|
|
a boundary check
All prior fuzzing mutated shared-buffer content, while the load descriptor is a separate
host-controlled input that had never been touched.
A third wedge trigger: the load command accepts a zero-length command buffer and
allocates a session, and the first invoke on that session then hangs the processor for ten
seconds and kills the ring, whereas the identical sequence with a normal length returns
immediately having written its output. The load-time validation is missing and the failure
surfaces as a hang rather than an error, making this simpler than the previously found
triggers since it needs two ordinary commands and no crafted payload.
A boundary check that holds: pointing the command buffer inside the processor's own
trusted memory region is rejected, so host-supplied buffers are validated against that
region and the most obvious confused-deputy write route is closed. A length far beyond the
allocation is accepted but harmless.
The objective is not met, since the zero-length case writes nothing before hanging and is
therefore the same class as the others, a hang rather than memory corruption.
|
