#include <sys/ucred.h>
#include <cstring>
+#include <cstdlib>
+
+static long x0;
int main()
{
+ long *px{static_cast<long*>(malloc(2*sizeof(long)))};
+ x0 = px[0];
struct setcred cred1;
struct setcred* cred2;
int flags1{0};
int flags2;
size_t size1{sizeof(cred1)};
- size_t size2;
std::memset(&cred1, 250, sizeof(cred1));
setcred(flags1, nullptr, size1);
// uninit
- setcred(flags2, cred2, size2);
+ setcred(flags2, (struct setcred*)x0, size1+x0);
cred2 = new struct setcred;
setcred(flags1, cred2, size1);
delete cred2;
+ free(px);
}
Syscall param setcred(wcred) points to unaddressable byte(s)
at 0x........: setcred (in /...libc...)
- by 0x........: main (setcred.cpp:19)
+ by 0x........: main (setcred.cpp:23)
Address 0x........ is not stack'd, malloc'd or (recently) free'd
Syscall param setcred(flags) contains uninitialised byte(s)
at 0x........: setcred (in /...libc...)
- by 0x........: main (setcred.cpp:22)
+ by 0x........: main (setcred.cpp:26)
Syscall param setcred(wcred) contains uninitialised byte(s)
at 0x........: setcred (in /...libc...)
- by 0x........: main (setcred.cpp:22)
+ by 0x........: main (setcred.cpp:26)
Syscall param setcred(size) contains uninitialised byte(s)
at 0x........: setcred (in /...libc...)
- by 0x........: main (setcred.cpp:22)
+ by 0x........: main (setcred.cpp:26)
-Syscall param setcred(wcred) points to uninitialised byte(s)
+Syscall param setcred(wcred) points to unaddressable byte(s)
at 0x........: setcred (in /...libc...)
- by 0x........: main (setcred.cpp:22)
- Address 0x........ is on thread 1's stack
- in frame #2, created by __libc_start1 (???:)
+ by 0x........: main (setcred.cpp:26)
+ Address 0x........ is not stack'd, malloc'd or (recently) free'd
Syscall param setcred(wcred) points to uninitialised byte(s)
at 0x........: setcred (in /...libc...)
- by 0x........: main (setcred.cpp:27)
+ by 0x........: main (setcred.cpp:31)
Address 0x........ is 0 bytes inside a block of size 48 alloc'd
at 0x........: ...operator new... (vg_replace_malloc.c:...)
- by 0x........: main (setcred.cpp:24)
+ by 0x........: main (setcred.cpp:28)