Fix buffer overflow in example handling of channel list

Jan Breuer

2016-05-16 28a375d5b724021d2ca391aa708e90b2dbc0dd3b

 libscpi/test/test_parser.c

@@ -1325,6 +1325,90 @@
    TEST_Result(ArrayDoubleSWAPPED, double_arr, "#216" "\x40\x8c\x16\xd3\x66\x67\xd1\x42" "\x1c\xbc\x6e\xf2\x54\x8b\x11\x43");
}

#define _countof(a) (sizeof(a)/sizeof(*(a)))

#define TEST_ParamArrayDouble(T, func, data, mandatory, _expected_value, expected_result, expected_error_code) \
{                                                                                       \
    T value[10];                                                                        \
    scpi_bool_t result;                                                                 \
    scpi_error_t errCode;                                                               \
    T expected_value[] = {NOPAREN _expected_value};                                     \
    size_t o_count;                                                                     \
    size_t i_count = _countof(expected_value);                                          \
                                                                                        \
    SCPI_CoreCls(&scpi_context);                                                        \
    scpi_context.input_count = 0;                                                       \
    scpi_context.param_list.lex_state.buffer = data;                                    \
    scpi_context.param_list.lex_state.len = strlen(scpi_context.param_list.lex_state.buffer);\
    scpi_context.param_list.lex_state.pos = scpi_context.param_list.lex_state.buffer;   \
    result = func(&scpi_context, value, 10, &o_count, SCPI_FORMAT_ASCII, mandatory);    \
                                                                                        \
    SCPI_ErrorPop(&scpi_context, &errCode);                                             \
    CU_ASSERT_EQUAL(result, expected_result);                                           \
    if (expected_result) {                                                              \
        CU_ASSERT_EQUAL(i_count, o_count);                                              \
        size_t i;                                                                       \
        for(i = 0; i < o_count; i++) {                                                  \
            CU_ASSERT_DOUBLE_EQUAL(value[i], expected_value[i], 0.000001);              \
        }                                                                               \
    }                                                                                   \
    CU_ASSERT_EQUAL(errCode.error_code, expected_error_code);                           \
}

#define TEST_ParamArrayInt(T, func, data, mandatory, _expected_value, expected_result, expected_error_code) \
{                                                                                       \
    T value[10];                                                                        \
    scpi_bool_t result;                                                                 \
    scpi_error_t errCode;                                                               \
    T expected_value[] = {NOPAREN _expected_value};                                     \
    size_t o_count;                                                                     \
    size_t i_count = _countof(expected_value);                                          \
                                                                                        \
    SCPI_CoreCls(&scpi_context);                                                        \
    scpi_context.input_count = 0;                                                       \
    scpi_context.param_list.lex_state.buffer = data;                                    \
    scpi_context.param_list.lex_state.len = strlen(scpi_context.param_list.lex_state.buffer);\
    scpi_context.param_list.lex_state.pos = scpi_context.param_list.lex_state.buffer;   \
    result = func(&scpi_context, value, 10, &o_count, SCPI_FORMAT_ASCII, mandatory);    \
                                                                                        \
    SCPI_ErrorPop(&scpi_context, &errCode);                                             \
    CU_ASSERT_EQUAL(result, expected_result);                                           \
    if (expected_result) {                                                              \
        CU_ASSERT_EQUAL(i_count, o_count);                                              \
        size_t i;                                                                       \
        for(i = 0; i < o_count; i++) {                                                  \
            CU_ASSERT_EQUAL(value[i], expected_value[i]);                               \
        }                                                                               \
    }                                                                                   \
    CU_ASSERT_EQUAL(errCode.error_code, expected_error_code);                           \
}

static void testParamArray(void) {
    TEST_ParamArrayDouble(double, SCPI_ParamArrayDouble, "1, 2, 3", TRUE, (1, 2, 3), TRUE, SCPI_ERROR_NO_ERROR);
    TEST_ParamArrayDouble(double, SCPI_ParamArrayDouble, "", TRUE, (0), FALSE, SCPI_ERROR_MISSING_PARAMETER);
    TEST_ParamArrayDouble(double, SCPI_ParamArrayDouble, "1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11", TRUE, (1, 2, 3, 4, 5, 6, 7, 8, 9, 10), TRUE, SCPI_ERROR_NO_ERROR);

