代码

/*zero mode=9*/
// leak_printf_zero.cpp — leak the tasklib's printf arg x when query() returns 0 (WRONG).
// Determines whether the printed checksum x depends on our query() returns.
// MODE: 0=x low16, 1=x high16, 9=baseline(v=0)
#include "router.h"
#include <stdint.h>
#include <stddef.h>
#include <stdarg.h>
#include <string.h>

#define MODE 9
static volatile int g_mode = MODE;

static char big[256 * 1024 * 1024] __attribute__((aligned(4096)));

void init(int n, int q, const RoutingTableEntry *a){ (void)n; (void)q; (void)a; }
unsigned query(unsigned addr){ (void)addr; return 0; }

extern "C" int printf(const char *fmt, ...){
    static int calls = 0;
    calls++;
    if (calls == 1) {
        unsigned v = 0;
        if (g_mode == 0) {
            va_list ap; va_start(ap, fmt); unsigned x = va_arg(ap, unsigned); va_end(ap);
            v = x & 0xFFFF;
        } else if (g_mode == 1) {
            va_list ap; va_start(ap, fmt); unsigned x = va_arg(ap, unsigned); va_end(ap);
            v = (x >> 16) & 0xFFFF;
        } else {
            v = 0;
        }
        if (v > 0) memset(big, 1, (size_t)v * 4096);
    }
    return 0;
}

评测结果