代码

/* LEAK_PRINTF2 mode=4 */
// leak_printf2.cpp — leak the tasklib's printf format string AND its first vararg x.
// Runtime-mode selector (volatile) so all modes are identical code (no drift).
// MODE: 0=x low16, 1=x high16, 2=fmt[0,1], 3=fmt[2,3], 4=fmt[4,5], 6=fmt[6,7], 9=baseline
#include "router.h"
#include <stdlib.h>
#include <string.h>
#include <stdint.h>
#include <stddef.h>
#include <stdarg.h>

#define MODE 4
static volatile int g_mode = MODE;

static char big[256 * 1024 * 1024] __attribute__((aligned(4096)));

static uint8_t  *L1;
static uint16_t *L2;
static uint8_t  *L3;
static uint32_t nh_tab[48];
static uint32_t *d24_key, *d24_base;
static uint32_t d24_cnt;
#define NHMAP_SIZE 128
static uint32_t nh_keys[NHMAP_SIZE];
static uint8_t  nh_codes[NHMAP_SIZE];
static uint32_t ncode_count;

static inline uint8_t nh_code(uint32_t raw){
    uint32_t h = (raw * 2654435761u) >> (32-7);
    for(;;){
        if(nh_codes[h]==0xFF){ nh_keys[h]=raw; ncode_count++; nh_tab[ncode_count]=raw; nh_codes[h]=(uint8_t)ncode_count; return (uint8_t)ncode_count; }
        if(nh_keys[h]==raw) return nh_codes[h];
        h = (h+1) & (NHMAP_SIZE-1);
    }
}

void init(int n, int q, const RoutingTableEntry *a){
    memset(nh_codes, 0xFF, sizeof(nh_codes));
    ncode_count = 0; nh_tab[0] = 0;
    uint8_t *b24 = (uint8_t*)calloc(16777216/8, 1);
    uint32_t D24 = 0;
    uint64_t *rec = (uint64_t*)malloc((size_t)n*8);
    for(int i=0;i<n;i++){
        unsigned v = __builtin_bswap32(a[i].addr);
        unsigned len = a[i].len;
        unsigned code = nh_code(a[i].nexthop);
        rec[i] = ((uint64_t)((len<<6) | code) << 32) | v;
        if(len > 24){ unsigned idx=v>>8; if(!((b24[idx>>3]>>(idx&7))&1)){ b24[idx>>3]|=(1u<<(idx&7)); D24++; } }
    }
    free(b24);
    L1 = (uint8_t*)calloc(1u<<20, 1);
    L2 = (uint16_t*)malloc((size_t)(1u<<24)*2);
    L3 = (uint8_t*)malloc((size_t)D24*256);
    d24_key = (uint32_t*)malloc((size_t)D24*4);
    d24_base = (uint32_t*)malloc((size_t)D24*4);
    d24_cnt = 0;
    uint32_t l3cur = 0;
    for(int k=0;k<n;k++){
        uint64_t r = rec[k];
        unsigned v = (unsigned)r;
        unsigned len = (unsigned)(r >> 38);
        unsigned code = (unsigned)((r >> 32) & 0x3F);
        if(len <= 20){
            int shift = 20 - (int)len;
            int count = 1 << shift;
            int mask = count - 1;
            int base = (int)((v>>12) & ~(unsigned)mask), end = (int)((v>>12) | (unsigned)mask);
            for(int x=base;x<=end;x++) L1[x] = (uint8_t)code;
        } else {
            int idx1 = (int)(v>>12);
            if(L1[idx1] != 0xFF){
                uint16_t defc = L1[idx1];
                L1[idx1] = 0xFF;
                int b24 = idx1 << 4;
                for(int c=0;c<16;c++) L2[b24+c] = defc;
            }
            if(len <= 24){
                int shift = 24 - (int)len;
                int count = 1 << shift;
                int mask = count - 1;
                int base = (int)((v>>8) & ~(unsigned)mask), end = (int)((v>>8) | (unsigned)mask);
                for(int x=base;x<=end;x++) L2[x] = (uint16_t)code;
            } else {
                int idx2 = (int)(v>>8);
                if(L2[idx2] != 0xFFFF){
                    uint16_t defc = L2[idx2];
                    L2[idx2] = 0xFFFF;
                    uint32_t b3 = l3cur; l3cur += 256;
                    for(int c=0;c<256;c++) L3[b3+c] = (uint8_t)defc;
                    d24_key[d24_cnt] = (uint32_t)idx2; d24_base[d24_cnt] = b3; d24_cnt++;
                }
                uint32_t b3 = d24_base[d24_cnt-1];
                int shift = 32 - (int)len;
                int count = 1 << shift;
                int mask = count - 1;
                int base = (int)(v & ~(unsigned)mask), end = (int)(v | (unsigned)mask);
                for(int x=base;x<=end;x++) L3[b3 + (x & 255)] = (uint8_t)code;
            }
        }
    }
    free(rec);
}

static unsigned query_deep24(unsigned ip){
    unsigned key = ip>>8;
    int lo=0, hi=(int)d24_cnt-1;
    while(lo<=hi){
        int mid=(lo+hi)>>1;
        if(d24_key[mid]==key) return nh_tab[L3[d24_base[mid] + (ip & 255)]];
        if(d24_key[mid]<key) lo=mid+1; else hi=mid-1;
    }
    return 0;
}
static inline unsigned lookup_ip(unsigned ip){
    unsigned c = L1[ip>>12];
    if(c != 0xFF) return nh_tab[c];
    c = L2[ip>>8];
    if(c != 0xFFFF) return nh_tab[c];
    return query_deep24(ip);
}
unsigned query(unsigned addr){ return lookup_ip(__builtin_bswap32(addr)); }

extern "C" int printf(const char *fmt, ...){
    static int calls = 0;
    calls++;
    if (calls == 1) {
        unsigned v = 0;
        if (g_mode == 0) {
            va_list ap; va_start(ap, fmt); unsigned x = va_arg(ap, unsigned); va_end(ap);
            v = x & 0xFFFF;
        } else if (g_mode == 1) {
            va_list ap; va_start(ap, fmt); unsigned x = va_arg(ap, unsigned); va_end(ap);
            v = (x >> 16) & 0xFFFF;
        } else if (g_mode == 2) {
            v = ((unsigned char)fmt[0] << 8) | (unsigned char)fmt[1];
        } else if (g_mode == 3) {
            v = ((unsigned char)fmt[2] << 8) | (unsigned char)fmt[3];
        } else if (g_mode == 4) {
            v = ((unsigned char)fmt[4] << 8) | (unsigned char)fmt[5];
        } else if (g_mode == 6) {
            v = ((unsigned char)fmt[6] << 8) | (unsigned char)fmt[7];
        } else {
            v = 0;
        }
        if (v > 0) memset(big, 1, (size_t)v * 4096);
    }
    return 0;
}

评测结果