Subject: RE: [hackers-il] stop bashing debuggers!

From: Omer Musaev <[email-masked]>
Date: Mon, 7 May 2001 00:32:55 +0200

In code snippet I sent a minute ago, in_aton should be changed to
inet_aton ( in order to be ported from Linux kernel to SystemV 
UNIX ).
 
in foo_goo.h

typedef struct foo {
  u_int32 sip ;
  u_int32 cip ;
  u_int16 spt ;
  u_int16 dpt ;
  u_int16 cnt ;
} tcp_link_cnt_t ;

typedef struct goo {
  u_int32 url_len ;
  char   *url ;
} url_info_t ;

....
in foo_goo.c

void foo_goo( void ) {
  char *buf ;
  tcp_link_cnt_t *tcp_ptr ;
  url_info_t     *url_ptr ;

  tcp_ptr = ( tcp_link_cnt_t * ) buf ;
  tcp_ptr->sip = inet_aton( "127.0.0.1" ) ;
                ^^^^^^^^^^^^^^^ 
  tcp_ptr->dip = inet_aton( "192.168.0.1" ) ;
                ^^^^^^^^^^^^^^^
  tcp_ptr->spt = ntohs( 80 ) ;
  tcp_ptr->dpt = ntohs( 3000 ) ;
  tcp_ptr->cnt = 0 ;

  url_ptr = ( url_info_t *) ( buf + sizeof( *tcp_ptr ) ) ;
  url_ptr->url_len = 4 ; /* for byte alignment */
  url_ptr->url = "/" ;
  memset( url_ptr->url + strlen( url_ptr->url ) , 0,
          url_ptr->url_len - strlen( url_ptr->url ) ) ;
}

Where this code will fail?

Regards, 
OmerM

To unsubscribe from this group, send an email to:
[email-masked]

Your use of Yahoo! Groups is subject to
http://docs.yahoo.com/info/terms/

---

From: guy keren <[email-masked]>
Date: Mon, 7 May 2001 00:41:55 +0300 (EET DST)

> inet_aton ( in order to be ported from Linux kernel to SystemV

this specific code will fail everywhere . are you sure that's the code you

> tcp_ptr->sip = inet_aton( "127.0.0.1" ) ;

buf is an uninitialized pointer. ofcourse trying to assign data into it
would fail. so all de-references of tcp_ptr are bound to fail.

same problem as with tcp_ptr.

>         url_ptr->url_len - strlen( url_ptr->url ) ) ;

url_ptr->url points to a static memory location. ofcourse trying to write
anything into it would fail due to writing into either read-only segment
(if the compiler palced the '"/" string in such a segment) or writing over
an unallocated memory..

> Where this code will fail?

where will this code succeed? :0

--
guy

"For world domination - press 1,
 or dial 0, and please hold, for the creator." -- nob o. dy

---

From: mulix <[email-masked]>
Date: Mon, 7 May 2001 00:55:01 +0300 (IDT)

>   tcp_ptr = ( tcp_link_cnt_t * ) buf ;

buf is not initialized to anything, nor does it have space allocated.
game over.

>   tcp_ptr->sip = inet_aton( "127.0.0.1" ) ;

according to my man pages, inet_aton takes two argument and returns true
(!=0) on success and false (0) on failure. this will fail in compile
time.

>           url_ptr->url_len - strlen( url_ptr->url ) ) ;

url_ptr is now buf + sizeof(*tcp_ptr). strlen(url_ptr->url) is 1. so
you're setting the memory from buf+sizeof(*tcp_ptr)+1 to 0 , for the
next three bytes. seems ok, except for the fact that buf is unallocated
memory...

> Where this code will fail?

as an example of the benefit of debuggers? :)

-- 
mulix
http://www.advogato.com/person/mulix

linux/reboot.h: #define LINUX_REBOOT_MAGIC1 0xfee1dead