== DF-1556 control run: PageLength=21 (exact-fit, no overflow) == $ ./run.sh 21 == DF-1556 harness: missing-MIN() heap overflow in mps_config_get_raid_volume_pg0 == kernel Mpi2RaidVolPage0_t = 44 (mpi2_cnfg.h:1362-1383) kernel Mpi2RaidVol0PhysDisk_t = 4 (mpi2_cnfg.h:1314-1321) MPS_MAX_DISKS_IN_VOL = 10 (mpsvar.h:106) caller buffer size (kernel) = 84 (=44+4*10, mps_config.c:378) firmware PageLength = 21 -> cm_length (PageLength*4) = 84 [BUGGY] bcopy(page, caller_buf, cm_length=84) into 84-byte buffer... cm_length=84 <= buf=84: no overflow this run. (use: ./harness with PageLength>=22 to trigger) RUN_EXIT=0