test: fix stack overflow reported by ASAN

It was meant to write to q instead of t
FAIL: test-id128
================

=================================================================
==125770==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7ffd4615bd31 at pc 0x7a2f41b1bf33 bp 0x7ffd4615b750 sp 0x7ffd4615b748
WRITE of size 1 at 0x7ffd4615bd31 thread T0
    #0 0x7a2f41b1bf32 in id128_to_uuid_string src/libsystemd/sd-id128/id128-util.c:42
    #1 0x401f73 in main src/test/test-id128.c:147
    #2 0x7a2f41336341 in __libc_start_main (/lib64/libc.so.6+0x20341)
    #3 0x401129 in _start (/home/crrodriguez/scm/systemd/.libs/test-id128+0x401129)

Address 0x7ffd4615bd31 is located in stack of thread T0 at offset 1409 in frame
    #0 0x401205 in main src/test/test-id128.c:37

  This frame has 23 object(s):
    [32, 40) 'b'
    [96, 112) 'id'
    [160, 176) 'id2'
    [224, 240) 'a'
    [288, 304) 'b'
    [352, 368) 'a'
    [416, 432) 'b'
    [480, 496) 'a'
    [544, 560) 'b'
    [608, 624) 'a'
    [672, 688) 'b'
    [736, 752) 'a'
    [800, 816) 'b'
    [864, 880) 'a'
    [928, 944) 'b'
    [992, 1008) 'a'
    [1056, 1072) 'b'
    [1120, 1136) 'a'
    [1184, 1200) 'b'
    [1248, 1264) 'a'
    [1312, 1328) 'b'
    [1376, 1409) 't' <== Memory access at offset 1409 overflows this variable
    [1472, 1509) 'q'
HINT: this may be a false positive if your program uses some custom stack unwind mechanism or swapcontext
      (longjmp and C++ exceptions *are* supported)
SUMMARY: AddressSanitizer: stack-buffer-overflow src/libsystemd/sd-id128/id128-util.c:42 in id128_to_uuid_string
Shadow bytes around the buggy address:
  0x100028c23750: f2 f2 00 00 f4 f4 f2 f2 f2 f2 00 00 f4 f4 f2 f2
  0x100028c23760: f2 f2 00 00 f4 f4 f2 f2 f2 f2 00 00 f4 f4 f2 f2
  0x100028c23770: f2 f2 00 00 f4 f4 f2 f2 f2 f2 00 00 f4 f4 f2 f2
  0x100028c23780: f2 f2 00 00 f4 f4 f2 f2 f2 f2 00 00 f4 f4 f2 f2
  0x100028c23790: f2 f2 00 00 f4 f4 f2 f2 f2 f2 00 00 f4 f4 f2 f2
=>0x100028c237a0: f2 f2 00 00 00 00[01]f4 f4 f4 f2 f2 f2 f2 00 00
  0x100028c237b0: 00 00 05 f4 f4 f4 00 00 00 00 00 00 00 00 00 00
  0x100028c237c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x100028c237d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x100028c237e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x100028c237f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Heap right redzone:      fb
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack partial redzone:   f4
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==125770==ABORTING
FAIL test-id128 (exit status: 1)

diff --git a/src/test/test-id128.c b/src/test/test-id128.c
index f01fbdd..1c8e554 100644 (file)
--- a/src/test/test-id128.c
+++ b/src/test/test-id128.c
@@ -144,7 +144,7 @@ int main(int argc, char *argv[]) {
         assert_se(ftruncate(fd, 0) >= 0);
 
         assert_se(sd_id128_randomize(&id) >= 0);
-        assert_se(write(fd, id128_to_uuid_string(id, t), 36) == 36);
+        assert_se(write(fd, id128_to_uuid_string(id, q), 36) == 36);
 
         assert_se(lseek(fd, 0, SEEK_SET) == 0);
         assert_se(id128_read_fd(fd, ID128_PLAIN, &id2) == -EINVAL);