From a55f15580f646252c56ea266c23ddeeb0094dad2 Mon Sep 17 00:00:00 2001 From: Gilles Peskine Date: Mon, 16 Mar 2026 15:49:48 +0100 Subject: [PATCH] Avoid a buffer overread if the child reports a wrong length The child code isn't supposed to cause memory corruption, but if it does, try to report a problem rather than mess up further. Adapt the code to report the failure to the parent accordingly. In particular, we need to make sure that the first byte written to the reporting pipe is the result code in all cases, so don't jump over the writing of the result code. Signed-off-by: Gilles Peskine --- tests/src/fork_helpers.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) diff --git a/tests/src/fork_helpers.c b/tests/src/fork_helpers.c index dc4e4fea3..4ef33bd1c 100644 --- a/tests/src/fork_helpers.c +++ b/tests/src/fork_helpers.c @@ -64,12 +64,16 @@ static void run_child( } child_callback(param, buf, size, &length); + TEST_LE_U(length, size); - char result_char = mbedtls_test_get_result(); - TEST_ASSERT(fputc(result_char, file) != EOF); - + /* Label called `exit`: this is where TEST_ASSERT() and friends jump to. */ exit: - if (mbedtls_test_get_result() == MBEDTLS_TEST_RESULT_SUCCESS) { + ; // label followed by a declaration is not portable C + char result_char = mbedtls_test_get_result(); + if (fputc(result_char, file) == EOF) { + goto write_done; + } + if (result_char == MBEDTLS_TEST_RESULT_SUCCESS) { if (fwrite(buf, length, 1, file) != 1) { goto write_done; } @@ -85,6 +89,8 @@ exit: } child_exit_code = CHILD_EXIT_CODE_OK; + /* Label for `_exit()` call: this is where we jump to if the failure + * reporting fails. */ write_done: _exit(child_exit_code); }