/*
 * DF-1060 — FW_GTPMAP bcopy uses attacker-inflatable crc_len
 *
 * Code-confirmed only: like DF-1059, the audit guest has no
 * FireWire PCI host controller, so /dev/fw* does not exist and
 * fw_ioctl case FW_GTPMAP is never invoked. This file documents
 * the bug for maintainers; it cannot be exec'd on this guest.
 *
 * Bug (sys/bus/firewire/fwdev.c):
 *
 *   657: case FW_GTPMAP:
 *   658:     bcopy(sc->fc->topology_map, ap->a_data,
 *   659:         (sc->fc->topology_map->crc_len + 1) * 4);
 *   660:     break;
 *
 * crc_len is uint16. The kernel bumps crc_len once per received
 * self-id packet in fw_sidrcv (firewire.c:1143) without bound
 * against topology_map's allocation (sizeof(struct fw_topology_map)
 * ~= 1036 bytes per firewire.c:738). With crc_len > ~258 the bcopy
 * reads past the allocation, leaking kernel heap bytes into the
 * user buffer; with a very large crc_len it page-faults.
 *
 * The user-side ioctl requires crc_len to have already been
 * inflated by a malicious/buggy FireWire device (or by trigger of
 * the related self_id[256] OOB write at firewire.c:1142).
 *
 * Build: nothing to build (no /dev/fw*); for documentation only.
 */

int main(void) { return 0; }