⬢ DragonFlyBSD Kernel Audit
DF-0608 / verify_typo.sh
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
#!/bin/sh
# DF-0608 verification: confirm the sizeof(ips) typo exists at the cited line
# and that on x86_64 it coincidentally matches the struct size (no runtime impact).
#
# This is a SOURCE-LEVEL Info finding. There is no memory-safety impact on any
# platform DragonFlyBSD currently targets (all 64-bit): sizeof(pointer) == 8
# == sizeof(struct ng_cisco_ipaddr). The bug is a latent CWE-131 that would
# become a 4-byte heap overflow if 32-bit support returned or the struct grew.
set -e
SRC="${1:-/usr/src}"

echo "== 1. Cited typo (netgraph7) =="
grep -nE 'NG_MKRESPONSE\(resp, msg, sizeof\(ips\)' "$SRC/sys/netgraph7/iface/ng_iface.c" || {
    echo "NOT FOUND in netgraph7/ng_iface.c (already fixed?)"
}

echo
echo "== 2. Twin typo (old netgraph) =="
grep -nE 'NG_MKRESPONSE\(resp, msg, sizeof\(ips\)' "$SRC/sys/netgraph/iface/ng_iface.c" || {
    echo "NOT FOUND in netgraph/ng_iface.c (already fixed?)"
}

echo
echo "== 3. struct ng_cisco_ipaddr definition (expect two in_addr = 8 bytes) =="
grep -nA4 'struct ng_cisco_ipaddr {' "$SRC/sys/netgraph7/cisco/ng_cisco.h"

echo
echo "== 4. ips is a pointer (sizeof(ips) = sizeof(pointer) = 8 on amd64) =="
grep -n 'struct ng_cisco_ipaddr \*ips;' "$SRC/sys/netgraph7/iface/ng_iface.c"

echo
echo "== 5. Compile-time size proof (userspace) =="
cc -o /tmp/df0608_sizes -x c - <<'EOF'
#include <stdio.h>
#include <stdint.h>
#include <stddef.h>
struct in_addr { uint32_t s_addr; };       /* 4 bytes, matches kernel layout on amd64 */
struct ng_cisco_ipaddr { struct in_addr ipaddr; struct in_addr netmask; };
int main(void) {
    struct ng_cisco_ipaddr *ips = NULL;
    printf("sizeof(struct ng_cisco_ipaddr) = %zu\n", sizeof(struct ng_cisco_ipaddr));
    printf("sizeof(*ips)                    = %zu\n", sizeof(*ips));
    printf("sizeof(ips)  [pointer, BUGGY]   = %zu\n", sizeof(ips));
    if (sizeof(ips) == sizeof(*ips))
        printf("VERDICT: on this platform sizes coincide -> NO runtime/security impact\n");
    else
        printf("VERDICT: sizes differ -> %zu-byte heap overflow in NG_MKRESPONSE body\n",
               sizeof(*ips) - sizeof(ips));
    return 0;
}
EOF
/tmp/df0608_sizes