Skip to content

Commit 4a84e0c

Browse files
committed
Fix a use-after-free in execve_test_factory
Ensure that the exec functions' arguments are valid for 'static. Previously they were short-lived temporaries.
1 parent bf7a5fd commit 4a84e0c

File tree

1 file changed

+17
-12
lines changed

1 file changed

+17
-12
lines changed

test/test_unistd.rs

Lines changed: 17 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -261,31 +261,36 @@ macro_rules! execve_test_factory(
261261

262262
#[cfg(test)]
263263
mod $test_name {
264+
use std::ffi::CStr;
264265
use super::*;
265266

267+
const EMPTY: &'static [u8] = b"\0";
268+
const DASH_C: &'static [u8] = b"-c\0";
269+
const BIGARG: &'static [u8] = b"echo nix!!! && echo foo=$foo && echo baz=$baz\0";
270+
const FOO: &'static [u8] = b"foo=bar\0";
271+
const BAZ: &'static [u8] = b"baz=quux\0";
272+
266273
fn syscall_cstr_ref() -> Result<std::convert::Infallible, nix::Error> {
267274
$syscall(
268275
$exe,
269276
$(CString::new($pathname).unwrap().as_c_str(), )*
270-
&[CString::new(b"".as_ref()).unwrap().as_c_str(),
271-
CString::new(b"-c".as_ref()).unwrap().as_c_str(),
272-
CString::new(b"echo nix!!! && echo foo=$foo && echo baz=$baz"
273-
.as_ref()).unwrap().as_c_str()],
274-
&[CString::new(b"foo=bar".as_ref()).unwrap().as_c_str(),
275-
CString::new(b"baz=quux".as_ref()).unwrap().as_c_str()]
277+
&[CStr::from_bytes_with_nul(EMPTY).unwrap(),
278+
CStr::from_bytes_with_nul(DASH_C).unwrap(),
279+
CStr::from_bytes_with_nul(BIGARG).unwrap()],
280+
&[CStr::from_bytes_with_nul(FOO).unwrap(),
281+
CStr::from_bytes_with_nul(BAZ).unwrap()]
276282
$(, $flags)*)
277283
}
278284

279285
fn syscall_cstring() -> Result<std::convert::Infallible, nix::Error> {
280286
$syscall(
281287
$exe,
282288
$(CString::new($pathname).unwrap().as_c_str(), )*
283-
&[CString::new(b"".as_ref()).unwrap(),
284-
CString::new(b"-c".as_ref()).unwrap(),
285-
CString::new(b"echo nix!!! && echo foo=$foo && echo baz=$baz"
286-
.as_ref()).unwrap()],
287-
&[CString::new(b"foo=bar".as_ref()).unwrap(),
288-
CString::new(b"baz=quux".as_ref()).unwrap()]
289+
&[CString::from(CStr::from_bytes_with_nul(EMPTY).unwrap()),
290+
CString::from(CStr::from_bytes_with_nul(DASH_C).unwrap()),
291+
CString::from(CStr::from_bytes_with_nul(BIGARG).unwrap())],
292+
&[CString::from(CStr::from_bytes_with_nul(FOO).unwrap()),
293+
CString::from(CStr::from_bytes_with_nul(BAZ).unwrap())]
289294
$(, $flags)*)
290295
}
291296

0 commit comments

Comments
 (0)