DragonFlyBSD Kernel Audit
1084 / fix_harness_run.log
← back to finding ↓ download raw
crom_init_context: info_len 255 too large
=== DF-1084: crom_init_context info_len overflow ===
hdr->info_len        = 255
logical csrrom range = quads [0 .. 256)  (1024 bytes)
&rom[256] (OOB start)= 0x403660
cc.depth             = -1
cc.stack[0].dir      = 0x0
cc.stack[0].index    = 0
[-] 1084: parser bailed (cc.depth=-1); OOB crc_len happened to be 0 in the test backing store.

=== DF-1086: crom_parse_text crc_len bytes-vs-quads ===
root dir @ quad 5, text-leaf @ quad 250, crc_len=20
CROM_END = byte 1023 (quad 255); leaf byte-check 1000+20=1020 <=1023 PASSES
but quad loop reads text[0..17] = quads 253..270 -> quads 256..270 are OOB
crom_parse_text output bytes (hex, first 96):
  286e756c6c29000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
[-] 1086: only 0 OOB bytes detected.
RC=0