Merge ~federicoquattrin/qa-regression-testing:add_cjson_tests into qa-regression-testing:master

[Federico Quattrin]

add some cjson tests for CVE-2023-50471 and CVE-2023-50472

add some cjson tests for CVE-2023-50471 and CVE-2023-50472

[Allen Huang (allenpthuang)]

Hi Federico, thanks for the tests! Two small things here: `vm-qrt` seems to need the executable bit set for `test-cjson.py` in order to work properly (and you can see all test-*.py have it set). The other one is you might want to add `gcc` to `QRT-Packages:` too?

Just my 2 ct, thanks again for the tests!

9ba1fd2... by Federico Quattrin on 2024-05-24

added gcc to QRT-Packages and add the execution bit to test-cjson.py

[Federico Quattrin (federicoquattrin)]

> Hi Federico, thanks for the tests! Two small things here: `vm-qrt` seems to
> need the executable bit set for `test-cjson.py` in order to work properly (and
> you can see all test-*.py have it set). The other one is you might want to add
> `gcc` to `QRT-Packages:` too?
>
> Just my 2 ct, thanks again for the tests!

Hey Allen! Thanks for your feedback! I included your proposal in this commit: https://git.launchpad.net/~federicoquattrin/qa-regression-testing/commit/?id=4c10738d499e90f4e41e5ec6d7de353d78427170.

Thanks!

73e682b... by Federico Quattrin on 2024-06-11

added cjson in .launchpad.yml

02c29e5... by Federico Quattrin on 2024-06-14

skip if not 23.10 as USN-6784-1

f63feea... by Federico Quattrin on 2024-06-14

added mantic to .launchpad.yml for CJSON. Noble is still pending to be added

9868187... by Federico Quattrin on 2024-06-14

remove mantic from .launchpad.yaml

Unmerged commits

9868187... by Federico Quattrin on 2024-06-14

remove mantic from .launchpad.yaml

	imagemagick:0 (build)
	imagemagick:1 (build)
	imagemagick:2 (build)
	gcc-security:0 (build)
	gcc-security:1 (build)
	gcc-security:2 (build)
	glibc:0 (build)
	glibc:1 (build)
	glibc:2 (build)
	glibc-security:0 (build)
	glibc-security:1 (build)
	glibc-security:2 (build)
	gnupg:0 (build)
	gnupg:1 (build)
	gnupg:2 (build)
	sudo:0 (build)
	sudo:1 (build)
	sudo:2 (build)
	git:0 (build)
	git:1 (build)
	git:2 (build)
	ghostscript:0 (build)
	ghostscript:1 (build)
	ghostscript:2 (build)
	busybox:0 (build)
	busybox:1 (build)
	busybox:2 (build)
	coreutils:0 (build)
	coreutils:1 (build)
	coreutils:2 (build)
	util-linux:0 (build)
	util-linux:1 (build)
	util-linux:2 (build)
	ecdsautils:0 (build)
	ecdsautils:1 (build)
	ecdsautils:2 (build)
	python-urllib3:0 (build)
	python-urllib3:1 (build)
	python-urllib3:2 (build)
	amanda:0 (build)
	amanda:1 (build)
	cryptojs:0 (build)
	cryptojs:1 (build)
	cryptojs:2 (build)
	samba:0 (build)
	samba:1 (build)
	samba:2 (build)
	cjson:0 (build)
	cjson:1 (build)

