⬢ DragonFlyBSD Kernel Audit
DF-3783 / run.log
← back to finding ↓ download raw
=== RUN DF-3783 ===
DMA_PROG_ALLOC = 32768 bytes = 8192 dwords per program buffer
[*] PoC clip list validation (BT848SCLIP): rc=0 (0 = accepted by driver), max_clip_node=99
[A] 640x480 default, 99 clips: field1=71526 field2=71526 dwords (cap 8192) -> overflow 8x / 8x
[B] 2046x1022 max, 99 clips: field1=304860 field2=304860 dwords (cap 8192) -> overflow 37x / 37x
CONFIRMED: RISC emission overruns the 8-page dma_prog/odd_dma_prog buffers -> linear kernel heap overflow (bytes past end: 1186672 / 1186672)
RC=0
  unsigned int  skip, start_skip = 0; /* Bpp==2 -> start_skip always 0 */
                ^~~~
  unsigned long flag, flag2;
                      ^~~~~
DMA_PROG_ALLOC = 32768 bytes = 8192 dwords per program buffer
[*] PoC clip list validation (BT848SCLIP): rc=0 (0 = accepted by driver), max_clip_node=99
[A] 640x480 default, 99 clips: field1=71526 field2=71526 dwords (cap 8192) -> overflow 8x / 8x
[B] 2046x1022 max, 99 clips: field1=304860 field2=304860 dwords (cap 8192) -> overflow 37x / 37x
[C] yuv422 odd-only rows=2046, 0 clips: 10236 dwords (cap 8192) -> overflow 1x (8176 bytes past end)
    CONFIRMED: geometry-only overflow, no clip list required
CONFIRMED: RISC emission overruns the 8-page dma_prog/odd_dma_prog buffers -> linear kernel heap overflow (bytes past end: 1186672 / 1186672)
RC=0