⬢ DragonFlyBSD Kernel Audit
← triage · dashboard
DF-0538

Type-confused stack buffer: char *addrbuf[NG_HOOKSIZ+4] is pointer array not byte array

Summary

Line :981: char *addrbuf[NG_HOOKSIZ+4] declares array of (NG_HOOKSIZ+4) char pointers = 36*sizeof(char*)=288 bytes on amd64, not intended char addrbuf[NG_HOOKSIZ+4]=36 bytes. Buffer then cast to sockaddr_ng filled byte-wise. Currently harmless (over-allocation only makes buffer larger) but wastes 252 bytes stack. Latent footgun: any future change relying on sizeof(addrbuf)==NG_HOOKSIZ+4 silently wrong. Fix: char addrbuf[NG_HOOKSIZ+4] drop the *.

Discussion (0)

No comments yet.

PoC verification

Evidence pack

findings/poc/DF-0538 · 1 files
FileTypeDescriptionSize
manifest.json file 398 B view raw

Fix verification

not_testable
baseline reproduced→ patch + rebuild →patched clean

recommended fix identified; fix.diff not authored/validated in this batch

recommended fix identified; fix.diff not authored/validated in this batch
combined build rc=0

Confirmed kernel references

—

Detail

Exploit chain

none (Info severity)

Evidence (decisive lines)

Source-confirmed at sys/netgraph7/socket/ng_socket.c:981: type-confused stack buffer (char *addrbuf[] is pointer array not byte array)

Verified recommended fix

Source-confirmed at sys/netgraph7/socket/ng_socket.c:981: type-confused stack buffer (char *addrbuf[] is pointer array not byte array)

Verdict

Source-confirmed at sys/netgraph7/socket/ng_socket.c:981: type-confused stack buffer (char *addrbuf[] is pointer array not byte array)