#!/bin/sh
# DF-0410 run — executes the vulnerable harness, then the fixed harness.
# The vulnerable run prints the OOB READ (info leak of bytes past the NUL) and
# the OOB WRITE (heap overflow: alloc=3, written=26 => 23-byte overflow).
# The fixed run shows the same encoded output but the allocation is now sized
# slen*4+3 (83 >= 26), so the overflow is gone.
#
# NOTE: this is a USERSPACE HARNESS, not a live kernel PoC. The vulnerable
# ng_encode_string() lives in netgraph7, which is opt-in (WANT_NETGRAPH7) and is
# NOT compiled into the default X86_64_GENERIC kernel (see VERDICT.md). The
# harness transcribes the function verbatim to prove the primitive at the
# object/harness level, the sanctioned approach for dead/optional code.
set -e
cd "$(dirname "$0")"
echo "########## VULNERABLE ##########"
./df0410_vuln
echo
echo "########## FIXED (-DAPPLY_FIX) ##########"
./df0410_fixed