hog.c

#include <sys/types.h>
#include <sys/time.h>
#include <sys/resource.h>
#include <signal.h>

/* written by Brian Redman (BER), sometime around 1986

Disclaimer

  THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY
  EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR HIS
  CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
  LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF
  USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
  ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
  OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
  OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  SUCH DAMAGE.
*/

/*
Basic Instructions

Compile this code to a binary:

# cc hog.c -o hog

then run something like:

# hog 10

- and the hog will do just that- sit and hog 10mb of ram.



To run a hog stampede, (a fork bomb):

# while (1)
# hog 99m&
# end

# note: BER has used this code to break nearly every stock UNIX system that's
# existed since 1986 or so, fork bombs are a complicated problem which nobody
# has eloquently resolved in a dynamic manner, to date (2006).
#
# This code is good for replicating overt system memory leaks as well.

*/

int dosleep = 0;
long rlimit = 0;

struct rlimit rl;

void catch2(int i) {
  printf("rlim_cur was: %ld\n", rl.rlim_cur);
  printf("rlim_max was: %ld\n", rl.rlim_max);
  rl.rlim_cur /= 2;
  setrlimit(RLIMIT_RSS, &rl);
  getrlimit(RLIMIT_RSS, &rl);
  printf("rlim_cur is: %ld\n", rl.rlim_cur);

  signal(SIGUSR2, catch2);
}

void catch1(int i) {
  if (dosleep) {
    dosleep = 0;
  } else {
    dosleep = 1;
  }
  signal(SIGUSR1, catch1);
}

main(int argc, char *argv[]) {
  long i, *ip, *p;
  unsigned long n;
  long m = 1;

  signal(SIGUSR1, catch1);
  signal(SIGUSR2, catch2);

  printf("%d\n", getpid());

  switch (argv[1][strlen(argv[1])-1]) {
    case 'g': m = 1024;
    case 'm': m = m * 1024;
    case 'k': m = m * 1024;
    argv[1][strlen(argv[1])-1] = '\0';
   }
  n = m * strtoul(argv[1], (char **)NULL, 10);

  getrlimit(RLIMIT_RSS, &rl);
  rl.rlim_cur = n+2*1024*1024;
  setrlimit(RLIMIT_RSS, &rl);

  if (p = (long *)malloc(n)) {
    printf("malloced %ld bytes\n",n);
    while (1) {
      while (dosleep) {
        sleep(10);
      }
      ip = p;
      for (i = 0; i < n/sizeof(long); i++) {
        *ip++ = i;
      }
    }
  } else {
    printf("failed to malloc %ud bytes\n", n);
  }
}

How come the 'm' and 'k' case gives the same number of bytes?