LD_LIBRARY_PATH=. ./test/test_flash_handler
[==========] flash_handler: Running 39 test(s).
[ RUN ] test_simple
malloc(): corrupted top size
qemu: uncaught target signal 6 (Aborted) - core dumped
Aborted (core dumped) LD_LIBRARY_PATH=. ./test/test_flash_handler
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Gianfranco Costamagna <
locutu...@debian.org>
Date: Jun, 18 2026 12:36:50 +0200
Subject: [PATCH] Fix undefined behaviour with -O3
open() is not declared as:
int open(const char *, int);
Its actual prototype is:
int open(const char *pathname, int flags, ...);
Internally, mkstemps() eventually calls open(..., O_CREAT | ..., mode).
Because you've wrapped open() with a non-variadic function, you have an ABI mismatch:
caller passes 3 arguments
wrapper accepts 2 arguments
That's undefined behavior.
--- swupdate-2026.05+dfsg.orig/test/test_flash_handler.c
+++ swupdate-2026.05+dfsg/test/test_flash_handler.c
@@ -97,25 +97,50 @@ void *__wrap_malloc(size_t size)
return impl_malloc(size);
}
-int __real_open(const char *pathname, int flags);
-static int default_open(const char *pathname, int flags)
+int __real_open(const char *pathname, int flags, ...);
+static int default_open(const char *pathname, int flags, ...)
{
- int ret;
- if (strcmp(pathname, image.device) == 0)
- return MTD_FD;
- ret = __real_open(pathname, flags);
- /* Usually file descriptors start from 0. Since MTD_FD is big enough,
- * a collision is very unlikely. */
- assert_int_not_equal(ret, MTD_FD);
- return ret;
-}
-static int (*impl_open)(const char *pathname, int flags) = default_open;
-int __wrap_open(const char *pathname, int flags);
-int __wrap_open(const char *pathname, int flags)
-{
- return impl_open(pathname, flags);
+ mode_t mode = 0;
+
+ if (flags & (O_CREAT | O_TMPFILE)) {
+ va_list ap;
+ va_start(ap, flags);
+ mode = va_arg(ap, mode_t);
+ va_end(ap);
+ }
+
+ if (strcmp(pathname, image.device) == 0)
+ return MTD_FD;
+
+ int ret;
+
+ if (flags & (O_CREAT | O_TMPFILE))
+ ret = __real_open(pathname, flags, mode);
+ else
+ ret = __real_open(pathname, flags);
+
+ assert_int_not_equal(ret, MTD_FD);
+
+ return ret;
}
+static int (*impl_open)(const char *pathname, int flags, ...) = default_open;
+int __wrap_open(const char *pathname, int flags, ...);
+int __wrap_open(const char *pathname, int flags, ...)
+{
+ mode_t mode = 0;
+
+ if (flags & (O_CREAT | O_TMPFILE)) {
+ va_list ap;
+ va_start(ap, flags);
+ mode = va_arg(ap, mode_t);
+ va_end(ap);
+ }
+ if (flags & (O_CREAT | O_TMPFILE))
+ return impl_open(pathname, flags, mode);
+
+ return impl_open(pathname, flags);
+}
int __real_close(int fd);
int __wrap_close(int fd);
int __wrap_close(int fd)
@@ -954,7 +979,7 @@ static void test_empty_image(void **stat
}
static int open_mtd_dev_failure_errno;
-static int open_mtd_dev_failure(const char *pathname, int flags)
+static int open_mtd_dev_failure(const char *pathname, int flags, ...)
{
if (strcmp(pathname, image.device) == 0) {
errno = open_mtd_dev_failure_errno;
G.