert_se(MUL_ASSIGN_SAFE(&_n_, sizeof(t)));            \
                (t*) alloca_safe(_n_);                                  \
        })

#define newa0(t, n)                                                     \
        ({                                                              \
                size_t _n_ = (n);                                       \
                assert_se(MUL_ASSIGN_SAFE(&_n_, sizeof(t)));            \
                (t*) alloca0(_n_);                                      \
        })

#define newdup(t, p, n) ((t*) memdup_multiply(p, n, sizeof(t)))

#define newdup_suffix0(t, p, n) ((t*) memdup_suffix0_multiply(p, n, sizeof(t)))

#define malloc0(n) (calloc(1, (n) ?: 1))

#define free_and_replace_full(a, b, free_func)  \
        ({                                      \
                typeof(a)* _a = &(a);           \
                typeof(b)* _b = &(b);           \
                free_func(*_a);                 \
                *_a = *_b;                      \
                *_b = NULL;                     \
                0;                              \
        })

#define free_and_replace(a, b)                  \
        free_and_replace_full(a, b, free)

/* This is similar to free_and_replace_full(), but NULL is not assigned to 'b', and its reference counter is
 * increased. */
#define unref_and_replace_full(a, b, ref_func, unref_func)      \
        ({                                       \
                typeof(a)* _a = &(a);            \
                typeof(b) _b = ref_func(b);      \
                unref_func(*_a);                 \
                *_a = _b;                        \
                0;                               \
        })

void* memdup(const void *p, size_t l) _alloc_(2);
void* memdup_suffix0(const void *p, size_t l); /* We can't use _alloc_() here, since we return a buffer one byte larger than the specified size */

#define memdupa(p, l)                           \
        ({                                      \
                void *_q_;                      \
                size_t _l_ = l;                 \
                _q_ = alloca_safe(_l_);         \
                memcpy_safe(_q_, p, _l_);       \
        })

#define memdupa_suffix0(p, l)                   \
        ({                                      \
                void *_q_;                      \
                size_t _l_ = l;                 \
                _q_ = alloca_safe(_l_ + 1);     \
                ((uint8_t*) _q_)[_l_] = 0;      \
                memcpy_safe(_q_, p, _l_);       \
        })

static inline void unsetp(void *p) {
        /* A trivial "destructor" that can be used in cases where we want to
         * unset a pointer from a _cleanup_ function. */

        *(void**)p = NULL;
}

static inline void freep(void *p) {
        *(void**)p = mfree(*(void**) p);
}

#define _cleanup_free_ _cleanup_(freep)

static inline bool size_multiply_overflow(size_t size, size_t need) {
        return _unlikely_(need != 0 && size > (SIZE_MAX / need));
}

_malloc_ _alloc_(1, 2) static inline void *malloc_multiply(size_t need, size_t size) {
        if (size_multiply_overflow(size, need))
                return NULL;

        return malloc(size * need ?: 1);
}

_alloc_(2, 3) static inline void *memdup_multiply(const void *p, size_t need, size_t size) {
        if (size_multiply_overflow(size, need))
                return NULL;

        return memdup(p, size * need);
}

/* Note that we can't decorate this function with _alloc_() since the returned memory area is one byte larger
 * than the product of its parameters. */
static inline void *memdup_suffix0_multiply(const void *p, size_t need, size_t size) {
        if (size_multiply_overflow(size, need))
                return NULL;

        return memdup_suffix0(p, size * need);
}

void* greedy_realloc(void **p, size_t need, size_t size);
void* greedy_realloc0(void **p, size_t need, size_t size);
void* greedy_realloc_append(void **p, size_t *n_p, const void *from, size_t n_from, size_t size);

#define GREEDY_REALLOC(array, need)                                     \
        greedy_realloc((void**) &(array), (need), sizeof((array)[0]))

#define GREEDY_REALLOC0(array, need)                                    \
        greedy_realloc0((void**) &(array), (need), sizeof((array)[0]))

