2012-07-07 08:08:28 +04:00
|
|
|
/*
|
|
|
|
* shmcrash2
|
|
|
|
*
|
|
|
|
* crashes!
|
|
|
|
*/
|
2012-02-11 08:13:31 +04:00
|
|
|
#include <sys/types.h>
|
|
|
|
#include <stdio.h>
|
|
|
|
#include <stdint.h>
|
|
|
|
#include <syscall.h>
|
|
|
|
#include <string.h>
|
|
|
|
#include <stdlib.h>
|
|
|
|
#include <unistd.h>
|
|
|
|
|
|
|
|
int main (int argc, char ** argv) {
|
|
|
|
if (argc < 2) {
|
|
|
|
fprintf(stderr, "%s: expected argument\n", argv[0]);
|
|
|
|
return 1;
|
|
|
|
}
|
|
|
|
|
|
|
|
printf("(this should not crash; but the kernel should free the shm block)\n");
|
|
|
|
|
2012-02-16 13:34:42 +04:00
|
|
|
size_t size = 0x1000;
|
|
|
|
volatile char * shm = (char *)syscall_shm_obtain(argv[1], &size);
|
2012-02-11 08:13:31 +04:00
|
|
|
if (shm == NULL) {
|
|
|
|
return 1;
|
|
|
|
}
|
|
|
|
|
|
|
|
char * args[] = {"/bin/echo", "exec'd to echo\n", NULL};
|
|
|
|
execve(args[0], args, NULL);
|
|
|
|
|
|
|
|
return 5;
|
|
|
|
}
|