⬢ DragonFlyBSD Kernel Audit
DF-0864 / validate_fix.sh
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
#!/bin/sh
# DF-0864 fix-validation: demonstrates the comparison oracle that
# distinguishes fixed from unfixed behavior.
#
# The image is crafted with:
#   sp_cpinum = 1   (hpm_cpdblk = 1 entry = 136 bytes)
#   dirent.de_cpid = 0xFF (255 >> sp_cpinum -> OOB on unfixed)
#   dirent.de_name = "\xFF\xFF\xFF\xFF"  (maps to b_upcase[0x7F])
#   b_upcase[0x00] = b_upcase[0x7F] = 0x42  (oracle marker)
#
# The lookup name "\x80\x80\x80\x80" maps to b_upcase[0x00] (via hpfs_u2d).
#
# On the UNFIXED kernel (cp=255): reads OOB bytes at cpdblk[255].  The
#   comparison b_upcase_OOB[0] - b_upcase_OOB[0x7F] uses random heap data
#   -> almost never zero -> lookup returns ENOENT.
#
# On the FIXED kernel (cp clamped to 0): reads in-bounds b_upcase[0]=0x42
#   and b_upcase[0x7F]=0x42 -> comparison is 0x42-0x42=0 -> MATCH ->
#   lookup succeeds (stat finds the entry, not ENOENT).
#
# This produces a DETERMINISTIC contrast:
#   unfixed:  stat /mnt/df0864/<0x80x4> -> ENOENT
#   fixed:    stat /mnt/df0864/<0x80x4> -> SUCCESS (entry found)
#
# usage: ./validate_fix.sh
set -e
cd "$(dirname "$0")"

# build the oracle-mode image (b_upcase[0]=b_upcase[0x7F]=0x42)
[ -x craft_img ] || cc -O2 -Wall -o craft_img craft_img.c
./craft_img oracle.img 0xFF 1

kldload hpfs 2>/dev/null || kldstat | grep -q hpfs
DEV=$(vnconfig -c vn "$(pwd)/oracle.img" 2>&1 | grep -oE 'vn[0-9]+' | head -1)
echo "[validate] attached oracle.img -> /dev/$DEV"
mkdir -p /mnt/df0864v
mount -t hpfs -o ro "/dev/$DEV" /mnt/df0864v
echo "[validate] mounted"

# lookup "\x80\x80\x80\x80" (the oracle probe name)
# on FIXED: match (entry found, stat returns 0)
# on UNFIXED: no match (OOB heap bytes differ, ENOENT)
# DragonFlyBSD printf uses octal escapes (\200 = 0x80), not \x
PROBE_NAME=$(printf '\200\200\200\200')
PROBE="/mnt/df0864v/${PROBE_NAME}"
echo "[validate] probing: stat '$PROBE'"
if stat "$PROBE" >/dev/null 2>&1; then
    echo "[validate] RESULT: MATCH (stat succeeded)"
    echo "[validate]   -> cp was CLAMPED to 0 (in-bounds), b_upcase[0]==b_upcase[0x7F]"
    echo "[validate]   -> this is the FIXED behavior"
    STAT_RC=0
else
    echo "[validate] RESULT: NO MATCH (ENOENT)"
    echo "[validate]   -> cp was NOT clamped (OOB), b_upcase_OOB[0]!=b_upcase_OOB[0x7F]"
    echo "[validate]   -> this is the UNFIXED behavior"
    STAT_RC=1
fi

# also show the dirent listing for sanity
echo "[validate] directory listing:"
ls -la /mnt/df0864v/ 2>&1

umount /mnt/df0864v 2>/dev/null || true
vnconfig -u "$DEV" 2>/dev/null || true
exit $STAT_RC