#define GREEDY_REALLOC_APPEND(array, n_array, from, n_from)             \
        ({                                                              \
                const typeof(*(array)) *_from_ = (from);                \
                greedy_realloc_append((void**) &(array), &(n_array), _from_, (n_from), sizeof((array)[0])); \
        })

#define alloca0(n)                                      \
        ({                                              \
                char *_new_;                            \
                size_t _len_ = n;                       \
                _new_ = alloca_safe(_len_);             \
                memset(_new_, 0, _len_);                \
        })

/* It's not clear what alignment glibc/gcc alloca() guarantee, hence provide a guaranteed safe version */
#define alloca_align(size, align)                                       \
        ({                                                              \
                void *_ptr_;                                            \
                size_t _mask_ = (align) - 1;                            \
                size_t _size_ = size;                                   \
                _ptr_ = alloca_safe(_size_ + _mask_);                   \
                (void*)(((uintptr_t)_ptr_ + _mask_) & ~_mask_);         \
        })

#define alloca0_align(size, align)                                      \
        ({                                                              \
                void *_new_;                                            \
                size_t _xsize_ = (size);                                \
                _new_ = alloca_align(_xsize_, (align));                 \
                memset(_new_, 0, _xsize_);                              \
        })

#if HAS_FEATURE_MEMORY_SANITIZER
#  define msan_unpoison(r, s) __msan_unpoison(r, s)
#else
#  define msan_unpoison(r, s)
#endif

/* Dummy allocator to tell the compiler that the new size of p is newsize. The implementation returns the
 * pointer as is; the only reason for its existence is as a conduit for the _alloc_ attribute.  This must not
 * be inlined (hence a non-static function with _noinline_ because LTO otherwise tries to inline it) because
 * gcc then loses the attributes on the function.
 * See: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=96503 */
void *expand_to_usable(void *p, size_t newsize) _alloc_(2) _returns_nonnull_ _noinline_;

static inline size_t malloc_sizeof_safe(void **xp) {
        if (_unlikely_(!xp || !*xp))
                return 0;

        size_t sz = malloc_usable_size(*xp);
        *xp = expand_to_usable(*xp, sz);
        /* GCC doesn't see the _returns_nonnull_ when built with ubsan, so yet another hint to make it doubly
         * clear that expand_to_usable won't return NULL.
         * See: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=79265 */
        if (!*xp)
                assert_not_reached();
        return sz;
}

/* This returns the number of usable bytes in a malloc()ed region as per malloc_usable_size(), which may
 * return a value larger than the size that was actually allocated. Access to that additional memory is
 * discouraged because it violates the C standard; a compiler cannot see that this as valid. To help the
 * compiler out, the MALLOC_SIZEOF_SAFE macro 'allocates' the usable size using a dummy allocator function
 * expand_to_usable. There is a possibility of malloc_usable_size() returning different values during the
 * lifetime of an object, which may cause problems, but the glibc allocator does not do that at the moment. */
#define MALLOC_SIZEOF_SAFE(x) \
        malloc_sizeof_safe((void**) &__builtin_choose_expr(__builtin_constant_p(x), (void*) { NULL }, (x)))

/* Inspired by ELEMENTSOF() but operates on malloc()'ed memory areas: typesafely returns the number of items
 * that fit into the specified memory block */
#define MALLOC_ELEMENTSOF(x) \
        (__builtin_choose_expr(                                         \
                __builtin_types_compatible_p(typeof(x), typeof(&*(x))), \
                MALLOC_SIZEOF_SAFE(x)/sizeof((x)[0]),                   \
                VOID_0))

/* These are like strdupa()/strndupa(), but honour ALLOCA_MAX */
#define strdupa_safe(s)                                                 \
        ({                                                              \
                const char *_t = (s);                                   \
                (char*) memdupa_suffix0(_t, strlen(_t));                \
        })

#define strndupa_safe(s, n)                                             \
        ({                                                              \
                const char *_t = (s);                                   \
                (char*) memdupa_suffix0(_t, strnlen(_t, n));            \
        })

/* Free every element of the array. */
static inline void free_many(void **p, size_t n) {
        assert(p || n == 0);

