realpath() warnings with gcc

realpath() warnings with gcc

[Khem Raj]

Hi Siddhesh

I am seeing this warning with gcc 11.2 with latest glibc master when 
compiling inotify-tools

This seems to happen after this commit

https://sourceware.org/git/?p=glibc.git;a=commit;h=a643f60c53876be0d57b4b7373770e6cb356fd13

The source line triggering this warning is here

https://github.com/inotify-tools/inotify-tools/blob/master/src/inotifywait.c#L247

error message is below.

make[2]: Entering directory 
'/mnt/b/yoe/master/build/tmp/work/core2-64-yoe-linux/inotify-tools/3.21.9.6-r0/build/src'
x86_64-yoe-linux-gcc  -m64 -march=core2 -mtune=core2 -msse3 -mfpmath=sse 
-fstack-protector-strong  -O2 -D_FORTIFY_SOURCE=2 -Wformat 
-Wformat-security -Werror=format-security 
--sysroot=/mnt/b/yoe/master/build/tmp/work/core2-64-yoe-linux/inotify-tools/3.21.9.6-r0/recipe-sysroot 
-DHAVE_CONFIG_H -I. -I../../git/src -I.. 
-I../libinotifytools/src/inotifytools  -I../../git/libinotifytools/src 
-Wall -Wextra -Wshadow -Werror -std=c99 -I../libinotifytools/src -O2 
-pipe -g -feliminate-unused-debug-types 
-fmacro-prefix-map=/mnt/b/yoe/master/build/tmp/work/core2-64-yoe-linux/inotify-tools/3.21.9.6-r0=/usr/src/debug/inotify-tools/3.21.9.6-r0 
 
-fdebug-prefix-map=/mnt/b/yoe/master/build/tmp/work/core2-64-yoe-linux/inotify-tools/3.21.9.6-r0=/usr/src/debug/inotify-tools/3.21.9.6-r0 
 
-fdebug-prefix-map=/mnt/b/yoe/master/build/tmp/work/core2-64-yoe-linux/inotify-tools/3.21.9.6-r0/recipe-sysroot= 
 
-fdebug-prefix-map=/mnt/b/yoe/master/build/tmp/work/core2-64-yoe-linux/inotify-tools/3.21.9.6-r0/recipe-sysroot-native= 
  -c -o inotifywait.o ../../git/src/inotifywait.c
In file included from 
/mnt/b/yoe/master/build/tmp/work/core2-64-yoe-linux/inotify-tools/3.21.9.6-r0/recipe-sysroot/usr/include/stdlib.h:1027,
                  from ../../git/src/inotifywait.c:20:
In function 'realpath',
     inlined from 'main' at ../../git/src/inotifywait.c:247:13:
/mnt/b/yoe/master/build/tmp/work/core2-64-yoe-linux/inotify-tools/3.21.9.6-r0/recipe-sysroot/usr/include/bits/stdlib.h:46:12: 
error: call to '__realpath_chk_warn' declared with attribute warning: 
second argument of realpath must be either NULL or at least PATH_MAX 
bytes long buffer [-Werror=attribute-warning]
    46 |     return __realpath_chk_warn (__name, __resolved, sz);
       |            ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
cc1: all warnings being treated as errors
make[2]: *** [Makefile:463: inotifywait.o] Error 1
make[2]: Leaving directory 
'/mnt/b/yoe/master/build/tmp/work/core2-64-yoe-linux/inotify-tools/3.21.9.6-r0/build/src'


Thanks
-Khem

[PATCH] fortify: Fix spurious warning with realpath

[Siddhesh Poyarekar]

The length and object size arguments were swapped around for realpath.
Also add a smoke test so that any changes in this area get caught in
future.

Signed-off-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
---
Verified that this fixes the inotify-tools build.  It's a trivial fix,
so I'll push this if there are no objections.

 debug/Makefile           |  3 ++-
 debug/tst-realpath-chk.c | 37 +++++++++++++++++++++++++++++++++++++
 stdlib/bits/stdlib.h     |  2 +-
 3 files changed, 40 insertions(+), 2 deletions(-)
 create mode 100644 debug/tst-realpath-chk.c

diff --git a/debug/Makefile b/debug/Makefile
index 357f888246..bc37e466ee 100644
--- a/debug/Makefile
+++ b/debug/Makefile
@@ -108,6 +108,7 @@ CFLAGS-tst-longjmp_chk2.c += -fexceptions -fasynchronous-unwind-tables
 CPPFLAGS-tst-longjmp_chk2.c += -D_FORTIFY_SOURCE=1
 CFLAGS-tst-longjmp_chk3.c += -fexceptions -fasynchronous-unwind-tables
 CPPFLAGS-tst-longjmp_chk3.c += -D_FORTIFY_SOURCE=1
+CPPFLAGS-tst-realpath-chk.c += -D_FORTIFY_SOURCE=2
 
