From e9c440d4eeebba983f9c57733b45088d565324b9 Mon Sep 17 00:00:00 2001 From: Ewen Smith <ewens@student.unimelb.edu.au> Date: Thu, 22 Oct 2020 18:05:07 +1100 Subject: [PATCH] Vuln 1 Revert --- poc/vuln-1.poc | 674 +++++++++++++++++++++++++++++++++++++++++++++++- src/vuln-1/dc.c | 11 +- 2 files changed, 683 insertions(+), 2 deletions(-) diff --git a/poc/vuln-1.poc b/poc/vuln-1.poc index 4a6d3c1..4184171 100644 --- a/poc/vuln-1.poc +++ b/poc/vuln-1.poc @@ -1,2 +1,674 @@ push 10 -store aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa \ No newline at end of file +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 +push 10 diff --git a/src/vuln-1/dc.c b/src/vuln-1/dc.c index 9ea9161..5f766a1 100644 --- a/src/vuln-1/dc.c +++ b/src/vuln-1/dc.c @@ -547,11 +547,12 @@ static int execute(void){ debug_printf("Expected 1 arguments to %s instruction but instead found %u\n",INSTRUCTION_PUSH,numToks-1); return -1; } - + /* if (stack_full()){ debug_printf("Push to full stack\n"); return -1; } + */ value_t value; if (sscanf(toks[1],"%d",&value) != 1){ debug_printf("Non-numeric argument to %s instruction: %s\n",INSTRUCTION_PUSH,toks[1]); @@ -619,6 +620,13 @@ static int run(FILE *f){ return -1; } } + if (inst[MAX_LINE_LENGTH] != '\0'){ + if (!(inst[MAX_LINE_LENGTH] == '\n' && inst[MAX_LINE_LENGTH+1] == '\0')){ + fprintf(stderr,"Line %d exceeds maximum length (%d)\n",instructionCount+1,MAX_LINE_LENGTH); + debug_printf("(Expected at array index %d to find NUL but found '%c' (%d))\n",MAX_LINE_LENGTH,inst[MAX_LINE_LENGTH],inst[MAX_LINE_LENGTH]); + return -1; + } + }else{ /* inst[MAX_LINE_LENGTH] == '\0', so strlen is guaranteed to be <= MAX_LINE_LENGTH Check if it has a newline and add it if it needs it */ @@ -629,6 +637,7 @@ static int run(FILE *f){ inst[len+1] = '\0'; } } + } instructionCount++; int r = execute(); if (r != 0){ -- GitLab