shinys000114/libssh
1
0
Fork 0
mirror of https://git.libssh.org/projects/libssh.git synced 2026-02-28 07:13:54 +09:00
Code Issues Packages Projects Releases Wiki Activity

tests: Add opendir handle exhaustion test for sftpserver

Browse Source 
Add torture_server_sftp_opendir_handles_exhaustion test that
exercises the error path in process_opendir() when all SFTP
handles are occupied. This covers the memory leak fix for
h->name that was missing in the sftp_handle_alloc() failure path.

The test exhausts all 256 handle slots with sftp_open(), then
verifies that sftp_opendir() fails gracefully without crashing
or leaking memory.

Signed-off-by: Mingyuan Li <2560359315@qq.com>
Reviewed-by: Jakub Jelen <jjelen@redhat.com>
This commit is contained in:
Mingyuan Li
2026-02-23 23:31:56 +08:00
committed by Jakub Jelen
parent 0d9b2c68cc
commit 60d6179eaa
1 changed files with 43 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

43
tests/server/torture_sftpserver.c
View File

@@ -1130,6 +1130,46 @@ static void torture_server_sftp_handles_exhaustion(void **state)
} }
} }
static void torture_server_sftp_opendir_handles_exhaustion(void **state)
{
struct test_server_st *tss = *state;
struct torture_state *s = NULL;
struct torture_sftp *tsftp = NULL;
char name[128] = {0};
sftp_file handles[SFTP_HANDLES] = {0};
sftp_dir dir = NULL;
sftp_session sftp = NULL;
int rc;
assert_non_null(tss);
s = tss->state;
assert_non_null(s);
tsftp = s->ssh.tsftp;
assert_non_null(tsftp);
sftp = tsftp->sftp;
assert_non_null(sftp);
/* Occupy all handles with files */
for (int i = 0; i < SFTP_HANDLES; i++) {
snprintf(name, sizeof(name), "%s/fn%d", tsftp->testdir, i);
handles[i] = sftp_open(sftp, name, O_WRONLY | O_CREAT, 0700);
assert_non_null(handles[i]);
}
/* Opening a directory should fail gracefully without leaking h->name */
dir = sftp_opendir(sftp, tsftp->testdir);
assert_null(dir);
/* cleanup */
for (int i = 0; i < SFTP_HANDLES; i++) {
rc = sftp_close(handles[i]);
assert_int_equal(rc, SSH_OK);
}
}
static void torture_server_sftp_handle_overrun(void **state) static void torture_server_sftp_handle_overrun(void **state)
{ {
struct test_server_st *tss = *state; struct test_server_st *tss = *state;
@@ -1290,6 +1330,9 @@ int torture_run_tests(void) {
cmocka_unit_test_setup_teardown(torture_server_sftp_handles_exhaustion, cmocka_unit_test_setup_teardown(torture_server_sftp_handles_exhaustion,
session_setup_sftp, session_setup_sftp,
session_teardown), session_teardown),
cmocka_unit_test_setup_teardown(torture_server_sftp_opendir_handles_exhaustion,
session_setup_sftp,
session_teardown),
cmocka_unit_test_setup_teardown(torture_server_sftp_handle_overrun, cmocka_unit_test_setup_teardown(torture_server_sftp_handle_overrun,
session_setup_sftp, session_setup_sftp,
session_teardown), session_teardown),