#!/bin/sh
# run.sh — exercise DF-0830 against a mounted malicious HPFS image.
#
# PRECONDITION (the realistic threat model): the HPFS module is loaded and
# an admin has mounted the crafted image.  Here we expect:
#   /dev/vn0 -> evil.hpfs, mounted at /mnt/hpfs, world-traversable.
#
# The PoC itself is an unprivileged userspace program that opens the
# mountpoint O_RDONLY|O_DIRECTORY and calls getdents.  hpfs_readdir has
# NO bounds check on the dep-walk, so a crafted dep with de_reclen=0x0900
# makes the kernel read 276 bytes past the 2 KB bread buffer.
set -e
cd "$(dirname "$0")"
MP="${1:-/mnt/hpfs}"
./poc "$MP"