⬢ DragonFlyBSD Kernel Audit
DF-5306 / fix.log
← back to finding ↓ download raw
HARNESS[1] DF-5305: parse_ctrl ret=0 sc.data=0xfffff8004f164060 blob=0xfffff8004f1840e8 blob_end=0xfffff8004f184130
HARNESS[1] DF-5305: nfmt=1 nfrm=0 nitv=0 fmt=0xfffff8004f1ae220
HARNESS fmt[0].name hex:
  c1 c2 c3 c4 c5 c6 c7 c8 c9 ca cb cc cd ce cf d0
  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
HARNESS[1] DF-5305: name strlen=16; in-bounds non-NUL run after GUID start (blob+45) is 27 bytes -> strlen > 27 PROVES read past the 72-byte cdesc allocation (groom marker this round = 0x43)
HARNESS[1] DF-5305: uvc_drv_enum_v4l2_fmt ret=0 -> user-visible description=<M-AM-BM-CM-DM-EM-FM-GM-HM-IM-JM-KM-LM-MM-NM-OM-P>
HARNESS[2] DF-5305: parse_ctrl ret=0 sc.data=0xfffff8004f163df8 blob=0xfffff8004f1841c0 blob_end=0xfffff8004f184208
HARNESS[2] DF-5305: nfmt=1 nfrm=0 nitv=0 fmt=0xfffff8004f1ae280
HARNESS fmt[0].name hex:
  c1 c2 c3 c4 c5 c6 c7 c8 c9 ca cb cc cd ce cf d0
  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
HARNESS[2] DF-5305: name strlen=16; in-bounds non-NUL run after GUID start (blob+45) is 27 bytes -> strlen > 27 PROVES read past the 72-byte cdesc allocation (groom marker this round = 0x45)
HARNESS[2] DF-5305: uvc_drv_enum_v4l2_fmt ret=0 -> user-visible description=<M-AM-BM-CM-DM-EM-FM-GM-HM-IM-JM-KM-LM-MM-NM-OM-P>
HARNESS[3] DF-5305: parse_ctrl ret=0 sc.data=0xfffff8004f164568 blob=0xfffff8004f184298 blob_end=0xfffff8004f1842e0
HARNESS[3] DF-5305: nfmt=1 nfrm=0 nitv=0 fmt=0xfffff8004f1ae2e0
HARNESS fmt[0].name hex:
  c1 c2 c3 c4 c5 c6 c7 c8 c9 ca cb cc cd ce cf d0
  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
HARNESS[3] DF-5305: name strlen=16; in-bounds non-NUL run after GUID start (blob+45) is 27 bytes -> strlen > 27 PROVES read past the 72-byte cdesc allocation (groom marker this round = 0x47)
HARNESS[3] DF-5305: uvc_drv_enum_v4l2_fmt ret=0 -> user-visible description=<M-AM-BM-CM-DM-EM-FM-GM-HM-IM-JM-KM-LM-MM-NM-OM-P>
HARNESS DF-5306: parse_ctrl ret=22 sc.data=0 (expected NULL)
HARNESS DF-5306: calling real uvc_drv_init_video(sc, ctrl, NULL): expect NULL-deref panic at uvc_drv.c:1513 (data->num_altsetting)
HARNESS DF-5306: returned 0 (UNEXPECTED - no panic)