Re: buffer overflow in regcomp and a way to find more of those

[Rich Felker <dalias@libc.org>]

On Mon, Mar 23, 2015 at 11:46:04AM -0400, stephen Turner wrote:
> On Mon, Mar 23, 2015 at 10:53 AM, Szabolcs Nagy <nsz@port70.net> wrote:
> 
> > * stephen Turner <stephen.n.turner@gmail.com> [2015-03-23 10:40:01 -0400]:
> > > So musl doesn't have any tests currently to ensure it was built correctly
> >
> > it has tests, just not in the main repo
> >
> > > by testing its responses to calls? I have seen a few packages such as
> > > binutils come with its own built in test which I would gladly make use of
> > > if it was available.
> >
> > you can use the tests, they are available at
> > http://nsz.repo.hu/git/?p=libc-test
> >
> > (which was supposed to be a temporary location until
> > a cleanup is done..)
> >
> nice, i will give those a spin. Is there any consideration for making them
> a feature/available in the release source files?

From a release and build system standpoint, it really makes sense to
do tests separately, not integrated.

The biggest reason is not making cross-compiling a special case, but
isolating the concept of "libs/binaries generated for the target" as
something non-executable on the host. Other packages generally do a
poor job of this and then either cross-compiling breaks you you need
lots of cross-specific logic in the build system. With separate tests,
musl's build has no reason to care if it's being cross-compiled, and
testing a cross-compiled libc (if you feel a need to) is a matter of
how you script the build of everything for the cross toolchain and
environment rather.

Other than that, nsz has aimed to make all the tests libc-agnostic, so
they can also be used to test other libcs for conformance and bugs.
This works well with glibc already but uclibc has so much missing that
lots of the tests are gratuitously failing.

Rich