# Valgrind cross-verification — os_kv.c kvvfsDecode heap overflow
# gcc -O0 -g kvvfs_overflow_poc.c && valgrind --error-exitcode=42 --leak-check=no ./a.out
# NOTE: kvvfs decodes UPPERCASE hex (A-F); kvvfsHexValue maps 0x41-0x46, lowercase a-f => -1.

==302456== Memcheck, a memory error detector
==302456== Copyright (C) 2002-2022, and GNU GPL'd, by Julian Seward et al.
==302456== Using Valgrind-3.19.0 and LibVEX; rerun with -h for copyright info
==302456== Command: /tmp/kvvfs_poc
==302456== 
==302456== Invalid write of size 1
==302456==    at 0x1092AD: kvvfsDecode (kvvfs_poc.c:64)
==302456==    by 0x109363: main (kvvfs_poc.c:82)
==302456==  Address 0x4a45044 is 0 bytes after a block of size 4 alloc'd
==302456==    at 0x48417B4: malloc (vg_replace_malloc.c:381)
==302456==    by 0x10933E: main (kvvfs_poc.c:80)
==302456== 
==302456== Invalid read of size 1
==302456==    at 0x1092F9: kvvfsDecode (kvvfs_poc.c:67)
==302456==    by 0x109363: main (kvvfs_poc.c:82)
==302456==  Address 0x4a45044 is 0 bytes after a block of size 4 alloc'd
==302456==    at 0x48417B4: malloc (vg_replace_malloc.c:381)
==302456==    by 0x10933E: main (kvvfs_poc.c:80)
==302456== 
==302456== Invalid write of size 1
==302456==    at 0x10930F: kvvfsDecode (kvvfs_poc.c:67)
==302456==    by 0x109363: main (kvvfs_poc.c:82)
==302456==  Address 0x4a45044 is 0 bytes after a block of size 4 alloc'd
==302456==    at 0x48417B4: malloc (vg_replace_malloc.c:381)
==302456==    by 0x10933E: main (kvvfs_poc.c:80)
==302456== 
==302456== Invalid write of size 1
==302456==    at 0x1092AD: kvvfsDecode (kvvfs_poc.c:64)
==302456==    by 0x10948A: main (kvvfs_poc.c:106)
==302456==  Address 0x4a460ea is 0 bytes after a block of size 26 alloc'd
==302456==    at 0x48417B4: malloc (vg_replace_malloc.c:381)
==302456==    by 0x109449: main (kvvfs_poc.c:104)
==302456== 
==302456== Invalid read of size 1
==302456==    at 0x1092F9: kvvfsDecode (kvvfs_poc.c:67)
==302456==    by 0x10948A: main (kvvfs_poc.c:106)
==302456==  Address 0x4a460ea is 0 bytes after a block of size 26 alloc'd
==302456==    at 0x48417B4: malloc (vg_replace_malloc.c:381)
==302456==    by 0x109449: main (kvvfs_poc.c:104)
==302456== 
==302456== Invalid write of size 1
==302456==    at 0x10930F: kvvfsDecode (kvvfs_poc.c:67)
==302456==    by 0x10948A: main (kvvfs_poc.c:106)
==302456==  Address 0x4a460ea is 0 bytes after a block of size 26 alloc'd
==302456==    at 0x48417B4: malloc (vg_replace_malloc.c:381)
==302456==    by 0x109449: main (kvvfs_poc.c:104)
==302456== 
[A] nOut=4  kvvfsDecode returned 16 (= bytes written)  -> 16 bytes into a 4-byte buffer
[B] header parsed n=26, malloc(26); payload=100 bytes
[B] kvvfsDecode returned 100 (= bytes written into the 26-byte buffer)
==302456== 
==302456== HEAP SUMMARY:
==302456==     in use at exit: 0 bytes in 0 blocks
==302456==   total heap usage: 3 allocs, 3 frees, 4,126 bytes allocated
==302456== 
==302456== For a detailed leak analysis, rerun with: --leak-check=full
==302456== 
==302456== For lists of detected and suppressed errors, rerun with: -s
==302456== ERROR SUMMARY: 258 errors from 6 contexts (suppressed: 0 from 0)
