From 6c229b249910f91eee06323b1f636da4c49fcd22 Mon Sep 17 00:00:00 2001 From: Alan Li <61896187+lebr0nli@users.noreply.github.com> Date: Sun, 13 Aug 2023 18:27:23 +0800 Subject: [PATCH] Move some comments into `generate_argv_with_sh` --- lib/one_gadget/fetchers/base.rb | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/lib/one_gadget/fetchers/base.rb b/lib/one_gadget/fetchers/base.rb index e8cf869..757c99b 100644 --- a/lib/one_gadget/fetchers/base.rb +++ b/lib/one_gadget/fetchers/base.rb @@ -131,10 +131,6 @@ def check_stack_argv(processor, lmda, allow_null) return if argv_already_valid?(argv) if global_var?(argv[0]) - # argv[0] is not controlled by the user, argv[0] probably is "/bin/sh" or "sh" (but actually, the content of - # argv[0] doesn't quite matter, just need to make sure it's readable) - # So far (I checked glibc 2.37), we can make argv to be {"/bin/sh", sth, NULL} or {"sh", "-c", sth, NULL} - # TODO: We need to update this when the above assumption is no longer true return generate_argv_with_sh(argv) end @@ -146,6 +142,10 @@ def argv_already_valid?(argv) end def generate_argv_with_sh(argv) + # argv[0] is not controlled by the user, argv[0] probably is "/bin/sh" or "sh" (but actually, the content of + # argv[0] doesn't quite matter, just need to make sure it's readable) + # So far (I checked glibc 2.37), we can make argv to be {"/bin/sh", sth, NULL} or {"sh", "-c", sth, NULL} + # TODO: We need to update this when the above assumption is no longer true if argv[2] == '0' && !global_var?(argv[1]) "#{argv[1]} == NULL || {\"/bin/sh\", #{argv[1]}, NULL} is a valid argv" else