 # We know these tests have problems with format strings, this is what
 # we are testing.  Disable that warning.  They are also testing
@@ -155,7 +156,7 @@ tests = backtrace-tst tst-longjmp_chk tst-chk1 tst-chk2 tst-chk3 \
 	tst-lfschk1 tst-lfschk2 tst-lfschk3 test-strcpy_chk test-stpcpy_chk \
 	tst-chk4 tst-chk5 tst-chk6 tst-chk7 tst-chk8 tst-lfschk4 tst-lfschk5 \
 	tst-lfschk6 tst-longjmp_chk2 tst-backtrace2 tst-backtrace3 \
-	tst-backtrace4 tst-backtrace5 tst-backtrace6
+	tst-backtrace4 tst-backtrace5 tst-backtrace6 tst-realpath-chk
 
 ifeq ($(have-ssp),yes)
 tests += tst-ssp-1
diff --git a/debug/tst-realpath-chk.c b/debug/tst-realpath-chk.c
new file mode 100644
index 0000000000..103a7e9f8b
--- /dev/null
+++ b/debug/tst-realpath-chk.c
@@ -0,0 +1,37 @@
+/* Smoke test to verify that realpath does not cause spurious warnings.
+   Copyright (C) GNU Tools Authors.
+   This file is part of the GNU C Library.
+
+   The GNU C Library is free software; you can redistribute it and/or
+   modify it under the terms of the GNU Lesser General Public
+   License as published by the Free Software Foundation; either
+   version 2.1 of the License, or (at your option) any later version.
+
+   The GNU C Library is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   Lesser General Public License for more details.
+
+   You should have received a copy of the GNU Lesser General Public
+   License along with the GNU C Library; if not, see
+   <https://www.gnu.org/licenses/>.  */
+
+#include <limits.h>
+#include <stdlib.h>
+
+#include <support/check.h>
+#include <support/support.h>
+
+static int
+do_test (void)
+{
+#if PATH_MAX > 0
+  char buf[PATH_MAX + 1];
+  char *res = realpath (".", buf);
+  TEST_VERIFY (res == buf);
+#endif
+
+    return 0;
+}
+
+#include <support/test-driver.c>
diff --git a/stdlib/bits/stdlib.h b/stdlib/bits/stdlib.h
index 067115eeca..ccacbdf76a 100644
--- a/stdlib/bits/stdlib.h
+++ b/stdlib/bits/stdlib.h
@@ -42,7 +42,7 @@ __NTH (realpath (const char *__restrict __name, char *__restrict __resolved))
     return __realpath_alias (__name, __resolved);
 
 #if defined _LIBC_LIMITS_H_ && defined PATH_MAX
-  if (__glibc_unsafe_len (sz, sizeof (char), PATH_MAX))
+  if (__glibc_unsafe_len (PATH_MAX, sizeof (char), sz))
     return __realpath_chk_warn (__name, __resolved, sz);
 #endif
   return __realpath_chk (__name, __resolved, sz);
-- 
2.31.1

[PATCH v1.1] fortify: Fix spurious warning with realpath

[Siddhesh Poyarekar]

The length and object size arguments were swapped around for realpath.
Also add a smoke test so that any changes in this area get caught in
future.

Signed-off-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
---
Changes from v1:
- It's the GNU *Toolchain* Authors, not GNU Tools Authors.

 debug/Makefile           |  3 ++-
 debug/tst-realpath-chk.c | 37 +++++++++++++++++++++++++++++++++++++
 stdlib/bits/stdlib.h     |  2 +-
 3 files changed, 40 insertions(+), 2 deletions(-)
 create mode 100644 debug/tst-realpath-chk.c

diff --git a/debug/Makefile b/debug/Makefile
index 357f888246..bc37e466ee 100644
--- a/debug/Makefile
+++ b/debug/Makefile
@@ -108,6 +108,7 @@ CFLAGS-tst-longjmp_chk2.c += -fexceptions -fasynchronous-unwind-tables
 CPPFLAGS-tst-longjmp_chk2.c += -D_FORTIFY_SOURCE=1
 CFLAGS-tst-longjmp_chk3.c += -fexceptions -fasynchronous-unwind-tables
 CPPFLAGS-tst-longjmp_chk3.c += -D_FORTIFY_SOURCE=1
+CPPFLAGS-tst-realpath-chk.c += -D_FORTIFY_SOURCE=2
 
 # We know these tests have problems with format strings, this is what
 # we are testing.  Disable that warning.  They are also testing
@@ -155,7 +156,7 @@ tests = backtrace-tst tst-longjmp_chk tst-chk1 tst-chk2 tst-chk3 \
 	tst-lfschk1 tst-lfschk2 tst-lfschk3 test-strcpy_chk test-stpcpy_chk \
 	tst-chk4 tst-chk5 tst-chk6 tst-chk7 tst-chk8 tst-lfschk4 tst-lfschk5 \
 	tst-lfschk6 tst-longjmp_chk2 tst-backtrace2 tst-backtrace3 \
-	tst-backtrace4 tst-backtrace5 tst-backtrace6
+	tst-backtrace4 tst-backtrace5 tst-backtrace6 tst-realpath-chk
 
