Skip to content

Instantly share code, notes, and snippets.

@lightdiscord
Last active June 16, 2021 15:23
Show Gist options
  • Select an option

  • Save lightdiscord/d9b5af9ff17d350172953d01be63e2be to your computer and use it in GitHub Desktop.

Select an option

Save lightdiscord/d9b5af9ff17d350172953d01be63e2be to your computer and use it in GitHub Desktop.
Test to check that some function copy past nul byte.

Test-case copy after nul byte.

for gets

$ echo -en 'this is fun!\x00oh no, it copies after nul byte!' | ./a.out | hexdump -C
00000000  74 68 69 73 20 69 73 20  66 75 6e 21 00 6f 68 20  |this is fun!.oh |
00000010  6e 6f 2c 20 69 74 20 63  6f 70 69 65 73 20 61 66  |no, it copies af|
00000020  74 65 72 20 6e 75 6c 20  62 79 74 65 21 00 00 00  |ter nul byte!...|
00000030  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00000100

for scanf

$ ./a.out | hexdump -C
00000000  74 65 73 74 00 68 65 6c  6c 6f 00 00 00 00 00 00  |test.hello......|
00000010  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000020
#include <unistd.h>
char *gets(char *);
int main(void)
{
char bytes[0x100] = { 0 };
gets(bytes);
(void)!write(1, bytes, 0x100);
}
#include <stdio.h>
#include <unistd.h>
int main(void) {
char data[32] = { 0 };
int fd[2];
pipe(fd);
dup2(fd[0], 0);
close(fd[0]);
write(fd[1], "test\0hello no", 14);
close(fd[1]);
scanf("%32s", data);
write(1, data, 32);
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment