DF-4600
renameobject() bcopy's full-width newname with no NUL-termination guard → unterminated drive/sd/plex/volume name fields persisted to config and fed to strcmp/strlen/log %s
Summary
VINUM_RENAME bcopy's msg->newname into the on-struct name fields at the full field width (32/64/64/64) and never forces a terminating NUL - a 64-byte non-NUL newname leaves the name unterminated, propagating into find_* strcmp walks, strlen/bcmp, log %s, and the persisted config text re-parsed at next init. Root-gated hygiene ceiling. Width-1-copy + forced-NUL fix.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-4600 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| verdict.json | file | 1.2 KB | view raw |
Fix verification
not_testablebaseline no→ patch + rebuild →patched clean
not_testable
width-1 bcopy + forced NUL (or strlcpy) in finding markdown
per-fix-DF-4600
Confirmed kernel references
Detail
Exploit chain
[]
Evidence (decisive lines)
renameobject bcopy's full field width (32/64/64/64) and never forces a NUL; a 64-byte non-NUL newname leaves the on-struct name unterminated. Root-gated hygiene/config-corruption ceiling. Same class as DF-4598, different code and field. Low -> no pack per contract.
Verdict
not_run: Low, trivially runnable but root-gated; pack omitted per contract
No comments yet.