DragonFlyBSD Kernel Audit
DF-0832 / run.log
← back to finding ↓ download raw
BUILD_EXIT=0
-rwxr-xr-x  1 maxx  maxx  8800 Jul 11 06:05 harness
=== RUN ===
DF-0832 udf_bmap_internal short_ad off-by-one harness
  fentry: l_ea=0 l_ad=8 (== 1 * sizeof(short_ad)=8)
  short_ad[0]: len=2048 pos=5 (covers bytes 0..2047)
  requested offset=2048 (past the only extent)
  buggy-loop returned rc=0  sector=0xcafebabe  max_size=0xdeadbeef
  OOB read detected: YES
BUG: loop read sizeof(short_ad)=8 bytes at ad_offset==l_ad,
     i.e. &fentry->data[l_ea + l_ad] = ONE PAST the end of
     the allocation-descriptor area.  On the kernel this is a
     heap OOB read of 8 bytes (short_ad) / 16 bytes (long_ad).
  CONFIRMED: returned sector/max_size are the guard sentinel
  (0xcafebabe / 0xdeadbeef) — the loop consumed OOB bytes as a live AD.
RUN_EXIT=1