* [LTP] [PATCH 0/3] Fix to float_trigo core dump and related enhancements @ 2026-07-15 13:04 ` Tomas Dzik via ltp 0 siblings, 0 replies; 11+ messages in thread From: Tomas Dzik via ltp @ 2026-07-15 9:45 UTC (permalink / raw) To: ltp Hi all, following 3 patches fix a core dump we observed during testing. Because failed malloc() was contributing factor to it I added also some checks to malloc() return value. And since I was editing these files I spotted that they use sprintf() and I replaced it with snprintf() which is IMHO safer and can make debugging test failures easier. I would be grateful for review. Best regards, Tomas D. Tomas Dzik (3): LTP/Lite test float_trigo core dumps due to free(): invalid pointer Add some checks for malloc() returning NULL Replace sprintf() with more secure snprintf() variant in float tests testcases/misc/math/float/bessel/genbessel.c | 10 +++--- .../misc/math/float/exp_log/genexp_log.c | 24 +++++++++---- testcases/misc/math/float/iperb/geniperb.c | 11 ++++-- testcases/misc/math/float/main.c | 18 +++++++--- testcases/misc/math/float/power/genpower.c | 21 ++++++++---- testcases/misc/math/float/thread_code.c | 34 +++++++++++++------ testcases/misc/math/float/trigo/gentrigo.c | 24 +++++++++---- 7 files changed, 99 insertions(+), 43 deletions(-) -- 2.55.0 -- Mailing list info: https://lists.linux.it/listinfo/ltp ^ permalink raw reply [flat|nested] 11+ messages in thread
* [LTP] [PATCH 0/3] Fix to float_trigo core dump and related enhancements @ 2026-07-15 13:04 ` Tomas Dzik via ltp 0 siblings, 0 replies; 11+ messages in thread From: Tomas Dzik via ltp @ 2026-07-15 13:04 UTC (permalink / raw) To: ltp Hi all, following 3 patches fix a core dump we observed during testing. Because failed malloc() was contributing factor to it I added also some checks to malloc() return value. And since I was editing these files I spotted that they use sprintf() and I replaced it with snprintf() which is IMHO safer and can make debugging test failures easier. I would be grateful for review. Best regards, Tomas D. Tomas Dzik (3): LTP/Lite test float_trigo core dumps due to free(): invalid pointer Add some checks for malloc() returning NULL Replace sprintf() with more secure snprintf() variant in float tests testcases/misc/math/float/bessel/genbessel.c | 10 +++--- .../misc/math/float/exp_log/genexp_log.c | 24 +++++++++---- testcases/misc/math/float/iperb/geniperb.c | 11 ++++-- testcases/misc/math/float/main.c | 18 +++++++--- testcases/misc/math/float/power/genpower.c | 21 ++++++++---- testcases/misc/math/float/thread_code.c | 34 +++++++++++++------ testcases/misc/math/float/trigo/gentrigo.c | 24 +++++++++---- 7 files changed, 99 insertions(+), 43 deletions(-) -- 2.55.0 -- Mailing list info: https://lists.linux.it/listinfo/ltp ^ permalink raw reply [flat|nested] 11+ messages in thread
* [LTP] [PATCH 1/3] LTP/Lite test float_trigo core dumps due to free(): invalid pointer 2026-07-15 13:04 ` Tomas Dzik via ltp (?) @ 2026-07-15 9:45 ` Tomas Dzik via ltp 2026-07-15 10:55 ` [LTP] " linuxtestproject.agent -1 siblings, 1 reply; 11+ messages in thread From: Tomas Dzik via ltp @ 2026-07-15 9:45 UTC (permalink / raw) To: ltp Function read_file() does not initialize *data on failure paths (for example if malloc() fails) and caller ens up calling SAFE_FREE() on an uninitialized pointer. Here is the log from failed run: ~==== float_trigo ==== command: float_trigo -v float_trigo 0 TINFO : Using /tmp/LTP_floJSug25 as tmpdir (xfs filesystem) float_trigo 1 TPASS : Test passed float_trigo 0 TINFO : float_trigo: will run for 500 loops; using . as a data directory float_trigo 0 TINFO : float_trigo: will run 7 functions, 20 threads per function float_trigo 0 TINFO : signal handler 140451533870784 started float_trigo 0 TINFO : Signal handler starts waiting... free(): invalid pointer Duration: 0.926 This fix initializes pointers where we actually core dumped (*din, *dex). Signed-off-by: Tomas Dzik <tdzik@redhat.com> --- testcases/misc/math/float/thread_code.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/testcases/misc/math/float/thread_code.c b/testcases/misc/math/float/thread_code.c index ca18cef1e..34a9578d4 100644 --- a/testcases/misc/math/float/thread_code.c +++ b/testcases/misc/math/float/thread_code.c @@ -278,7 +278,13 @@ void *thread_code(void *arg) { TH_DATA *th_data = (TH_DATA *) arg; size_t fsize, fsize2, fsize3; - double *din, *dex, *dex2 = NULL; + /* + * If read_file() fails for whatever reason, these pointers might + * stay uninitialized. Initialize them to NULL, because SAFE_FREE() + * can handle it. + */ + + double *din = NULL, *dex = NULL, *dex2 = NULL; int imax, index; fsize = read_file(th_data->th_func.din_fname, (void **)&din); -- 2.55.0 -- Mailing list info: https://lists.linux.it/listinfo/ltp ^ permalink raw reply related [flat|nested] 11+ messages in thread
