/* * hexdiff.c -- pass-2 differential harness for sys/libkern/hexncpy.c * (DF-5709 evidence; also confirms the negative results of the pass-2 audit). * * Links against the REAL kernel source (hexncpy.c compiled unmodified via the * shim/sys/systm.h stub). Tests: * * T1 Guard-byte theorem: for every inlen>0, outlen>=3, sep in * {NULL, ":", "-", " ", ""}: hexncpy touches no byte at or after * outb[outlen] and none before outb[0]. Expected: 0 violations. * T2 Reference differential: expected = full hex string (pairs joined by * sep, or plain pairs for sep==NULL) truncated to outlen-1 chars + * NUL. Deviations classified: * dev_sepnull -- sep==NULL mismatch (known DF-2253 class) * dev_trunc -- sep!=NULL, actual is strict prefix: whole-group * truncation granularity vs char-granularity * (cosmetic; occurs only when outlen%3 != 0 and the * buffer ran out mid-group) * dev_other -- anything else. Expected: 0. * T3 HEX_NCPYLEN macro mis-expansion (DF-5709): the macro from * sys/sys/libkern.h:67 is copied VERBATIM; compound arguments * mis-size the buffer by C precedence. Demonstrates a latent * hexncpy overflow for the "future caller" pattern. * T4 Known-behavior confirmation: DF-2252 (inlen<=0 -> outb[-1] NUL) * and DF-2253 (sep==NULL eats the final nibble). */ #include #include #include #include #include char *hexncpy(const u_char *, int, char *, int, const char *); /* ---- verbatim from sys/sys/libkern.h:67 ---- */ #define HEX_NCPYLEN(s) (s * 3) /* ---- the fix under test (DF-5709) ---- */ #define HEX_NCPYLEN_FIXED(s) ((s) * 3) #define GUARD 0xA5 #define MAXIN 64 static unsigned long t1_cases, t1_viol; static unsigned long t2_cases, t2_match, t2_dev_sepnull, t2_dev_trunc, t2_dev_other; static unsigned long t4_df2252, t4_df2253; static void * xmalloc(size_t n) { void *p = malloc(n); if (p == NULL) { perror("malloc"); exit(1); } return p; } /* Full reference string: hex pairs of inlen bytes, sep between pairs * (no trailing sep), or plain pairs when sep==NULL. */ static void ref_full(const u_char *inb, int inlen, const char *sep, char *out) { const char hx[] = "0123456789abcdef"; int o = 0, i; for (i = 0; i < inlen; i++) { out[o++] = hx[inb[i] >> 4]; out[o++] = hx[inb[i] & 0xf]; if (sep && i != inlen - 1) out[o++] = sep[0]; } out[o] = '\0'; } static void run_case(const u_char *inb, int inlen, int outlen, const char *sep) { size_t bufsz = 32 + (size_t)outlen + 32; unsigned char *buf = xmalloc(bufsz); char *base; char *ret; char actual[3 * MAXIN + 4], full[3 * MAXIN + 4], expected[3 * MAXIN + 4]; size_t keep; size_t i; int bad = 0; /* ---- T1: guarded sandbox ---- */ memset(buf, GUARD, bufsz); base = (char *)buf + 32; memset(base, 0x00, (size_t)outlen); ret = hexncpy(inb, inlen, base, outlen, sep); t1_cases++; for (i = 0; i < 32; i++) if (buf[i] != GUARD) { bad++; break; } for (i = 32 + (size_t)outlen; i < bufsz; i++) if (buf[i] != GUARD) { bad++; break; } if (ret != base) bad++; if (bad) { t1_viol++; printf("T1 VIOLATION inlen=%d outlen=%d sep=%s\n", inlen, outlen, sep ? sep : "(null)"); } /* ---- T2: differential (skip the "" separator: embedded NULs) ---- */ if (sep == NULL || sep[0] != '\0') { snprintf(actual, sizeof(actual), "%s", base); ref_full(inb, inlen, sep, full); keep = strlen(full); if (keep > (size_t)outlen - 1) keep = (size_t)outlen - 1; memcpy(expected, full, keep); expected[keep] = '\0'; t2_cases++; if (strcmp(actual, expected) == 0) t2_match++; else if (sep == NULL) t2_dev_sepnull++; /* known DF-2253 class */ else if (strlen(actual) < strlen(expected) && strncmp(actual, expected, strlen(actual)) == 0) t2_dev_trunc++; /* whole-group truncation granularity */ else { t2_dev_other++; printf("T2 OTHER inlen=%d outlen=%d sep=%s actual='%s' expected='%s'\n", inlen, outlen, sep ? sep : "(null)", actual, expected); } } free(buf); } /* ---------------- T3: macro mis-expansion (DF-5709) ---------------- */ enum { NBYTES = 8 }; static char macro_sized[HEX_NCPYLEN(NBYTES + 1)]; /* expands (8 + 1*3) = 11 */ static char fixed_sized[HEX_NCPYLEN_FIXED(NBYTES + 1)]; /* expands ((8+1)*3) = 27 */ static void t3(void) { u_char in[NBYTES + 1] = {0xde,0xad,0xbe,0xef,0x13,0x37,0xc0,0x0d,0x42}; int n = NBYTES; int inlen = NBYTES + 1; /* 9 */ int outlen; /* what a caller would compute */ size_t bufsz = 32 + sizeof(macro_sized) + 32; unsigned char *buf; char *base; size_t i; int over = 0; printf("T3 HEX_NCPYLEN argument is unparenthesized (sys/sys/libkern.h:67):\n"); printf(" #define HEX_NCPYLEN(s) (s * 3)\n"); printf(" HEX_NCPYLEN(NBYTES+1), NBYTES=%d -> sizeof array = %zu (need %d)\n", NBYTES, sizeof(macro_sized), (NBYTES + 1) * 3); printf(" HEX_NCPYLEN_FIXED(NBYTES+1) -> sizeof array = %zu\n", sizeof(fixed_sized)); printf(" runtime: n=%d HEX_NCPYLEN(n+1)=%d HEX_NCPYLEN_FIXED(n+1)=%d\n", n, HEX_NCPYLEN(n + 1), HEX_NCPYLEN_FIXED(n + 1)); /* latent-overflow demo: the future-caller pattern -- * char hexstr[HEX_NCPYLEN(cnt + 1)]; * hexncpy(p, cnt + 1, hexstr, HEX_NCPYLEN(cnt + 1), ":"); * The array is 11 bytes; hexncpy is told outlen=27 and writes 27 bytes. */ outlen = HEX_NCPYLEN(inlen); buf = xmalloc(bufsz); memset(buf, GUARD, bufsz); base = (char *)buf + 32; memset(base, 0x00, sizeof(macro_sized)); hexncpy(in, inlen, base, outlen, ":"); for (i = 32 + sizeof(macro_sized); i < bufsz; i++) if (buf[i] != GUARD) over++; printf(" hexncpy(9 bytes, outlen=%d, \":\") into the %zu-byte macro-sized buffer:\n", outlen, sizeof(macro_sized)); printf(" string produced : '%s'\n", base); printf(" guard bytes smashed past the %zu-byte buffer: %d (true footprint = %d bytes)\n", sizeof(macro_sized), over, 3 * inlen); if (sizeof(macro_sized) == (size_t)(NBYTES + 3) && outlen == 3 * inlen && over > 0) printf("T3 RESULT: LATENT OVERFLOW DEMONSTRATED " "(macro sizes %d->%zu, hexncpy needs %d bytes at sep!=NULL)\n", 3 * inlen, sizeof(macro_sized), 3 * inlen); else printf("T3 RESULT: NOT DEMONSTRATED (unexpected)\n"); free(buf); } /* ---------------- T4: known behaviors ---------------- */ static void t4(void) { u_char in[4] = {0x01, 0x02, 0x03, 0x04}; unsigned char *buf; char *base; /* DF-2252: inlen == 0 -> NUL written at outb[-1] */ buf = xmalloc(64); memset(buf, GUARD, 64); base = (char *)buf + 32; memset(base, 0x00, 32); hexncpy(in, 0, base, 32, ":"); if (base[-1] == 0x00) { /* sandbox was pre-filled with 0xA5 */ t4_df2252++; printf("T4 DF-2252 confirmed: inlen=0 wrote NUL at outb[-1] (byte before buffer)\n"); } free(buf); /* DF-2253: sep==NULL, exact HEX_NCPYLEN buffer -> final nibble eaten */ buf = xmalloc(64); memset(buf, GUARD, 64); base = (char *)buf + 16; memset(base, 0x00, 32); hexncpy(in, 4, base, HEX_NCPYLEN(4), NULL); if (strcmp(base, "0102030") == 0) { /* should be "01020304" */ t4_df2253++; printf("T4 DF-2253 confirmed: sep=NULL, outlen=HEX_NCPYLEN(4)=12 -> '%s' " "(final nibble of 04 destroyed)\n", base); } free(buf); } int main(void) { static const char *seps_t1[] = { NULL, ":", "-", " ", "" }; u_char in[MAXIN]; int s, il, ol; for (il = 0; il < MAXIN; il++) in[il] = (u_char)(il * 37 + 5); for (s = 0; s < 5; s++) for (il = 1; il <= MAXIN; il++) for (ol = 3; ol <= 3 * MAXIN; ol++) run_case(in, il, ol, seps_t1[s]); printf("T1 guard theorem : cases=%lu violations=%lu (expected 0)\n", t1_cases, t1_viol); printf("T2 differential : cases=%lu match=%lu dev_sepnull(DF-2253 class)=%lu " "dev_trunc_granularity=%lu dev_other=%lu (expected 0)\n", t2_cases, t2_match, t2_dev_sepnull, t2_dev_trunc, t2_dev_other); t3(); t4(); return (t1_viol == 0 && t2_dev_other == 0 && t4_df2252 == 1 && t4_df2253 == 1) ? 0 : 1; }