1*d4514f0bSApple OSS Distributions #include <stdio.h> 2*d4514f0bSApple OSS Distributions #include <assert.h> 3*d4514f0bSApple OSS Distributions #include <stdlib.h> 4*d4514f0bSApple OSS Distributions #include <unistd.h> 5*d4514f0bSApple OSS Distributions #include <string.h> 6*d4514f0bSApple OSS Distributions #include <sys/ioctl.h> 7*d4514f0bSApple OSS Distributions #include <sys/socket.h> 8*d4514f0bSApple OSS Distributions #include <sys/sys_domain.h> 9*d4514f0bSApple OSS Distributions #include <sys/kern_control.h> 10*d4514f0bSApple OSS Distributions 11*d4514f0bSApple OSS Distributions #include <darwintest.h> 12*d4514f0bSApple OSS Distributions 13*d4514f0bSApple OSS Distributions #define RVI_CONTROL_NAME "com.apple.net.rvi_control" 14*d4514f0bSApple OSS Distributions #define RVI_COMMAND_GET_INTERFACE 0x20 15*d4514f0bSApple OSS Distributions 16*d4514f0bSApple OSS Distributions T_GLOBAL_META( 17*d4514f0bSApple OSS Distributions T_META_NAMESPACE("xnu.net"), 18*d4514f0bSApple OSS Distributions T_META_RADAR_COMPONENT_NAME("xnu"), 19*d4514f0bSApple OSS Distributions T_META_RADAR_COMPONENT_VERSION("networking"), 20*d4514f0bSApple OSS Distributions T_META_ENABLED(TARGET_OS_OSX), 21*d4514f0bSApple OSS Distributions T_META_ASROOT_(1) 22*d4514f0bSApple OSS Distributions ); 23*d4514f0bSApple OSS Distributions 24*d4514f0bSApple OSS Distributions T_DECL(rvi_control_get_interface, "getsockopt on RVI control-socket triggering out-of-bounds memory access", T_META_TAG_VM_PREFERRED) 25*d4514f0bSApple OSS Distributions { 26*d4514f0bSApple OSS Distributions int fd; 27*d4514f0bSApple OSS Distributions 28*d4514f0bSApple OSS Distributions T_ASSERT_POSIX_SUCCESS(fd = socket(PF_SYSTEM, SOCK_DGRAM, SYSPROTO_CONTROL), NULL); 29*d4514f0bSApple OSS Distributions 30*d4514f0bSApple OSS Distributions struct ctl_info ctl_info = { 31*d4514f0bSApple OSS Distributions .ctl_name = RVI_CONTROL_NAME 32*d4514f0bSApple OSS Distributions }; 33*d4514f0bSApple OSS Distributions T_ASSERT_POSIX_SUCCESS(ioctl(fd, CTLIOCGINFO, &ctl_info), NULL); 34*d4514f0bSApple OSS Distributions 35*d4514f0bSApple OSS Distributions struct sockaddr_ctl sockaddr_ctl = { 36*d4514f0bSApple OSS Distributions .sc_len = sizeof(struct sockaddr_ctl), 37*d4514f0bSApple OSS Distributions .sc_family = AF_SYSTEM, 38*d4514f0bSApple OSS Distributions .ss_sysaddr = AF_SYS_CONTROL, 39*d4514f0bSApple OSS Distributions .sc_id = ctl_info.ctl_id, 40*d4514f0bSApple OSS Distributions .sc_unit = 0 41*d4514f0bSApple OSS Distributions }; 42*d4514f0bSApple OSS Distributions T_ASSERT_POSIX_SUCCESS(connect(fd, (const struct sockaddr *)&sockaddr_ctl, sizeof(struct sockaddr_ctl)), NULL); 43*d4514f0bSApple OSS Distributions 44*d4514f0bSApple OSS Distributions char data[10]; 45*d4514f0bSApple OSS Distributions socklen_t data_len = 1; 46*d4514f0bSApple OSS Distributions T_ASSERT_POSIX_SUCCESS(getsockopt(fd, SYSPROTO_CONTROL, RVI_COMMAND_GET_INTERFACE, &data, &data_len), NULL); 47*d4514f0bSApple OSS Distributions 48*d4514f0bSApple OSS Distributions data_len = 5; 49*d4514f0bSApple OSS Distributions T_ASSERT_POSIX_SUCCESS(getsockopt(fd, SYSPROTO_CONTROL, RVI_COMMAND_GET_INTERFACE, &data, &data_len), NULL); 50*d4514f0bSApple OSS Distributions T_ASSERT_EQ(data_len, 5, "data_len == 5", NULL); 51*d4514f0bSApple OSS Distributions 52*d4514f0bSApple OSS Distributions data_len = 10; 53*d4514f0bSApple OSS Distributions T_ASSERT_POSIX_SUCCESS(getsockopt(fd, SYSPROTO_CONTROL, RVI_COMMAND_GET_INTERFACE, &data, &data_len), NULL); 54*d4514f0bSApple OSS Distributions T_ASSERT_EQ(data_len, 5, "data_len == 5", NULL); 55*d4514f0bSApple OSS Distributions 56*d4514f0bSApple OSS Distributions T_PASS("success"); 57*d4514f0bSApple OSS Distributions } 58