#!/bin/sh
# DF-0450 run: send NGM_BINARY2ASCII with a crafted inner ng_mesg whose data
# area has no NUL terminator, observe strlen() leak past the user allocation
# into kernel heap.  Run as root; ng_socket.ko + netgraph.ko must be loaded.
#
# Required setup (root, one-time):
#   kldload ng_socket.ko
#
# Expected (bug present): ascii->data shows "DDDD...DDDD\\x02\\x02" or similar
#                          -- bytes AFTER the 64 user-controlled D's came from
#                          kernel heap.
# Expected (bug fixed):   ascii->data is exactly "DDDD...DDDD" (64 D's, no leak);
#                          arglen == 67 (1+64+1 quotes + 1 NUL), down from 75.
ng_present=$(kldstat | grep -c '^.*ng_socket.ko')
[ "$ng_present" -lt 1 ] && kldload ng_socket.ko
exec ./ng_oob_leak