DragonFlyBSD Kernel Audit
DF-0785 / harness_compare.log
← back to finding ↓ download raw
=== UNFIXED (buggy) ===
[harness] DF-0785 ntfs_ntlookupfile overflow transcription
[harness] blsize (ir_size,  kmalloc)  = 16
[harness] rdsize (va_datalen, copy)   = 200
[harness] OVERFLOW = 184 attacker-controlled bytes past 16-byte object
[harness] rdbuf  = 0x80047cff0  (last 16 bytes of a page; next page PROT_NONE)
[harness] performing ntfs_readattr-equivalent memcpy of 200 bytes...
Segmentation fault (core dumped)
UNFIXED_EXIT=139
=== FIXED ===
[harness-fixed] blsize=16 rdsize=200  -> kmalloc(max)=200
[harness-fixed] rdbuf=0x80047bf38 (last 200 bytes of page; next page PROT_NONE)
[harness-fixed] performing memcpy of 200 bytes (fits in 200-byte buffer)...
[harness-fixed] memcpy completed cleanly -- NO OVERFLOW (fix effective)
FIXED_EXIT=0