* Re: [LTP] LTP/Lite test float_trigo core dumps due to free(): invalid pointer 2026-07-15 9:45 ` [LTP] [PATCH 1/3] LTP/Lite test float_trigo core dumps due to free(): invalid pointer Tomas Dzik via ltp @ 2026-07-15 10:55 ` linuxtestproject.agent 0 siblings, 0 replies; 11+ messages in thread From: linuxtestproject.agent @ 2026-07-15 10:55 UTC (permalink / raw) To: Tomas Dzik; +Cc: ltp Hi Tomas, On Wed, 15 Jul 2026, Tomas Dzik wrote: > LTP/Lite test float_trigo core dumps due to free(): invalid pointer --- [PATCH 1/3] --- > Function read_file() does not initialize *data on failure paths > (for example if malloc() fails) and caller ens up calling SAFE_FREE() > on an uninitialized pointer. Typo: "caller ens up" should be "caller ends up". > + /* > + * If read_file() fails for whatever reason, these pointers might > + * stay uninitialized. Initialize them to NULL, because SAFE_FREE() > + * can handle it. > + */ > + > + double *din = NULL, *dex = NULL, *dex2 = NULL; There is a blank line between the comment and the declaration it describes. A block comment that annotates the immediately following statement should have no empty line between them. --- [PATCH 2/3] --- > Because it was contributing factor to observed core dump I am adding > these checks to make debugging failures easier. Grammar: "it was contributing factor" should be "it was a contributing factor". Verdict - Needs revision --- Note: The agent can sometimes produce false positives although often its findings are genuine. If you find issues with the review, please comment this email or ignore the suggestions. Regards, LTP AI Reviewer -- Mailing list info: https://lists.linux.it/listinfo/ltp ^ permalink raw reply [flat|nested] 11+ messages in thread
* [LTP] [PATCH 2/3] Add some checks for malloc() returning NULL 2026-07-15 13:04 ` Tomas Dzik via ltp (?) (?) @ 2026-07-15 9:45 ` Tomas Dzik via ltp -1 siblings, 0 replies; 11+ messages in thread From: Tomas Dzik via ltp @ 2026-07-15 9:45 UTC (permalink / raw) To: ltp Current code in directory testcases/misc/math/float/ does not check if malloc() returns NULL. Because it was contributing factor to observed core dump I am adding these checks to make debugging failures easier. Signed-off-by: Tomas Dzik <tdzik@redhat.com> --- testcases/misc/math/float/exp_log/genexp_log.c | 3 +++ testcases/misc/math/float/iperb/geniperb.c | 2 ++ testcases/misc/math/float/power/genpower.c | 3 +++ testcases/misc/math/float/trigo/gentrigo.c | 3 +++ 4 files changed, 11 insertions(+) diff --git a/testcases/misc/math/float/exp_log/genexp_log.c b/testcases/misc/math/float/exp_log/genexp_log.c index 7f26945ec..e02d0d344 100644 --- a/testcases/misc/math/float/exp_log/genexp_log.c +++ b/testcases/misc/math/float/exp_log/genexp_log.c @@ -30,6 +30,7 @@ #include <stdlib.h> #include <string.h> #include <errno.h> +#include <err.h> #include <limits.h> #include <unistd.h> #include <fcntl.h> @@ -76,6 +77,8 @@ int main(int argc, char *argv[]) bin_path = argv[1]; funct = malloc(strlen(bin_path) + MAX_FNAME_LEN); + if (funct == NULL) + err(1, "malloc failed"); sprintf(funct, "%s/genexp", bin_path); child = create_file(funct, 0); waitpid(child, NULL, 0); diff --git a/testcases/misc/math/float/iperb/geniperb.c b/testcases/misc/math/float/iperb/geniperb.c index f7bf55c84..98a6a380a 100644 --- a/testcases/misc/math/float/iperb/geniperb.c +++ b/testcases/misc/math/float/iperb/geniperb.c @@ -78,6 +78,8 @@ int main(int argc, char *argv[]) bin_path = argv[1]; funct = malloc(strlen(bin_path) + MAX_FNAME_LEN); + if (funct == NULL) + err(1, "malloc failed"); sprintf(funct, "%s/gencosh", bin_path); child = create_file(funct, 0); waitpid(child, NULL, 0); diff --git a/testcases/misc/math/float/power/genpower.c b/testcases/misc/math/float/power/genpower.c index 44f7af934..8a8f753a7 100644 --- a/testcases/misc/math/float/power/genpower.c +++ b/testcases/misc/math/float/power/genpower.c @@ -34,6 +34,7 @@ #include <unistd.h> #include <fcntl.h> #include <errno.h> +#include <err.h> #include <sys/signal.h> #include <math.h> @@ -76,6 +77,8 @@ int main(int argc, char *argv[]) bin_path = argv[1]; funct = malloc(strlen(bin_path) + MAX_FNAME_LEN); + if (funct == NULL) + err(1, "malloc failed"); sprintf(funct, "%s/genceil", bin_path); child = create_file(funct, 0); waitpid(child, NULL, 0); diff --git a/testcases/misc/math/float/trigo/gentrigo.c b/testcases/misc/math/float/trigo/gentrigo.c index 5f7e0cbc7..4908d0435 100644 --- a/testcases/misc/math/float/trigo/gentrigo.c +++ b/testcases/misc/math/float/trigo/gentrigo.c @@ -34,6 +34,7 @@ #include <unistd.h> #include <fcntl.h> #include <errno.h> +#include <err.h> #include <sys/signal.h> #include <math.h> @@ -77,6 +78,8 @@ int main(int argc, char *argv[]) bin_path = argv[1]; funct = malloc(strlen(bin_path) + MAX_FNAME_LEN); + if (funct == NULL) + err(1, "malloc failed"); sprintf(funct, "%s/gencos", bin_path); child = create_file(funct, 0); waitpid(child, NULL, 0); -- 2.55.0 -- Mailing list info: https://lists.linux.it/listinfo/ltp ^ permalink raw reply related [flat|nested] 11+ messages in thread
* [LTP] [PATCH 3/3] Replace sprintf() with more secure snprintf() variant in float tests 2026-07-15 13:04 ` Tomas Dzik via ltp ` (2 preceding siblings ...) (?) @ 2026-07-15 9:45 ` Tomas Dzik via ltp -1 siblings, 0 replies; 11+ messages in thread From: Tomas Dzik via ltp @ 2026-07-15 9:45 UTC (permalink / raw) To: ltp There are tests in testcases/misc/math/float/ which use sprintf(). It is safer to use snprintf(). Signed-off-by: Tomas Dzik <tdzik@redhat.com> --- testcases/misc/math/float/bessel/genbessel.c | 10 +++---- .../misc/math/float/exp_log/genexp_log.c | 21 ++++++++++----- testcases/misc/math/float/iperb/geniperb.c | 9 ++++--- testcases/misc/math/float/main.c | 18 +++++++++---- testcases/misc/math/float/power/genpower.c | 18 ++++++++----- testcases/misc/math/float/thread_code.c | 26 ++++++++++++------- testcases/misc/math/float/trigo/gentrigo.c | 21 ++++++++++----- 7 files changed, 81 insertions(+), 42 deletions(-) diff --git a/testcases/misc/math/float/bessel/genbessel.c b/testcases/misc/math/float/bessel/genbessel.c index 91ea3b6da..644aa7e3d 100644 --- a/testcases/misc/math/float/bessel/genbessel.c +++ b/testcases/misc/math/float/bessel/genbessel.c @@ -79,23 +79,23 @@ int main(int argc, char *argv[]) funct = malloc(strlen(bin_path) + MAX_FNAME_LEN); if (funct == NULL) err(1, "malloc failed"); - sprintf(funct, "%s/genj0", bin_path); + snprintf(funct, strlen(bin_path) + MAX_FNAME_LEN, "%s/genj0", bin_path); child = create_file(funct, 