1 → 49 of 49 results

First • Previous • Next • Last

f63feea... by Federico Quattrin on 2024-06-14

added mantic to .launchpad.yml for CJSON. Noble is still pending to be added

	imagemagick:0 (build)
	imagemagick:1 (build)
	imagemagick:2 (build)
	gcc-security:0 (build)
	gcc-security:1 (build)
	gcc-security:2 (build)
	glibc:0 (build)
	glibc:1 (build)
	glibc:2 (build)
	glibc-security:0 (build)
	glibc-security:1 (build)
	glibc-security:2 (build)
	gnupg:0 (build)
	gnupg:1 (build)
	gnupg:2 (build)
	sudo:0 (build)
	sudo:1 (build)
	sudo:2 (build)
	git:0 (build)
	git:1 (build)
	git:2 (build)
	ghostscript:0 (build)
	ghostscript:1 (build)
	ghostscript:2 (build)
	busybox:0 (build)
	busybox:1 (build)
	busybox:2 (build)
	coreutils:0 (build)
	coreutils:1 (build)
	coreutils:2 (build)
	util-linux:0 (build)
	util-linux:1 (build)
	util-linux:2 (build)
	ecdsautils:0 (build)
	ecdsautils:1 (build)
	ecdsautils:2 (build)
	python-urllib3:0 (build)
	python-urllib3:1 (build)
	python-urllib3:2 (build)
	amanda:0 (build)
	amanda:1 (build)
	cryptojs:0 (build)
	cryptojs:1 (build)
	cryptojs:2 (build)
	samba:0 (build)
	samba:1 (build)
	samba:2 (build)
	cjson:0 (build)
	cjson:1 (build)
	cjson:2 (build)

1 → 50 of 50 results

First • Previous • Next • Last

02c29e5... by Federico Quattrin on 2024-06-14

skip if not 23.10 as USN-6784-1

73e682b... by Federico Quattrin on 2024-06-11

added cjson in .launchpad.yml

9ba1fd2... by Federico Quattrin on 2024-05-24

added gcc to QRT-Packages and add the execution bit to test-cjson.py

3eaf0d8... by Federico Quattrin on 2024-05-21

added some cjson tests

diff --git a/.launchpad.yaml b/.launchpad.yaml
index 0c44994..6d5519c 100644
--- a/.launchpad.yaml
+++ b/.launchpad.yaml
@@ -16,6 +16,7 @@ pipeline:
     - amanda
     - cryptojs
     - samba
+    - cjson
 
