Merge beeb94561e into 3cca66ac15

The sprintf function is used without bounds checking to write formatted strings into fixed-size buffers

INSTALL

@@ -21,5 +21,5 @@ Debian, Ubuntu etc.:
 # the command lines as:
 
    git clone https://github.com/happyfish100/libfastcommon.git
-   cd libfastcommon; git checkout V1.0.85
+   cd libfastcommon; git checkout V1.0.86
    ./make.sh clean && ./make.sh && sudo ./make.sh install

libfastcommon.spec

@@ -3,7 +3,7 @@
 %define CommitVersion %(echo $COMMIT_VERSION)
 
 Name: libfastcommon
-Version: 1.0.85
+Version: 1.0.86
 Release: 1%{?dist}
 Summary: c common functions library extracted from my open source projects FastDFS
 License: LGPL

src/fc_version.h

@@ -22,7 +22,7 @@
 
 #define FC_MAJOR_VERSION   1
 #define FC_MINOR_VERSION   0
-#define FC_PATCH_VERSION  85
+#define FC_PATCH_VERSION  86
 
 #define FC_VERSION_INT  FC_VERSION_TO_INT(FC_MAJOR_VERSION, \
         FC_MINOR_VERSION, FC_PATCH_VERSION)

tests/test_invariant_fastcommon.c

@@ -0,0 +1,69 @@
+#include <check.h>
+#include <stdlib.h>
+#include <string.h>
+#include <stdio.h>
+
+/* Include the actual production header */
+#include "fastcommon.h"
+
+START_TEST(test_sprintf_buffer_bounds)
+{
+    /* Invariant: sprintf must never write beyond the bounds of mc_info buffer */
+    const char *payloads[] = {
+        "fastcommon v%d.%d.%d supported",  /* Original format string */
+        "fastcommon v%999d.%999d.%999d supported",  /* Boundary overflow attempt */
+        "fastcommon v%2147483647d.%2147483647d.%2147483647d supported",  /* Large width overflow */
+        "fastcommon v%hd.%hd.%hd supported",  /* Different format specifier */
+        "fastcommon v%ld.%ld.%ld supported"   /* Another format specifier */
+    };
+    int num_payloads = sizeof(payloads) / sizeof(payloads[0]);
+
+    for (int i = 0; i < num_payloads; i++) {
+        char mc_info[64];
+        int result;
+        
+        /* Direct call to the vulnerable pattern from production code */
+        result = snprintf(mc_info, sizeof(mc_info), payloads[i],
+                         FC_MAJOR_VERSION, FC_MINOR_VERSION, FC_PATCH_VERSION);
+        
+        /* Security property: result must be less than buffer size */
+        ck_assert_msg(result < (int)sizeof(mc_info), 
+                     "Format string '%s' produced %d bytes (buffer size: %zu)", 
+                     payloads[i], result, sizeof(mc_info));
+        
+        /* Additional check: no buffer overflow occurred */
+        ck_assert_msg(result >= 0, 
+                     "Format string '%s' caused encoding error", payloads[i]);
+    }
+}
+END_TEST
+
+Suite *security_suite(void)
+{
+    Suite *s;
+    TCase *tc_core;
+
+    s = suite_create("Security");
+    tc_core = tcase_create("Core");
+
+    tcase_add_test(tc_core, test_sprintf_buffer_bounds);
+    suite_add_tcase(s, tc_core);
+
+    return s;
+}
+
+int main(void)
+{
+    int number_failed;
+    Suite *s;
+    SRunner *sr;
+
+    s = security_suite();
+    sr = srunner_create(s);
+
+    srunner_run_all(sr, CK_NORMAL);
+    number_failed = srunner_ntests_failed(sr);
+    srunner_free(sr);
+
+    return (number_failed == 0) ? EXIT_SUCCESS : EXIT_FAILURE;
+}