    TEST_ParamArrayDouble(float, SCPI_ParamArrayFloat, "1, 2, 3", TRUE, (1, 2, 3), TRUE, SCPI_ERROR_NO_ERROR);
    TEST_ParamArrayDouble(float, SCPI_ParamArrayFloat, "", TRUE, (0), FALSE, SCPI_ERROR_MISSING_PARAMETER);
    TEST_ParamArrayDouble(float, SCPI_ParamArrayFloat, "1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11", TRUE, (1, 2, 3, 4, 5, 6, 7, 8, 9, 10), TRUE, SCPI_ERROR_NO_ERROR);

    TEST_ParamArrayInt(int32_t, SCPI_ParamArrayInt32, "1, 2, 3", TRUE, (1, 2, 3), TRUE, SCPI_ERROR_NO_ERROR);
    TEST_ParamArrayInt(int32_t, SCPI_ParamArrayInt32, "", TRUE, (0), FALSE, SCPI_ERROR_MISSING_PARAMETER);
    TEST_ParamArrayInt(int32_t, SCPI_ParamArrayInt32, "1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11", TRUE, (1, 2, 3, 4, 5, 6, 7, 8, 9, 10), TRUE, SCPI_ERROR_NO_ERROR);

    TEST_ParamArrayInt(uint32_t, SCPI_ParamArrayUInt32, "1, 2, 3", TRUE, (1, 2, 3), TRUE, SCPI_ERROR_NO_ERROR);
    TEST_ParamArrayInt(uint32_t, SCPI_ParamArrayUInt32, "", TRUE, (0), FALSE, SCPI_ERROR_MISSING_PARAMETER);
    TEST_ParamArrayInt(uint32_t, SCPI_ParamArrayUInt32, "1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11", TRUE, (1, 2, 3, 4, 5, 6, 7, 8, 9, 10), TRUE, SCPI_ERROR_NO_ERROR);

    TEST_ParamArrayInt(int64_t, SCPI_ParamArrayInt64, "1, 2, 3", TRUE, (1, 2, 3), TRUE, SCPI_ERROR_NO_ERROR);
    TEST_ParamArrayInt(int64_t, SCPI_ParamArrayInt64, "", TRUE, (0), FALSE, SCPI_ERROR_MISSING_PARAMETER);
    TEST_ParamArrayInt(int64_t, SCPI_ParamArrayInt64, "1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11", TRUE, (1, 2, 3, 4, 5, 6, 7, 8, 9, 10), TRUE, SCPI_ERROR_NO_ERROR);

    TEST_ParamArrayInt(uint64_t, SCPI_ParamArrayUInt64, "1, 2, 3", TRUE, (1, 2, 3), TRUE, SCPI_ERROR_NO_ERROR);
    TEST_ParamArrayInt(uint64_t, SCPI_ParamArrayUInt64, "", TRUE, (0), FALSE, SCPI_ERROR_MISSING_PARAMETER);
    TEST_ParamArrayInt(uint64_t, SCPI_ParamArrayUInt64, "1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11", TRUE, (1, 2, 3, 4, 5, 6, 7, 8, 9, 10), TRUE, SCPI_ERROR_NO_ERROR);
}

static void testNumberToStr(void) {

#define TEST_SCPI_NumberToStr(_special, _value, _unit, expected_result) do {\
@@ -1340,9 +1424,62 @@
    CU_ASSERT_EQUAL(res_len, strlen(expected_result));\
} while(0)

#define TEST_SCPI_NumberToStr_limited(_special, _value, _unit, expected_result, limit) do {\
    scpi_number_t number;\
    number.base = 10;\
    number.special = (_special);\
    number.unit = (_unit);\
    if (number.special) { number.tag = (int)(_value); } else { number.value = (_value); }\
    char buffer[100];\
    memset(buffer, 0xaa, 100);\
    size_t res_len;\
    res_len = SCPI_NumberToStr(&scpi_context, scpi_special_numbers_def, &number, buffer, limit);\
    size_t expected_len = strnlen(expected_result, limit - 1);\
    CU_ASSERT_NSTRING_EQUAL(buffer, expected_result, expected_len);\
    CU_ASSERT_EQUAL(buffer[expected_len], 0);\
    CU_ASSERT_EQUAL((unsigned char)buffer[limit], 0xaa);\
    CU_ASSERT_EQUAL(res_len, expected_len);\
} while(0)

    TEST_SCPI_NumberToStr(FALSE, 10.5, SCPI_UNIT_NONE, "10.5");
    TEST_SCPI_NumberToStr(FALSE, 10.5, SCPI_UNIT_VOLT, "10.5 V");
    TEST_SCPI_NumberToStr(TRUE, SCPI_NUM_DEF, SCPI_UNIT_NONE, "DEFault");

