1*aca3beaaSApple OSS Distributions #include <stdio.h> 2*aca3beaaSApple OSS Distributions #include <assert.h> 3*aca3beaaSApple OSS Distributions #include <stdlib.h> 4*aca3beaaSApple OSS Distributions #include <unistd.h> 5*aca3beaaSApple OSS Distributions #include <string.h> 6*aca3beaaSApple OSS Distributions #include <sys/ioctl.h> 7*aca3beaaSApple OSS Distributions #include <sys/socket.h> 8*aca3beaaSApple OSS Distributions #include <sys/sys_domain.h> 9*aca3beaaSApple OSS Distributions #include <sys/kern_control.h> 10*aca3beaaSApple OSS Distributions 11*aca3beaaSApple OSS Distributions #include <darwintest.h> 12*aca3beaaSApple OSS Distributions 13*aca3beaaSApple OSS Distributions #define RVI_CONTROL_NAME "com.apple.net.rvi_control" 14*aca3beaaSApple OSS Distributions #define RVI_COMMAND_GET_INTERFACE 0x20 15*aca3beaaSApple OSS Distributions 16*aca3beaaSApple OSS Distributions T_GLOBAL_META( 17*aca3beaaSApple OSS Distributions T_META_NAMESPACE("xnu.net"), 18*aca3beaaSApple OSS Distributions T_META_RADAR_COMPONENT_NAME("xnu"), 19*aca3beaaSApple OSS Distributions T_META_RADAR_COMPONENT_VERSION("networking"), 20*aca3beaaSApple OSS Distributions T_META_ENABLED(TARGET_OS_OSX), 21*aca3beaaSApple OSS Distributions T_META_ASROOT_(1) 22*aca3beaaSApple OSS Distributions ); 23*aca3beaaSApple OSS Distributions 24*aca3beaaSApple OSS Distributions T_DECL(rvi_control_get_interface, "getsockopt on RVI control-socket triggering out-of-bounds memory access") 25*aca3beaaSApple OSS Distributions { 26*aca3beaaSApple OSS Distributions int fd; 27*aca3beaaSApple OSS Distributions 28*aca3beaaSApple OSS Distributions T_ASSERT_POSIX_SUCCESS(fd = socket(PF_SYSTEM, SOCK_DGRAM, SYSPROTO_CONTROL), NULL); 29*aca3beaaSApple OSS Distributions 30*aca3beaaSApple OSS Distributions struct ctl_info ctl_info = { 31*aca3beaaSApple OSS Distributions .ctl_name = RVI_CONTROL_NAME 32*aca3beaaSApple OSS Distributions }; 33*aca3beaaSApple OSS Distributions T_ASSERT_POSIX_SUCCESS(ioctl(fd, CTLIOCGINFO, &ctl_info), NULL); 34*aca3beaaSApple OSS Distributions 35*aca3beaaSApple OSS Distributions struct sockaddr_ctl sockaddr_ctl = { 36*aca3beaaSApple OSS Distributions .sc_len = sizeof(struct sockaddr_ctl), 37*aca3beaaSApple OSS Distributions .sc_family = AF_SYSTEM, 38*aca3beaaSApple OSS Distributions .ss_sysaddr = AF_SYS_CONTROL, 39*aca3beaaSApple OSS Distributions .sc_id = ctl_info.ctl_id, 40*aca3beaaSApple OSS Distributions .sc_unit = 0 41*aca3beaaSApple OSS Distributions }; 42*aca3beaaSApple OSS Distributions T_ASSERT_POSIX_SUCCESS(connect(fd, (const struct sockaddr *)&sockaddr_ctl, sizeof(struct sockaddr_ctl)), NULL); 43*aca3beaaSApple OSS Distributions 44*aca3beaaSApple OSS Distributions char data[10]; 45*aca3beaaSApple OSS Distributions socklen_t data_len = 1; 46*aca3beaaSApple OSS Distributions T_ASSERT_POSIX_SUCCESS(getsockopt(fd, SYSPROTO_CONTROL, RVI_COMMAND_GET_INTERFACE, &data, &data_len), NULL); 47*aca3beaaSApple OSS Distributions 48*aca3beaaSApple OSS Distributions data_len = 5; 49*aca3beaaSApple OSS Distributions T_ASSERT_POSIX_SUCCESS(getsockopt(fd, SYSPROTO_CONTROL, RVI_COMMAND_GET_INTERFACE, &data, &data_len), NULL); 50*aca3beaaSApple OSS Distributions T_ASSERT_EQ(data_len, 5, "data_len == 5", NULL); 51*aca3beaaSApple OSS Distributions 52*aca3beaaSApple OSS Distributions data_len = 10; 53*aca3beaaSApple OSS Distributions T_ASSERT_POSIX_SUCCESS(getsockopt(fd, SYSPROTO_CONTROL, RVI_COMMAND_GET_INTERFACE, &data, &data_len), NULL); 54*aca3beaaSApple OSS Distributions T_ASSERT_EQ(data_len, 5, "data_len == 5", NULL); 55*aca3beaaSApple OSS Distributions 56*aca3beaaSApple OSS Distributions T_PASS("success"); 57*aca3beaaSApple OSS Distributions } 58