/* * Demonstrates brk area crashing into other segments when run * under NX-emulation kernel patch. * * Copyright (C) 2010, Canonical, Ltd. * Author: Kees Cook * License: GPLv3 * * gcc explode.c -fPIE -pie -o explode * */ #define _GNU_SOURCE #include #include #include #include #include #include #include #include // The larger this size, the faster a collision can be found. //#define SIZE (32*1024) #define SIZE (1) int main(int argc, char * argv[]) { char cmd[80]; int i; void * start = sbrk(0); void * end = (void*)((uintptr_t)start + SIZE); snprintf(cmd,sizeof(cmd),"cat /proc/%d/maps", getpid()); printf("%p\n", start); if ((uintptr_t)sbrk(SIZE) == -1) { printf("Failed to use brk area at %p - %p\n", start, end); system(cmd); return 1; } // try again execv(argv[0],argv); perror("execv"); return 2; }