⬢ DragonFlyBSD Kernel Audit
DF-2240 / prop_uint_roundtrip.c
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
/* DF-2240: prop_array_add_uint{8,16,32,64} store via the SIGNED creator
 * prop_number_create_integer (prop_array_util.c:187), so values that no
 * longer fit the signed width get a prop_number_size() of the next width
 * up and prop_array_get_uintN() then rejects them: roundtrip breaks for
 * every value with the top data bit set.  Control values (top bit clear)
 * roundtrip fine. */
#include <stdio.h>
#include <stdbool.h>
#include <libprop/proplib.h>

#define T(sz, vc, vb) do {						 \
	prop_array_t a = prop_array_create();				 \
	uint ## sz ## _t c = (vc), b = (vb), o = 0;			 \
	bool rc, rb;							 \
	prop_array_add_uint ## sz (a, c);				 \
	rc = prop_array_get_uint ## sz (a, 0, &o);			 \
	prop_array_add_uint ## sz (a, b);				 \
	rb = prop_array_get_uint ## sz (a, 1, &o);			 \
	printf("uint%-2d control 0x%0*llx -> get %-5s | boundary 0x%0*llx -> get %s\n", \
	    sz, sz/4, (unsigned long long)c, rc ? "true" : "FALSE",	 \
	    sz/4, (unsigned long long)b, rb ? "true" : "FALSE");	 \
	prop_object_release(a);						 \
} while (0)

int main(void)
{
	T(8,  0x7f, 0xff);
	T(16, 0x7fff, 0xffff);
	T(32, 0x7ffffffful, 0xfffffffful);
	T(64, 0x7fffffffffffffffull, 0xffffffffffffffffull);
	printf("[*] boundary values with the top bit set cannot be read back\n");
	printf("    with the matching get_uintN: roundtrip broken.\n");
	return 0;
}