 ifeq ($(have-ssp),yes)
 tests += tst-ssp-1
diff --git a/debug/tst-realpath-chk.c b/debug/tst-realpath-chk.c
new file mode 100644
index 0000000000..291b7d6a91
--- /dev/null
+++ b/debug/tst-realpath-chk.c
@@ -0,0 +1,37 @@
+/* Smoke test to verify that realpath does not cause spurious warnings.
+   Copyright (C) GNU Toolchain Authors.
+   This file is part of the GNU C Library.
+
+   The GNU C Library is free software; you can redistribute it and/or
+   modify it under the terms of the GNU Lesser General Public
+   License as published by the Free Software Foundation; either
+   version 2.1 of the License, or (at your option) any later version.
+
+   The GNU C Library is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   Lesser General Public License for more details.
+
+   You should have received a copy of the GNU Lesser General Public
+   License along with the GNU C Library; if not, see
+   <https://www.gnu.org/licenses/>.  */
+
+#include <limits.h>
+#include <stdlib.h>
+
+#include <support/check.h>
+#include <support/support.h>
+
+static int
+do_test (void)
+{
+#if PATH_MAX > 0
+  char buf[PATH_MAX + 1];
+  char *res = realpath (".", buf);
+  TEST_VERIFY (res == buf);
+#endif
+
+    return 0;
+}
+
+#include <support/test-driver.c>
diff --git a/stdlib/bits/stdlib.h b/stdlib/bits/stdlib.h
index 067115eeca..ccacbdf76a 100644
--- a/stdlib/bits/stdlib.h
+++ b/stdlib/bits/stdlib.h
@@ -42,7 +42,7 @@ __NTH (realpath (const char *__restrict __name, char *__restrict __resolved))
     return __realpath_alias (__name, __resolved);
 
 #if defined _LIBC_LIMITS_H_ && defined PATH_MAX
-  if (__glibc_unsafe_len (sz, sizeof (char), PATH_MAX))
+  if (__glibc_unsafe_len (PATH_MAX, sizeof (char), sz))
     return __realpath_chk_warn (__name, __resolved, sz);
 #endif
   return __realpath_chk (__name, __resolved, sz);
-- 
2.31.1

[PATCH v1.2] fortify: Fix spurious warning with realpath

[Siddhesh Poyarekar]

The length and object size arguments were swapped around for realpath.
Also add a smoke test so that any changes in this area get caught in
future.

Signed-off-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
---
Changes from v1.1:
- It's *The* GNU Toolchain Authors, not GNU Toolchain Authors.

Changes from v1:
- It's the GNU *Toolchain* Authors, not GNU Tools Authors.

 debug/Makefile           |  3 ++-
 debug/tst-realpath-chk.c | 37 +++++++++++++++++++++++++++++++++++++
 stdlib/bits/stdlib.h     |  2 +-
 3 files changed, 40 insertions(+), 2 deletions(-)
 create mode 100644 debug/tst-realpath-chk.c

diff --git a/debug/Makefile b/debug/Makefile
index 357f888246..bc37e466ee 100644
--- a/debug/Makefile
+++ b/debug/Makefile
@@ -108,6 +108,7 @@ CFLAGS-tst-longjmp_chk2.c += -fexceptions -fasynchronous-unwind-tables
 CPPFLAGS-tst-longjmp_chk2.c += -D_FORTIFY_SOURCE=1
 CFLAGS-tst-longjmp_chk3.c += -fexceptions -fasynchronous-unwind-tables
 CPPFLAGS-tst-longjmp_chk3.c += -D_FORTIFY_SOURCE=1
+CPPFLAGS-tst-realpath-chk.c += -D_FORTIFY_SOURCE=2
 
 # We know these tests have problems with format strings, this is what
 # we are testing.  Disable that warning.  They are also testing
@@ -155,7 +156,7 @@ tests = backtrace-tst tst-longjmp_chk tst-chk1 tst-chk2 tst-chk3 \
 	tst-lfschk1 tst-lfschk2 tst-lfschk3 test-strcpy_chk test-stpcpy_chk \
 	tst-chk4 tst-chk5 tst-chk6 tst-chk7 tst-chk8 tst-lfschk4 tst-lfschk5 \
 	tst-lfschk6 tst-longjmp_chk2 tst-backtrace2 tst-backtrace3 \
-	tst-backtrace4 tst-backtrace5 tst-backtrace6
+	tst-backtrace4 tst-backtrace5 tst-backtrace6 tst-realpath-chk
 
