DF-0785 / harness_compare.log
=== UNFIXED (buggy) === [harness] DF-0785 ntfs_ntlookupfile overflow transcription [harness] blsize (ir_size, kmalloc) = 16 [harness] rdsize (va_datalen, copy) = 200 [harness] OVERFLOW = 184 attacker-controlled bytes past 16-byte object [harness] rdbuf = 0x80047cff0 (last 16 bytes of a page; next page PROT_NONE) [harness] performing ntfs_readattr-equivalent memcpy of 200 bytes... Segmentation fault (core dumped) UNFIXED_EXIT=139 === FIXED === [harness-fixed] blsize=16 rdsize=200 -> kmalloc(max)=200 [harness-fixed] rdbuf=0x80047bf38 (last 200 bytes of page; next page PROT_NONE) [harness-fixed] performing memcpy of 200 bytes (fits in 200-byte buffer)... [harness-fixed] memcpy completed cleanly -- NO OVERFLOW (fix effective) FIXED_EXIT=0