/*	$OpenBSD: malloc0test.c,v 1.5 2008/04/13 00:22:17 djm Exp $	*/
/*
 * Public domain.  2001, Theo de Raadt
 */
#include <sys/types.h>
#include <sys/signal.h>
#include <stdio.h>
#include <unistd.h>
#include <stdlib.h>
#include <setjmp.h>
#include <limits.h>
#include <errno.h>

volatile sig_atomic_t got;
jmp_buf jmp;

static void
catch(int signo)
{
	got++;
	longjmp(jmp, 1);
}

static int
test(char *p, int size)
{
	signal(SIGSEGV, catch);
	got = 0;
	if (setjmp(jmp) == 0)
		*p = 0;
	if (setjmp(jmp) == 0)
		*(p+size-1) = 0;
	return (got);
}

char *prot_table[] = {
	"unprotected",
	"fuckup",
	"protected"
};

#define SIZE	10

/*
 * Do random memory allocations.
 *
 * For each one, ensure that it is at least 16 bytes in size (that
 * being what our current malloc returns for the minsize of an
 * object, alignment wise);
 *
 * For zero-byte allocations, check that they are still aligned.
 *
 * For each object, ensure that they are correctly protected or not
 * protected.
 *
 * Does not regress test malloc + free combinations ... it should.
 */
int
main(int argc, char *argv[])
{
	caddr_t blob;
	int size, tsize;
	int prot;
	int rval = 0, fuckup = 0;
	long limit = 200000, count;
	int ch, silent = 0;
	char *ep;
	extern char *__progname;

	while ((ch = getopt(argc, argv, "sn:")) != -1) {
		switch (ch) {
		case 's':
			silent = 1;
			break;
		case 'n':
			errno = 0;
			limit = strtol(optarg, &ep, 10);
			if (optarg[0] == '\0' || *ep != '\0' ||
			    (errno == ERANGE &&
			     (limit == LONG_MAX || limit == LONG_MIN)))
				goto usage;
			break;
		default:
usage:
			fprintf(stderr, "Usage: %s [-s][-n <count>]\n",
			    __progname);
			exit(1);
		}
	}

	if (limit == 0)
		limit = LONG_MAX;

	for (count = 0; count < limit; count++) {
		size = arc4random_uniform(SIZE);
		blob = malloc(size);
		if (blob == NULL) {
			fprintf(stderr, "success: out of memory\n");
			exit(rval);
		}

		tsize = size == 0 ? 16 : size;
		fuckup = 0;
		prot = test(blob, tsize);

		if (size == 0 && prot < 2)
			fuckup = 1;

		if (fuckup) {
			printf("%8p %6d %20s %10s\n", blob, size,
			    prot_table[prot], fuckup ? "fuckup" : "");
			rval = 1;
		}

		if (!silent && count % 100000 == 0 && count != 0)
			fprintf(stderr, "count = %ld\n", count);
	}

	return rval;
}