DragonFlyBSD Kernel Audit
DF-1556 / run.3.log
← back to finding ↓ download raw
== DF-1556 control run: PageLength=21 (exact-fit, no overflow) ==
$ ./run.sh 21

== DF-1556 harness: missing-MIN() heap overflow in mps_config_get_raid_volume_pg0 ==
kernel Mpi2RaidVolPage0_t       = 44 (mpi2_cnfg.h:1362-1383)
kernel Mpi2RaidVol0PhysDisk_t   = 4  (mpi2_cnfg.h:1314-1321)
MPS_MAX_DISKS_IN_VOL            = 10 (mpsvar.h:106)
caller buffer size (kernel)     = 84 (=44+4*10, mps_config.c:378)
firmware PageLength             = 21
-> cm_length (PageLength*4)  = 84

[BUGGY] bcopy(page, caller_buf, cm_length=84) into 84-byte buffer...
cm_length=84 <= buf=84: no overflow this run.
(use: ./harness <PageLength>   with PageLength>=22 to trigger)
RUN_EXIT=0