NGM_SOURCE_GET_COUNTER reads msg->data without arglen validation heap OOB read
Summary
GET_COUNTER handler reads *(uint8_t*)msg->data to obtain counter index before checking message carries data. Every sibling command(START SETPPS SET_TIMESTAMP SET_COUNTER) validates arglen first GET_COUNTER is lone exception. struct ng_mesg has 0-length flexible data[] allocated sizeof(ng_mesg)+arglen. With arglen==0 data region zero bytes read lands 1 byte beyond allocation. File NOT built by default not in sys/conf/files netgraph7 block + line 743 ifq typo compile error. Latent. [VERIFIED pass2: reproduced - pass-2 DUPLICATE of DF-2546 same rig, fold on triage]
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-2598 · 2 files| File | Type | Description | Size | |
|---|---|---|---|---|
| harness.c | — | 7.6 KB | view raw | |
| run.log | — | 7 B | view raw |
Fix verification
not_testableConfirmed kernel references
Detail
Evidence (decisive lines)
ngsource_all.log mode 0/1
PoC changes
same rig as DF-2546
Verified recommended fix
same as DF-2546
Verdict
Duplicate of DF-2546 (same handler, arglen==0 1-byte read past the ng_mesg). Demonstrated by the same rig; fold on triage. netgraph7 is not in the stock kernel (DF-2539); ng_source.c is additionally absent from sys/conf/files and cannot compile as-is (:743 undeclared ifq). The harness module compiles the pristine file with only the documented build adaptations (:743 ifq->ifsq; DFly API renames IF_ENQUEUE/altq/ifq_var includes); ng7 core (netgraph.ko) kldloaded for the framework.
No comments yet.