#!/bin/sh
# DF-1329 — run the mpr_diag_read_buffer integer-overflow OOB-read PoC as
# an unprivileged user.  Issues MPTIOCTL_DIAG_ACTION (READ_BUFFER) with
# StartingOffset=0x100, BytesToRead=0xFFFFFF00 whose sum wraps to 0,
# defeating the bounds check.  NOTE: a real run requires a previously
# REGISTERED diag buffer (same ioctl) to set pBuffer->size and a valid
# UniqueId.  On the QEMU audit guest (no SAS HBA) it fails at
# open("/dev/mpr0") — see VERDICT.md.
set -e
cd "$(dirname "$0")"
echo "+ ./poc"
./poc
echo "RUN_EXIT=$?"