summaryrefslogtreecommitdiff
path: root/usr.bin/make
diff options
context:
space:
mode:
authorrillig <rillig@NetBSD.org>2021-12-05 15:01:04 +0000
committerrillig <rillig@NetBSD.org>2021-12-05 15:01:04 +0000
commit415154514fb2cc1a5083d76cdfa88ad4895c8cf7 (patch)
treed09c29d43c107946da65fb119fa08d128f472b16 /usr.bin/make
parent2d74688a623565272e542e3f6e60dc79d62b3a0e (diff)
tests/make: demonstrate use-after-free in modifier ':@'
Diffstat (limited to 'usr.bin/make')
-rw-r--r--usr.bin/make/unit-tests/varmod-loop-varname.exp12
-rw-r--r--usr.bin/make/unit-tests/varmod-loop-varname.mk4
-rw-r--r--usr.bin/make/unit-tests/varmod-loop.exp1
-rw-r--r--usr.bin/make/unit-tests/varmod-loop.mk33
4 files changed, 39 insertions, 11 deletions
diff --git a/usr.bin/make/unit-tests/varmod-loop-varname.exp b/usr.bin/make/unit-tests/varmod-loop-varname.exp
index 64f67bdd021..edb704864de 100644
--- a/usr.bin/make/unit-tests/varmod-loop-varname.exp
+++ b/usr.bin/make/unit-tests/varmod-loop-varname.exp
@@ -1,11 +1,11 @@
make: "varmod-loop-varname.mk" line 16: In the :@ modifier of "", the variable name "${:Ubar:S,b,v,}" must not contain a dollar.
make: "varmod-loop-varname.mk" line 16: Malformed conditional (${:Uone two three:@${:Ubar:S,b,v,}@+${var}+@} != "+one+ +two+ +three+")
-make: "varmod-loop-varname.mk" line 83: In the :@ modifier of "1 2 3", the variable name "v$" must not contain a dollar.
-make: "varmod-loop-varname.mk" line 83: Malformed conditional (${1 2 3:L:@v$@($v)@} != "(1) (2) (3)")
-make: "varmod-loop-varname.mk" line 88: In the :@ modifier of "1 2 3", the variable name "v$$" must not contain a dollar.
-make: "varmod-loop-varname.mk" line 88: Malformed conditional (${1 2 3:L:@v$$@($v)@} != "() () ()")
-make: "varmod-loop-varname.mk" line 93: In the :@ modifier of "1 2 3", the variable name "v$$$" must not contain a dollar.
-make: "varmod-loop-varname.mk" line 93: Malformed conditional (${1 2 3:L:@v$$$@($v)@} != "() () ()")
+make: "varmod-loop-varname.mk" line 85: In the :@ modifier of "1 2 3", the variable name "v$" must not contain a dollar.
+make: "varmod-loop-varname.mk" line 85: Malformed conditional (${1 2 3:L:@v$@($v)@} != "(1) (2) (3)")
+make: "varmod-loop-varname.mk" line 90: In the :@ modifier of "1 2 3", the variable name "v$$" must not contain a dollar.
+make: "varmod-loop-varname.mk" line 90: Malformed conditional (${1 2 3:L:@v$$@($v)@} != "() () ()")
+make: "varmod-loop-varname.mk" line 95: In the :@ modifier of "1 2 3", the variable name "v$$$" must not contain a dollar.
+make: "varmod-loop-varname.mk" line 95: Malformed conditional (${1 2 3:L:@v$$$@($v)@} != "() () ()")
make: Fatal errors encountered -- cannot continue
make: stopped in unit-tests
exit status 1
diff --git a/usr.bin/make/unit-tests/varmod-loop-varname.mk b/usr.bin/make/unit-tests/varmod-loop-varname.mk
index 2344996c930..91f8a487646 100644
--- a/usr.bin/make/unit-tests/varmod-loop-varname.mk
+++ b/usr.bin/make/unit-tests/varmod-loop-varname.mk
@@ -1,4 +1,4 @@
-# $NetBSD: varmod-loop-varname.mk,v 1.3 2021/11/30 23:52:19 rillig Exp $
+# $NetBSD: varmod-loop-varname.mk,v 1.4 2021/12/05 15:01:04 rillig Exp $
#
# Tests for the first part of the variable modifier ':@var@...@', which
# contains the variable name to use during the loop.
@@ -15,6 +15,8 @@
# variable name.
.if ${:Uone two three:@${:Ubar:S,b,v,}@+${var}+@} != "+one+ +two+ +three+"
. error
+.else
+. error
.endif
diff --git a/usr.bin/make/unit-tests/varmod-loop.exp b/usr.bin/make/unit-tests/varmod-loop.exp
index d05b870d5b5..bf28f2ba180 100644
--- a/usr.bin/make/unit-tests/varmod-loop.exp
+++ b/usr.bin/make/unit-tests/varmod-loop.exp
@@ -13,4 +13,5 @@ mod-loop-dollar:$3$:
mod-loop-dollar:$${word}$$:
mod-loop-dollar:$$5$$:
mod-loop-dollar:$$${word}$$$:
+: all: ' rest of the value'
exit status 0
diff --git a/usr.bin/make/unit-tests/varmod-loop.mk b/usr.bin/make/unit-tests/varmod-loop.mk
index abcb9668f55..c9a4aa9d15d 100644
--- a/usr.bin/make/unit-tests/varmod-loop.mk
+++ b/usr.bin/make/unit-tests/varmod-loop.mk
@@ -1,4 +1,4 @@
-# $NetBSD: varmod-loop.mk,v 1.16 2021/11/30 23:52:19 rillig Exp $
+# $NetBSD: varmod-loop.mk,v 1.17 2021/12/05 15:01:04 rillig Exp $
#
# Tests for the :@var@...${var}...@ variable modifier.
@@ -187,6 +187,31 @@ CMDLINE= global # needed for deleting the environment
.endif
-# TODO: Actually trigger the undefined behavior (use after free) that was
-# already suspected in Var_Parse, in the comment 'the value of the variable
-# must not change'.
+# A side effect of the modifier ':@' is that the loop variable is created as
+# an actual variable in the current evaluation scope (Command/Global/target),
+# and at the end of the loop, this variable is deleted. Before var.c 1.TODO
+# from 2021-12-05, a variable could be deleted while it was in use, leading to
+# a use-after-free bug.
+#
+# See Var_Parse, comment 'the value of the variable must not change'.
+
+# Set up the variable that deletes itself when it is evaluated.
+VAR= ${:U:@VAR@@} rest of the value
+
+# In an assignment, the scope is 'Global'. Since the variable 'VAR' is
+# defined in the global scope, it deletes itself.
+EVAL:= ${:U rest of the value} #${VAR} # FIXME: use-after-free
+.if ${EVAL} != " rest of the value"
+. error
+.endif
+
+VAR= ${:U:@VAR@@} rest of the value
+all: .PHONY
+ # In the command that is associated with a target, the scope is the
+ # one from the target. That scope only contains a few variables like
+ # '.TARGET', '.ALLSRC', '.IMPSRC'. Make does not expect that these
+ # variables get modified from the outside.
+ #
+ # There is no variable named 'VAR' in the local scope, so nothing
+ # happens.
+ : $@: '${VAR}'