99#![ allow( function_casts_as_integer) ]
1010
1111use std:: env;
12+ use std:: ffi:: c_void;
1213use std:: process:: { Command , ExitStatus } ;
1314
1415fn main ( ) {
@@ -42,7 +43,9 @@ fn vulnerable_function() {
4243 let bad_code_ptr = malicious_code as usize ;
4344 // Overwrite the on-stack return address with the address of `malicious_code()`,
4445 // thereby jumping to that function when returning from `vulnerable_function()`.
45- unsafe { fill ( stackaddr, bad_code_ptr, 20 ) ; }
46+ unsafe {
47+ fill ( stackaddr, bad_code_ptr, 20 ) ;
48+ }
4649 // Capture the address, so the write is not optimized away.
4750 std:: hint:: black_box ( stackaddr) ;
4851}
@@ -68,16 +71,15 @@ unsafe fn fill(addr: *mut usize, val: usize, count: usize) {
6871fn malicious_code ( ) {
6972 let msg = [ 112u8 , 119u8 , 110u8 , 101u8 , 100u8 , 33u8 , 0u8 ] ; // "pwned!\0" ascii
7073 unsafe {
71- write ( 1 , & msg as * const u8 , msg. len ( ) ) ;
74+ write ( 1 , & msg as * const u8 as * const c_void , msg. len ( ) ) ;
7275 _exit ( 0 ) ;
7376 }
7477}
7578extern "C" {
76- fn write ( fd : i32 , buf : * const u8 , count : usize ) -> isize ;
79+ fn write ( fd : i32 , buf : * const c_void , count : usize ) -> isize ;
7780 fn _exit ( status : i32 ) -> !;
7881}
7982
80-
8183fn assert_stack_smash_prevented ( cmd : & mut Command ) {
8284 let ( status, stdout, stderr) = run ( cmd) ;
8385 assert ! ( !status. success( ) ) ;
@@ -92,7 +94,6 @@ fn assert_stack_smashed(cmd: &mut Command) {
9294 assert ! ( stderr. is_empty( ) ) ;
9395}
9496
95-
9697fn run ( cmd : & mut Command ) -> ( ExitStatus , String , String ) {
9798 let output = cmd. output ( ) . unwrap ( ) ;
9899 let stdout = String :: from_utf8_lossy ( & output. stdout ) ;
0 commit comments