 ifeq ($(have-ssp),yes)
 tests += tst-ssp-1
diff --git a/debug/tst-realpath-chk.c b/debug/tst-realpath-chk.c
new file mode 100644
index 0000000000..b10f9a11b1
--- /dev/null
+++ b/debug/tst-realpath-chk.c
@@ -0,0 +1,37 @@
+/* Smoke test to verify that realpath does not cause spurious warnings.
+   Copyright (C) The GNU Toolchain Authors.
+   This file is part of the GNU C Library.
+
+   The GNU C Library is free software; you can redistribute it and/or
+   modify it under the terms of the GNU Lesser General Public
+   License as published by the Free Software Foundation; either
+   version 2.1 of the License, or (at your option) any later version.
+
+   The GNU C Library is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   Lesser General Public License for more details.
+
+   You should have received a copy of the GNU Lesser General Public
+   License along with the GNU C Library; if not, see
+   <https://www.gnu.org/licenses/>.  */
+
+#include <limits.h>
+#include <stdlib.h>
+
+#include <support/check.h>
+#include <support/support.h>
+
+static int
+do_test (void)
+{
+#if PATH_MAX > 0
+  char buf[PATH_MAX + 1];
+  char *res = realpath (".", buf);
+  TEST_VERIFY (res == buf);
+#endif
+
+    return 0;
+}
+
+#include <support/test-driver.c>
diff --git a/stdlib/bits/stdlib.h b/stdlib/bits/stdlib.h
index 067115eeca..ccacbdf76a 100644
--- a/stdlib/bits/stdlib.h
+++ b/stdlib/bits/stdlib.h
@@ -42,7 +42,7 @@ __NTH (realpath (const char *__restrict __name, char *__restrict __resolved))
     return __realpath_alias (__name, __resolved);
 
 #if defined _LIBC_LIMITS_H_ && defined PATH_MAX
-  if (__glibc_unsafe_len (sz, sizeof (char), PATH_MAX))
+  if (__glibc_unsafe_len (PATH_MAX, sizeof (char), sz))
     return __realpath_chk_warn (__name, __resolved, sz);
 #endif
   return __realpath_chk (__name, __resolved, sz);
-- 
2.31.1

Re: [PATCH v1.2] fortify: Fix spurious warning with realpath

[Siddhesh Poyarekar]

On 12/17/21 07:26, Siddhesh Poyarekar via Libc-alpha wrote:
> The length and object size arguments were swapped around for realpath.
> Also add a smoke test so that any changes in this area get caught in
> future.
> 
> Signed-off-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
> ---
> Changes from v1.1:
> - It's *The* GNU Toolchain Authors, not GNU Toolchain Authors.
> 
> Changes from v1:
> - It's the GNU *Toolchain* Authors, not GNU Tools Authors.
> 
>   debug/Makefile           |  3 ++-
>   debug/tst-realpath-chk.c | 37 +++++++++++++++++++++++++++++++++++++
>   stdlib/bits/stdlib.h     |  2 +-
>   3 files changed, 40 insertions(+), 2 deletions(-)
>   create mode 100644 debug/tst-realpath-chk.c
> 
> diff --git a/debug/Makefile b/debug/Makefile
> index 357f888246..bc37e466ee 100644
> --- a/debug/Makefile
> +++ b/debug/Makefile
> @@ -108,6 +108,7 @@ CFLAGS-tst-longjmp_chk2.c += -fexceptions -fasynchronous-unwind-tables
>   CPPFLAGS-tst-longjmp_chk2.c += -D_FORTIFY_SOURCE=1
>   CFLAGS-tst-longjmp_chk3.c += -fexceptions -fasynchronous-unwind-tables
>   CPPFLAGS-tst-longjmp_chk3.c += -D_FORTIFY_SOURCE=1
> +CPPFLAGS-tst-realpath-chk.c += -D_FORTIFY_SOURCE=2
>   
>   # We know these tests have problems with format strings, this is what
>   # we are testing.  Disable that warning.  They are also testing
> @@ -155,7 +156,7 @@ tests = backtrace-tst tst-longjmp_chk tst-chk1 tst-chk2 tst-chk3 \
>   	tst-lfschk1 tst-lfschk2 tst-lfschk3 test-strcpy_chk test-stpcpy_chk \
>   	tst-chk4 tst-chk5 tst-chk6 tst-chk7 tst-chk8 tst-lfschk4 tst-lfschk5 \
>   	tst-lfschk6 tst-longjmp_chk2 tst-backtrace2 tst-backtrace3 \
> -	tst-backtrace4 tst-backtrace5 tst-backtrace6
> +	tst-backtrace4 tst-backtrace5 tst-backtrace6 tst-realpath-chk
>   
>   ifeq ($(have-ssp),yes)
>   tests += tst-ssp-1
> diff --git a/debug/tst-realpath-chk.c b/debug/tst-realpath-chk.c
> new file mode 100644
> index 0000000000..b10f9a11b1
> --- /dev/null
> +++ b/debug/tst-realpath-chk.c
> @@ -0,0 +1,37 @@
> +/* Smoke test to verify that realpath does not cause spurious warnings.
> +   Copyright (C) The GNU Toolchain Authors.

I need to remove (C) here to be consistent with gcc.

