Martino Ferrari
74 lines
3.1 KiB
C++
74 lines
3.1 KiB
C++
/**
|
|
* @file BoundsCheckTest.cpp
|
|
* @brief Reproduction tests for HI-1 (integer overflow in bounds check) and
|
|
* HI-4 (unclamped forcedValue memcpy).
|
|
*
|
|
* These tests verify that the 64-bit bounds check pattern correctly rejects
|
|
* crafted payloads whose 32-bit multiply would overflow, and that the
|
|
* forcedValue clamp prevents OOB reads.
|
|
*/
|
|
|
|
#include <gtest/gtest.h>
|
|
#include "GeneralDefinitions.h"
|
|
|
|
// HI-1: Verify that a 64-bit bounds check rejects a payload where
|
|
// elemsToRead * wireElemBytes would overflow uint32.
|
|
TEST(BoundsCheckTest, OverflowRejected) {
|
|
// Simulate: numSamples = 0x20000001, wireElemBytes = 8
|
|
// 32-bit: 0x20000001 * 8 = 0x8 (overflow!)
|
|
// 64-bit: 0x100000008 (correctly large, > any reasonable payload size)
|
|
MARTe::uint32 elemsToRead = 0x20000001u;
|
|
MARTe::uint32 wireElemBytes = 8u;
|
|
MARTe::uint32 off = 12u; // after HRT + numSamples
|
|
MARTe::uint32 size = 1400u; // typical max payload
|
|
|
|
// This is the FIXED pattern (64-bit):
|
|
MARTe::uint64 bytesNeeded = static_cast<MARTe::uint64>(off) +
|
|
static_cast<MARTe::uint64>(elemsToRead) *
|
|
static_cast<MARTe::uint64>(wireElemBytes);
|
|
// Should reject (bytesNeeded >> size)
|
|
EXPECT_GT(bytesNeeded, static_cast<MARTe::uint64>(size))
|
|
<< "64-bit check should detect overflow that 32-bit would miss";
|
|
|
|
// Verify the OLD (buggy) 32-bit pattern would have passed:
|
|
MARTe::uint32 oldCheck = off + (elemsToRead * wireElemBytes);
|
|
// On 32-bit: 0x20000001 * 8 = 0x100000008 truncated to 0x8
|
|
// off + 0x8 = 20, which is < 1400, so the old check would pass (bug!)
|
|
// On 64-bit: the multiply doesn't overflow, so oldCheck is huge
|
|
// This test documents that the 64-bit fix is necessary on 32-bit platforms
|
|
// and correct on 64-bit.
|
|
(void) oldCheck;
|
|
}
|
|
|
|
// HI-1: Verify a normal (non-overflow) case passes the 64-bit check.
|
|
TEST(BoundsCheckTest, NormalCasePasses) {
|
|
MARTe::uint32 elemsToRead = 100u;
|
|
MARTe::uint32 wireElemBytes = 4u;
|
|
MARTe::uint32 off = 12u;
|
|
MARTe::uint32 size = 500u;
|
|
|
|
MARTe::uint64 bytesNeeded = static_cast<MARTe::uint64>(off) +
|
|
static_cast<MARTe::uint64>(elemsToRead) *
|
|
static_cast<MARTe::uint64>(wireElemBytes);
|
|
EXPECT_LE(bytesNeeded, static_cast<MARTe::uint64>(size))
|
|
<< "normal case should pass the bounds check";
|
|
}
|
|
|
|
// HI-1: Verify numRows * numCols overflow is detected.
|
|
TEST(BoundsCheckTest, NumRowsNumColsOverflow) {
|
|
MARTe::uint32 numRows = 0x10000u;
|
|
MARTe::uint32 numCols = 0x10000u;
|
|
|
|
// 32-bit: 0x10000 * 0x10000 = 0 (overflow!)
|
|
MARTe::uint32 oldResult = numRows * numCols;
|
|
EXPECT_EQ(oldResult, 0u) << "32-bit multiply should overflow to 0";
|
|
|
|
// 64-bit fix:
|
|
MARTe::uint64 newResult = static_cast<MARTe::uint64>(numRows) *
|
|
static_cast<MARTe::uint64>(numCols);
|
|
EXPECT_EQ(newResult, static_cast<MARTe::uint64>(0x100000000ULL))
|
|
<< "64-bit multiply should give correct result";
|
|
EXPECT_GT(newResult, static_cast<MARTe::uint64>(0x100000u))
|
|
<< "should exceed the sanity cap, triggering rejection";
|
|
}
|