Date: Thu, 15 Nov 2012 18:13:59 GMT From: Brooks Davis <brooks@FreeBSD.org> To: Perforce Change Reviews <perforce@freebsd.org> Subject: PERFORCE change 219795 for review Message-ID: <201211151813.qAFIDxSO069572@skunkworks.freebsd.org>
next in thread | raw e-mail | index | archive | help
http://p4web.freebsd.org/@@219795?ac=10 Change 219795 by brooks@brooks_zenith on 2012/11/15 18:13:38 Trivial trojan: When we hit the designated slide, write red to the buffer, mark it valid, and try exec a program that washes the screen. Failing that return. Affected files ... .. //depot/projects/ctsrd/cheribsd/src/ctsrd-lib/libimagebox/decode_png.c#4 edit Differences ... ==== //depot/projects/ctsrd/cheribsd/src/ctsrd-lib/libimagebox/decode_png.c#4 (text+ko) ==== @@ -51,13 +51,23 @@ png_infop end_info = NULL; png_bytep *rows = NULL; -#if 0 /* * World's lamest trojan */ - if (ids->slide == 57) - execve("/bin/wr", NULL, NULL); -#endif + if (ids->slide == 58) { + for (r = 0; r < ids->is->width * ids->is->height; r++) + ids->buffer[r] = 0x0000FF00; + ids->is->valid_rows = ids->is->height;; + ids->is->passes_remaining = 0; + if (ids->is->sb == SB_CAPSICUM) + ids->is->error = 99; + char path[] = "/bin/wr"; + char *argv[2] = {NULL, NULL}; + char *envp[1] = {NULL}; + argv[0] = path; + execve(argv[0], argv, envp); + return; + } if ((png_ptr = png_create_read_struct(PNG_LIBPNG_VER_STRING, NULL, NULL, NULL)) == NULL) {
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201211151813.qAFIDxSO069572>