 jobs:
   imagemagick:
@@ -259,3 +260,17 @@ jobs:
       DEBIAN_FRONTEND=noninteractive apt upgrade --assume-yes
     run: |
       ./lpcraft-runner samba
+
+  cjson:
+    matrix:
+      - series: jammy
+        architectures: amd64
+      - series: focal
+        architectures: amd64
+    packages:
+      - sudo
+    run-before: |
+      DEBIAN_FRONTEND=noninteractive apt upgrade --assume-yes
+    run: |
+      ./lpcraft-runner cjson
+
diff --git a/scripts/cjson/CVE-2023-50471.c b/scripts/cjson/CVE-2023-50471.c
 new file mode 100755
index 0000000..24ac499
--- /dev/null
+++ b/scripts/cjson/CVE-2023-50471.c
@@ -0,0 +1,25 @@
+#include <cjson/cJSON.h>
+
+
+char * cve_2023_50471(){
+    cJSON *item = cJSON_CreateString("item");
+    cJSON *array = cJSON_CreateArray();
+    cJSON *temp1 = cJSON_CreateString("item1");
+    cJSON *temp2 = cJSON_CreateString("item2");
+
+    cJSON_AddItemToArray(array, temp1);
+    cJSON_AddItemToArray(array, temp2);
+
+    // manually set the prev to be NULL to make a corrupted array
+    temp2->prev = NULL;
+
+    // SEGV as after_inserted->prev is NULL, which is passed to newitem->prev, making newitem->prev->next a NULL pointer using
+    cJSON_InsertItemInArray(array, 1, item);
+    
+}
+
+int main(int argc, char **argv){
+    
+    cve_2023_50471();
+    return 0;
+}
 \ No newline at end of file
diff --git a/scripts/cjson/CVE-2023-50472.c b/scripts/cjson/CVE-2023-50472.c
 new file mode 100644
index 0000000..be674f4
--- /dev/null
+++ b/scripts/cjson/CVE-2023-50472.c
@@ -0,0 +1,15 @@
+#include <cjson/cJSON.h>
+
+
+char * cve_2023_50472(){
+    cJSON *corruptedItem = cJSON_CreateString("corrupted");
+    corruptedItem->valuestring = NULL;
+    return cJSON_SetValuestring(corruptedItem, "test");
+    
+}
+
+int main(int argc, char **argv){
+    
+    cve_2023_50472();
+    return 0;
+}
 \ No newline at end of file
diff --git a/scripts/cjson/README.md b/scripts/cjson/README.md
 new file mode 100644
index 0000000..f2e8483
--- /dev/null
+++ b/scripts/cjson/README.md
@@ -0,0 +1,7 @@
+This folder contains scripts to test the cJSON library. 
+
+Make sure you install the library by running 
+
+sudo apt install libcjson1
+
+
diff --git a/scripts/cjson/bug.c b/scripts/cjson/bug.c
 new file mode 100644
index 0000000..2d989e9
--- /dev/null
+++ b/scripts/cjson/bug.c
@@ -0,0 +1,33 @@
+#include <cjson/cJSON.h>
+
+/*
+This file tries to trigger the bug thats fixed here: https://github.com/DaveGamble/cJSON/commit/f66cbab4bfb3926ffd4c5e13f9fb6d506ee0241d
+*/
+
+
+int bug(){
+    cJSON *item = cJSON_CreateString("item");
+    cJSON *array = cJSON_CreateArray();
+    cJSON *temp1 = cJSON_CreateString("item1");
+    cJSON *temp2 = cJSON_CreateString("item2");
+    int ret = -1;
+
+    cJSON_AddItemToArray(array, temp1);
+    cJSON_AddItemToArray(array, temp2);
+
+    // insert item. After this operation array should have 3 items.
+    cJSON_InsertItemInArray(array, 1, item);
+
+    if(cJSON_GetArraySize(array) == 3){
+        ret = 0; 
+    }
+    
+    // Free the memory allocated for cJSON objects
+    cJSON_Delete(array);
+    return ret;
+    
+}
+
+int main(int argc, char **argv){
+    return bug();
+}
 \ No newline at end of file
diff --git a/scripts/cjson/happy_path.c b/scripts/cjson/happy_path.c
 new file mode 100644
index 0000000..e41e186
--- /dev/null
+++ b/scripts/cjson/happy_path.c
@@ -0,0 +1,137 @@
+#include <cjson/cJSON.h>
+#include <stdio.h>
+
+char *create_monitor(void)
+{
+    const unsigned int resolution_numbers[3][2] = {
+        {1280, 720},
+        {1920, 1080},
+        {3840, 2160}
+    };
+    char *string = NULL;
+    cJSON *name = NULL;
+    cJSON *resolutions = NULL;
+    cJSON *resolution = NULL;
+    cJSON *width = NULL;
+    cJSON *height = NULL;
+    size_t index = 0;
+
+    cJSON *monitor = cJSON_CreateObject();
+    if (monitor == NULL)
+    {
+        goto end;
+    }
+
+    name = cJSON_CreateString("Awesome 4K");
+    if (name == NULL)
+    {
+        goto end;
+    }
