| 139 | } |
| 140 | |
| 141 | static void test_bracket_security(void) |
| 142 | { |
| 143 | bencode_buffer_t buf; |
| 144 | int t = 1; |
| 145 | |
| 146 | /* 1. Exceeding max depth (9 levels of nesting) */ |
| 147 | ok(bencode_buffer_init(&buf) == 0, "test-bracket-security-%d", t++); |
| 148 | ok(check_bencode("[[[[[[[[[x]]]]]]]]]", 19, NULL, &buf, 0), |
| 149 | "test-bracket-security-%d", t++); |
| 150 | bencode_buffer_free(&buf); |
| 151 | |
| 152 | /* 2. Exceeding max length */ |
| 153 | ok(bencode_buffer_init(&buf) == 0, "test-bracket-security-%d", t++); |
| 154 | { |
| 155 | char big[BRACKET_MAX_LEN + 100]; |
| 156 | memset(big, 'a', sizeof(big)); |
| 157 | big[sizeof(big) - 1] = '\0'; |
| 158 | ok(check_bencode(big, sizeof(big) - 1, NULL, &buf, 0), |
| 159 | "test-bracket-security-%d", t++); |
| 160 | } |
| 161 | bencode_buffer_free(&buf); |
| 162 | |
| 163 | /* 3. Unmatched ] at start */ |
| 164 | ok(bencode_buffer_init(&buf) == 0, "test-bracket-security-%d", t++); |
| 165 | ok(check_bencode("]", 1, NULL, &buf, 0), |
| 166 | "test-bracket-security-%d", t++); |
| 167 | bencode_buffer_free(&buf); |
| 168 | |
| 169 | /* 4. Unmatched [ only */ |
| 170 | ok(bencode_buffer_init(&buf) == 0, "test-bracket-security-%d", t++); |
| 171 | ok(check_bencode("[", 1, NULL, &buf, 0), |
| 172 | "test-bracket-security-%d", t++); |
| 173 | bencode_buffer_free(&buf); |
| 174 | |
| 175 | /* 5. Empty key in dict context */ |
| 176 | ok(bencode_buffer_init(&buf) == 0, "test-bracket-security-%d", t++); |
| 177 | ok(check_bencode("=val", 4, NULL, &buf, 0) || |
| 178 | /* empty key is skipped, result is empty dict */ |
| 179 | check_bencode("=val", 4, "de", &buf, 0), |
| 180 | "test-bracket-security-%d", t++); |
| 181 | bencode_buffer_free(&buf); |
| 182 | |
| 183 | /* 6. Empty value after = in dict */ |
| 184 | ok(bencode_buffer_init(&buf) == 0, "test-bracket-security-%d", t++); |
| 185 | { |
| 186 | /* key= with nothing after it - empty value is skipped */ |
| 187 | bencode_item_t *r = parse_bracket_value("key=", 4, &buf, 0); |
| 188 | /* Either NULL or a dict with skipped empty value */ |
| 189 | ok(r == NULL || r->type == BENCODE_DICTIONARY, |
| 190 | "test-bracket-security-%d", t++); |
| 191 | } |
| 192 | bencode_buffer_free(&buf); |
| 193 | |
| 194 | /* 7. NULL buf pointer */ |
| 195 | ok(parse_bracket_value("test", 4, NULL, 0) == NULL, |
| 196 | "test-bracket-security-%d", t++); |
| 197 | |
| 198 | /* 8. Unmatched bracket inside dict value: key=[val */ |
no test coverage detected