From c9a240a62ce54b0b0cbf883612ffc6e199ca7f23 Mon Sep 17 00:00:00 2001
From: Scott Vokes <svokes@fastly.com>
Date: Fri, 8 Nov 2024 16:22:57 -0500
Subject: [PATCH] Add a regression test for the memory leak.

I verified that LeakSanitizer catches the leak during this test when the
fix is reverted.

This commit adds a test directory, `tests/regressions`, for misc.
regression tests that need a .c file and aren't easily testable via fsm,
re, etc. inputs.
---
 Makefile                                      |  1 +
 tests/regressions/Makefile                    | 20 ++++++
 ...regressions_determinise_state_limit_leak.c | 69 +++++++++++++++++++
 3 files changed, 90 insertions(+)
 create mode 100644 tests/regressions/Makefile
 create mode 100644 tests/regressions/regressions_determinise_state_limit_leak.c

diff --git a/Makefile b/Makefile
index 514f80bba..7075e432d 100644
--- a/Makefile
+++ b/Makefile
@@ -136,6 +136,7 @@ SUBDIR += tests/pcre-repeat
 SUBDIR += tests/pred
 SUBDIR += tests/re_literal
 SUBDIR += tests/re_strings
+SUBDIR += tests/regressions
 SUBDIR += tests/reverse
 SUBDIR += tests/trim
 SUBDIR += tests/union
diff --git a/tests/regressions/Makefile b/tests/regressions/Makefile
new file mode 100644
index 000000000..624353ef6
--- /dev/null
+++ b/tests/regressions/Makefile
@@ -0,0 +1,20 @@
+.include "../../share/mk/top.mk"
+
+TEST.tests/regressions != ls -1 tests/regressions/regressions*.c
+TEST_SRCDIR.tests/regressions = tests/regressions
+TEST_OUTDIR.tests/regressions = ${BUILD}/tests/regressions
+
+.for n in ${TEST.tests/regressions:T:R:C/^regressions//}
+INCDIR.${TEST_SRCDIR.tests/regressions}/regressions${n}.c += src/adt
+.endfor
+
+.for n in ${TEST.tests/regressions:T:R:C/^regressions//}
+test:: ${TEST_OUTDIR.tests/regressions}/res${n}
+SRC += ${TEST_SRCDIR.tests/regressions}/regressions${n}.c
+CFLAGS.${TEST_SRCDIR.tests/regressions}/regressions${n}.c += -UNDEBUG
+
+${TEST_OUTDIR.tests/regressions}/run${n}: ${TEST_OUTDIR.tests/regressions}/regressions${n}.o ${BUILD}/lib/libfsm.a ${BUILD}/lib/libre.a
+	${CC} ${CFLAGS} ${CFLAGS.${TEST_SRCDIR.tests/regressions}/regressions${n}.c} -o ${TEST_OUTDIR.tests/regressions}/run${n} ${TEST_OUTDIR.tests/regressions}/regressions${n}.o ${BUILD}/lib/libfsm.a ${BUILD}/lib/libre.a
+${TEST_OUTDIR.tests/regressions}/res${n}: ${TEST_OUTDIR.tests/regressions}/run${n}
+	( ${TEST_OUTDIR.tests/regressions}/run${n} 1>&2 && echo PASS || echo FAIL ) > ${TEST_OUTDIR.tests/regressions}/res${n}
+.endfor
diff --git a/tests/regressions/regressions_determinise_state_limit_leak.c b/tests/regressions/regressions_determinise_state_limit_leak.c
new file mode 100644
index 000000000..afdfbd9c5
--- /dev/null
+++ b/tests/regressions/regressions_determinise_state_limit_leak.c
@@ -0,0 +1,69 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <stdbool.h>
+#include <string.h>
+
+#include <assert.h>
+
+#include <re/re.h>
+#include <fsm/fsm.h>
+#include <fsm/bool.h>
+
+static const char *strings[] = {
+	[0] = "apple",
+	[1] = "banana",
+	[2] = "carrot",
+	[3] = "durian",
+	[4] = "eggplant",
+};
+#define STRING_COUNT sizeof(strings)/sizeof(strings[0])
+
+int main(void)
+{
+	struct fsm *fsms[STRING_COUNT] = {0};
+
+	for (size_t i = 0; i < STRING_COUNT; i++) {
+		fsms[i] = re_comp(RE_PCRE, fsm_sgetc, &strings[i], NULL, 0, NULL);
+		assert(fsms[i] != NULL);
+	}
+
+	struct fsm *combined_fsm = fsm_union_array(STRING_COUNT, fsms, NULL);
+	assert(combined_fsm != NULL);
+
+	size_t state_limit_base = fsm_countstates(combined_fsm);
+	size_t max_state_limit = state_limit_base + 100;
+
+	bool hit_state_limit = false;
+
+	for (size_t state_limit = state_limit_base; state_limit < max_state_limit; state_limit += 10) {
+		struct fsm *cp = fsm_clone(combined_fsm);
+
+		const struct fsm_determinise_config det_config = {
+			.state_limit = state_limit,
+		};
+
+		/* Previously this would leak memory when hitting the STATE_LIMIT_REACHED
+		 * early exit, because the edge sets for the DFA being constructed were
+		 * not freed properly.
+		 *
+		 * The first time this should fail immediately because the state limit IS the starting size,
+		 * but later on it should halt in the middle of construction. */
+		switch (fsm_determinise_with_config(cp, &det_config)) {
+		case FSM_DETERMINISE_WITH_CONFIG_OK:
+			fsm_free(cp);
+			break;
+		case FSM_DETERMINISE_WITH_CONFIG_STATE_LIMIT_REACHED:
+			hit_state_limit = true;
+			fsm_free(cp);
+			break;
+		case FSM_DETERMINISE_WITH_CONFIG_ERRNO:
+			assert(!"internal error");
+			return EXIT_FAILURE;
+		}
+	}
+
+	assert(hit_state_limit);
+
+	fsm_free(combined_fsm);
+	return EXIT_SUCCESS;
+}