DF-1199 / run.log
== DF-1199 radeon_atombios_get_asic_ss_info underflow harness == sizeof(ATOM_COMMON_TABLE_HEADER)=4 sizeof(V2)=12 size= 0 -> num_indices=1431655765 <-- UNDERFLOW (huge loop -> OOB read) size= 1 -> num_indices=1431655765 <-- UNDERFLOW (huge loop -> OOB read) size= 2 -> num_indices=1431655765 <-- UNDERFLOW (huge loop -> OOB read) size= 3 -> num_indices=1431655765 <-- UNDERFLOW (huge loop -> OOB read) size= 4 -> num_indices=0 size= 16 -> num_indices=1 size= 40 -> num_indices=3 Finding's cited value: size=2 -> num_indices=1431655765 (== 1431655765 ? YES) size_t trace: (2 - 4) = 0xfffffffffffffffe (18446744073709551614); /12 = 0x1555555555555555; trunc->int = 1431655765 [BUG REPRODUCED] malicious VBIOS with size<4 drives a 1431655765-iteration loop reading 12B/iter past the BIOS table. Fixed kernel checks `size >= sizeof(ATOM_COMMON_TABLE_HEADER)` before the subtraction and bails. RUN_EXIT=0