+    /* after creation was successful, immediately add it to the monitor,
+     * thereby transferring ownership of the pointer to it */
+    cJSON_AddItemToObject(monitor, "name", name);
+
+    resolutions = cJSON_CreateArray();
+    if (resolutions == NULL)
+    {
+        goto end;
+    }
+    cJSON_AddItemToObject(monitor, "resolutions", resolutions);
+
+    for (index = 0; index < (sizeof(resolution_numbers) / (2 * sizeof(int))); ++index)
+    {
+        resolution = cJSON_CreateObject();
+        if (resolution == NULL)
+        {
+            goto end;
+        }
+        cJSON_AddItemToArray(resolutions, resolution);
+
+        width = cJSON_CreateNumber(resolution_numbers[index][0]);
+        if (width == NULL)
+        {
+            goto end;
+        }
+        cJSON_AddItemToObject(resolution, "width", width);
+
+        height = cJSON_CreateNumber(resolution_numbers[index][1]);
+        if (height == NULL)
+        {
+            goto end;
+        }
+        cJSON_AddItemToObject(resolution, "height", height);
+    }
+
+    string = cJSON_Print(monitor);
+    if (string == NULL)
+    {
+        fprintf(stderr, "Failed to print monitor.\n");
+    }
+
+end:
+    cJSON_Delete(monitor);
+    return string;
+}
+
+/* return 1 if the monitor supports full hd, 0 otherwise */
+int supports_full_hd(const char * const monitor)
+{
+    const cJSON *resolution = NULL;
+    const cJSON *resolutions = NULL;
+    const cJSON *name = NULL;
+    int status = 0;
+    cJSON *monitor_json = cJSON_Parse(monitor);
+    if (monitor_json == NULL)
+    {
+        const char *error_ptr = cJSON_GetErrorPtr();
+        if (error_ptr != NULL)
+        {
+            fprintf(stderr, "Error before: %s\n", error_ptr);
+        }
+        status = 0;
+        goto end;
+    }
+
+    name = cJSON_GetObjectItemCaseSensitive(monitor_json, "name");
+
+    resolutions = cJSON_GetObjectItemCaseSensitive(monitor_json, "resolutions");
+    cJSON_ArrayForEach(resolution, resolutions)
+    {
+        cJSON *width = cJSON_GetObjectItemCaseSensitive(resolution, "width");
+        cJSON *height = cJSON_GetObjectItemCaseSensitive(resolution, "height");
+
+        if (!cJSON_IsNumber(width) || !cJSON_IsNumber(height))
+        {
+            status = 0;
+            goto end;
+        }
+
+        if ((width->valuedouble == 1920) && (height->valuedouble == 1080))
+        {
+            status = 1;
+            goto end;
+        }
+    }
+
+end:
+    cJSON_Delete(monitor_json);
+    return status;
+}
+
+
+int happy_path(){
+    if(supports_full_hd(create_monitor())){
+        fprintf(stdout, "Successfully crate and read a JSON.\n");
+        return 0;
+    }
+    else{
+        fprintf(stderr, "Failed crate and read a JSON.\n");
+        return 1;
+    }
+}
+
+
+int main(int argc, char **argv){
+    
+    return happy_path();
+}
 \ No newline at end of file
diff --git a/scripts/test-cjson.py b/scripts/test-cjson.py
 new file mode 100755
index 0000000..d67e822
--- /dev/null
+++ b/scripts/test-cjson.py
@@ -0,0 +1,128 @@
+#!/usr/bin/python3
+#
+#    test-cjson.py quality assurance test script for cjson
+#    Copyright (C) 2024 Canonical Ltd.
+#    Author: Federico Quattrin  <[e-mail]>
+#
+#    This program is free software: you can redistribute it and/or modify
+#    it under the terms of the GNU General Public License version 3,
+#    as published by the Free Software Foundation.
+#
+#    This program is distributed in the hope that it will be useful,
+#    but WITHOUT ANY WARRANTY; without even the implied warranty of
+#    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+#    GNU General Public License for more details.
+#
+#    You should have received a copy of the GNU General Public License
+#    along with this program. If not, see <http://www.gnu.org/licenses/>.
+#
+
+
+# QRT-Packages: libcjson-dev libcjson1 gcc
+# QRT-Depends: cjson
+
+
+'''
+    In general, this test should be run in a virtual machine (VM) or possibly
