⬢ DragonFlyBSD Kernel Audit
DF-4661 / fix_validate.sh
← back to finding ↓ download raw
#!/bin/sh
# DF-4660 / DF-4661 / DF-4662 fix validation (guest).
# Applies the three fix.diffs to a copy of the pristine guest ar2413.c,
# re-extracts the (patched) function bodies verbatim, rebuilds the
# harness against them and re-runs all three modes.  Success criteria:
#   mode 1: NO overflow past pcdacTable[128]
#   mode 2: early return, no wild-read propagation, no uninit read
#   mode 3: completes without the wild-address SIGSEGV
set -e
cd /root/df2413

cp ar2413_src.c ar2413_fixed.c
patch -p1 ar2413_fixed.c < fixA.diff
patch -p1 ar2413_fixed.c < fixB.diff
patch -p1 ar2413_fixed.c < fixC.diff
echo PATCHES_APPLIED

awk '
  !f && /^GetLowerUpperIndex\(int16_t v/ { print prev; f=1 }
  f { print; if ($0 ~ /^#undef VpdTable_I/) { getline; print; exit } }
  { prev = $0 }
' ar2413_fixed.c > ar2413_extracted.inc
wc -l ar2413_extracted.inc

cc -O2 -Wall -Wno-pointer-sign -o ar2413_harness_fixed ar2413_harness.c
echo FIXED_BUILD_OK

echo "=== PATCHED mode 1 (expect: NO overflow) ==="
./ar2413_harness_fixed 1 || echo "exit=$? (1 == no overflow detected)"
echo "=== PATCHED mode 2 (expect: ret=0, no 0x5A5A propagation, sentinel minPower) ==="
./ar2413_harness_fixed 2 || echo "exit=$?"
echo "=== PATCHED mode 3 (expect: completes, no SIGSEGV at wild address) ==="
./ar2413_harness_fixed 3 || echo "exit=$?"