#!/bin/sh
# runs each harness: control case (in-bounds) then the OOB case in a
# fresh process; exit 139 (SIGSEGV) on the OOB case = the verbatim code
# read past the guard page = over-read proven.
cd "$(dirname "$0")"
rep=0
for spec in \
 "df3324:oob:DF-3324 parse_ath 3-byte read past saved Atheros IE" \
 "df3325:oob:DF-3325 hostap pre-dispatch i_qos/i_seq past 10-byte frame" \
 "df3342h:oob:DF-3342 sta pre-dispatch i_qos/i_seq past 10-byte frame" \
 "df3416:oob:DF-3416 adhoc pre-dispatch i_qos/i_seq past 10-byte frame" \
 "df3329:1:DF-3329 preq iefrm[33] past 3-byte IE" \
 "df3329:2:DF-3329 perr iefrm[3] past 2-byte IE" \
 "df3329:3:DF-3329 perr dest-flag past 4-byte IE" \
 "df3341:oob:DF-3341 tim_period (byte 4) past 3-byte TIM IE" \
 "df3374:1:DF-3374 csa_newchan (byte 3) past 3-byte CSA IE" \
 "df3374:2:DF-3374 csa_count (byte 4) past 4-byte CSA IE" \
 "df3343:oob:DF-3343 htrates[159] past 77-entry table" \
 "df3284:1:DF-3284 ether_type read past 10-byte raw frame" \
 "df3284:2:DF-3284 m_copydata(off=15) past 14-byte chain" \
 "df3274:uaf:DF-3274 obytes read of freed mbuf pkthdr" \
 "df3346:poison:DF-3346 next SIOCSLAGG NULL-deref via lp_psc" \
 "df3347:poison:DF-3347 later LACP op NULL-deref via lp_psc" \
 "df3322:null:DF-3322 rcvif NULL deref in 127/8 martian check" \
 "df3393:oob:DF-3393 rn_match reads stored key bytes 16..254" \
 "df3442:oob:DF-3442 kfnmatch scans past non-terminated name" \
 ; do
	bin=$(echo $spec | cut -d: -f1); cas=$(echo $spec | cut -d: -f2); desc=$(echo $spec | cut -d: -f3-)
	./$bin control >/dev/null 2>&1
	crc=$?
	./$bin $cas > /tmp/case.out 2>&1
	rc=$?
	if [ $rc -eq 139 ] || [ $rc -eq 138 ] || [ $rc -eq 133 ] || [ $rc -eq 132 ] || grep -q "KASSERT .* FIRES" /tmp/case.out; then
		echo "REPRODUCED (rc=$rc): $desc"
		sed 's/^/    /' /tmp/case.out | grep -v "Segmentation" | tail -3
		rep=$((rep+1))
	else
		echo "NOT-REPRODUCED (rc=$rc): $desc"
		head -4 /tmp/case.out | sed 's/^/    /'
	fi
done
echo "---- reproduced $rep cases via guard-page SEGV ----"