⬢ DragonFlyBSD Kernel Audit
DF-5718 / run.log
← back to finding ↓ download raw
INTREE: input    : "A\tB\x41C\"D\\E"
INTREE: parsed  : [A\x09B\x1c"D\E]
INTREE: expected: [A\x09B\x1c"D\E]
INTREE: parse correct with verbatim byte-forward strcpy: YES
INTREE: overlapping strcpy invocations (restrict violations at ng_parse.c:1572/1621): 5
rig_intree exit=0
LIBC  : parsed  : [A\x09B\x1c"D\E]
LIBC  : expected: [A\x09B\x1c"D\E]
LIBC  : divergence vs in-tree strcpy: none
rig_libc exit=0
BLOCK : child killed by SIGSEGV: block-store strcpy's past-the-NUL store crossed the guard page
BLOCK : cbuf allocated at exactly the kernel size (ng_parse.c:1559 has no +1) => equivalent to a kernel heap OOB write
RESULT : overlap/past-NUL reliance CONFIRMED - the in-tree byte-forward strcpy is load-bearing
rig_block exit=0
FIXED  : parsed  : [A\x09B\x1c"D\E]
FIXED  : expected: [A\x09B\x1c"D\E]
FIXED  : memmove treatment output identical to in-tree semantics: YES
rig_fixed exit=0