1*e3723e1fSApple OSS Distributions #include <stdio.h> 2*e3723e1fSApple OSS Distributions #include <assert.h> 3*e3723e1fSApple OSS Distributions #include <stdlib.h> 4*e3723e1fSApple OSS Distributions #include <unistd.h> 5*e3723e1fSApple OSS Distributions #include <string.h> 6*e3723e1fSApple OSS Distributions #include <sys/ioctl.h> 7*e3723e1fSApple OSS Distributions #include <sys/socket.h> 8*e3723e1fSApple OSS Distributions #include <sys/sys_domain.h> 9*e3723e1fSApple OSS Distributions #include <sys/kern_control.h> 10*e3723e1fSApple OSS Distributions 11*e3723e1fSApple OSS Distributions #include <darwintest.h> 12*e3723e1fSApple OSS Distributions 13*e3723e1fSApple OSS Distributions #define RVI_CONTROL_NAME "com.apple.net.rvi_control" 14*e3723e1fSApple OSS Distributions #define RVI_COMMAND_GET_INTERFACE 0x20 15*e3723e1fSApple OSS Distributions 16*e3723e1fSApple OSS Distributions T_GLOBAL_META( 17*e3723e1fSApple OSS Distributions T_META_NAMESPACE("xnu.net"), 18*e3723e1fSApple OSS Distributions T_META_RADAR_COMPONENT_NAME("xnu"), 19*e3723e1fSApple OSS Distributions T_META_RADAR_COMPONENT_VERSION("networking"), 20*e3723e1fSApple OSS Distributions T_META_ENABLED(TARGET_OS_OSX), 21*e3723e1fSApple OSS Distributions T_META_ASROOT_(1) 22*e3723e1fSApple OSS Distributions ); 23*e3723e1fSApple OSS Distributions 24*e3723e1fSApple OSS Distributions T_DECL(rvi_control_get_interface, "getsockopt on RVI control-socket triggering out-of-bounds memory access", T_META_TAG_VM_PREFERRED) 25*e3723e1fSApple OSS Distributions { 26*e3723e1fSApple OSS Distributions int fd; 27*e3723e1fSApple OSS Distributions 28*e3723e1fSApple OSS Distributions T_ASSERT_POSIX_SUCCESS(fd = socket(PF_SYSTEM, SOCK_DGRAM, SYSPROTO_CONTROL), NULL); 29*e3723e1fSApple OSS Distributions 30*e3723e1fSApple OSS Distributions struct ctl_info ctl_info = { 31*e3723e1fSApple OSS Distributions .ctl_name = RVI_CONTROL_NAME 32*e3723e1fSApple OSS Distributions }; 33*e3723e1fSApple OSS Distributions T_ASSERT_POSIX_SUCCESS(ioctl(fd, CTLIOCGINFO, &ctl_info), NULL); 34*e3723e1fSApple OSS Distributions 35*e3723e1fSApple OSS Distributions struct sockaddr_ctl sockaddr_ctl = { 36*e3723e1fSApple OSS Distributions .sc_len = sizeof(struct sockaddr_ctl), 37*e3723e1fSApple OSS Distributions .sc_family = AF_SYSTEM, 38*e3723e1fSApple OSS Distributions .ss_sysaddr = AF_SYS_CONTROL, 39*e3723e1fSApple OSS Distributions .sc_id = ctl_info.ctl_id, 40*e3723e1fSApple OSS Distributions .sc_unit = 0 41*e3723e1fSApple OSS Distributions }; 42*e3723e1fSApple OSS Distributions T_ASSERT_POSIX_SUCCESS(connect(fd, (const struct sockaddr *)&sockaddr_ctl, sizeof(struct sockaddr_ctl)), NULL); 43*e3723e1fSApple OSS Distributions 44*e3723e1fSApple OSS Distributions char data[10]; 45*e3723e1fSApple OSS Distributions socklen_t data_len = 1; 46*e3723e1fSApple OSS Distributions T_ASSERT_POSIX_SUCCESS(getsockopt(fd, SYSPROTO_CONTROL, RVI_COMMAND_GET_INTERFACE, &data, &data_len), NULL); 47*e3723e1fSApple OSS Distributions 48*e3723e1fSApple OSS Distributions data_len = 5; 49*e3723e1fSApple OSS Distributions T_ASSERT_POSIX_SUCCESS(getsockopt(fd, SYSPROTO_CONTROL, RVI_COMMAND_GET_INTERFACE, &data, &data_len), NULL); 50*e3723e1fSApple OSS Distributions T_ASSERT_EQ(data_len, 5, "data_len == 5", NULL); 51*e3723e1fSApple OSS Distributions 52*e3723e1fSApple OSS Distributions data_len = 10; 53*e3723e1fSApple OSS Distributions T_ASSERT_POSIX_SUCCESS(getsockopt(fd, SYSPROTO_CONTROL, RVI_COMMAND_GET_INTERFACE, &data, &data_len), NULL); 54*e3723e1fSApple OSS Distributions T_ASSERT_EQ(data_len, 5, "data_len == 5", NULL); 55*e3723e1fSApple OSS Distributions 56*e3723e1fSApple OSS Distributions T_PASS("success"); 57*e3723e1fSApple OSS Distributions } 58