0); waitpid(child, NULL, 0); - sprintf(funct, "%s/genj1", bin_path); + snprintf(funct, strlen(bin_path) + MAX_FNAME_LEN, "%s/genj1", bin_path); child = create_file(funct, 0); waitpid(child, NULL, 0); - sprintf(funct, "%s/geny0", bin_path); + snprintf(funct, strlen(bin_path) + MAX_FNAME_LEN, "%s/geny0", bin_path); child = create_file(funct, 0); waitpid(child, NULL, 0); - sprintf(funct, "%s/geny1", bin_path); + snprintf(funct, strlen(bin_path) + MAX_FNAME_LEN, "%s/geny1", bin_path); child = create_file(funct, 0); waitpid(child, NULL, 0); - sprintf(funct, "%s/genlgamma", bin_path); + snprintf(funct, strlen(bin_path) + MAX_FNAME_LEN, "%s/genlgamma", bin_path); child = create_file(funct, 0); waitpid(child, NULL, 0); diff --git a/testcases/misc/math/float/exp_log/genexp_log.c b/testcases/misc/math/float/exp_log/genexp_log.c index e02d0d344..0411aa8bf 100644 --- a/testcases/misc/math/float/exp_log/genexp_log.c +++ b/testcases/misc/math/float/exp_log/genexp_log.c @@ -79,31 +79,38 @@ int main(int argc, char *argv[]) funct = malloc(strlen(bin_path) + MAX_FNAME_LEN); if (funct == NULL) err(1, "malloc failed"); - sprintf(funct, "%s/genexp", bin_path); + snprintf(funct, strlen(bin_path) + MAX_FNAME_LEN, + "%s/genexp", bin_path); child = create_file(funct, 0); waitpid(child, NULL, 0); - sprintf(funct, "%s/genlog", bin_path); + snprintf(funct, strlen(bin_path) + MAX_FNAME_LEN, + "%s/genlog", bin_path); child = create_file(funct, 0); waitpid(child, NULL, 0); - sprintf(funct, "%s/genlog10", bin_path); + snprintf(funct, strlen(bin_path) + MAX_FNAME_LEN, + "%s/genlog10", bin_path); child = create_file(funct, 0); waitpid(child, NULL, 0); - sprintf(funct, "%s/genfrexp", bin_path); + snprintf(funct, strlen(bin_path) + MAX_FNAME_LEN, + "%s/genfrexp", bin_path); child = create_file(funct, 0); waitpid(child, NULL, 0); - sprintf(funct, "%s/genldexp", bin_path); + snprintf(funct, strlen(bin_path) + MAX_FNAME_LEN, + "%s/genldexp", bin_path); child = create_file(funct, 0); waitpid(child, NULL, 0); - sprintf(funct, "%s/genhypot", bin_path); + snprintf(funct, strlen(bin_path) + MAX_FNAME_LEN, + "%s/genhypot", bin_path); child = create_file(funct, 0); waitpid(child, NULL, 0); - sprintf(funct, "%s/genmodf", bin_path); + snprintf(funct, strlen(bin_path) + MAX_FNAME_LEN, + "%s/genmodf", bin_path); child = create_file(funct, 0); waitpid(child, NULL, 0); diff --git a/testcases/misc/math/float/iperb/geniperb.c b/testcases/misc/math/float/iperb/geniperb.c index 98a6a380a..2583f9cfb 100644 --- a/testcases/misc/math/float/iperb/geniperb.c +++ b/testcases/misc/math/float/iperb/geniperb.c @@ -80,15 +80,18 @@ int main(int argc, char *argv[]) funct = malloc(strlen(bin_path) + MAX_FNAME_LEN); if (funct == NULL) err(1, "malloc failed"); - sprintf(funct, "%s/gencosh", bin_path); + snprintf(funct, strlen(bin_path) + MAX_FNAME_LEN, + "%s/gencosh", bin_path); child = create_file(funct, 0); waitpid(child, NULL, 0); - sprintf(funct, "%s/gensinh", bin_path); + snprintf(funct, strlen(bin_path) + MAX_FNAME_LEN, + "%s/gensinh", bin_path); child = create_file(funct, 0); waitpid(child, NULL, 0); - sprintf(funct, "%s/gentanh", bin_path); + snprintf(funct, strlen(bin_path) + MAX_FNAME_LEN, + "%s/gentanh", bin_path); child = create_file(funct, 0); waitpid(child, NULL, 0); diff --git a/testcases/misc/math/float/main.c b/testcases/misc/math/float/main.c index 7285141a4..862250d7f 100644 --- a/testcases/misc/math/float/main.c +++ b/testcases/misc/math/float/main.c @@ -83,11 +83,15 @@ int generate(char *datadir, char *bin_path) { char *cmdline; char *fmt = "cd %s; %s/%s %s"; + size_t cmdline_size; - cmdline = malloc(2 * strlen(bin_path) + strlen(datadir) + strlen(GENERATOR) + strlen(fmt)); + cmdline_size = 2 * strlen(bin_path) + strlen(datadir); + cmdline_size += strlen(GENERATOR) + strlen(fmt); + cmdline = malloc(cmdline_size); if (cmdline == NULL) return (1); - sprintf(cmdline, fmt, datadir, bin_path, GENERATOR, bin_path); + snprintf(cmdline, cmdline_size, fmt, datadir, + bin_path, GENERATOR, bin_path); system(cmdline); free(cmdline); return (0); @@ -114,6 +118,7 @@ int main(int argc, char *argv[]) int error = 0; /*int time=1; */ int i; + size_t bin_path_size; /* Generate test ID from invocation name */ if ((TCID = strrchr(argv[0], '/')) != NULL) @@ -125,11 +130,13 @@ int main(int argc, char *argv[]) tst_brkm(TBROK, NULL, "You must set $LTPROOT before executing this test"); } - bin_path = malloc(strlen(ltproot) + 16); + + bin_path_size = strlen(ltproot) + 16; + bin_path = malloc(bin_path_size); if (bin_path == NULL) { tst_brkm(TBROK | TERRNO, NULL, "malloc failed"); } - sprintf(bin_path, "%s/testcases/bin", ltproot); + snprintf(bin_path, bin_path_size, "%s/testcases/bin", ltproot); tst_tmpdir(); @@ -432,6 +439,7 @@ static void sys_error(const char *msg, int line) { char syserr_msg[256]; - sprintf(syserr_msg, "%s: %s", msg, strerror(errno)); + snprintf(syserr_msg, sizeof(syserr_msg), + "%s: %s", msg, strerror(errno)); error(syserr_msg, line); } diff --git a/testcases/misc/math/float/power/genpower.c b/testcases/misc/math/float/power/genpower.c index 8a8f753a7..6e8356e8e 100644 --- a/testcases/misc/math/float/power/genpower.c +++ b/testcases/misc/math/float/power/genpower.c @@ -79,27 +79,33 @@ int main(int argc, char *argv[]) funct = malloc(strlen(bin_path) + MAX_FNAME_LEN); if (funct == NULL) err(1, "malloc failed"); - sprintf(funct, "%s/genceil", bin_path); + snprintf(funct, strlen(bin_path) + MAX_FNAME_LEN, + "%s/genceil", bin_path); child = create_file(funct, 0); waitpid(child, NULL, 0); - sprintf(funct, "%s/genfabs", bin_path); + snprintf(funct, strlen(bin_path) + MAX_FNAME_LEN, + "%s/genfabs", bin_path); child = create_file(funct, 0); waitpid(child, NULL, 