test: Add targeted tests for dbus/dbus#413, dbus/dbus#418

Unlike the message-internals test, these do not rely on extra debug
instrumentation in libdbus, and so can be used for "as-installed"
testing. (However, they do require GLib.)

Reproduces: https://gitlab.freedesktop.org/dbus/dbus/-/issues/413
Reproduces: https://gitlab.freedesktop.org/dbus/dbus/-/issues/418
Signed-off-by: Simon McVittie <smcv@collabora.com>
(cherry picked from commit 3ef342410a1cefe3d0bfaf46279c6517f4b44a26)
(cherry picked from commit 6b88e768d887470573bc746bf9f22a24f2c00dbf)
[backport to 1.12.x: resolve conflicts; call _dbus_header_delete_field
directly because _dbus_message_remove_unknown_fields didn't yet exist
in this branch]

1 files changed, 98 insertions, 3 deletions

diff --git a/test/message.c b/test/message.c
index 75c441e5..618528bb 100644
--- a/test/message.c
+++ b/test/message.c
@@ -31,6 +31,9 @@
 
 #include <dbus/dbus.h>
 #include "dbus/dbus-internals.h"
+#include "dbus/dbus-marshal-header.h"
+#include "dbus/dbus-message-internal.h"
+#include "dbus/dbus-message-private.h"
 #include "dbus/dbus-pipe.h"
 #include "test-utils-glib.h"
 
@@ -176,6 +179,70 @@ out:
   return !g_test_failed ();
 }
 
+/* Return TRUE if the right thing happens, but the right thing might include
+ * OOM. */
+static dbus_bool_t
+test_invalid_message_blobs (void *message_name)
+{
+  gchar *path = NULL;
+  gchar *contents = NULL;
+  gsize len = 0;
+  DBusMessage *m = NULL;
+  GError *error = NULL;
+  DBusError e = DBUS_ERROR_INIT;
+  dbus_bool_t ok = TRUE;
+  gchar *filename = NULL;
+
+  filename = g_strdup_printf ("%s.message-raw", (const char *) message_name);
+  path = g_test_build_filename (G_TEST_DIST, "data", "invalid-messages",
+                                filename, NULL);
+  g_file_get_contents (path, &contents, &len, &error);
+  g_assert_no_error (error);
+  g_assert_cmpuint (len, <, (gsize) INT_MAX);
+
+  m = dbus_message_demarshal (contents, (int) len, &e);
+
+  if (m != NULL)
+    {
+      g_test_message ("Parsing %s reported that it was valid", path);
+      g_test_fail ();
+      ok = FALSE;
+
+      /* Attempt to reproduce dbus#413 */
+      _dbus_header_delete_field (&m->header, 0x52);
+      _dbus_header_delete_field (&m->header, 0xfd);
+      _dbus_header_delete_field (&m->header, 0xff);
+
+      goto out;
+    }
+
+  if (dbus_error_has_name (&e, DBUS_ERROR_NO_MEMORY))
+    {
+      g_test_message ("Out of memory (not a problem)");
+      goto out;
+    }
+
+  if (dbus_error_has_name (&e, DBUS_ERROR_INVALID_ARGS))
+    {
+      g_test_message ("Parsing %s reported error as expected: %s: %s",
+                      path, e.name, e.message);
+      goto out;
+    }
+
+  g_test_message ("Parsing %s reported unexpected error %s: %s",
+                  path, e.name, e.message);
+  g_test_fail ();
+  ok = FALSE;
+
+out:
+  dbus_clear_message (&m);
+  dbus_error_free (&e);
+  g_free (path);
+  g_free (contents);
+  g_free (filename);
+  return ok;
+}
+
 /* Similar to test_array(), but making use of
  * dbus_message_iter_abandon_container_if_open().
  *
@@ -252,12 +319,21 @@ out:
 
 typedef struct
 {
-  const gchar *name;
+  gchar *name;
   DBusTestMemoryFunction function;
   const void *data;
 } OOMTestCase;
 
 static void
+oom_test_case_free (gpointer data)
+{
+  OOMTestCase *test = data;
+
+  g_free (test->name);
+  g_free (test);
+}
+
+static void
 test_oom_wrapper (gconstpointer data)
 {
   const OOMTestCase *test = data;
@@ -282,18 +358,29 @@ add_oom_test (const gchar *name,
    * _dbus_get_malloc_blocks_outstanding() */
   OOMTestCase *test_case = g_new0 (OOMTestCase, 1);
 
-  test_case->name = name;
+  test_case->name = g_strdup (name);
   test_case->function = function;
   test_case->data = data;
   g_test_add_data_func (name, test_case, test_oom_wrapper);
   g_queue_push_tail (test_cases_to_free, test_case);
 }
 
+static const char *invalid_messages[] =
+{
+  "boolean-has-no-value",
+  "fixed-array-not-divisible",
+  "issue418",
+  "mis-nested-sig",
+  "truncated-variant-sig",
+  "zero-length-variant-sig",
+};
+
 int
 main (int argc,
       char **argv)
 {
   int ret;
+  gsize i;
 
   test_init (&argc, &argv);
 
@@ -304,8 +391,16 @@ main (int argc,
   add_oom_test ("/message/fd", test_fd, NULL);
   add_oom_test ("/message/zero-iter", test_zero_iter, NULL);
 
+  for (i = 0; i < G_N_ELEMENTS (invalid_messages); i++)
+    {
+      gchar *path = g_strdup_printf ("/message/invalid/%s", invalid_messages[i]);
+
+      add_oom_test (path, test_invalid_message_blobs, invalid_messages[i]);
+      g_free (path);
+    }
+
   ret = g_test_run ();
 
-  g_queue_free_full (test_cases_to_free, g_free);
+  g_queue_free_full (test_cases_to_free, oom_test_case_free);
   return ret;
 }