#!/bin/sh
# DF-3944: patch_gamut_packet_checksum reads ptr[i] for i <= sb[1] (<=255)
# off &sb[3] of a 32-byte array -> up to 227 bytes OOB read; the path is
# gated on gamut_packet->valid which is never set true in this tree.
SRC=${1:-/usr/src/sys/dev/drm/amd/display/dc/core/dc_resource.c}
TREE=$(dirname $(dirname $(dirname $(dirname $(dirname "$SRC")))))
echo "-- vulnerable loop:"; grep -n -A4 "ptr = &gamut_packet->sb\[3\]" "$SRC"
echo "-- dc_info_packet.sb[] size:"; grep -n -A7 "struct dc_info_packet {" "$TREE/dc_types.h" | head -9
echo "-- in-tree writers that set gamut.valid=true (expect 0):"
grep -rn "gamut.valid = true" "$TREE" | wc -l
echo "-- only assignment is resource_build_info_frame invalidating it:"
grep -n -B2 -A2 "info->gamut.valid" "$SRC"