0); - sprintf(funct, "%s/genfloor", bin_path); + snprintf(funct, strlen(bin_path) + MAX_FNAME_LEN, + "%s/genfloor", bin_path); child = create_file(funct, 0); waitpid(child, NULL, 0); - sprintf(funct, "%s/genfmod", bin_path); + snprintf(funct, strlen(bin_path) + MAX_FNAME_LEN, + "%s/genfmod", bin_path); child = create_file(funct, 0); waitpid(child, NULL, 0); - sprintf(funct, "%s/genpow", bin_path); + snprintf(funct, strlen(bin_path) + MAX_FNAME_LEN, + "%s/genpow", bin_path); child = create_file(funct, 0); waitpid(child, NULL, 0); - sprintf(funct, "%s/gensqrt", bin_path); + snprintf(funct, strlen(bin_path) + MAX_FNAME_LEN, + "%s/gensqrt", bin_path); child = create_file(funct, 0); waitpid(child, NULL, 0); diff --git a/testcases/misc/math/float/thread_code.c b/testcases/misc/math/float/thread_code.c index 34a9578d4..af32b71c9 100644 --- a/testcases/misc/math/float/thread_code.c +++ b/testcases/misc/math/float/thread_code.c @@ -47,7 +47,7 @@ static size_t read_file(char *fname, void **data) int fd; int maxretries = 1; - (void)sprintf(path, "%s/%s", datadir, fname); + (void)snprintf(path, PATH_MAX, "%s/%s", datadir, fname); errno = 0; @@ -135,7 +135,8 @@ static void check_error(TH_DATA * th_data, double e, double r, int index) ++th_data->th_nerror; /* record first error only ! */ if (th_data->th_result == 0) { - sprintf(th_data->detail_data, + snprintf(th_data->detail_data, + DETAIL_DATA_SIZE, errtmplt, th_data->th_func.fident, index, e, r, x); @@ -194,7 +195,8 @@ static void compute_modf(TH_DATA * th_data, double *din, double *dex, ++th_data->th_nerror; /* record first error only ! */ if (th_data->th_result == 0) { - sprintf(th_data->detail_data, + snprintf(th_data->detail_data, + DETAIL_DATA_SIZE, errtmplt1, th_data->th_func.fident, index, dex2[index], tmp); @@ -239,7 +241,8 @@ static void compute_frexp_lgamma(TH_DATA * th_data, double *din, double *dex, ++th_data->th_nerror; /* record first error only ! */ if (th_data->th_result == 0) { - sprintf(th_data->detail_data, + snprintf(th_data->detail_data, + DETAIL_DATA_SIZE, errtmplt2, th_data->th_func.fident, index, dex2[index], tmp); @@ -289,7 +292,8 @@ void *thread_code(void *arg) fsize = read_file(th_data->th_func.din_fname, (void **)&din); if (fsize == (size_t) 0) { - sprintf(th_data->detail_data, + snprintf(th_data->detail_data, + DETAIL_DATA_SIZE, "FAIL: %s: reading %s, %s\n", th_data->th_func.fident, th_data->th_func.din_fname, strerror(errno)); @@ -299,7 +303,8 @@ void *thread_code(void *arg) } fsize2 = read_file(th_data->th_func.dex_fname, (void **)&dex); if (fsize2 == (size_t) 0) { - sprintf(th_data->detail_data, + snprintf(th_data->detail_data, + DETAIL_DATA_SIZE, "FAIL: %s: reading %s, %s\n", th_data->th_func.fident, th_data->th_func.dex_fname, strerror(errno)); @@ -319,7 +324,8 @@ void *thread_code(void *arg) case FUNC_GAM: fsize3 = read_file(th_data->th_func.dex2_fname, (void **)&dex2); if (fsize3 == (size_t) 0) { - sprintf(th_data->detail_data, + snprintf(th_data->detail_data, + DETAIL_DATA_SIZE, "FAIL: %s: reading %s, %s\n", th_data->th_func.fident, th_data->th_func.dex2_fname, strerror(errno)); @@ -352,7 +358,8 @@ void *thread_code(void *arg) break; default: file_size_error: - sprintf(th_data->detail_data, + snprintf(th_data->detail_data, + DETAIL_DATA_SIZE, "FAIL: %s: file sizes don't match\n", th_data->th_func.fident); th_data->th_result = 1; @@ -396,7 +403,8 @@ file_size_error: din, dex, (int *)dex2, index); break; default: - sprintf(th_data->detail_data, + snprintf(th_data->detail_data, + DETAIL_DATA_SIZE, "FAIL: %s: unexpected function type\n", th_data->th_func.fident); th_data->th_result = 1; diff --git a/testcases/misc/math/float/trigo/gentrigo.c b/testcases/misc/math/float/trigo/gentrigo.c index 4908d0435..a0c6f2a88 100644 --- a/testcases/misc/math/float/trigo/gentrigo.c +++ b/testcases/misc/math/float/trigo/gentrigo.c @@ -80,31 +80,38 @@ int main(int argc, char *argv[]) funct = malloc(strlen(bin_path) + MAX_FNAME_LEN); if (funct == NULL) err(1, "malloc failed"); - sprintf(funct, "%s/gencos", bin_path); + snprintf(funct, strlen(bin_path) + MAX_FNAME_LEN, + "%s/gencos", bin_path); child = create_file(funct, 0); waitpid(child, NULL, 0); - sprintf(funct, "%s/gensin", bin_path); + snprintf(funct, strlen(bin_path) + MAX_FNAME_LEN, + "%s/gensin", bin_path); child = create_file(funct, 0); waitpid(child, NULL, 0); - sprintf(funct, "%s/gentan", bin_path); + snprintf(funct, strlen(bin_path) + MAX_FNAME_LEN, + "%s/gentan", bin_path); child = create_file(funct, 0); waitpid(child, NULL, 0); - sprintf(funct, "%s/genatan", bin_path); + snprintf(funct, strlen(bin_path) + MAX_FNAME_LEN, + "%s/genatan", bin_path); child = create_file(funct, 0); waitpid(child, NULL, 0); - sprintf(funct, "%s/genatan2", bin_path); + snprintf(funct, strlen(bin_path) + MAX_FNAME_LEN, + "%s/genatan2", bin_path); child = create_file(funct, 0); waitpid(child, NULL, 0); - sprintf(funct, "%s/genacos", bin_path); + snprintf(funct, strlen(bin_path) + MAX_FNAME_LEN, + "%s/genacos", bin_path); child = create_file(funct, 0); waitpid(child, NULL, 0); - sprintf(funct, "%s/genasin", bin_path); + snprintf(funct, strlen(bin_path) + MAX_FNAME_LEN, + "%s/genasin", bin_path); child = create_file(funct, 0); waitpid(child, NULL, 0); -- 2.55.0 -- Mailing list info: https://lists.linux.it/listinfo/ltp ^ permalink raw reply related [flat|nested] 11+ messages in thread