> +   This file is part of the GNU C Library.
> +
> +   The GNU C Library is free software; you can redistribute it and/or
> +   modify it under the terms of the GNU Lesser General Public
> +   License as published by the Free Software Foundation; either
> +   version 2.1 of the License, or (at your option) any later version.
> +
> +   The GNU C Library is distributed in the hope that it will be useful,
> +   but WITHOUT ANY WARRANTY; without even the implied warranty of
> +   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
> +   Lesser General Public License for more details.
> +
> +   You should have received a copy of the GNU Lesser General Public
> +   License along with the GNU C Library; if not, see
> +   <https://www.gnu.org/licenses/>.  */
> +
> +#include <limits.h>
> +#include <stdlib.h>
> +
> +#include <support/check.h>
> +#include <support/support.h>
> +
> +static int
> +do_test (void)
> +{
> +#if PATH_MAX > 0
> +  char buf[PATH_MAX + 1];
> +  char *res = realpath (".", buf);
> +  TEST_VERIFY (res == buf);
> +#endif
> +
> +    return 0;
> +}
> +
> +#include <support/test-driver.c>
> diff --git a/stdlib/bits/stdlib.h b/stdlib/bits/stdlib.h
> index 067115eeca..ccacbdf76a 100644
> --- a/stdlib/bits/stdlib.h
> +++ b/stdlib/bits/stdlib.h
> @@ -42,7 +42,7 @@ __NTH (realpath (const char *__restrict __name, char *__restrict __resolved))
>       return __realpath_alias (__name, __resolved);
>   
>   #if defined _LIBC_LIMITS_H_ && defined PATH_MAX
> -  if (__glibc_unsafe_len (sz, sizeof (char), PATH_MAX))
> +  if (__glibc_unsafe_len (PATH_MAX, sizeof (char), sz))
>       return __realpath_chk_warn (__name, __resolved, sz);
>   #endif
>     return __realpath_chk (__name, __resolved, sz);
> 

[PATCH v1.3] fortify: Fix spurious warning with realpath

[Siddhesh Poyarekar]

The length and object size arguments were swapped around for realpath.
Also add a smoke test so that any changes in this area get caught in
future.

Signed-off-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
---
Changes from v1.2:
- It's The GNU Toolchain Authors without the (C).

Changes from v1.1:
- It's *The* GNU Toolchain Authors, not GNU Toolchain Authors.

Changes from v1:
- It's the GNU *Toolchain* Authors, not GNU Tools Authors.

 debug/Makefile           |  3 ++-
 debug/tst-realpath-chk.c | 37 +++++++++++++++++++++++++++++++++++++
 stdlib/bits/stdlib.h     |  2 +-
 3 files changed, 40 insertions(+), 2 deletions(-)
 create mode 100644 debug/tst-realpath-chk.c

diff --git a/debug/Makefile b/debug/Makefile
index 357f888246..bc37e466ee 100644
--- a/debug/Makefile
+++ b/debug/Makefile
@@ -108,6 +108,7 @@ CFLAGS-tst-longjmp_chk2.c += -fexceptions -fasynchronous-unwind-tables
 CPPFLAGS-tst-longjmp_chk2.c += -D_FORTIFY_SOURCE=1
 CFLAGS-tst-longjmp_chk3.c += -fexceptions -fasynchronous-unwind-tables
 CPPFLAGS-tst-longjmp_chk3.c += -D_FORTIFY_SOURCE=1
+CPPFLAGS-tst-realpath-chk.c += -D_FORTIFY_SOURCE=2
 
 # We know these tests have problems with format strings, this is what
 # we are testing.  Disable that warning.  They are also testing
@@ -155,7 +156,7 @@ tests = backtrace-tst tst-longjmp_chk tst-chk1 tst-chk2 tst-chk3 \
 	tst-lfschk1 tst-lfschk2 tst-lfschk3 test-strcpy_chk test-stpcpy_chk \
 	tst-chk4 tst-chk5 tst-chk6 tst-chk7 tst-chk8 tst-lfschk4 tst-lfschk5 \
 	tst-lfschk6 tst-longjmp_chk2 tst-backtrace2 tst-backtrace3 \
-	tst-backtrace4 tst-backtrace5 tst-backtrace6
+	tst-backtrace4 tst-backtrace5 tst-backtrace6 tst-realpath-chk
 
 ifeq ($(have-ssp),yes)
 tests += tst-ssp-1
diff --git a/debug/tst-realpath-chk.c b/debug/tst-realpath-chk.c
new file mode 100644
index 0000000000..a7ac8b3a06
--- /dev/null
+++ b/debug/tst-realpath-chk.c
@@ -0,0 +1,37 @@
+/* Smoke test to verify that realpath does not cause spurious warnings.
+   Copyright The GNU Toolchain Authors.
+   This file is part of the GNU C Library.
+
+   The GNU C Library is free software; you can redistribute it and/or
+   modify it under the terms of the GNU Lesser General Public
+   License as published by the Free Software Foundation; either
+   version 2.1 of the License, or (at your option) any later version.
+
+   The GNU C Library is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   Lesser General Public License for more details.
+
+   You should have received a copy of the GNU Lesser General Public
+   License along with the GNU C Library; if not, see
+   <https://www.gnu.org/licenses/>.  */
+
+#include <limits.h>
+#include <stdlib.h>
+
+#include <support/check.h>
+#include <support/support.h>
+
+static int
+do_test (void)
+{
+#if PATH_MAX > 0
+  char buf[PATH_MAX + 1];
+  char *res = realpath (".", buf);
+  TEST_VERIFY (res == buf);
+#endif
+
+    return 0;
+}
+
+#include <support/test-driver.c>
diff --git a/stdlib/bits/stdlib.h b/stdlib/bits/stdlib.h
index 067115eeca..ccacbdf76a 100644
--- a/stdlib/bits/stdlib.h
+++ b/stdlib/bits/stdlib.h
@@ -42,7 +42,7 @@ __NTH (realpath (const char *__restrict __name, char *__restrict __resolved))
     return __realpath_alias (__name, __resolved);
 
