|
| 1 | +/* Copyright (C) 2010-2026 The RetroArch team |
| 2 | + * |
| 3 | + * --------------------------------------------------------------------------------------- |
| 4 | + * The following license statement only applies to this file (archive_zstd_test.c). |
| 5 | + * --------------------------------------------------------------------------------------- |
| 6 | + * |
| 7 | + * Permission is hereby granted, free of charge, |
| 8 | + * to any person obtaining a copy of this software and associated documentation files (the "Software"), |
| 9 | + * to deal in the Software without restriction, including without limitation the rights to |
| 10 | + * use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, |
| 11 | + * and to permit persons to whom the Software is furnished to do so, subject to the following conditions: |
| 12 | + * |
| 13 | + * The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. |
| 14 | + * |
| 15 | + * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, |
| 16 | + * INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, |
| 17 | + * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. |
| 18 | + * IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, |
| 19 | + * WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, |
| 20 | + * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. |
| 21 | + */ |
| 22 | + |
| 23 | +/* Contract test for archive_file_zstd content_size guards. |
| 24 | + * |
| 25 | + * Self-contained: does NOT link against libzstd or the archive |
| 26 | + * backend. The bugs being guarded against are arithmetic truncation |
| 27 | + * and addition overflow on an attacker-controlled 64-bit value |
| 28 | + * returned by ZSTD_getFrameContentSize(); the guards live in |
| 29 | + * archive_file_zstd.c and are plain integer comparisons. |
| 30 | + * |
| 31 | + * This test is explicitly a CONTRACT test, not a regression test. |
| 32 | + * It validates that the guard SPEC (as replicated in the oracle |
| 33 | + * functions below) behaves correctly on boundary inputs. It does |
| 34 | + * NOT call into archive_file_zstd.c, so it cannot detect if someone |
| 35 | + * later edits the real guards in a way that diverges from this spec. |
| 36 | + * |
| 37 | + * Why: a true regression test would need to link libzstd to exercise |
| 38 | + * ZSTD_getFrameContentSize on a crafted frame, which would introduce |
| 39 | + * an external dependency this samples tree does not otherwise carry. |
| 40 | + * The contract test is the next-best thing within that constraint. |
| 41 | + * |
| 42 | + * What the real patched code does (keep these in sync with the |
| 43 | + * oracle functions below): |
| 44 | + * |
| 45 | + * zstd_parse_file_iterate_step() [iterate path]: |
| 46 | + * if (content_size > UINT32_MAX) |
| 47 | + * return -1; |
| 48 | + * ctx->decompressed_size = (uint32_t)content_size; |
| 49 | + * |
| 50 | + * zstd_file_read() [decompress-in-place path]: |
| 51 | + * if (content_size >= SIZE_MAX) |
| 52 | + * return -1; |
| 53 | + * decompressed = malloc((size_t)(content_size + 1)); |
| 54 | + * |
| 55 | + * If either real guard is ever edited, the corresponding oracle |
| 56 | + * below must be updated to match or this test loses its value. |
| 57 | + */ |
| 58 | + |
| 59 | +#include <stdio.h> |
| 60 | +#include <stdlib.h> |
| 61 | +#include <stdint.h> |
| 62 | +#include <limits.h> |
| 63 | + |
| 64 | +/* These match <zstd.h> but are reproduced here so we don't pull in |
| 65 | + * the zstd headers. Update if zstd ever redefines them. */ |
| 66 | +#ifndef ZSTD_CONTENTSIZE_UNKNOWN |
| 67 | +#define ZSTD_CONTENTSIZE_UNKNOWN ((unsigned long long)0 - 1) |
| 68 | +#endif |
| 69 | +#ifndef ZSTD_CONTENTSIZE_ERROR |
| 70 | +#define ZSTD_CONTENTSIZE_ERROR ((unsigned long long)0 - 2) |
| 71 | +#endif |
| 72 | + |
| 73 | +static int failures = 0; |
| 74 | + |
| 75 | +/* --- oracle: the patched iterate-path guard --------------------- * |
| 76 | + * Must be kept in sync with archive_file_zstd.c: |
| 77 | + * zstd_parse_file_iterate_step. |