* [LTP] [PATCH 0/3] Fix to float_trigo core dump and related enhancements 2026-07-15 13:04 ` Tomas Dzik via ltp ` (3 preceding siblings ...) (?) @ 2026-07-15 13:04 ` Tomas Dzik via ltp 2026-07-15 13:04 ` [LTP] [PATCH 1/3] LTP/Lite test float_trigo core dumps due to free(): invalid pointer Tomas Dzik via ltp ` (2 more replies) -1 siblings, 3 replies; 11+ messages in thread From: Tomas Dzik via ltp @ 2026-07-15 13:04 UTC (permalink / raw) To: ltp Hi all, following 3 patches fix a core dump we observed during testing. Because failed malloc() was contributing factor to it I added also some checks to malloc() return value. And since I was editing these files I spotted that they use sprintf() and I replaced it with snprintf() which is IMHO safer and can make debugging test failures easier. I would be grateful for review. Best regards, Tomas D. Tomas Dzik (3): LTP/Lite test float_trigo core dumps due to free(): invalid pointer Add some checks for malloc() returning NULL Replace sprintf() with more secure snprintf() variant in float tests testcases/misc/math/float/bessel/genbessel.c | 10 +++--- .../misc/math/float/exp_log/genexp_log.c | 24 ++++++++++---- testcases/misc/math/float/iperb/geniperb.c | 11 +++++-- testcases/misc/math/float/main.c | 18 +++++++--- testcases/misc/math/float/power/genpower.c | 21 ++++++++---- testcases/misc/math/float/thread_code.c | 33 +++++++++++++------ testcases/misc/math/float/trigo/gentrigo.c | 24 ++++++++++---- 7 files changed, 98 insertions(+), 43 deletions(-) -- 2.55.0 -- Mailing list info: https://lists.linux.it/listinfo/ltp ^ permalink raw reply [flat|nested] 11+ messages in thread
* [LTP] [PATCH 1/3] LTP/Lite test float_trigo core dumps due to free(): invalid pointer 2026-07-15 13:04 ` [LTP] [PATCH 0/3] Fix to float_trigo core dump and related enhancements Tomas Dzik via ltp @ 2026-07-15 13:04 ` Tomas Dzik via ltp 2026-07-15 13:04 ` [LTP] [PATCH 2/3] Add some checks for malloc() returning NULL Tomas Dzik via ltp 2026-07-15 13:04 ` [LTP] [PATCH 3/3] Replace sprintf() with more secure snprintf() variant in float tests Tomas Dzik via ltp 2 siblings, 0 replies; 11+ messages in thread From: Tomas Dzik via ltp @ 2026-07-15 13:04 UTC (permalink / raw) To: ltp Function read_file() does not initialize *data on failure paths (for example if malloc() fails) and caller ends up calling SAFE_FREE() on an uninitialized pointer. Here is the log from failed run: ~==== float_trigo ==== command: float_trigo -v float_trigo 0 TINFO : Using /tmp/LTP_floJSug25 as tmpdir (xfs filesystem) float_trigo 1 TPASS : Test passed float_trigo 0 TINFO : float_trigo: will run for 500 loops; using . as a data directory float_trigo 0 TINFO : float_trigo: will run 7 functions, 20 threads per function float_trigo 0 TINFO : signal handler 140451533870784 started float_trigo 0 TINFO : Signal handler starts waiting... free(): invalid pointer Duration: 0.926 This fix initializes pointers where we actually core dumped (*din, *dex). Signed-off-by: Tomas Dzik <tdzik@redhat.com> --- testcases/misc/math/float/thread_code.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/testcases/misc/math/float/thread_code.c b/testcases/misc/math/float/thread_code.c index ca18cef1e..6f3a463dd 100644 --- a/testcases/misc/math/float/thread_code.c +++ b/testcases/misc/math/float/thread_code.c @@ -278,7 +278,12 @@ void *thread_code(void *arg) { TH_DATA *th_data = (TH_DATA *) arg; size_t fsize, fsize2, fsize3; - double *din, *dex, *dex2 = NULL; + /* + * If read_file() fails for whatever reason, these pointers might + * stay uninitialized. Initialize them to NULL, because SAFE_FREE() + * can handle it. + */ + double *din = NULL, *dex = NULL, *dex2 = NULL; int imax, index; fsize = read_file(th_data->th_func.din_fname, (void **)&din); -- 2.55.0 -- Mailing list info: https://lists.linux.it/listinfo/ltp ^ permalink raw reply related [flat|nested] 11+ messages in thread
* [LTP] [PATCH 2/3] Add some checks for malloc() returning NULL 2026-07-15 13:04 ` [LTP] [PATCH 0/3] Fix to float_trigo core dump and related enhancements Tomas Dzik via ltp 2026-07-15 13:04 ` [LTP] [PATCH 1/3] LTP/Lite test float_trigo core dumps due to free(): invalid pointer Tomas Dzik via ltp @ 2026-07-15 13:04 ` Tomas Dzik via ltp 2026-07-15 13:04 ` [LTP] [PATCH 3/3] Replace sprintf() with more secure snprintf() variant in float tests Tomas Dzik via ltp 2 siblings, 0 replies; 11+ messages in thread From: Tomas Dzik via ltp @ 2026-07-15 13:04 UTC (permalink / raw) To: ltp Current code in directory testcases/misc/math/float/ does not check if malloc() returns NULL. Because it was a contributing factor to observed core dump I am adding these checks to make debugging failures easier. Signed-off-by: Tomas Dzik <tdzik@redhat.com> --- testcases/misc/math/float/exp_log/genexp_log.c | 3 +++ testcases/misc/math/float/iperb/geniperb.c | 2 ++ testcases/misc/math/float/power/genpower.c | 3 +++ testcases/misc/math/float/trigo/gentrigo.c | 3 +++ 4 files changed, 11 insertions(+) diff --git a/testcases/misc/math/float/exp_log/genexp_log.c b/testcases/misc/math/float/exp_log/genexp_log.c index 7f26945ec..e02d0d344 100644 --- a/testcases/misc/math/float/exp_log/genexp_log.c +++ b/testcases/misc/math/float/exp_log/genexp_log.c @@ -30,6 +30,7 @@ #include <stdlib.h> #include <string.h> #include <errno.h> +#include <err.h> #include <limits.h> #include <unistd.h> #include <fcntl.h> @@ -76,6 +77,8 @@ int main(int argc, char *argv[]) bin_path = argv[1]; funct = malloc(strlen(bin_path) + MAX_FNAME_LEN); + if (funct == NULL) + err(1, "malloc failed"); sprintf(funct, "%s/genexp", bin_path); child = create_file(funct, 0); waitpid(child, NULL, 0); diff --git a/testcases/misc/math/float/iperb/geniperb.c b/testcases/misc/math/float/iperb/geniperb.c index f7bf55c84..98a6a380a 100644 --- a/testcases/misc/math/float/iperb/geniperb.c +++ b/testcases/misc/math/float/iperb/geniperb.c @@ -78,6 +78,8 @@ int main(int argc, char *argv[]) bin_path = argv[1]; funct = malloc(strlen(bin_path) + MAX_FNAME_LEN); + if (funct == NULL) + err(1, "malloc