 #if defined _LIBC_LIMITS_H_ && defined PATH_MAX
-  if (__glibc_unsafe_len (sz, sizeof (char), PATH_MAX))
+  if (__glibc_unsafe_len (PATH_MAX, sizeof (char), sz))
     return __realpath_chk_warn (__name, __resolved, sz);
 #endif
   return __realpath_chk (__name, __resolved, sz);
-- 
2.31.1

Re: [PATCH v1.3] fortify: Fix spurious warning with realpath

[Adhemerval Zanella]

On 16/12/2021 23:05, Siddhesh Poyarekar wrote:
> The length and object size arguments were swapped around for realpath.
> Also add a smoke test so that any changes in this area get caught in
> future.
> 
> Signed-off-by: Siddhesh Poyarekar <siddhesh@sourceware.org>

LGTM with the two small fixes below.

Reviewed-by: Adhemerval Zanella  <adhemerval.zanella@linaro.org>

> ---
> Changes from v1.2:
> - It's The GNU Toolchain Authors without the (C).
> 
> Changes from v1.1:
> - It's *The* GNU Toolchain Authors, not GNU Toolchain Authors.
> 
> Changes from v1:
> - It's the GNU *Toolchain* Authors, not GNU Tools Authors.
> 
>  debug/Makefile           |  3 ++-
>  debug/tst-realpath-chk.c | 37 +++++++++++++++++++++++++++++++++++++
>  stdlib/bits/stdlib.h     |  2 +-
>  3 files changed, 40 insertions(+), 2 deletions(-)
>  create mode 100644 debug/tst-realpath-chk.c
> 
> diff --git a/debug/Makefile b/debug/Makefile
> index 357f888246..bc37e466ee 100644
> --- a/debug/Makefile
> +++ b/debug/Makefile
> @@ -108,6 +108,7 @@ CFLAGS-tst-longjmp_chk2.c += -fexceptions -fasynchronous-unwind-tables
>  CPPFLAGS-tst-longjmp_chk2.c += -D_FORTIFY_SOURCE=1
>  CFLAGS-tst-longjmp_chk3.c += -fexceptions -fasynchronous-unwind-tables
>  CPPFLAGS-tst-longjmp_chk3.c += -D_FORTIFY_SOURCE=1
> +CPPFLAGS-tst-realpath-chk.c += -D_FORTIFY_SOURCE=2
>  
>  # We know these tests have problems with format strings, this is what
>  # we are testing.  Disable that warning.  They are also testing
> @@ -155,7 +156,7 @@ tests = backtrace-tst tst-longjmp_chk tst-chk1 tst-chk2 tst-chk3 \
>  	tst-lfschk1 tst-lfschk2 tst-lfschk3 test-strcpy_chk test-stpcpy_chk \
>  	tst-chk4 tst-chk5 tst-chk6 tst-chk7 tst-chk8 tst-lfschk4 tst-lfschk5 \
>  	tst-lfschk6 tst-longjmp_chk2 tst-backtrace2 tst-backtrace3 \
> -	tst-backtrace4 tst-backtrace5 tst-backtrace6
> +	tst-backtrace4 tst-backtrace5 tst-backtrace6 tst-realpath-chk
>  
>  ifeq ($(have-ssp),yes)
>  tests += tst-ssp-1

Ok.

> diff --git a/debug/tst-realpath-chk.c b/debug/tst-realpath-chk.c
> new file mode 100644
> index 0000000000..a7ac8b3a06
> --- /dev/null
> +++ b/debug/tst-realpath-chk.c
> @@ -0,0 +1,37 @@
> +/* Smoke test to verify that realpath does not cause spurious warnings.
> +   Copyright The GNU Toolchain Authors.
> +   This file is part of the GNU C Library.
> +
> +   The GNU C Library is free software; you can redistribute it and/or
> +   modify it under the terms of the GNU Lesser General Public
> +   License as published by the Free Software Foundation; either
> +   version 2.1 of the License, or (at your option) any later version.
> +
> +   The GNU C Library is distributed in the hope that it will be useful,
> +   but WITHOUT ANY WARRANTY; without even the implied warranty of
> +   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
> +   Lesser General Public License for more details.
> +
> +   You should have received a copy of the GNU Lesser General Public
> +   License along with the GNU C Library; if not, see
> +   <https://www.gnu.org/licenses/>.  */
> +
> +#include <limits.h>
> +#include <stdlib.h>
> +
> +#include <support/check.h>
> +#include <support/support.h>
> +
> +static int
> +do_test (void)
> +{
> +#if PATH_MAX > 0

It fails to build on Hurd, use #ifdef.

