⬢ DragonFlyBSD Kernel Audit
DF-2224 / run_section.log
← back to finding ↓ download raw
DF22X RIG start =========================================
DF22X ----
DF22X ----
DF22X ----
DF2224 start: verbatim seq_printf (linux_printf.c:31-39) vs fix-2224 (kvsnprintf) with identical variadic args
DF2224 BASELINE [int fmt %d/%lu/%x (want 111/222222/beef)] buf=[402699856/48879/5f5e100] canaries=INTACT first16=3430323639393835362f34383837392f
DF2224 FIXED    [int fmt %d/%lu/%x (want 111/222222/beef)] buf=[111/222222/beef] canaries=INTACT first16=3131312f3232323232322f6265656600
DF2224 BASELINE [%%p of 0xdeadbeef (leak flavor)] buf=[ptr=0xfffff8011800b650] canaries=INTACT first16=7074723d307866666666663830313138
DF2224 FIXED    [%%p of 0xdeadbeef] buf=[ptr=0xdeadbeef] canaries=INTACT first16=7074723d3078646561646265656600cc
DF2224 witness: rig kernel stack address for comparison: 0xfffff8011800b6ec (baseline buf above should hold an address of this shape, not 0xdeadbeef)
DF2224 BASELINE [%s of hi] buf=[s=[^P]] canaries=INTACT first16=733d5b105d00cccccccccccccccccccc
DF2224 FIXED    [%s of hi] buf=[s=[hi]] canaries=INTACT first16=733d5b68695d00cccccccccccccccccc
DF2224 VERDICT: baseline garbles every conversion and can print a kernel stack address (%p) into the seq buffer; fixed forwards the real arguments; canaries prove no overflow
DF22X RIG done ==========================================