mirrors/qira
1
0
Fork 0
mirror of https://github.com/geohot/qira synced 2025-02-19 07:54:15 +03:00
Code Issues Packages Projects Releases Wiki Activity

update

Browse Source
This commit is contained in:
George Hotz 2014-08-01 21:49:31 +00:00
parent 34d51258c6
commit fe9ae2c3dc
2 changed files with 5 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

BIN
tests/heapfunn
View File

Binary file not shown.

9
tests/heapfunn.c
View File

@ -6,21 +6,22 @@ char *bufs[NUMBUFS];
int main() {
unsigned int bufnum, size, haxx, i;
int ret;
for (i = 0; i < NUMBUFS; i++) bufs[i] = NULL;
printf("exploit me bro\n");
fflush(stdout);
while (1) {
read(0, &bufnum, sizeof(bufnum));
ret = read(0, &bufnum, sizeof(bufnum)); if (ret <= 0) break;
if (bufnum >= NUMBUFS) continue;
read(0, &size, sizeof(size));
read(0, &haxx, sizeof(haxx));
ret = read(0, &size, sizeof(size)); if (ret <= 0) break;
ret = read(0, &haxx, sizeof(haxx)); if (ret <= 0) break;
if (size == 0) {
if (bufs[bufnum] != NULL) free(bufs[bufnum]);
bufs[bufnum] = NULL;
} else {
bufs[bufnum] = (char *)malloc(size);
if (bufs[bufnum] != NULL) {
int r = read(0, bufs[bufnum], size);
ret = read(0, bufs[bufnum], size); if (ret <= 0) break;
if (haxx) {
bufs[bufnum][size] = '\0';
}