⬢ DragonFlyBSD Kernel Audit
DF-4912 / run.log
← back to finding ↓ download raw
stats_len0_demo.c: In function 'main':
stats_len0_demo.c:35:17: warning: array subscript 4294967295 is above array bounds of 'char[512]' [-Warray-bounds]
  ev.event_string[copy_length - 1] = '\0';   /* <- [-1] when length==0 */
  ~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~~~
BUILD_OK
=== dead-code proof: modules built by amdgpu Makefile (guest /usr/src) ===
49:	${.CURDIR}/../display/modules/freesync \
50:	${.CURDIR}/../display/modules/color \
51:	${.CURDIR}/../display/modules/info_packet
335:# modules/freesync
338:# modules/color
=== semantic demo ===
event_string at offset 4 within struct
after length==0 call: entry_id = 0x00000000
PROVEN: write landed at event_string[-1] (offset 3, entry_id MSB); byte of event_string[0] untouched
note: stats.c:323 then overwrites entry_id wholesale, clobbering the OOB byte — net-zero corruption, hence Info