        FOREACH_ARRAY(i, p, n)
                *i = mfree(*i);
}

/* Typesafe wrapper for char** rather than void**. Unfortunately C won't implicitly cast this. */
static inline void free_many_charp(char **c, size_t n) {
        free_many((void**) c, n);
}

_alloc_(2) static inline void *realloc0(void *p, size_t new_size) {
        size_t old_size;
        void *q;

        /* Like realloc(), but initializes anything appended to zero */

        old_size = MALLOC_SIZEOF_SAFE(p);

        q = realloc(p, new_size);
        if (!q)
                return NULL;

        new_size = MALLOC_SIZEOF_SAFE(q); /* Update with actually allocated space */

        if (new_size > old_size)
                memset((uint8_t*) q + old_size, 0, new_size - old_size);

        return q;
}

#include "memory-util.h"

1	/* SPDX-License-Identifier: LGPL-2.1-or-later */
2	#pragma once
3
4	#include <alloca.h>
5	#include <malloc.h>
6	#include <stddef.h>
7	#include <stdlib.h>
8	#include <string.h>
9
10	#include "macro.h"
11
12	#if HAS_FEATURE_MEMORY_SANITIZER
13	# include <sanitizer/msan_interface.h>
14	#endif
15
16	typedef void (free_func_t)(void p);
17	typedef void* (mfree_func_t)(void p);
18
19	/* If for some reason more than 4M are allocated on the stack, let's abort immediately. It's better than
20	* proceeding and smashing the stack limits. Note that by default RLIMIT_STACK is 8M on Linux. */
21	#define ALLOCA_MAX (4U1024U1024U)
22
23	#define new(t, n) ((t*) malloc_multiply(n, sizeof(t)))
24
25	#define new0(t, n) ((t*) calloc((n) ?: 1, sizeof(t)))
26
27	#define alloca_safe(n) \
28	({ \
29	size_t _nn_ = (n); \
30	assert(_nn_ <= ALLOCA_MAX); \
31	alloca(_nn_ == 0 ? 1 : _nn_); \
32	}) \
33
34	#define newa(t, n) \
35	({ \
36	size_t _n_ = (n); \
37	assert_se(MUL_ASSIGN_SAFE(&_n_, sizeof(t))); \
38	(t*) alloca_safe(_n_); \
39	})
40
41	#define newa0(t, n) \
42	({ \
43	size_t _n_ = (n); \
44	assert_se(MUL_ASSIGN_SAFE(&_n_, sizeof(t))); \
45	(t*) alloca0(_n_); \
46	})
47
48	#define newdup(t, p, n) ((t*) memdup_multiply(p, n, sizeof(t)))
49
50	#define newdup_suffix0(t, p, n) ((t*) memdup_suffix0_multiply(p, n, sizeof(t)))
51
52	#define malloc0(n) (calloc(1, (n) ?: 1))
53
54	#define free_and_replace_full(a, b, free_func) \
55	({ \
56	typeof(a)* _a = &(a); \
57	typeof(b)* _b = &(b); \
58	free_func(*_a); \
59	_a = _b; \
60	*_b = NULL; \
61	0; \
62	})
63
64	#define free_and_replace(a, b) \
65	free_and_replace_full(a, b, free)
66
67	/* This is similar to free_and_replace_full(), but NULL is not assigned to 'b', and its reference counter is
68	* increased. */
69	#define unref_and_replace_full(a, b, ref_func, unref_func) \
70	({ \
71	typeof(a)* _a = &(a); \
72	typeof(b) _b = ref_func(b); \
73	unref_func(*_a); \
74	*_a = _b; \
75	0; \
76	})
77
78	void* memdup(const void *p, size_t l) _alloc_(2);
79	void* memdup_suffix0(const void p, size_t l); / We can't use _alloc_() here, since we return a buffer one byte larger than the specified size */
80
81	#define memdupa(p, l) \
82	({ \
83	void *_q_; \
84	size_t _l_ = l; \
85	_q_ = alloca_safe(_l_); \
86	memcpy_safe(_q_, p, _l_); \
87	})
88
89	#define memdupa_suffix0(p, l) \
90	({ \
91	void *_q_; \
92	size_t _l_ = l; \
93	_q_ = alloca_safe(_l_ + 1); \
94	((uint8_t*) _q_)[_l_] = 0; \
95	memcpy_safe(_q_, p, _l_); \
96	})
97
98	static inline void unsetp(void *p) {	67,308✔
