nelhage

# The fact that YAML.load will instantiate arbitrary ruby objects
# means that calling `YAML.load` on untrusted data is virtually always
# equivalent to executing arbitrary code in a complex app.

# This code fragment globally neuters YAML to disable this behavior,
# which should (hopefully) cut off all such attacks from the start.

# I don't promise this closes all possible attacks, but this closes
# off the trivial case.  You should audit and upgrade all your
# dependencies, as well.

nelhage

    case 'G':
      if (! IS_SYNTAX_OP(syn, ONIG_SYN_OP_ESC_CAPITAL_G_BEGIN_ANCHOR)) break;
      tok->type = TK_ANCHOR;
      tok->u.subtype = ANCHOR_BEGIN_POSITION;
      break;

// elsewhere
    case '^':
      if (! IS_SYNTAX_OP(syn, ONIG_SYN_OP_LINE_ANCHOR)) break;
      tok->type = TK_ANCHOR;

nelhage

Normally, this header is included in most HTTP requests (and
preserved across HTTP-level redirects), except in the following
scenarios:
⋅ After organically entering a new URL into the address bar or
  opening a bookmarked page.
⋅ When the navigation originates from a pseudo-URL document, such
  as data: or javascript:.
⋅ When the request is a result of redirection controlled by the
   Refresh header (but not a Location-based one).
⋅ Whenever the referring site is encrypted but the requested page

nelhage

for o in $(find .git/objects -ctime -2 -type f);
  do o=$(basename "$(dirname "$o")")"$(basename "$o")";
  if [ "$(git cat-file -t "$o")" = "blob" ]; then
    if git cat-file blob $o | grep SOME-WORD; then
      echo ">> $o";
    fi;
  fi;
done

nelhage

(require 'ido)
(setq ido-max-directory-size (* 256 1024)
      ido-enable-flex-matching t)

(defun chomp (str)
  "Chomp leading and tailing whitespace from STR."
  (while (string-match "\\`\n+\\|^\\s-+\\|\\s-+$\\|\n+\\'"
                       str)
    (setq str (replace-match "" t t str)))
  str)

nelhage

def callblock (&block)
  block.call
  puts "block.call returned normally"
end

def yieldblock (&block)
  yield
  puts "yield returned normally"
end

nelhage

/*
 * $ gcc -m32 -fPIC -shared -o regdump.so regdump.c
 * $ LD_PRELOAD=$(pwd)/regdump.so ./test
 *
 * Dump register state with 'ud2a' (0F 0B)
 */

#define _GNU_SOURCE
#include <signal.h>
#include <stdlib.h>

nelhage

#include <stdlib.h>
#include <stdio.h>

struct doit_kwargs {
    int a, b, c;
};

void __doit(struct doit_kwargs kw) {
    printf("%d %d %d\n", kw.a, kw.b, kw.c);
}

nelhage

#include <stdlib.h>
#include <stdio.h>

#define NALLOC		(1 << 10)
#define ALLOCSZ		(1 << 12)

int main(void) {
	void *buffers[NALLOC];
	int i;

nelhage

fluid-let