From 633e9ff96d89134a78075b0d8bc4bc846b8017d4 Mon Sep 17 00:00:00 2001
From: Matt Brown <matt@brownfinesecurity.com>
Date: Thu, 17 Sep 2026 12:38:16 -0400
Subject: [PATCH] test: regression for the partition-boundary overrun fix (#33)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

A stale/oversized finding must not hide a real partition behind it: the
scanner clamps its skip-ahead at partition boundaries, and resolve() no
longer demotes a finding that starts exactly on a partition boundary.

Adds tests/test_partition_overlap.py — fully self-contained (a hand-built
GPT plus synthetic ext superblocks, no mkfs tools). It is a differential:
a stale ext at 0x8000 overruns a real partition at 0x40000; with the GPT
present the real partition is recovered, and with the GPT zeroed the same
stale finding hides it. That both asserts the fix and confirms the
partition table is what makes the difference (it fails on pre-fix master).
Wired into run.sh and CTest.
---
 CMakeLists.txt                  |   1 +
 tests/run.sh                    |   2 +
 tests/test_partition_overlap.py | 140 ++++++++++++++++++++++++++++++++
 3 files changed, 143 insertions(+)
 create mode 100644 tests/test_partition_overlap.py

diff --git a/CMakeLists.txt b/CMakeLists.txt
index 3887876..1e6a0e9 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -215,6 +215,7 @@ if(Python3_Interpreter_FOUND)
     test_extract
     test_human_tree
     test_partition
+    test_partition_overlap
     test_esp32_part
     test_esp32_nvs
     test_legacy_fs
diff --git a/tests/run.sh b/tests/run.sh
index 4285cfe..996c14e 100755
--- a/tests/run.sh
+++ b/tests/run.sh
@@ -18,6 +18,8 @@ python3 tests/test_extract.py
 python3 tests/test_human_tree.py
 # GPT/MBR partition-table identify + region map (synthetic + real-tool round-trip).
 python3 tests/test_partition.py
+# Partition-boundary overrun: a stale finding must not hide a real partition (PR #33).
+python3 tests/test_partition_overlap.py
 # ESP32 partition-table region map + NVS identify/extract (synthetic, self-contained).
 python3 tests/test_esp32_part.py
 python3 tests/test_esp32_nvs.py
diff --git a/tests/test_partition_overlap.py b/tests/test_partition_overlap.py
new file mode 100644
index 0000000..69befe9
--- /dev/null
+++ b/tests/test_partition_overlap.py
@@ -0,0 +1,140 @@
+#!/usr/bin/env python3
+"""Regression for the partition-boundary overrun fix (PR #33).
+
+A finding's self-declared size can overrun a region the partition table already
+accounts for (a stale superblock in unpartitioned space still recording its
+pre-repartition size). The scanner used to skip the whole extent, stepping over
+the real partition's superblock so it was never validated and went missing. The
+fix clamps the skip (and the resolve owner-skip) at partition boundaries.
+
+Fully self-contained (hand-built GPT + synthetic ext superblocks, no mkfs tools).
+It is a differential: with the GPT present the hidden partition is recovered;
+with the GPT zeroed the same stale finding hides it — which proves the partition
+table is what rescues it. Run: python3 tests/test_partition_overlap.py
+"""
+import json
+import os
+import struct
+import subprocess
+import sys
+import tempfile
+import zlib
+
+HERE = os.path.dirname(os.path.abspath(__file__))
+MORIA = os.path.join(HERE, "..", "build", "moria")
+
+SECT = 512
+
+
+def ext_sb(buf, off, size_bytes, block_size=4096):
+    """Plant a minimal ext superblock at image offset `off` (moria: ext consistent,
+    finding size = s_blocks_count_lo * (1024 << s_log_block_size))."""
+    log = block_size.bit_length() - 1 - 10          # 4096 -> 2
+    blocks = size_bytes // block_size
+    sb = off + 1024
+    struct.pack_into("<I", buf, sb + 0, 1000)       # s_inodes_count
+    struct.pack_into("<I", buf, sb + 4, blocks)     # s_blocks_count_lo
+    struct.pack_into("<I", buf, sb + 20, 0)         # s_first_data_block
+    struct.pack_into("<I", buf, sb + 24, log)       # s_log_block_size
+    struct.pack_into("<H", buf, off + 0x438, 0xEF53)  # magic
+
+
+def build_image(with_gpt=True):
+    """A 2 MB image:
+      GPT partitions rootfs@0x10000, userdata@0x40000 (member offsets).
+      A STALE ext @0x8000 sized 256 KB -> extent 0x8000..0x48000, overrunning the
+      real userdata partition start at 0x40000.
+      A REAL ext (userdata) @0x40000 sized 256 KB -> extent 0x40000..0x80000, which
+      extends beyond the stale extent (so it is not merely interior noise)."""
+    disk_sectors = 4096                              # 2 MB
+    buf = bytearray(disk_sectors * SECT)
+
+    if with_gpt:
+        # protective MBR
+        struct.pack_into("<B", buf, 0x1BE + 4, 0xEE)
+        struct.pack_into("<I", buf, 0x1BE + 8, 1)
+        struct.pack_into("<I", buf, 0x1BE + 12, disk_sectors - 1)
+        buf[0x1FE], buf[0x1FF] = 0x55, 0xAA
+        LINUX = bytes.fromhex("af3dc60f838472478e793d69d8477de4")
+        arr = bytearray(4 * 128)
+
+        def put(i, first, last, name):
+            o = i * 128
+            arr[o:o + 16] = LINUX
+            arr[o + 16:o + 32] = bytes(range(16))
+            struct.pack_into("<Q", arr, o + 32, first)
+            struct.pack_into("<Q", arr, o + 40, last)
+            nm = name.encode("utf-16-le")[:72]
+            arr[o + 56:o + 56 + len(nm)] = nm
+
+        put(0, 0x10000 // SECT, 0x10000 // SECT + 100, "rootfs")
+        put(1, 0x40000 // SECT, 0x80000 // SECT - 1, "userdata")
+        arr_crc = zlib.crc32(bytes(arr)) & 0xFFFFFFFF
+        hdr = bytearray(92)
+        hdr[0:8] = b"EFI PART"
+        struct.pack_into("<I", hdr, 8, 0x00010000)
+        struct.pack_into("<I", hdr, 12, 92)
+        struct.pack_into("<Q", hdr, 24, 1)
+        struct.pack_into("<Q", hdr, 32, disk_sectors - 1)
+        struct.pack_into("<Q", hdr, 40, 34)
+        struct.pack_into("<Q", hdr, 48, disk_sectors - 34)
+        hdr[56:72] = bytes(range(16, 32))
+        struct.pack_into("<Q", hdr, 72, 2)
+        struct.pack_into("<I", hdr, 80, 4)
+        struct.pack_into("<I", hdr, 84, 128)
+        struct.pack_into("<I", hdr, 88, arr_crc)
+        struct.pack_into("<I", hdr, 16, zlib.crc32(bytes(hdr)) & 0xFFFFFFFF)
+        buf[SECT:SECT + 92] = hdr
+        buf[2 * SECT:2 * SECT + len(arr)] = arr
+
+    ext_sb(buf, 0x8000, 256 * 1024)    # stale, overruns 0x40000
+    ext_sb(buf, 0x40000, 256 * 1024)   # real userdata partition
+    return bytes(buf)
+
+
+def ext_offsets(data):
+    with tempfile.NamedTemporaryFile(suffix=".img") as f:
+        f.write(data)
+        f.flush()
+        r = subprocess.run([MORIA, "-j", f.name], capture_output=True, timeout=60)
+    doc = json.loads(r.stdout)
+    return {x["offset"] for x in doc["findings"] if x["type"] == "ext"}
+
+
+def main():
+    if not os.path.exists(MORIA):
+        print("moria not built", file=sys.stderr)
+        return 1
+    fails = []
+
+    def check(cond, msg):
+        if not cond:
+            fails.append(msg)
+
+    with_gpt = ext_offsets(build_image(with_gpt=True))
+    no_gpt = ext_offsets(build_image(with_gpt=False))
+
+    # The stale ext at 0x8000 is found in both cases.
+    check(0x8000 in with_gpt, "stale ext @0x8000 should be found")
+    # With the partition table, the real partition at 0x40000 is rescued from the
+    # stale finding's overrun (the fix).
+    check(0x40000 in with_gpt, "real partition ext @0x40000 hidden despite the GPT (regression!)")
+    # Without any partition table, there is no boundary to rescue it: the stale
+    # finding's skip hides 0x40000 (this is the pre-fix behavior, and confirms the
+    # partition table is what makes the difference).
+    check(0x40000 not in no_gpt,
+          "control: without a GPT, 0x40000 should be hidden by the stale finding "
+          "(the fixture no longer exercises the fix)")
+
+    print("-" * 60)
+    if fails:
+        for m in fails:
+            print("FAIL:", m)
+        return 1
+    print("PASS: a partition table rescues a real partition from a stale finding's "
+          "size overrun (PR #33)")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())