DragonFlyBSD Kernel Audit
DF-0907 / harness_run.log
← back to finding ↓ download raw
line 170: pe-pc-2 = (buf+80)-(buf+2)-2 = 76  (bound)
           -> size_t bound = 76
           after index: pc = buf+78 (NUL at buf+78)
line 171: pc < pe-1  ->  TRUE
line 172: wrote '@' at buf+78, pc now buf+79
line 173: pe-pc-2 = (buf+80)-(buf+79)-2 = -1  (ptrdiff_t)
           coerced to size_t (strncpy 3rd arg) = 18446744073709551615
           SIZE_MAX = 18446744073709551615
*** CONFIRMED: bound is (size_t)-1 == SIZE_MAX ***
*** strncpy would write vc_srvname + ~SIZE_MAX zero-padding ***
*** => heap overflow past f_mntfromname into struct statfs/mount ***