99	/* A trivial "destructor" that can be used in cases where we want to
100	* unset a pointer from a _cleanup_ function. */
101
102	(void*)p = NULL;	67,308✔
103	}
104
105	static inline void freep(void *p) {	201,402,458✔
106	(void)p = mfree((void**) p);	244,553,685✔
107	}	8,634,806✔
108
109	#define _cleanup_free_ _cleanup_(freep)
110
111	static inline bool size_multiply_overflow(size_t size, size_t need) {	11,553,448✔
112	return _unlikely_(need != 0 && size > (SIZE_MAX / need));	11,538,637✔
113	}
114
115	_malloc_ _alloc_(1, 2) static inline void *malloc_multiply(size_t need, size_t size) {	23,138,667✔
116	if (size_multiply_overflow(size, need))	20,418,045✔
117	return NULL;
118
119	return malloc(size * need ?: 1);	23,161,348✔
120	}
121
122	_alloc_(2, 3) static inline void memdup_multiply(const void p, size_t need, size_t size) {	491,121✔
123	if (size_multiply_overflow(size, need))	491,121✔
124	return NULL;
125
126	return memdup(p, size * need);	491,121✔
127	}
128
129	/* Note that we can't decorate this function with _alloc_() since the returned memory area is one byte larger
130	* than the product of its parameters. */
131	static inline void memdup_suffix0_multiply(const void p, size_t need, size_t size) {	826,925✔
132	if (size_multiply_overflow(size, need))	826,925✔
133	return NULL;
134
135	return memdup_suffix0(p, size * need);	826,925✔
136	}
137
138	void* greedy_realloc(void **p, size_t need, size_t size);
139	void* greedy_realloc0(void **p, size_t need, size_t size);
140	void* greedy_realloc_append(void *p, size_t n_p, const void *from, size_t n_from, size_t size);
141
142	#define GREEDY_REALLOC(array, need) \
143	greedy_realloc((void**) &(array), (need), sizeof((array)[0]))
144
145	#define GREEDY_REALLOC0(array, need) \
146	greedy_realloc0((void**) &(array), (need), sizeof((array)[0]))
147
148	#define GREEDY_REALLOC_APPEND(array, n_array, from, n_from) \
149	({ \
150	const typeof((array)) _from_ = (from); \
151	greedy_realloc_append((void**) &(array), &(n_array), _from_, (n_from), sizeof((array)[0])); \
152	})
153
154	#define alloca0(n) \
155	({ \
156	char *_new_; \
157	size_t _len_ = n; \
158	_new_ = alloca_safe(_len_); \
159	memset(_new_, 0, _len_); \
160	})
161
162	/* It's not clear what alignment glibc/gcc alloca() guarantee, hence provide a guaranteed safe version */
163	#define alloca_align(size, align) \
164	({ \
165	void *_ptr_; \
166	size_t _mask_ = (align) - 1; \
167	size_t _size_ = size; \
168	_ptr_ = alloca_safe(_size_ + _mask_); \
169	(void*)(((uintptr_t)_ptr_ + _mask_) & ~_mask_); \
170	})
171
172	#define alloca0_align(size, align) \
173	({ \
174	void *_new_; \
175	size_t _xsize_ = (size); \
176	_new_ = alloca_align(_xsize_, (align)); \
177	memset(_new_, 0, _xsize_); \
178	})
179
180	#if HAS_FEATURE_MEMORY_SANITIZER
181	# define msan_unpoison(r, s) __msan_unpoison(r, s)
182	#else
183	# define msan_unpoison(r, s)
184	#endif
185
186	/* Dummy allocator to tell the compiler that the new size of p is newsize. The implementation returns the
187	* pointer as is; the only reason for its existence is as a conduit for the _alloc_ attribute. This must not
188	* be inlined (hence a non-static function with _noinline_ because LTO otherwise tries to inline it) because
189	* gcc then loses the attributes on the function.
