unsigned long get_interesting_value(void)
{
#if __WORDSIZE == 32
	return get_interesting_32bit_value();
#else
	unsigned long low = 0;

	if (rand_bool())
		low = get_interesting_32bit_value();

	switch (rand() % 13) {
	case 0: return 0;
	case 1: return low;
	case 2: return 0x0000000100000000UL | low;
	case 3: return 0x7fffffff00000000UL | low;
	case 4: return 0x8000000000000000UL | low;
	case 5: return 0xffffffff00000000UL | low;
	case 6: return 0xffffffffffffff00UL | (rand() % 256);
	case 7: return 0xffffffffffffffffUL - page_size;
	case 8: return PAGE_OFFSET | (low << 4);
	case 9: return KERNEL_ADDR | (low & 0xffffff);
	case 10: return MODULE_ADDR | (low & 0xffffff);
	case 11: return per_arch_interesting_addr(low);
	case 12: return (low << 32);
	}

	return low;	// unreachable, but gcc is dumb.
#endif	/* __WORDSIZE */
}
Exemplo n.º 2
0
unsigned long get_interesting_value(void)
{
	unsigned long low = 0;

	switch (rand() % 3) {
	case 0:	low = get_interesting_8bit_value();
		break;
	case 1:	low = get_interesting_16bit_value();
		break;
	case 2: low = get_interesting_32bit_value();
		break;
	}

	low = (rand() & 0xf) ? low : plus_minus_two(low);	// 1 in 16 call plus_minus_two
#if __WORDSIZE != 32

	if (RAND_BOOL()) {	// FIXME: This should likely be less aggressive than 50/50
		switch (rand() % 11) {
		case 0: return 0x0000000100000000UL | low;
		case 1: return 0x7fffffff00000000UL | low;
		case 2: return 0x8000000000000000UL | low;
		case 3: return 0xffffffff00000000UL | low;
		case 4: return 0xffffffffffffff00UL | RAND_BYTE();
		case 5: return 0xffffffffffffffffUL - page_size;
		case 6: return PAGE_OFFSET | (low << 4);
		case 7: return KERNEL_ADDR | (low & 0xffffff);
		case 8: return MODULE_ADDR | (low & 0xffffff);
		case 9: return per_arch_interesting_addr(low);
		case 10: return (low << 32);
		}
	}

#endif	/* __WORDSIZE */
	return low;
}