⬢ DragonFlyBSD Kernel Audit
DF-4224 / fixdemo.c
← back to finding ↓ download raw
/* Demonstrates both layers of findings/poc/DF-4224/fix.diff:
 *  (a) parse guard on simple_strtol intake for '@'/'-' values,
 *  (b) drm_cvt_mode/drm_gtf_mode_complex vfieldrate sanity bound. */
#include <stdio.h>
#include <stdlib.h>
#include <limits.h>
int main(void) {
	const char *vals[] = {"2147483648", "134217728", "4294967295", "-5", "60", "500"};
	for (int i = 0; i < 6; i++) {
		long val = strtol(vals[i], NULL, 10);	/* == simple_strtol */
		int layer = 0;
		if (val < 0 || val > INT_MAX)		/* fix.diff layer (a) */
			layer = 1;
		else if (val == 0 || val > 1000)	/* fix.diff layer (b) */
			layer = 2;
		printf("refresh \"%-11s\" -> %s\n", vals[i],
		       layer == 0 ? "accepted" :
		       layer == 1 ? "REJECTED by parse range guard" :
		                   "REJECTED by cvt/gtf vfieldrate bound");
	}
	return 0;
}