// https://syzkaller.appspot.com/bug?id=1b5e5ac8338cf3a41c5d421cc9dfea73bc53f1ee
#define _GNU_SOURCE
#include <fcntl.h>
#include <sys/ioctl.h>
#include <linux/dvb/frontend.h>
#include <stdio.h>
#include <unistd.h>
#include <string.h>
#include <errno.h>
#include <stdlib.h>

void enable_dynamic_debug(void)
{
    /* Attempt to enable dynamic debug for dvb_frontend.c */
    int fd = open("/sys/kernel/debug/dynamic_debug/control", O_WRONLY);
    if (fd < 0) {
        fd = open("/proc/dynamic_debug/control", O_WRONLY);
    }
    if (fd >= 0) {
        const char *cmd = "file dvb_frontend.c +p";
        ssize_t ret = write(fd, cmd, strlen(cmd));
        if (ret < 0) {
            printf("[-] write dynamic_debug failed: %s\n", strerror(errno));
        } else {
            printf("[+] Enabled dynamic debug for dvb_frontend.c\n");
        }
        close(fd);
    } else {
        printf("[-] Failed to open dynamic_debug control: %s\n", strerror(errno));
    }
}

int main(void)
{
    enable_dynamic_debug();

    /* Open the DVB frontend device */
    int fd = open("/dev/dvb/adapter0/frontend0", O_RDWR);
    if (fd < 0) {
        fd = open("/dev/dvb/adapter0/frontend0", O_RDONLY);
    }
    if (fd < 0) {
        printf("[-] open /dev/dvb/adapter0/frontend0 failed: %s\n", strerror(errno));
        exit(1);
    }
    printf("[+] open /dev/dvb/adapter0/frontend0 successful.\n");

    struct dtv_property prop;
    memset(&prop, 0, sizeof(prop));
    prop.cmd = DTV_FREQUENCY;
    
    /* 
     * Set a length that exceeds FIELD_WIDTH_MAX ((1 << 23) - 1).
     * DTV_FREQUENCY only modifies prop.u.data (offset 0), leaving 
     * prop.u.buffer.len (offset 32) untouched.
     */
    prop.u.buffer.len = 0x45520028; /* 1163001896 */

    struct dtv_properties props;
    memset(&props, 0, sizeof(props));
    props.num = 1;
    props.props = &prop;

    /* Trigger the out-of-bounds field width warning in vsprintf */
    int res = ioctl(fd, FE_GET_PROPERTY, &props);
    if (res < 0) {
        printf("[-] ioctl FE_GET_PROPERTY failed: %s\n", strerror(errno));
        exit(1);
    }
    printf("[+] ioctl FE_GET_PROPERTY successful.\n");

    close(fd);
    return 0;
}