failed"); sprintf(funct, "%s/gencosh", bin_path); child = create_file(funct, 0); waitpid(child, NULL, 0); diff --git a/testcases/misc/math/float/power/genpower.c b/testcases/misc/math/float/power/genpower.c index 44f7af934..8a8f753a7 100644 --- a/testcases/misc/math/float/power/genpower.c +++ b/testcases/misc/math/float/power/genpower.c @@ -34,6 +34,7 @@ #include <unistd.h> #include <fcntl.h> #include <errno.h> +#include <err.h> #include <sys/signal.h> #include <math.h> @@ -76,6 +77,8 @@ int main(int argc, char *argv[]) bin_path = argv[1]; funct = malloc(strlen(bin_path) + MAX_FNAME_LEN); + if (funct == NULL) + err(1, "malloc failed"); sprintf(funct, "%s/genceil", bin_path); child = create_file(funct, 0); waitpid(child, NULL, 0); diff --git a/testcases/misc/math/float/trigo/gentrigo.c b/testcases/misc/math/float/trigo/gentrigo.c index 5f7e0cbc7..4908d0435 100644 --- a/testcases/misc/math/float/trigo/gentrigo.c +++ b/testcases/misc/math/float/trigo/gentrigo.c @@ -34,6 +34,7 @@ #include <unistd.h> #include <fcntl.h> #include <errno.h> +#include <err.h> #include <sys/signal.h> #include <math.h> @@ -77,6 +78,8 @@ int main(int argc, char *argv[]) bin_path = argv[1]; funct = malloc(strlen(bin_path) + MAX_FNAME_LEN); + if (funct == NULL) + err(1, "malloc failed"); sprintf(funct, "%s/gencos", bin_path); child = create_file(funct, 0); waitpid(child, NULL, 0); -- 2.55.0 -- Mailing list info: https://lists.linux.it/listinfo/ltp ^ permalink raw reply related [flat|nested] 11+ messages in thread
* [LTP] [PATCH 3/3] Replace sprintf() with more secure snprintf() variant in float tests 2026-07-15 13:04 ` [LTP] [PATCH 0/3] Fix to float_trigo core dump and related enhancements Tomas Dzik via ltp 2026-07-15 13:04 ` [LTP] [PATCH 1/3] LTP/Lite test float_trigo core dumps due to free(): invalid pointer Tomas Dzik via ltp 2026-07-15 13:04 ` [LTP] [PATCH 2/3] Add some checks for malloc() returning NULL Tomas Dzik via ltp @ 2026-07-15 13:04 ` Tomas Dzik via ltp 2 siblings, 0 replies; 11+ messages in thread From: Tomas Dzik via ltp @ 2026-07-15 13:04 UTC (permalink / raw) To: ltp There are tests in testcases/misc/math/float/ which use sprintf(). It is safer to use snprintf(). Signed-off-by: Tomas Dzik <tdzik@redhat.com> --- testcases/misc/math/float/bessel/genbessel.c | 10 +++---- .../misc/math/float/exp_log/genexp_log.c | 21 ++++++++++----- testcases/misc/math/float/iperb/geniperb.c | 9 ++++--- testcases/misc/math/float/main.c | 18 +++++++++---- testcases/misc/math/float/power/genpower.c | 18 ++++++++----- testcases/misc/math/float/thread_code.c | 26 ++++++++++++------- testcases/misc/math/float/trigo/gentrigo.c | 21 ++++++++++----- 7 files changed, 81 insertions(+), 42 deletions(-) diff --git a/testcases/misc/math/float/bessel/genbessel.c b/testcases/misc/math/float/bessel/genbessel.c index 91ea3b6da..644aa7e3d 100644 --- a/testcases/misc/math/float/bessel/genbessel.c +++ b/testcases/misc/math/float/bessel/genbessel.c @@ -79,23 +79,23 @@ int main(int argc, char *argv[]) funct = malloc(strlen(bin_path) + MAX_FNAME_LEN); if (funct == NULL) err(1, "malloc failed"); - sprintf(funct, "%s/genj0", bin_path); + snprintf(funct, strlen(bin_path) + MAX_FNAME_LEN, "%s/genj0", bin_path); child = create_file(funct, 0); waitpid(child, NULL, 0); - sprintf(funct, "%s/genj1", bin_path); + snprintf(funct, strlen(bin_path) + MAX_FNAME_LEN, "%s/genj1", bin_path); child = create_file(funct, 0); waitpid(child, NULL, 0); - sprintf(funct, "%s/geny0", bin_path); + snprintf(funct, strlen(bin_path) + MAX_FNAME_LEN, "%s/geny0", bin_path); child = create_file(funct, 0); waitpid(child, NULL, 0); - sprintf(funct, "%s/geny1", bin_path); + snprintf(funct, strlen(bin_path) + MAX_FNAME_LEN, "%s/geny1", bin_path); child = create_file(funct, 0); waitpid(child, NULL, 0); - sprintf(funct, "%s/genlgamma", bin_path); + snprintf(funct, strlen(bin_path) + MAX_FNAME_LEN, "%s/genlgamma", bin_path); child = create_file(funct, 0); waitpid(child, NULL, 0); diff --git a/testcases/misc/math/float/exp_log/genexp_log.c b/testcases/misc/math/float/exp_log/genexp_log.c index e02d0d344..0411aa8bf 100644 --- a/testcases/misc/math/float/exp_log/genexp_log.c +++ b/testcases/misc/math/float/exp_log/genexp_log.c @@ -79,31 +79,38 @@ int main(int argc, char *argv[]) funct = malloc(strlen(bin_path) + MAX_FNAME_LEN); if (funct == NULL) err(1, "malloc failed"); - sprintf(funct, "%s/genexp", bin_path); + snprintf(funct, strlen(bin_path) + MAX_FNAME_LEN, + "%s/genexp", bin_path); child = create_file(funct, 0); waitpid(child, NULL, 0); - sprintf(funct, "%s/genlog", bin_path); + snprintf(funct, strlen(bin_path) + MAX_FNAME_LEN, + "%s/genlog", bin_path); child = create_file(funct, 0); waitpid(child, NULL, 0); - sprintf(funct, "%s/genlog10", bin_path); + snprintf(funct, strlen(bin_path) + MAX_FNAME_LEN, + "%s/genlog10", bin_path); child = create_file(funct, 0); waitpid(child, NULL, 0); - sprintf(funct, "%s/genfrexp", bin_path); + snprintf(funct, strlen(bin_path) + MAX_FNAME_LEN, + "%s/genfrexp", bin_path); child = create_file(funct, 0); waitpid(child, NULL, 0); - sprintf(funct, "%s/genldexp", bin_path); + snprintf(funct, strlen(bin_path) + MAX_FNAME_LEN, + "%s/genldexp", bin_path); child = create_file(funct, 0); waitpid(child, NULL, 0); - sprintf(funct, "%s/genhypot", bin_path); + snprintf(funct, strlen(bin_path) + MAX_FNAME_LEN, + "%s/genhypot", bin_path); child = create_file(funct, 0); waitpid(child, NULL, 0); - sprintf(funct, "%s/genmodf", bin_path); + snprintf(funct, strlen(bin_path) + MAX_FNAME_LEN, + "%s/genmodf", bin_path); child = create_file(funct, 0); waitpid(child, NULL, 0); diff --git a/testcases/misc/math/float/iperb/geniperb.c b/testcases/misc/math/float/iperb/geniperb.c