|
|
earlier finding
The last unfuzzed descriptor field is the image source. If unchecked, pointing it at the
trusted region would pull trusted memory into the authentication path. Testing shows it is
range-checked exactly as the command buffer is: an image inside the region and one
straddling its start are both rejected, while a control and an oversized length that stays
within our allocation are accepted, and a zero-length image is rejected cleanly with an
error code.
That sharpens the earlier finding. Within one descriptor, a zero-length image yields a
clean error while a zero-length command buffer yields a hang, so the platform knows how to
reject this input class and the command-buffer length is simply missing the check. That is
a concrete narrow defect to report rather than a vague intermittent hang.
The whole load descriptor surface is now fuzzed, giving two correct range checks, one
clean zero-length rejection and one missing check that produces a denial of service, with
no memory corruption anywhere in it.
|