| 78 | + * Returns 0 if the value is accepted, -1 if rejected. */ |
| 79 | +static int oracle_iterate_guard(unsigned long long content_size) |
| 80 | +{ |
| 81 | + if ( content_size == ZSTD_CONTENTSIZE_UNKNOWN |
| 82 | + || content_size == ZSTD_CONTENTSIZE_ERROR) |
| 83 | + return -1; |
| 84 | + if (content_size > UINT32_MAX) |
| 85 | + return -1; |
| 86 | + return 0; |
| 87 | +} |
| 88 | + |
| 89 | +/* --- oracle: the patched read-path guard ------------------------ * |
| 90 | + * Must be kept in sync with archive_file_zstd.c: zstd_file_read. * |
| 91 | + * Returns 0 if the value is accepted, -1 if rejected. */ |
| 92 | +static int oracle_read_guard(unsigned long long content_size) |
| 93 | +{ |
| 94 | + if ( content_size == ZSTD_CONTENTSIZE_UNKNOWN |
| 95 | + || content_size == ZSTD_CONTENTSIZE_ERROR) |
| 96 | + return -1; |
| 97 | + if (content_size >= (unsigned long long)SIZE_MAX) |
| 98 | + return -1; |
| 99 | + return 0; |
| 100 | +} |
| 101 | + |
| 102 | +/* ================================================================ */ |
| 103 | + |
| 104 | +typedef struct { |
| 105 | + const char *label; |
| 106 | + unsigned long long value; |
| 107 | + int want_iterate; /* expected oracle_iterate result */ |
| 108 | + int want_read; /* expected oracle_read result */ |
| 109 | +} case_t; |
| 110 | + |
| 111 | +int main(void) |
| 112 | +{ |
| 113 | + size_t i; |
| 114 | + /* These cases exercise the boundaries the guards protect. Each |
| 115 | + * case lists the expected verdict for both the iterate path |
| 116 | + * (uint32_t destination) and the read path (size_t + 1). */ |
| 117 | + case_t cases[] = { |
| 118 | + /* label value iter read */ |
| 119 | + { "zero", 0, 0, 0 }, |
| 120 | + { "typical small", 1024, 0, 0 }, |
| 121 | + { "100 MiB", 100ULL * 1024 * 1024, 0, 0 }, |
| 122 | + { "UINT32_MAX exactly", (unsigned long long)UINT32_MAX, 0, 0 }, |
| 123 | + { "UINT32_MAX + 1 (iterate trunc)",(unsigned long long)UINT32_MAX + 1, -1, 0 }, |
| 124 | + { "4 GiB (iterate trunc)", 4ULL * 1024 * 1024 * 1024, -1, 0 }, |
| 125 | + { "2^63 (iterate trunc)", 1ULL << 63, -1, 0 }, |
| 126 | + { "ZSTD_CONTENTSIZE_ERROR sentinel",ZSTD_CONTENTSIZE_ERROR, -1, -1 }, |
| 127 | + { "ZSTD_CONTENTSIZE_UNKNOWN", ZSTD_CONTENTSIZE_UNKNOWN, -1, -1 }, |
| 128 | + /* SIZE_MAX case -- on 64-bit, SIZE_MAX == ULLONG_MAX - 1, |
| 129 | + * which equals ZSTD_CONTENTSIZE_ERROR, so the sentinel check |
| 130 | + * catches it. On 32-bit, SIZE_MAX is far smaller and the |
| 131 | + * >= SIZE_MAX branch catches it first. Either way: rejected |
| 132 | + * on the read path. On the iterate path it's also rejected |
| 133 | + * (too big for uint32_t). */ |
| 134 | + { "SIZE_MAX (read-path guard)", (unsigned long long)SIZE_MAX, -1, -1 }, |
| 135 | + }; |
| 136 | + |
| 137 | + for (i = 0; i < sizeof(cases)/sizeof(cases[0]); i++) |
| 138 | + { |
| 139 | + int got_iter = oracle_iterate_guard(cases[i].value); |
| 140 | + int got_read = oracle_read_guard(cases[i].value); |
| 141 | + |
| 142 | + if (got_iter != cases[i].want_iterate) |
| 143 | + { |
| 144 | + printf("[FAILED] iterate-guard(%s=%llu) got %d want %d\n", |
| 145 | + cases[i].label, |
| 146 | + (unsigned long long)cases[i].value, |
| 147 | + got_iter, cases[i].want_iterate); |
| 148 | + failures++; |
| 149 | + continue; |
| 150 | + } |
| 151 | + if (got_read != cases[i].want_read) |
| 152 | + { |
| 153 | + printf("[FAILED] read-guard(%s=%llu) got %d want %d\n", |
| 154 | + cases[i].label, |
| 155 | + (unsigned long long)cases[i].value, |
| 156 | + got_read, cases[i].want_read); |
| 157 | + failures++; |
| 158 | + continue; |
| 159 | + } |
| 160 | + printf("[SUCCESS] %-40s iter=%s read=%s\n", |
| 161 | + cases[i].label, |
| 162 | + got_iter == 0 ? "accept" : "reject", |
| 163 | + got_read == 0 ? "accept" : "reject"); |
| 164 | + } |
| 165 | + |
| 166 | + if (failures) |
| 167 | + { |
| 168 | + printf("\n%d test(s) failed\n", failures); |
| 169 | + return 1; |
| 170 | + } |
| 171 | + printf("\nAll zstd content_size regression tests passed.\n"); |
| 172 | + return 0; |
| 173 | +} |
0 commit comments