DF-0641 / harness_run.log
$ cc -O2 -o overflow_harness overflow_harness.c && ./overflow_harness vc_pass (original password) : 128 bytes pbuf after UTF-8->ISO8859-1 iconv : 64 bytes (SHORTENED) plen = strlen(pbuf)+1 : 65 uniplen = plen*2 (kmalloc size) : 130 smb_strtouni writes (from vc_pass) : 258 bytes ==> HEAP OVERFLOW : 128 bytes overflow content: attacker-controlled (Unicode expansion of pw) RESULT: ntencpass (slab bucket for 130) overflows by 128 bytes => kernel heap corruption (C:H/I:H/A:H) HARNESS_RC=0