DragonFlyBSD Kernel Audit
DF-1180 / run.log
← back to finding ↓ download raw
harness.c: In function 'main':
harness.c:45:41: warning: iteration 32 invokes undefined behavior [-Waggressive-loop-optimizations]
         vol_table->entries[i].value     = dep_table->entries[i].vddc;   /* line 1094 */
         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~~~~
harness.c:44:5: note: within this loop
     for (i = 0; i < (int)vol_table->count; i++) { /* line 1093 */
     ^~~
harness.c:45:41: warning: iteration 32 invokes undefined behavior [-Waggressive-loop-optimizations]
         vol_table->entries[i].value     = dep_table->entries[i].vddc;   /* line 1094 */
         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~~~~
harness.c:44:5: note: within this loop
     for (i = 0; i < (int)vol_table->count; i++) { /* line 1093 */
     ^~~
BUILD_EXIT=0
-rwxr-xr-x  1 maxx  maxx  8760 Jul 17 06:46 harness
----- RUN -----
=== DF-1180: vega10 voltage-table OOB on entries[32] ===
sizeof(pp_atomfwctrl_voltage_table)=268  entries[0]=4  past entries[31]=260
benign  count=16 -> (ok)
[*] crafted VBIOS: dep_table->count = 40
[!] vol_table->count = 40  (entries[] holds 32)  >>> OVERFLOW
[!] CONFIRMED OOB: trailing_gpio_ctrl=0x41410020 trailing_smuio=0x0 (would corrupt fields past the voltage table in the backend)

[*] worst case: count=255 -> writes 223 entries past entries[31]

[+] DF-1180 OOB CONFIRMED: dep_table->count drives writes past entries[32].
RUN_EXIT=0