index 98a6a380a..2583f9cfb 100644 --- a/testcases/misc/math/float/iperb/geniperb.c +++ b/testcases/misc/math/float/iperb/geniperb.c @@ -80,15 +80,18 @@ int main(int argc, char *argv[]) funct = malloc(strlen(bin_path) + MAX_FNAME_LEN); if (funct == NULL) err(1, "malloc failed"); - sprintf(funct, "%s/gencosh", bin_path); + snprintf(funct, strlen(bin_path) + MAX_FNAME_LEN, + "%s/gencosh", bin_path); child = create_file(funct, 0); waitpid(child, NULL, 0); - sprintf(funct, "%s/gensinh", bin_path); + snprintf(funct, strlen(bin_path) + MAX_FNAME_LEN, + "%s/gensinh", bin_path); child = create_file(funct, 0); waitpid(child, NULL, 0); - sprintf(funct, "%s/gentanh", bin_path); + snprintf(funct, strlen(bin_path) + MAX_FNAME_LEN, + "%s/gentanh", bin_path); child = create_file(funct, 0); waitpid(child, NULL, 0); diff --git a/testcases/misc/math/float/main.c b/testcases/misc/math/float/main.c index 7285141a4..862250d7f 100644 --- a/testcases/misc/math/float/main.c +++ b/testcases/misc/math/float/main.c @@ -83,11 +83,15 @@ int generate(char *datadir, char *bin_path) { char *cmdline; char *fmt = "cd %s; %s/%s %s"; + size_t cmdline_size; - cmdline = malloc(2 * strlen(bin_path) + strlen(datadir) + strlen(GENERATOR) + strlen(fmt)); + cmdline_size = 2 * strlen(bin_path) + strlen(datadir); + cmdline_size += strlen(GENERATOR) + strlen(fmt); + cmdline = malloc(cmdline_size); if (cmdline == NULL) return (1); - sprintf(cmdline, fmt, datadir, bin_path, GENERATOR, bin_path); + snprintf(cmdline, cmdline_size, fmt, datadir, + bin_path, GENERATOR, bin_path); system(cmdline); free(cmdline); return (0); @@ -114,6 +118,7 @@ int main(int argc, char *argv[]) int error = 0; /*int time=1; */ int i; + size_t bin_path_size; /* Generate test ID from invocation name */ if ((TCID = strrchr(argv[0], '/')) != NULL) @@ -125,11 +130,13 @@ int main(int argc, char *argv[]) tst_brkm(TBROK, NULL, "You must set $LTPROOT before executing this test"); } - bin_path = malloc(strlen(ltproot) + 16); + + bin_path_size = strlen(ltproot) + 16; + bin_path = malloc(bin_path_size); if (bin_path == NULL) { tst_brkm(TBROK | TERRNO, NULL, "malloc failed"); } - sprintf(bin_path, "%s/testcases/bin", ltproot); + snprintf(bin_path, bin_path_size, "%s/testcases/bin", ltproot); tst_tmpdir(); @@ -432,6 +439,7 @@ static void sys_error(const char *msg, int line) { char syserr_msg[256]; - sprintf(syserr_msg, "%s: %s", msg, strerror(errno)); + snprintf(syserr_msg, sizeof(syserr_msg), + "%s: %s", msg, strerror(errno)); error(syserr_msg, line); } diff --git a/testcases/misc/math/float/power/genpower.c b/testcases/misc/math/float/power/genpower.c index 8a8f753a7..6e8356e8e 100644 --- a/testcases/misc/math/float/power/genpower.c +++ b/testcases/misc/math/float/power/genpower.c @@ -79,27 +79,33 @@ int main(int argc, char *argv[]) funct = malloc(strlen(bin_path) + MAX_FNAME_LEN); if (funct == NULL) err(1, "malloc failed"); - sprintf(funct, "%s/genceil", bin_path); + snprintf(funct, strlen(bin_path) + MAX_FNAME_LEN, + "%s/genceil", bin_path); child = create_file(funct, 0); waitpid(child, NULL, 0); - sprintf(funct, "%s/genfabs", bin_path); + snprintf(funct, strlen(bin_path) + MAX_FNAME_LEN, + "%s/genfabs", bin_path); child = create_file(funct, 0); waitpid(child, NULL, 0); - sprintf(funct, "%s/genfloor", bin_path); + snprintf(funct, strlen(bin_path) + MAX_FNAME_LEN, + "%s/genfloor", bin_path); child = create_file(funct, 0); waitpid(child, NULL, 0); - sprintf(funct, "%s/genfmod", bin_path); + snprintf(funct, strlen(bin_path) + MAX_FNAME_LEN, + "%s/genfmod", bin_path); child = create_file(funct, 0); waitpid(child, NULL, 0); - sprintf(funct, "%s/genpow", bin_path); + snprintf(funct, strlen(bin_path) + MAX_FNAME_LEN, + "%s/genpow", bin_path); child = create_file(funct, 0); waitpid(child, NULL, 0); - sprintf(funct, "%s/gensqrt", bin_path); + snprintf(funct, strlen(bin_path) + MAX_FNAME_LEN, + "%s/gensqrt", bin_path); child = create_file(funct, 0); waitpid(child, NULL, 0); diff --git a/testcases/misc/math/float/thread_code.c b/testcases/misc/math/float/thread_code.c index 6f3a463dd..b67edbb34 100644 --- a/testcases/misc/math/float/thread_code.c +++ b/testcases/misc/math/float/thread_code.c @@ -47,7 +47,7 @@ static size_t read_file(char *fname, void **data) int fd; int maxretries = 1; - (void)sprintf(path, "%s/%s", datadir, fname); + (void)snprintf(path, PATH_MAX, "%s/%s", datadir, fname); errno = 0; @@ -135,7 +135,8 @@ static void check_error(TH_DATA * th_data, double e, double r, int index) ++th_data->th_nerror; /* record first error only ! */ if (th_data->th_result == 0) { - sprintf(th_data->detail_data, + snprintf(th_data->detail_data, + DETAIL_DATA_SIZE, errtmplt, th_data->th_func.fident, index, e, r, x); @@ -194,7 +195,8 @@ static void compute_modf(TH_DATA * th_data, double *din, double *dex, ++th_data->th_nerror; /* record first error only ! */ if (th_data->th_result == 0) { - sprintf(th_data->detail_data, + snprintf(th_data->detail_data, + DETAIL_DATA_SIZE, errtmplt1, th_data->th_func.fident, index, dex2[index], tmp); @@ -239,7 +241,8 @@ static void compute_frexp_lgamma(TH_DATA * th_data, double *din, double *dex, ++th_data->th_nerror; /* record first error only ! */ if (th_data->th_result == 0) { - sprintf(th_data->detail_data, + snprintf(th_data->detail_data, + DETAIL_DATA_SIZE, errtmplt2, th_data->th_func.fident, index, dex2[index], tmp); @@ -288,7 +291,8 @@ void *thread_code(void *arg) fsize = read_file(th_data->th_func.din_fname, (void **)&din); if (fsize == (size_t) 0) { - sprintf(th_data->detail_data, + snprintf(th_data->detail_data, + DETAIL_DATA_SIZE, "FAIL: %s: reading %s, %s\n", th_data->th_func.fident, th_data->th_func.din_fname, strerror(errno)); @@ -298,7 +302,8 @@ void *thread_code(void *arg) } fsize2 = read_file(th_data->th_func.dex_fname, (void **)&dex); if (fsize2 == (size_t) 0) { - sprintf(th_data->detail_data, + snprintf(th_data->detail_data, + DETAIL_DATA_SIZE, "FAIL: %s: reading %s, %s\n", th_data->th_func.fident, th_data->th_func.dex_fname, strerror(errno)); @@ -318,7 +323,8 @@ void *thread_code(void *arg) case FUNC_GAM: fsize3 = read_file(th_data->th_func.dex2_fname, (void **)&dex2); if (fsize3 == (size_t) 0) { - sprintf(th_data->detail_data, + snprintf(th_data->detail_data, + DETAIL_DATA_SIZE, "FAIL: %s: reading %s, %s\n", th_data->th_func.fident, th_data->th_func.dex2_fname, strerror(errno)); @@ -351,7 +357,8 @@ void *thread_code(void *arg) break; default: file_size_error: - sprintf(th_data->detail_data, + snprintf(th_data->detail_data, + DETAIL_DATA_SIZE, "FAIL: %s: file sizes don't match\n", th_data->th_func.fident); th_data->th_result = 1; @@ -395,7 +402,8 @@ file_size_error: din, dex, (int *)dex2, index); break; default: - sprintf(th_data->detail_data, + snprintf(th_data->detail_data, + DETAIL_DATA_SIZE, "FAIL: %s: unexpected function type\n", th_data->th_func.fident); th_data->th_result = 1; diff --git a/testcases/misc/math/float/trigo/gentrigo.c b/testcases/misc/math/float/trigo/gentrigo.c index 4908d0435..a0c6f2a88 100644 --- a/testcases/misc/math/float/trigo/gentrigo.c +++ b/testcases/misc/math/float/trigo/gentrigo.c @@ -80,31 +80,38 @@ int main(int argc, char *argv[]) funct = malloc(strlen(bin_path) + MAX_FNAME_LEN); if (funct == NULL) err(1, "malloc failed"); - sprintf(funct, "%s/gencos", bin_path); + snprintf(funct, strlen(bin_path) + MAX_FNAME_LEN, + "%s/gencos", bin_path); child = create_file(funct, 0); waitpid(child, NULL, 0); - sprintf(funct, "%s/gensin", bin_path); + snprintf(funct, strlen(bin_path) + MAX_FNAME_LEN, + "%s/gensin", bin_path); child = create_file(funct, 0); waitpid(child, NULL, 0); - sprintf(funct, "%s/gentan", bin_path); + snprintf(funct, strlen(bin_path) + MAX_FNAME_LEN, + "%s/gentan", bin_path); child = create_file(funct, 0); waitpid(child, NULL, 0); - sprintf(funct, "%s/genatan", bin_path); + snprintf(funct, strlen(bin_path) + MAX_FNAME_LEN, + "%s/genatan", bin_path); child = create_file(funct, 0); waitpid(child, NULL, 0); - sprintf(funct, "%s/genatan2", bin_path); + snprintf(funct, strlen(bin_path) + MAX_FNAME_LEN, + "%s/genatan2", bin_path); child = create_file(funct, 0); waitpid(child, NULL, 0); - sprintf(funct, "%s/genacos", bin_path); + snprintf(funct, strlen(bin_path) + MAX_FNAME_LEN, + "%s/genacos", bin_path); child = create_file(funct, 0); waitpid(child, NULL, 0); - sprintf(funct, "%s/genasin", bin_path); + snprintf(funct, strlen(bin_path) + MAX_FNAME_LEN, + "%s/genasin", bin_path); child = create_file(funct, 0); waitpid(child, NULL, 0); -- 2.55.0 -- Mailing list info: https://lists.linux.it/listinfo/ltp ^ permalink raw reply related [flat|nested] 11+ messages in thread
* [LTP] [PATCH 0/3] Fix to float_trigo core dump and related enhancements @ 2026-07-09 15:40 Tomas Dzik via ltp 0 siblings, 0 replies; 11+ messages in thread From: Tomas Dzik via ltp @ 2026-07-09 15:40 UTC (permalink / raw) To: ltp Hi all, following 3 patches fix a core dump we observed during testing. Because failed malloc() was contributing factor to it I added also some checks to malloc() return value. And since I was editing these files I spotted that they use sprintf() and I replaced it with snprintf() which is IMHO safer and can make debugging test failures easier. I would be grateful for review. Best regards, Tomas D. Tomas Dzik (3): LTP/Lite test float_trigo core dumps due to free(): invalid pointer Add some checks for malloc() returning NULL Replace sprintf() with more secure snprintf() variant in float tests testcases/misc/math/float/bessel/genbessel.c | 10 +++--- .../misc/math/float/exp_log/genexp_log.c | 24 +++++++++---- testcases/misc/math/float/iperb/geniperb.c | 10 ++++-- testcases/misc/math/float/main.c | 18 +++++++--- testcases/misc/math/float/power/genpower.c | 21 ++++++++---- testcases/misc/math/float/thread_code.c | 34 +++++++++++++------ testcases/misc/math/float/trigo/gentrigo.c | 24 +++++++++---- 7 files changed, 99 insertions(+), 42 deletions(-) -- 2.55.0 -- Mailing list info: https://lists.linux.it/listinfo/ltp ^ permalink raw reply [flat|nested] 11+ messages in thread
end of thread, other threads:[~2026-07-15 13:06 UTC | newest] Thread overview: 11+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2026-07-15 9:45 [LTP] [PATCH 0/3] Fix to float_trigo core dump and related enhancements Tomas Dzik via ltp 2026-07-15 13:04 ` Tomas Dzik via ltp 2026-07-15 9:45 ` [LTP] [PATCH 1/3] LTP/Lite test float_trigo core dumps due to free(): invalid pointer Tomas Dzik via ltp 2026-07-15 10:55 ` [LTP] " linuxtestproject.agent 2026-07-15 9:45 ` [LTP] [PATCH 2/3] Add some checks for malloc() returning NULL Tomas Dzik via ltp 2026-07-15 9:45 ` [LTP] [PATCH 3/3] Replace sprintf() with more secure snprintf() variant in float tests Tomas Dzik via ltp 2026-07-15 13:04 ` [LTP] [PATCH 0/3] Fix to float_trigo core dump and related enhancements Tomas Dzik via ltp 2026-07-15 13:04 ` [LTP] [PATCH 1/3] LTP/Lite test float_trigo core dumps due to free(): invalid pointer Tomas Dzik via ltp 2026-07-15 13:04 ` [LTP] [PATCH 2/3] Add some checks for malloc() returning NULL Tomas Dzik via ltp 2026-07-15 13:04 ` [LTP] [PATCH 3/3] Replace sprintf() with more secure snprintf() variant in float tests Tomas Dzik via ltp -- strict thread matches above, loose matches on Subject: below -- 2026-07-09 15:40 [LTP] [PATCH 0/3] Fix to float_trigo core dump and related enhancements Tomas Dzik via ltp
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.