DF-0832 / run.log
BUILD_EXIT=0
-rwxr-xr-x 1 maxx maxx 8800 Jul 11 06:05 harness
=== RUN ===
DF-0832 udf_bmap_internal short_ad off-by-one harness
fentry: l_ea=0 l_ad=8 (== 1 * sizeof(short_ad)=8)
short_ad[0]: len=2048 pos=5 (covers bytes 0..2047)
requested offset=2048 (past the only extent)
buggy-loop returned rc=0 sector=0xcafebabe max_size=0xdeadbeef
OOB read detected: YES
BUG: loop read sizeof(short_ad)=8 bytes at ad_offset==l_ad,
i.e. &fentry->data[l_ea + l_ad] = ONE PAST the end of
the allocation-descriptor area. On the kernel this is a
heap OOB read of 8 bytes (short_ad) / 16 bytes (long_ad).
CONFIRMED: returned sector/max_size are the guard sentinel
(0xcafebabe / 0xdeadbeef) — the loop consumed OOB bytes as a live AD.
RUN_EXIT=1