#!/bin/sh
# DF-0451 run: send NGM_BINARY2ASCII with a crafted inner ng_mesg whose
# nodeinfo-struct fixedstring fields (name[NG_NODESIZ=32], type[NG_TYPESIZ=32])
# have NO NUL terminators; observe ng_fixedstring_unparse's strlen run past
# bufSize into adjacent fields / heap.  Run as root; ng_socket.ko must be loaded.
#
# Required setup (root, one-time):
#   kldload ng_socket.ko
#
# Expected (bug present): "name=" field contains 72 'E's + several leaked
#                          bytes from kernel heap (e.g. "5yJyL.s" or "P>\\x99\\x89").
# Expected (bug fixed):   "name=" field contains exactly 32 'E's; the
#                          fixedstring strlen stopped at bufSize.
ng_present=$(kldstat | grep -c '^.*ng_socket.ko')
[ "$ng_present" -lt 1 ] && kldload ng_socket.ko
exec ./ng_fixedstring_oob