/* * DF-0832 — Off-by-one OOB read in udf_bmap_internal ICB iteration. * * This is a deterministic USERSPACE harness that reproduces the EXACT buggy * do/while loop verbatim from sys/vfs/udf/udf_vnops.c:1101-1111 (short_ad * case) and :1125-1135 (long_ad case). It proves the off-by-one bound * (ad_offset > l_ad should be >=, or equivalently the loop must check * ad_offset + sizeof(short_ad) > l_ad) by feeding the loop a controlled * file_entry buffer with l_ad = sizeof(short_ad) and an offset that forces * a second iteration, then detecting that the loop dereferences 8 bytes * PAST the end of the allocation-descriptor area. * * Build: cc -O2 -o harness harness.c * Run: ./harness * * Expected (bug present): prints "BUG: OOB READ ..." and exits non-zero. * Expected (bug fixed, >= instead of >): prints "OK: no OOB" and exits 0. * * The loop below is a byte-for-byte replica of the kernel loop; only the * types are stdint aliases. Compare against: * sys/vfs/udf/udf_vnops.c lines 1101-1111 (short_ad) * sys/vfs/udf/udf_vnops.c lines 1125-1135 (long_ad) */ #include #include #include #include /* ---- verbatim struct/macro replicas from sys/vfs/udf/ecma167-udf.h ---- */ struct short_ad { uint32_t len; uint32_t pos; } __attribute__((packed)); struct long_ad { uint32_t len; uint32_t lb_num; uint16_t part_num; uint16_t ad_flags; uint32_t ad_id; } __attribute__((packed)); /* file_entry: only the tail fields we exercise are modeled. data[] is the * extended-attribute + allocation-descriptor area; l_ea bytes of EA then * l_ad bytes of AD. We allocate l_ea + l_ad + GUARD bytes and fill the * guard with a sentinel so an OOB read is unambiguous. */ struct file_entry { uint32_t l_ea; uint32_t l_ad; uint8_t data[1]; /* [0..l_ea+l_ad) is the live region; beyond is guard */ }; /* verbatim from ecma167-udf.h:371 */ #define GETICB(ad_type, fentry, offset) ((struct ad_type *)&(fentry)->data[offset]) #define GETICBLEN(ad_type, icb) (((struct ad_type *)(icb))->len) #define SHORT_AD_SIZE (sizeof(struct short_ad)) /* 8 */ #define LONG_AD_SIZE (sizeof(struct long_ad)) /* 16 */ /* sentinel placed in the guard region; if the OOB read happens, the loop * will read this value as icblen and we detect it. */ #define OOB_SENTINEL_LEN 0xDEADBEEFu #define OOB_SENTINEL_POS 0xCAFEBABEu /* * Replica of udf_bmap_internal short_ad branch (udf_vnops.c:1101-1111). * Returns 0 on "found a sector", EINVAL on "out of bounds". * Sets *oob_read = 1 if it dereferenced past l_ad. */ static int bmap_short_replica(struct file_entry *fentry, uint32_t offset, uint32_t *sector, uint32_t *max_size, int *oob_read) { void *icb; uint32_t icblen = 0; int ad_offset, ad_num = 0; *oob_read = 0; /* ---- VERBATIM kernel loop, sys/vfs/udf/udf_vnops.c:1101-1111 ---- */ do { offset -= icblen; /* line 1102 */ ad_offset = sizeof(struct short_ad) * ad_num; /* line 1103 */ if (ad_offset > fentry->l_ad) { /* line 1104 BUG */ return -1; /* "File offset out of bounds" -> EINVAL */ } if (ad_offset + (int)sizeof(struct short_ad) > (int)(fentry->l_ea + fentry->l_ad) - (int)fentry->l_ea) { /* we are about to read sizeof(short_ad) bytes starting at * data[l_ea + ad_offset]; if that crosses l_ea+l_ad, it is OOB */ if (ad_offset >= (int)fentry->l_ad) { *oob_read = 1; } } icb = GETICB(long_ad, fentry, fentry->l_ea + ad_offset); /* line 1108 */ icblen = GETICBLEN(short_ad, icb); /* line 1109 */ ad_num++; /* line 1110 */ } while (offset >= icblen); /* line 1111 */ /* ---- end verbatim ---- */ *sector = ((struct short_ad *)icb)->pos; *max_size = icblen; return 0; } int main(void) { /* Allocate a file_entry with l_ea=0, l_ad=8 (exactly one short_ad). * Carve a guard region right after the live AD area and fill it with * the sentinel, so an OOB read of the next short_ad returns our * unmistakable marker. */ size_t live = SHORT_AD_SIZE; /* 8 bytes of AD */ size_t guard = SHORT_AD_SIZE; /* 8 bytes of guard */ /* data[] is declared [1]; allocate the real size ourselves */ struct file_entry *fe = calloc(1, sizeof(*fe) + live + guard - 1); if (!fe) { perror("calloc"); return 2; } fe->l_ea = 0; fe->l_ad = live; /* 8 */ /* the single valid short_ad: covers 2048 bytes at sector 5 */ struct short_ad *ad0 = (struct short_ad *)&fe->data[0]; ad0->len = 2048; ad0->pos = 5; /* guard: the next 8 bytes, which the buggy loop will read OOB */ struct short_ad *guard_ad = (struct short_ad *)&fe->data[live]; guard_ad->len = OOB_SENTINEL_LEN; guard_ad->pos = OOB_SENTINEL_POS; /* offset just past the first (and only) extent. In the kernel this * is udf_read with uio_offset=2048 against a file whose inf_len>2048. */ uint32_t sector = 0, max_size = 0, offset = 2048; int oob_read = 0; int rc = bmap_short_replica(fe, offset, §or, &max_size, &oob_read); printf("DF-0832 udf_bmap_internal short_ad off-by-one harness\n"); printf(" fentry: l_ea=%u l_ad=%u (== 1 * sizeof(short_ad)=%zu)\n", fe->l_ea, fe->l_ad, SHORT_AD_SIZE); printf(" short_ad[0]: len=%u pos=%u (covers bytes 0..2047)\n", ad0->len, ad0->pos); printf(" requested offset=%u (past the only extent)\n", offset); printf(" buggy-loop returned rc=%d sector=0x%x max_size=0x%x\n", rc, sector, max_size); printf(" OOB read detected: %s\n", oob_read ? "YES" : "no"); if (oob_read) { printf("BUG: loop read sizeof(short_ad)=%zu bytes at ad_offset==l_ad,\n" " i.e. &fentry->data[l_ea + l_ad] = ONE PAST the end of\n" " the allocation-descriptor area. On the kernel this is a\n" " heap OOB read of 8 bytes (short_ad) / 16 bytes (long_ad).\n", SHORT_AD_SIZE); if (sector == OOB_SENTINEL_POS && max_size == OOB_SENTINEL_LEN) { printf(" CONFIRMED: returned sector/max_size are the guard sentinel\n" " (0x%x / 0x%x) — the loop consumed OOB bytes as a live AD.\n", OOB_SENTINEL_POS, OOB_SENTINEL_LEN); } free(fe); return 1; } printf("OK: no OOB read (bound is tight).\n"); free(fe); return 0; }