⬢ DragonFlyBSD Kernel Audit
DF-2249 / run.log
← back to finding ↓ download raw
== STOCK harness kernel (dfh-built2, #1) ==
dfh: DF2249: mode 0 convchr ret=0
dfh: DF2249: outbuf[0..11]: 41 51 51 51 51 51 51 51 51 51 51 51
dfh: DF2249: control expect out[0]=41 (table['A'])
dfh: DF2249: TRIGGER OOB READ: iconv_convchr with *inbytesleft=0
dfh: DF2249: mode 1 convchr ret=0
dfh: DF2249: outbuf[0..11]: 5c 51 51 51 51 51 51 51 51 51 51 51
dfh: DF2249: expect out[0]=5c (table['Z']) -- the byte read past the EMPTY input buffer was 'Z'
dfh: DF2249: TRIGGER OOB WRITE: iconv_convchr with *outbytesleft=0
dfh: DF2249: mode 2 convchr ret=0
dfh: DF2249: outbuf[0..11]: 51 51 51 51 51 51 51 51 5c 51 51 51
dfh: DF2249: OOB WRITE proof: outbuf[8] 51 -> 5c (byte written with *outbytesleft==0)
dfh: DF2249: TRIGGER OOB READ: iconv_convchr with *inbytesleft=0
dfh: DF2249: TRIGGER OOB WRITE: iconv_convchr with *outbytesleft=0
dfh: DF2249: mode 3 convchr ret=0
dfh: DF2249: outbuf[0..11]: 51 51 51 51 51 51 51 51 5c 51 51 51
dfh: DF2249: expect out[0]=5c (table['Z']) -- the byte read past the EMPTY input buffer was 'Z'
dfh: DF2249: OOB WRITE proof: outbuf[8] 51 -> 5c (byte written with *outbytesleft==0)

== FIXED harness kernel (dfx-built, #7) ==
dfh: DF2249: mode 0 convchr ret=0
dfh: DF2249: outbuf[0..11]: 41 51 51 51 51 51 51 51 51 51 51 51
dfh: DF2249: control expect out[0]=41 (table['A'])
dfh: DF2249: TRIGGER OOB READ: iconv_convchr with *inbytesleft=0
dfh: DF2249: mode 1 convchr ret=-1
dfh: DF2249: outbuf[0..11]: 51 51 51 51 51 51 51 51 51 51 51 51
dfh: DF2249: expect out[0]=5c (table['Z']) -- the byte read past the EMPTY input buffer was 'Z'
dfh: DF2249: TRIGGER OOB WRITE: iconv_convchr with *outbytesleft=0
dfh: DF2249: mode 2 convchr ret=-1
dfh: DF2249: outbuf[0..11]: 51 51 51 51 51 51 51 51 51 51 51 51
dfh: DF2249: outbuf[8] still Q (no OOB write)
dfh: DF2249: TRIGGER OOB READ: iconv_convchr with *inbytesleft=0
dfh: DF2249: TRIGGER OOB WRITE: iconv_convchr with *outbytesleft=0
dfh: DF2249: mode 3 convchr ret=-1
dfh: DF2249: outbuf[0..11]: 51 51 51 51 51 51 51 51 51 51 51 51
dfh: DF2249: expect out[0]=5c (table['Z']) -- the byte read past the EMPTY input buffer was 'Z'
dfh: DF2249: outbuf[8] still Q (no OOB write)