[PATCH] resolv: Add test for gethostbyname_r unaligned buffer [BZ #18287]

[Florian Weimer]

* Adhemerval Zanella Netto:

>> +static int
>> +query_host (const char *host_name, size_t size, int align)
>> +{
>> +  struct hostent ret;
>> +  struct hostent *result;
>> +  int err;
>> +
>> +  /* Allocate memory for buffer, align and 64 bytes.  */
>> +  size_t total_alloc = size + align + 64;
>> +  unsigned char *raw_buf = malloc (total_alloc);
>> +  TEST_VERIFY_EXIT (raw_buf != NULL);
>> +
>> +  /* Fill in buffer with 0xAA to detect buffer overflow.  */
>> +  memset (raw_buf, 0, size + align);
>> +  memset (raw_buf + size + align, 0xAA, 64);
>
> Use support_next_to_fault_allocate (support/next_to_fault.h) instead of the 
> hand-rolled 0xAA guard as localedata/tst-bz12701-lc.c, resolv/tst-inet_pton.c, 
> and posix/wordexp-test.c.  Something like:
>
>   struct support_next_to_fault nf = 
>     support_next_to_fault_allocate (size + align);
>   memset (nf.buffer, 0, size + align);
>   char *ptr = nf.buffer + align;          /* ptr + size lands exactly on the fault page */
>   int res = gethostbyname_r (host_name, &ret, ptr, size, &result, &err);
>   [...]
>   support_next_to_fault_free (&nf);
>
> On a vulnerable glibc it produces a clean SIGSEGV instead of relying on the 
> corruption landing within 64 bytes.

I don't think this will work for this bug because it depends on
alignment.  We cannot produce arbitrary byte alignment for the buffer
end with <support/next_to_fault.h>.  Therefore, varying alignment would
require varying the buffer usage.  I think this would add even more
complexity to this test.

Thanks,
Florian