> +  char buf[PATH_MAX + 1];
> +  char *res = realpath (".", buf);
> +  TEST_VERIFY (res == buf);
> +#endif
> +
> +    return 0;

Indentation seems off here.

> +}
> +
> +#include <support/test-driver.c>

Ok.

> diff --git a/stdlib/bits/stdlib.h b/stdlib/bits/stdlib.h
> index 067115eeca..ccacbdf76a 100644
> --- a/stdlib/bits/stdlib.h
> +++ b/stdlib/bits/stdlib.h
> @@ -42,7 +42,7 @@ __NTH (realpath (const char *__restrict __name, char *__restrict __resolved))
>      return __realpath_alias (__name, __resolved);
>  
>  #if defined _LIBC_LIMITS_H_ && defined PATH_MAX
> -  if (__glibc_unsafe_len (sz, sizeof (char), PATH_MAX))
> +  if (__glibc_unsafe_len (PATH_MAX, sizeof (char), sz))
>      return __realpath_chk_warn (__name, __resolved, sz);
>  #endif
>    return __realpath_chk (__name, __resolved, sz);

Ok.

[committed] fortify: Fix spurious warning with realpath

[Siddhesh Poyarekar]

The length and object size arguments were swapped around for realpath.
Also add a smoke test so that any changes in this area get caught in
future.

Signed-off-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
---
 debug/Makefile           |  3 ++-
 debug/tst-realpath-chk.c | 37 +++++++++++++++++++++++++++++++++++++
 stdlib/bits/stdlib.h     |  2 +-
 3 files changed, 40 insertions(+), 2 deletions(-)
 create mode 100644 debug/tst-realpath-chk.c

diff --git a/debug/Makefile b/debug/Makefile
index 357f888246..bc37e466ee 100644
--- a/debug/Makefile
+++ b/debug/Makefile
@@ -108,6 +108,7 @@ CFLAGS-tst-longjmp_chk2.c += -fexceptions -fasynchronous-unwind-tables
 CPPFLAGS-tst-longjmp_chk2.c += -D_FORTIFY_SOURCE=1
 CFLAGS-tst-longjmp_chk3.c += -fexceptions -fasynchronous-unwind-tables
 CPPFLAGS-tst-longjmp_chk3.c += -D_FORTIFY_SOURCE=1
+CPPFLAGS-tst-realpath-chk.c += -D_FORTIFY_SOURCE=2
 
 # We know these tests have problems with format strings, this is what
 # we are testing.  Disable that warning.  They are also testing
@@ -155,7 +156,7 @@ tests = backtrace-tst tst-longjmp_chk tst-chk1 tst-chk2 tst-chk3 \
 	tst-lfschk1 tst-lfschk2 tst-lfschk3 test-strcpy_chk test-stpcpy_chk \
 	tst-chk4 tst-chk5 tst-chk6 tst-chk7 tst-chk8 tst-lfschk4 tst-lfschk5 \
 	tst-lfschk6 tst-longjmp_chk2 tst-backtrace2 tst-backtrace3 \
-	tst-backtrace4 tst-backtrace5 tst-backtrace6
+	tst-backtrace4 tst-backtrace5 tst-backtrace6 tst-realpath-chk
 
 ifeq ($(have-ssp),yes)
 tests += tst-ssp-1
diff --git a/debug/tst-realpath-chk.c b/debug/tst-realpath-chk.c
new file mode 100644
index 0000000000..a8fcb327c4
--- /dev/null
+++ b/debug/tst-realpath-chk.c
@@ -0,0 +1,37 @@
+/* Smoke test to verify that realpath does not cause spurious warnings.
+   Copyright The GNU Toolchain Authors.
+   This file is part of the GNU C Library.
+
+   The GNU C Library is free software; you can redistribute it and/or
+   modify it under the terms of the GNU Lesser General Public
+   License as published by the Free Software Foundation; either
+   version 2.1 of the License, or (at your option) any later version.
+
+   The GNU C Library is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   Lesser General Public License for more details.
+
+   You should have received a copy of the GNU Lesser General Public
+   License along with the GNU C Library; if not, see
+   <https://www.gnu.org/licenses/>.  */
+
+#include <limits.h>
+#include <stdlib.h>
+
+#include <support/check.h>
+#include <support/support.h>
+
+static int
+do_test (void)
+{
+#ifdef PATH_MAX
+  char buf[PATH_MAX + 1];
+  char *res = realpath (".", buf);
+  TEST_VERIFY (res == buf);
+#endif
+
+  return 0;
+}
+
+#include <support/test-driver.c>
diff --git a/stdlib/bits/stdlib.h b/stdlib/bits/stdlib.h
index 067115eeca..ccacbdf76a 100644
--- a/stdlib/bits/stdlib.h
+++ b/stdlib/bits/stdlib.h
@@ -42,7 +42,7 @@ __NTH (realpath (const char *__restrict __name, char *__restrict __resolved))
     return __realpath_alias (__name, __resolved);
 
 #if defined _LIBC_LIMITS_H_ && defined PATH_MAX
-  if (__glibc_unsafe_len (sz, sizeof (char), PATH_MAX))
+  if (__glibc_unsafe_len (PATH_MAX, sizeof (char), sz))
     return __realpath_chk_warn (__name, __resolved, sz);
 #endif
   return __realpath_chk (__name, __resolved, sz);
-- 
2.31.1

Re: [committed] fortify: Fix spurious warning with realpath

[Khem Raj]

Thank Siddhesh,

This seems to fix the issue I reported.

On Fri, Dec 17, 2021 at 5:58 AM Siddhesh Poyarekar via Libc-alpha
<libc-alpha@sourceware.org> wrote:
>
> The length and object size arguments were swapped around for realpath.
> Also add a smoke test so that any changes in this area get caught in
> future.
>
> Signed-off-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
> Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
> ---
>  debug/Makefile           |  3 ++-
>  debug/tst-realpath-chk.c | 37 +++++++++++++++++++++++++++++++++++++
>  stdlib/bits/stdlib.h     |  2 +-
>  3 files changed, 40 insertions(+), 2 deletions(-)
>  create mode 100644 debug/tst-realpath-chk.c
>
> diff --git a/debug/Makefile b/debug/Makefile
> index 357f888246..bc37e466ee 100644
> --- a/debug/Makefile
> +++ b/debug/Makefile
> @@ -108,6 +108,7 @@ CFLAGS-tst-longjmp_chk2.c += -fexceptions -fasynchronous-unwind-tables
>  CPPFLAGS-tst-longjmp_chk2.c += -D_FORTIFY_SOURCE=1
>  CFLAGS-tst-longjmp_chk3.c += -fexceptions -fasynchronous-unwind-tables
>  CPPFLAGS-tst-longjmp_chk3.c += -D_FORTIFY_SOURCE=1
> +CPPFLAGS-tst-realpath-chk.c += -D_FORTIFY_SOURCE=2
>
>  # We know these tests have problems with format strings, this is what
>  # we are testing.  Disable that warning.  They are also testing
> @@ -155,7 +156,7 @@ tests = backtrace-tst tst-longjmp_chk tst-chk1 tst-chk2 tst-chk3 \
>         tst-lfschk1 tst-lfschk2 tst-lfschk3 test-strcpy_chk test-stpcpy_chk \
>         tst-chk4 tst-chk5 tst-chk6 tst-chk7 tst-chk8 tst-lfschk4 tst-lfschk5 \
>         tst-lfschk6 tst-longjmp_chk2 tst-backtrace2 tst-backtrace3 \
> -       tst-backtrace4 tst-backtrace5 tst-backtrace6
> +       tst-backtrace4 tst-backtrace5 tst-backtrace6 tst-realpath-chk
>
>  ifeq ($(have-ssp),yes)
>  tests += tst-ssp-1
> diff --git a/debug/tst-realpath-chk.c b/debug/tst-realpath-chk.c
> new file mode 100644
> index 0000000000..a8fcb327c4
> --- /dev/null
> +++ b/debug/tst-realpath-chk.c
> @@ -0,0 +1,37 @@
> +/* Smoke test to verify that realpath does not cause spurious warnings.
> +   Copyright The GNU Toolchain Authors.
> +   This file is part of the GNU C Library.
> +
> +   The GNU C Library is free software; you can redistribute it and/or
> +   modify it under the terms of the GNU Lesser General Public
> +   License as published by the Free Software Foundation; either
> +   version 2.1 of the License, or (at your option) any later version.
> +
> +   The GNU C Library is distributed in the hope that it will be useful,
> +   but WITHOUT ANY WARRANTY; without even the implied warranty of
> +   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
> +   Lesser General Public License for more details.
> +
> +   You should have received a copy of the GNU Lesser General Public
> +   License along with the GNU C Library; if not, see
> +   <https://www.gnu.org/licenses/>.  */
> +
> +#include <limits.h>
> +#include <stdlib.h>
> +
> +#include <support/check.h>
> +#include <support/support.h>
> +
> +static int
> +do_test (void)
> +{
> +#ifdef PATH_MAX
> +  char buf[PATH_MAX + 1];
> +  char *res = realpath (".", buf);
> +  TEST_VERIFY (res == buf);
> +#endif
> +
> +  return 0;
> +}
> +
> +#include <support/test-driver.c>
> diff --git a/stdlib/bits/stdlib.h b/stdlib/bits/stdlib.h
> index 067115eeca..ccacbdf76a 100644
> --- a/stdlib/bits/stdlib.h
> +++ b/stdlib/bits/stdlib.h
> @@ -42,7 +42,7 @@ __NTH (realpath (const char *__restrict __name, char *__restrict __resolved))
>      return __realpath_alias (__name, __resolved);
>
>  #if defined _LIBC_LIMITS_H_ && defined PATH_MAX
> -  if (__glibc_unsafe_len (sz, sizeof (char), PATH_MAX))
> +  if (__glibc_unsafe_len (PATH_MAX, sizeof (char), sz))
>      return __realpath_chk_warn (__name, __resolved, sz);
>  #endif
>    return __realpath_chk (__name, __resolved, sz);
> --
> 2.31.1
>