1 /* 2 * Copyright (C) 2017 The Android Open Source Project 3 * All rights reserved. 4 * 5 * Redistribution and use in source and binary forms, with or without 6 * modification, are permitted provided that the following conditions 7 * are met: 8 * * Redistributions of source code must retain the above copyright 9 * notice, this list of conditions and the following disclaimer. 10 * * Redistributions in binary form must reproduce the above copyright 11 * notice, this list of conditions and the following disclaimer in 12 * the documentation and/or other materials provided with the 13 * distribution. 14 * 15 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 16 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 17 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS 18 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE 19 * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, 20 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, 21 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS 22 * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED 23 * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, 24 * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT 25 * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 26 * SUCH DAMAGE. 27 */ 28 29 #ifndef _STDIO_H_ 30 #error "Never include this file directly; instead, include <stdio.h>" 31 #endif 32 33 char* __fgets_chk(char*, int, FILE*, size_t) __INTRODUCED_IN(17); 34 size_t __fread_chk(void*, size_t, size_t, FILE*, size_t) __INTRODUCED_IN(24); 35 size_t __fwrite_chk(const void*, size_t, size_t, FILE*, size_t) __INTRODUCED_IN(24); 36 37 #if defined(__BIONIC_FORTIFY) && !defined(__BIONIC_NO_STDIO_FORTIFY) 38 39 #if __ANDROID_API__ >= __ANDROID_API_J_MR1__ 40 __BIONIC_FORTIFY_INLINE __printflike(3, 0) 41 int vsnprintf(char* const __pass_object_size dest, size_t size, const char* format, va_list ap) 42 __overloadable { 43 return __builtin___vsnprintf_chk(dest, size, 0, __bos(dest), format, ap); 44 } 45 46 __BIONIC_FORTIFY_INLINE __printflike(2, 0) 47 int vsprintf(char* const __pass_object_size dest, const char* format, va_list ap) __overloadable { 48 return __builtin___vsprintf_chk(dest, 0, __bos(dest), format, ap); 49 } 50 #endif /* __ANDROID_API__ >= __ANDROID_API_J_MR1__ */ 51 52 #if defined(__clang__) 53 #if __ANDROID_API__ >= __ANDROID_API_J_MR1__ 54 /* 55 * Simple case: `format` can't have format specifiers, so we can just compare 56 * its length to the length of `dest` 57 */ 58 __BIONIC_ERROR_FUNCTION_VISIBILITY 59 int snprintf(char* dest, size_t size, const char* format) 60 __overloadable 61 __enable_if(__bos(dest) != __BIONIC_FORTIFY_UNKNOWN_SIZE && 62 __bos(dest) < __builtin_strlen(format), 63 "format string will always overflow destination buffer") 64 __errorattr("format string will always overflow destination buffer"); 65 66 __BIONIC_FORTIFY_VARIADIC __printflike(3, 4) 67 int snprintf(char* const __pass_object_size dest, size_t size, const char* format, ...) 68 __overloadable { 69 va_list va; 70 va_start(va, format); 71 int result = __builtin___vsnprintf_chk(dest, size, 0, __bos(dest), format, va); 72 va_end(va); 73 return result; 74 } 75 76 __BIONIC_ERROR_FUNCTION_VISIBILITY 77 int sprintf(char* dest, const char* format) 78 __overloadable 79 __enable_if(__bos(dest) != __BIONIC_FORTIFY_UNKNOWN_SIZE && 80 __bos(dest) < __builtin_strlen(format), 81 "format string will always overflow destination buffer") 82 __errorattr("format string will always overflow destination buffer"); 83 84 __BIONIC_FORTIFY_VARIADIC __printflike(2, 3) 85 int sprintf(char* const __pass_object_size dest, const char* format, ...) __overloadable { 86 va_list va; 87 va_start(va, format); 88 int result = __builtin___vsprintf_chk(dest, 0, __bos(dest), format, va); 89 va_end(va); 90 return result; 91 } 92 #endif /* __ANDROID_API__ >= __ANDROID_API_J_MR1__ */ 93 94 #if __ANDROID_API__ >= __ANDROID_API_N__ 95 __BIONIC_FORTIFY_INLINE 96 size_t fread(void* const __pass_object_size0 buf, size_t size, size_t count, FILE* stream) 97 __overloadable 98 __clang_error_if(__unsafe_check_mul_overflow(size, count), 99 "in call to 'fread', size * count overflows") 100 __clang_error_if(__bos(buf) != __BIONIC_FORTIFY_UNKNOWN_SIZE && size * count > __bos(buf), 101 "in call to 'fread', size * count is too large for the given buffer") { 102 size_t bos = __bos0(buf); 103 104 if (bos == __BIONIC_FORTIFY_UNKNOWN_SIZE) { 105 return __call_bypassing_fortify(fread)(buf, size, count, stream); 106 } 107 return __fread_chk(buf, size, count, stream, bos); 108 } 109 110 __BIONIC_FORTIFY_INLINE 111 size_t fwrite(const void* const __pass_object_size0 buf, size_t size, size_t count, FILE* stream) 112 __overloadable 113 __clang_error_if(__unsafe_check_mul_overflow(size, count), 114 "in call to 'fwrite', size * count overflows") 115 __clang_error_if(__bos(buf) != __BIONIC_FORTIFY_UNKNOWN_SIZE && size * count > __bos(buf), 116 "in call to 'fwrite', size * count is too large for the given buffer") { 117 size_t bos = __bos0(buf); 118 119 if (bos == __BIONIC_FORTIFY_UNKNOWN_SIZE) { 120 return __call_bypassing_fortify(fwrite)(buf, size, count, stream); 121 } 122 123 return __fwrite_chk(buf, size, count, stream, bos); 124 } 125 #endif /* __ANDROID_API__ >= __ANDROID_API_N__ */ 126 127 #if __ANDROID_API__ >= __ANDROID_API_J_MR1__ 128 __BIONIC_FORTIFY_INLINE 129 char* fgets(char* const __pass_object_size dest, int size, FILE* stream) 130 __overloadable 131 __clang_error_if(size < 0, "in call to 'fgets', size should not be negative") 132 __clang_error_if(size > __bos(dest), 133 "in call to 'fgets', size is larger than the destination buffer") { 134 size_t bos = __bos(dest); 135 136 if (bos == __BIONIC_FORTIFY_UNKNOWN_SIZE) { 137 return __call_bypassing_fortify(fgets)(dest, size, stream); 138 } 139 140 return __fgets_chk(dest, size, stream, bos); 141 } 142 #endif /* __ANDROID_API__ >= __ANDROID_API_J_MR1__ */ 143 144 #else /* defined(__clang__) */ 145 146 size_t __fread_real(void*, size_t, size_t, FILE*) __RENAME(fread); 147 __errordecl(__fread_too_big_error, "fread called with size * count bigger than buffer"); 148 __errordecl(__fread_overflow, "fread called with overflowing size * count"); 149 150 char* __fgets_real(char*, int, FILE*) __RENAME(fgets); 151 __errordecl(__fgets_too_big_error, "fgets called with size bigger than buffer"); 152 __errordecl(__fgets_too_small_error, "fgets called with size less than zero"); 153 154 size_t __fwrite_real(const void*, size_t, size_t, FILE*) __RENAME(fwrite); 155 __errordecl(__fwrite_too_big_error, "fwrite called with size * count bigger than buffer"); 156 __errordecl(__fwrite_overflow, "fwrite called with overflowing size * count"); 157 158 159 #if __ANDROID_API__ >= __ANDROID_API_J_MR1__ 160 __BIONIC_FORTIFY_VARIADIC __printflike(3, 4) 161 int snprintf(char* dest, size_t size, const char* format, ...) { 162 return __builtin___snprintf_chk(dest, size, 0, __bos(dest), format, __builtin_va_arg_pack()); 163 } 164 165 __BIONIC_FORTIFY_VARIADIC __printflike(2, 3) 166 int sprintf(char* dest, const char* format, ...) { 167 return __builtin___sprintf_chk(dest, 0, __bos(dest), format, __builtin_va_arg_pack()); 168 } 169 #endif /* __ANDROID_API__ >= __ANDROID_API_J_MR1__ */ 170 171 #if __ANDROID_API__ >= __ANDROID_API_N__ 172 __BIONIC_FORTIFY_INLINE 173 size_t fread(void* buf, size_t size, size_t count, FILE* stream) { 174 size_t bos = __bos0(buf); 175 176 if (bos == __BIONIC_FORTIFY_UNKNOWN_SIZE) { 177 return __fread_real(buf, size, count, stream); 178 } 179 180 if (__builtin_constant_p(size) && __builtin_constant_p(count)) { 181 size_t total; 182 if (__size_mul_overflow(size, count, &total)) { 183 __fread_overflow(); 184 } 185 186 if (total > bos) { 187 __fread_too_big_error(); 188 } 189 190 return __fread_real(buf, size, count, stream); 191 } 192 193 return __fread_chk(buf, size, count, stream, bos); 194 } 195 196 __BIONIC_FORTIFY_INLINE 197 size_t fwrite(const void* buf, size_t size, size_t count, FILE* stream) { 198 size_t bos = __bos0(buf); 199 200 if (bos == __BIONIC_FORTIFY_UNKNOWN_SIZE) { 201 return __fwrite_real(buf, size, count, stream); 202 } 203 204 if (__builtin_constant_p(size) && __builtin_constant_p(count)) { 205 size_t total; 206 if (__size_mul_overflow(size, count, &total)) { 207 __fwrite_overflow(); 208 } 209 210 if (total > bos) { 211 __fwrite_too_big_error(); 212 } 213 214 return __fwrite_real(buf, size, count, stream); 215 } 216 217 return __fwrite_chk(buf, size, count, stream, bos); 218 } 219 #endif /* __ANDROID_API__ >= __ANDROID_API_N__ */ 220 221 #if __ANDROID_API__ >= __ANDROID_API_J_MR1__ 222 __BIONIC_FORTIFY_INLINE 223 char *fgets(char* dest, int size, FILE* stream) { 224 size_t bos = __bos(dest); 225 226 // Compiler can prove, at compile time, that the passed in size 227 // is always negative. Force a compiler error. 228 if (__builtin_constant_p(size) && (size < 0)) { 229 __fgets_too_small_error(); 230 } 231 232 // Compiler doesn't know destination size. Don't call __fgets_chk 233 if (bos == __BIONIC_FORTIFY_UNKNOWN_SIZE) { 234 return __fgets_real(dest, size, stream); 235 } 236 237 // Compiler can prove, at compile time, that the passed in size 238 // is always <= the actual object size. Don't call __fgets_chk 239 if (__builtin_constant_p(size) && (size <= (int) bos)) { 240 return __fgets_real(dest, size, stream); 241 } 242 243 // Compiler can prove, at compile time, that the passed in size 244 // is always > the actual object size. Force a compiler error. 245 if (__builtin_constant_p(size) && (size > (int) bos)) { 246 __fgets_too_big_error(); 247 } 248 249 return __fgets_chk(dest, size, stream, bos); 250 } 251 #endif /* __ANDROID_API__ >= __ANDROID_API_J_MR1__ */ 252 253 #endif /* defined(__clang__) */ 254 #endif /* defined(__BIONIC_FORTIFY) */ 255