    TEST_SCPI_NumberToStr_limited(FALSE, 10.5, SCPI_UNIT_NONE, "10.5", 1);
    TEST_SCPI_NumberToStr_limited(FALSE, 10.5, SCPI_UNIT_VOLT, "10.5 V", 1);
    TEST_SCPI_NumberToStr_limited(TRUE, SCPI_NUM_DEF, SCPI_UNIT_NONE, "DEFault", 1);

    TEST_SCPI_NumberToStr_limited(FALSE, 10.5, SCPI_UNIT_NONE, "10.5", 2);
    TEST_SCPI_NumberToStr_limited(FALSE, 10.5, SCPI_UNIT_VOLT, "10.5 V", 2);
    TEST_SCPI_NumberToStr_limited(TRUE, SCPI_NUM_DEF, SCPI_UNIT_NONE, "DEFault", 2);

    TEST_SCPI_NumberToStr_limited(FALSE, 10.5, SCPI_UNIT_NONE, "10.5", 3);
    TEST_SCPI_NumberToStr_limited(FALSE, 10.5, SCPI_UNIT_VOLT, "10.5 V", 3);
    TEST_SCPI_NumberToStr_limited(TRUE, SCPI_NUM_DEF, SCPI_UNIT_NONE, "DEFault", 3);

    TEST_SCPI_NumberToStr_limited(FALSE, 10.5, SCPI_UNIT_NONE, "10.5", 4);
    TEST_SCPI_NumberToStr_limited(FALSE, 10.5, SCPI_UNIT_VOLT, "10.5 V", 4);
    TEST_SCPI_NumberToStr_limited(TRUE, SCPI_NUM_DEF, SCPI_UNIT_NONE, "DEFault", 4);

    TEST_SCPI_NumberToStr_limited(FALSE, 10.5, SCPI_UNIT_NONE, "10.5", 5);
    TEST_SCPI_NumberToStr_limited(FALSE, 10.5, SCPI_UNIT_VOLT, "10.5 V", 5);
    TEST_SCPI_NumberToStr_limited(TRUE, SCPI_NUM_DEF, SCPI_UNIT_NONE, "DEFault", 5);

    TEST_SCPI_NumberToStr_limited(FALSE, 10.5, SCPI_UNIT_NONE, "10.5", 6);
    TEST_SCPI_NumberToStr_limited(FALSE, 10.5, SCPI_UNIT_VOLT, "10.5 V", 6);
    TEST_SCPI_NumberToStr_limited(TRUE, SCPI_NUM_DEF, SCPI_UNIT_NONE, "DEFault", 6);

    TEST_SCPI_NumberToStr_limited(FALSE, 10.5, SCPI_UNIT_NONE, "10.5", 7);
    TEST_SCPI_NumberToStr_limited(FALSE, 10.5, SCPI_UNIT_VOLT, "10.5 V", 7);
    TEST_SCPI_NumberToStr_limited(TRUE, SCPI_NUM_DEF, SCPI_UNIT_NONE, "DEFault", 7);

    TEST_SCPI_NumberToStr_limited(FALSE, 10.5, SCPI_UNIT_NONE, "10.5", 8);
    TEST_SCPI_NumberToStr_limited(FALSE, 10.5, SCPI_UNIT_VOLT, "10.5 V", 8);
    TEST_SCPI_NumberToStr_limited(TRUE, SCPI_NUM_DEF, SCPI_UNIT_NONE, "DEFault", 8);

    TEST_SCPI_NumberToStr_limited(FALSE, 10.5, SCPI_UNIT_NONE, "10.5", 9);
    TEST_SCPI_NumberToStr_limited(FALSE, 10.5, SCPI_UNIT_VOLT, "10.5 V", 9);
    TEST_SCPI_NumberToStr_limited(TRUE, SCPI_NUM_DEF, SCPI_UNIT_NONE, "DEFault", 9);
}

static void testErrorQueue(void) {
@@ -1551,6 +1688,7 @@
            || (NULL == CU_add_test(pSuite, "SCPI_ResultText", testResultText))
            || (NULL == CU_add_test(pSuite, "SCPI_ResultArbitraryBlock", testResultArbitraryBlock))
            || (NULL == CU_add_test(pSuite, "SCPI_ResultArray", testResultArray))
            || (NULL == CU_add_test(pSuite, "SCPI_ParamArray", testParamArray))
            || (NULL == CU_add_test(pSuite, "SCPI_NumberToStr", testNumberToStr))
            || (NULL == CU_add_test(pSuite, "SCPI_ErrorQueue", testErrorQueue))
            || (NULL == CU_add_test(pSuite, "Incomplete arbitrary parameter", testIncompleteArbitraryParameter))