190	* See: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=96503 */
191	void expand_to_usable(void p, size_t newsize) _alloc_(2) _returns_nonnull_ _noinline_;
192
193	static inline size_t malloc_sizeof_safe(void **xp) {	597,698,159✔
194	if (_unlikely_(!xp \|\| !*xp))	597,698,159✔
195	return 0;
196
197	size_t sz = malloc_usable_size(*xp);	597,328,159✔
198	xp = expand_to_usable(xp, sz);	597,328,159✔
199	/* GCC doesn't see the _returns_nonnull_ when built with ubsan, so yet another hint to make it doubly
200	* clear that expand_to_usable won't return NULL.
201	* See: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=79265 */
202	if (!*xp)	597,328,159✔
UNCOV 203	assert_not_reached();	×
204	return sz;
205	}
206
207	/* This returns the number of usable bytes in a malloc()ed region as per malloc_usable_size(), which may
208	* return a value larger than the size that was actually allocated. Access to that additional memory is
209	* discouraged because it violates the C standard; a compiler cannot see that this as valid. To help the
210	* compiler out, the MALLOC_SIZEOF_SAFE macro 'allocates' the usable size using a dummy allocator function
211	* expand_to_usable. There is a possibility of malloc_usable_size() returning different values during the
212	* lifetime of an object, which may cause problems, but the glibc allocator does not do that at the moment. */
213	#define MALLOC_SIZEOF_SAFE(x) \
214	malloc_sizeof_safe((void*) &__builtin_choose_expr(__builtin_constant_p(x), (void) { NULL }, (x)))
215
216	/* Inspired by ELEMENTSOF() but operates on malloc()'ed memory areas: typesafely returns the number of items
217	* that fit into the specified memory block */
218	#define MALLOC_ELEMENTSOF(x) \
219	(__builtin_choose_expr( \
220	__builtin_types_compatible_p(typeof(x), typeof(&*(x))), \
221	MALLOC_SIZEOF_SAFE(x)/sizeof((x)[0]), \
222	VOID_0))
223
224	/* These are like strdupa()/strndupa(), but honour ALLOCA_MAX */
225	#define strdupa_safe(s) \
226	({ \
227	const char *_t = (s); \
228	(char*) memdupa_suffix0(_t, strlen(_t)); \
229	})
230
231	#define strndupa_safe(s, n) \
232	({ \
233	const char *_t = (s); \
234	(char*) memdupa_suffix0(_t, strnlen(_t, n)); \
235	})
236
237	/* Free every element of the array. */
238	static inline void free_many(void **p, size_t n) {	57,422✔
239	assert(p \|\| n == 0);	57,422✔
240
241	FOREACH_ARRAY(i, p, n)	993,430✔
242	i = mfree(i);	936,008✔
243	}	57,422✔
244
245	/* Typesafe wrapper for char rather than void. Unfortunately C won't implicitly cast this. */
246	static inline void free_many_charp(char **c, size_t n) {	1,208✔
247	free_many((void**) c, n);	1,208✔
UNCOV 248	}	×
249
250	_alloc_(2) static inline void realloc0(void p, size_t new_size) {	23,365✔
251	size_t old_size;	23,365✔
252	void *q;	23,365✔
253
254	/* Like realloc(), but initializes anything appended to zero */
255
256	old_size = MALLOC_SIZEOF_SAFE(p);	23,365✔
257
258	q = realloc(p, new_size);	23,365✔
259	if (!q)	23,365✔
260	return NULL;	23,365✔
261
262	new_size = MALLOC_SIZEOF_SAFE(q); /* Update with actually allocated space */	23,365✔
263
264	if (new_size > old_size)	23,365✔
265	memset((uint8_t*) q + old_size, 0, new_size - old_size);	20,636✔
266
267	return q;	23,365✔
268	}
269
270	#include "memory-util.h"

systemd / systemd / 13665439908

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous