#!/usr/bin/env python3
"""Byte-level annotation of poc_oob_read_missing_verifier.ptd (64 bytes).
Run: python3 decode_poc.py poc_oob_read_missing_verifier.ptd
"""
import struct
import sys

with open(sys.argv[1] if len(sys.argv) > 1 else "poc_oob_read_missing_verifier.ptd", "rb") as f:
    data = f.read()

assert len(data) == 64, f"expected 64 bytes, got {len(data)}"

root_offset = struct.unpack_from("<I", data, 0)[0]
fb_identifier = data[4:8]
fh_magic = data[8:12]
header_len = struct.unpack_from("<I", data, 12)[0]
fb_offset = struct.unpack_from("<Q", data, 16)[0]
fb_size = struct.unpack_from("<Q", data, 24)[0]
seg_base = struct.unpack_from("<Q", data, 32)[0]
seg_size = struct.unpack_from("<Q", data, 40)[0]

print(f"[0:4]   root_offset (of the inner flatbuffer payload) = {root_offset} (0x{root_offset:x})")
print(f"[4:8]   flatbuffer file_identifier                    = {fb_identifier!r}")
print(f"[8:12]  FlatTensorHeader magic                        = {fh_magic!r}")
print(f"[12:16] FlatTensorHeader.length                       = {header_len}")
print(f"[16:24] FlatTensorHeader.flatbuffer_offset             = {fb_offset}")
print(f"[24:32] FlatTensorHeader.flatbuffer_size               = {fb_size}")
print(f"[32:40] FlatTensorHeader.segment_base_offset           = {seg_base}")
print(f"[40:48] FlatTensorHeader.segment_data_size              = {seg_size}")
print(f"[48:64] trailing bytes (unused padding/garbage)        = {data[48:64].hex()}")
print()
loaded_flatbuffer_len = fb_offset + fb_size
print(f"Loaded flatbuffer segment length = flatbuffer_offset + flatbuffer_size = {fb_offset} + {fb_size} = {loaded_flatbuffer_len} bytes")
print(f"Root table offset stored in the file = {root_offset}")
if root_offset > loaded_flatbuffer_len:
    print(f"*** root_offset ({root_offset}) EXCEEDS the loaded flatbuffer segment length ({loaded_flatbuffer_len}) ***")
    print("This is the corrupted field that FlatTensorDataMap::load() never validates:")
    print("no flatbuffers::Verifier runs, so GetFlatTensor()/field accessors trust this")
    print("out-of-range offset and walk memory past the end of the loaded buffer.")