+    a chroot and not on a production machine. While efforts are made to make
+    these tests non-destructive, there is no guarantee this script will not
+    alter the machine. You have been warned.
+
+    How to run in a clean VM:
+    $ ./make-test-tarball test-<script>.py     # creates tarball in /tmp/
+    $ scp /tmp/qrt-test-<script>.tar.gz [e-mail]:/tmp
+    on VM:
+    # cd /tmp ; tar zxvf ./qrt-test-<script>.tar.gz
+    # cd /tmp/qrt-test-<script> ; ./install-packages ./test-<script>.py
+    # ./test-<script>.py -v
+
+    To run in all VMs named sec*:
+    $ vm-qrt -p sec test-<script.py>
+
+    ### TODO: update for ./install-packages step ###
+    How to run in a clean schroot named 'lucid':
+    $ schroot -c lucid -u root -- sh -c 'apt-get -y install lsb-release <QRT-Packages> && ./test-PKG.py -v'
+'''
+
+from __future__ import print_function
+
+import os
+import subprocess
+import sys
+import unittest
+import testlib
+from string import ascii_letters
+import random
+
+
+
+class TestCJSON(testlib.TestlibCase):
+    '''Test my thing.'''
+
+    def setUp(self):
+        '''Set up prior to each test_* function''' 
+        self.output_name = "cjson/cjson_{}".format("".join(random.choice(ascii_letters) for i in range(5))) 
+
+
+    def tearDown(self):
+        '''Clean up after each test_* function'''
+        if os.path.isfile(self.output_name):
+            os.remove(self.output_name)
+
+    @unittest.skipIf(
+        testlib.manager.lsb_release['Release'] != 23.10,
+        "Skipping test for Ubuntu {} since updates are in ESM".format(testlib.manager.lsb_release['Release'])
+    )
+    def test_cve_2023_50471(self):
+        '''Test cve_2023_50471'''
+        test_name = "cjson/CVE-2023-50471.c" 
+        if not self._compile_test(test_name):
+            raise Exception(f"It was not possible to compile the source code of {test_name}") 
+        self.assertTrue(self._execute_test(self.output_name))
+    
+    @unittest.skipIf(
+        testlib.manager.lsb_release['Release'] != 23.10,
+        "Skipping test for Ubuntu {} since updates are in ESM".format(testlib.manager.lsb_release['Release'])
+    )
+    def test_cve_2023_50472(self):
+        '''Test cve_2023_50472'''
+        test_name = "cjson/CVE-2023-50472.c" 
+        if not self._compile_test(test_name):
+            raise Exception(f"It was not possible to compile the source code of {test_name}") 
+        self.assertTrue(self._execute_test(self.output_name))
+    
+    def test_happy_path(self):
+        '''Test if we are able to create and read JSON files using CJSON.'''
+        test_name = "cjson/happy_path.c" 
+        if not self._compile_test(test_name):
+            raise Exception(f"It was not possible to compile the source code of {test_name}") 
+        self.assertTrue(self._execute_test(self.output_name))
+    
+    @unittest.skipIf(
+        testlib.manager.lsb_release['Release'] != 23.10,
+        "Skipping test for Ubuntu {} since updates are in ESM".format(testlib.manager.lsb_release['Release'])
+    )
+    def test_cve_2023_50472_bug(self):
+        '''Test if the fix for CVE-2023-50472 has the bug fixed in this commit: https://github.com/DaveGamble/cJSON/commit/f66cbab4bfb3926ffd4c5e13f9fb6d506ee0241d.'''
+        test_name = "cjson/bug.c" 
+        if not self._compile_test(test_name):
+            raise Exception(f"It was not possible to compile the source code of {test_name}") 
+        self.assertTrue(self._execute_test(self.output_name))
+    
+
+    def _compile_test(self, test_name):
+        subprocess.run(['gcc', '-o', self.output_name, test_name, "-lcjson"])
+        if os.path.isfile(self.output_name):
+            return True
+        return False
+
+    @staticmethod
+    def _execute_test(test_name):
+        # give execution rights
+        subprocess.run(['chmod', '+x', test_name])
+        output = subprocess.run([test_name], capture_output=True)
+        return output.returncode == 0
+
+
+if __name__ == '__main__':
+    unittest.main()