⬢ DragonFlyBSD Kernel Audit
DF-5701 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
{
  "finding_id": "DF-5701",
  "title": "libkern/bcmp.c:58 int len = length size_t->int truncation: bcmp(a,b,2^32)==0 false equal (zero bytes compared), prefix-only compare at 2^32+k, signed-overflow unbounded forward walk at 2^31",
  "verdict": "reproduced",
  "impact": "none",
  "severity": "Low",
  "confidence": "certain",
  "reproduce": {
    "build": "./build.sh",
    "run": "./run.sh",
    "expected": "trunc_harness at -O2 and -O0: (A) df_bcmp(b1,b2,2^32)=0 FALSE EQUAL; (B) df_bcmp(b1,b2,2^32+8)=0 FALSE EQUAL; (C) child SIGSEGV unbounded walk; fixed: FIX-PASS (no false equal)"
  },
  "kernel_refs": [
    "sys/libkern/bcmp.c:58",
    "sys/libkern/bcmp.c:62-63",
    "sys/libkern/bcmp.c:88",
    "sys/libkern/bcmp.c:100-103",
    "sys/libkern/bcmp.c:110-111",
    "sys/libkern/bcmp.c:114",
    "sys/libkern/bcmp.c:128-129",
    "sys/conf/files:2195-2237",
    "sys/platform/pc64/conf/files:131"
  ],
  "artifacts": [
    "README.md", "VERDICT.md",
    "bcmp_kernel.c", "trunc_harness.c", "trunc_fixed.c", "bcmp_fixed.c",
    "build.sh", "run.sh",
    "logs/trunc2.out", "logs/trunc0.out", "logs/truncfix.out",
    "logs/kernel_bcmp_disasm.txt", "logs/env.txt",
    "fix.diff", "manifest.json", "verdict.json"
  ]
}