d3m3vilurr
/
sonyoss-vita-webkit


			
							123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123
							/*

   HTML manglizer
   --------------
   Copyright (C) 2004 by Michal Zalewski <lcamtuf@coredump.cx>

   HTML manglizer library. Logs random seeds to error-log; find the last entry before
   crash, then pass it to remangle.cgi to reproduce the problem.

 */


#include <stdio.h>
#include <unistd.h>
#include <stdlib.h>
#include <string.h>
#include <time.h>

#include "tags.h"

#define R(x) (rand() % (x))

#define MAXTCOUNT 100
#define MAXPCOUNT 20
#define MAXSTR2   80

void make_up_value(void) {
  char c=R(2);
  
  if (c) putchar('"');

  switch (R(31)) {

    case 0: printf("javascript:"); make_up_value(); break;
//    case 1: printf("jar:"); make_up_value(); break;
    case 2: printf("mk:"); make_up_value(); break;
    case 3: printf("file:"); make_up_value(); break;
    case 4: printf("http:"); make_up_value(); break;
    case 5: printf("about:"); make_up_value(); break;
    case 6: printf("_blank"); break;
    case 7: printf("_self"); break;
    case 8: printf("top"); break;
    case 9: printf("left"); break;
    case 10: putchar('&'); make_up_value(); putchar(';'); break;
    case 11: make_up_value(); make_up_value(); break;
 
    case 12 ... 20: {
        int c = R(10) ? R(10) : (1 + R(MAXSTR2) * R(MAXSTR2));
        char* x = malloc(c);
        memset(x,R(256),c);
        fwrite(x,c,1,stdout);
        free(x);
        break;
      }
      
    case 21: printf("%s","%n%n%n%n%n%n"); break;
    case 22: putchar('#'); break;
    case 23: putchar('*'); break;
    default: if (R(2)) putchar('-'); printf("%d",rand()); break;
    
  }

  if (c) putchar('"');

}
  

void random_tag(void) {
  int tn, tc;
  
  do tn = R(MAXTAGS); while (!tags[tn][0]);
  tc = R(MAXPCOUNT) + 1;
  
  putchar('<');
  
  switch (R(10)) {
    case 0: putchar(R(256)); break;
    case 1: putchar('/');
  }
  
  printf("%s", tags[tn][0]);
  
  while (tc--) {
    int pn;
    switch (R(32)) {
      case 0: putchar(R(256)); 
      case 1: break;
      default: putchar(' ');
    }
    do pn = R(MAXPARS-1) + 1; while (!tags[tn][pn]);
    printf("%s", tags[tn][pn]);
    switch (R(32)) {
      case 0: putchar(R(256)); 
      case 1: break;
      default: putchar('=');
    }
    
    make_up_value();
    
  }
    
  putchar('>');
  
}


int main(int argc,char** argv) {
  int tc,seed;
  
  printf("Content-Type: text/html;charset=utf-8\nRefresh: 0;URL=mangle.cgi\n\n");
  printf("<HTML><HEAD><META HTTP-EQUIV=\"Refresh\" content=\"0;URL=mangle.cgi\">\n");
  printf("<script language=\"javascript\">setTimeout('window.location=\"mangle.cgi\"', 1000);</script>\n");

  seed = (time(0) ^ (getpid() << 16));
  fprintf(stderr,"[%u] Mangle attempt 0x%08x (%s) -- %s\n", (int)time(0), seed, getenv("HTTP_USER_AGENT"), getenv("REMOTE_ADDR"));
  srand(seed);
  
  tc = R(MAXTCOUNT) + 1;
  while (tc--) random_tag();
  fflush(0);
  return 0;
}