From a90cb8f397c5d566d2357ad3511555291c0a390b Mon Sep 17 00:00:00 2001
From: tb <tb@openbsd.org>
Date: Tue, 22 Nov 2022 08:56:33 +0000
Subject: [PATCH] Add a unit test that crashes without bn_print.c r1.34.

---
 regress/lib/libcrypto/bn/general/Makefile  |  8 +-
 regress/lib/libcrypto/bn/general/bn_unit.c | 88 ++++++++++++++++++++++
 2 files changed, 95 insertions(+), 1 deletion(-)
 create mode 100644 regress/lib/libcrypto/bn/general/bn_unit.c

diff --git a/regress/lib/libcrypto/bn/general/Makefile b/regress/lib/libcrypto/bn/general/Makefile
index b9282a11268..22f3e3f95fb 100644
--- a/regress/lib/libcrypto/bn/general/Makefile
+++ b/regress/lib/libcrypto/bn/general/Makefile
@@ -1,4 +1,4 @@
-#	$OpenBSD: Makefile,v 1.15 2022/11/09 23:28:08 tb Exp $
+#	$OpenBSD: Makefile,v 1.16 2022/11/22 08:56:33 tb Exp $
 
 .include "../../Makefile.inc"
 
@@ -8,6 +8,7 @@ PROGS +=	bn_mod_exp2_mont
 PROGS +=	bn_mod_sqrt
 PROGS +=	bn_primes
 PROGS +=	bn_to_string
+PROGS +=	bn_unit
 
 DPADD +=	${LIBCRYPTO}
 LDFLAGS +=	-lcrypto
@@ -44,6 +45,11 @@ REGRESS_TARGETS += run-bn_to_string
 run-bn_to_string: bn_to_string
 	./bn_to_string
 
+REGRESS_TARGETS += run-bn_unit
+run-bn_unit: bn_unit
+	./bn_unit
+
+
 LDADD_bn_isqrt = ${CRYPTO_INT}
 REGRESS_TARGETS += run-bn_isqrt
 run-bn_isqrt: bn_isqrt
diff --git a/regress/lib/libcrypto/bn/general/bn_unit.c b/regress/lib/libcrypto/bn/general/bn_unit.c
new file mode 100644
index 00000000000..fefbded107c
--- /dev/null
+++ b/regress/lib/libcrypto/bn/general/bn_unit.c
@@ -0,0 +1,88 @@
+/*	$OpenBSD: bn_unit.c,v 1.1 2022/11/22 08:56:33 tb Exp $ */
+
+/*
+ * Copyright (c) 2022 Theo Buehler <tb@openbsd.org>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include <sys/resource.h>
+
+#include <err.h>
+#include <limits.h>
+#include <stdlib.h>
+#include <string.h>
+
+#include <openssl/bn.h>
+
+static int
+test_bn_print_wrapper(char *a, size_t size, const char *descr,
+    int (*to_bn)(BIGNUM **, const char *))
+{
+	int ret;
+
+	ret = to_bn(NULL, a);
+	if (ret != 0 && (ret < 0 || (size_t)ret != size - 1)) {
+		fprintf(stderr, "unexpected %s() return"
+		    "want 0 or %zu, got %d\n", descr, size - 1, ret);
+		return 1;
+	}
+
+	return 0;
+}
+
+static int
+test_bn_print_null_derefs(void)
+{
+	struct rlimit rlimit;
+	size_t size = INT_MAX / 4 + 4;
+	size_t datalimit = (size + 500 * 1024) / 1024;
+	char *a;
+	int failed = 0;
+
+	if (getrlimit(RLIMIT_DATA, &rlimit) != 0)
+		err(1, "getrlimit");
+
+	if ((rlimit.rlim_cur + 1023) / 1024 < datalimit) {
+		printf("%s: Insufficient data limit\n", __func__);
+		printf("Need more than %zu kB\n", datalimit);
+		printf("SKIPPED\n");
+		return 0;
+	}
+
+	if ((a = malloc(size)) == NULL)
+		err(1, "malloc(%zu) failed", size);
+
+	memset(a, '0', size - 1);
+	a[size - 1] = '\0';
+
+	failed |= test_bn_print_wrapper(a, size, "BN_dec2bn", BN_dec2bn);
+	failed |= test_bn_print_wrapper(a, size, "BN_hex2bn", BN_hex2bn);
+
+	free(a);
+
+	return failed;
+}
+
+int
+main(void)
+{
+	int failed = 0;
+
+	failed |= test_bn_print_null_derefs();
+
+	if (!failed)
+		printf("SUCCESS\n");
+
+	return failed;
+}
-- 
2.20.1