diff options
Diffstat (limited to 'Tools/mangleme/remangle.cgi.c')
-rw-r--r-- | Tools/mangleme/remangle.cgi.c | 125 |
1 files changed, 0 insertions, 125 deletions
diff --git a/Tools/mangleme/remangle.cgi.c b/Tools/mangleme/remangle.cgi.c deleted file mode 100644 index ccc447275..000000000 --- a/Tools/mangleme/remangle.cgi.c +++ /dev/null @@ -1,125 +0,0 @@ -/* - - HTML manglizer - -------------- - Copyright (C) 2004 by Michal Zalewski <lcamtuf@coredump.cx> - - Fault reproduction utility. - - */ - - -#include <stdio.h> -#include <unistd.h> -#include <stdlib.h> -#include <string.h> -#include <time.h> - -#include "tags.h" - -#define R(x) (rand() % (x)) - -#define MAXTCOUNT 100 -#define MAXPCOUNT 20 -#define MAXSTR2 80 - -void make_up_value(void) { - char c=R(2); - - if (c) putchar('"'); - - switch (R(31)) { - - case 0: printf("javascript:"); make_up_value(); break; -// case 1: printf("jar:"); make_up_value(); break; - case 2: printf("mk:"); make_up_value(); break; - case 3: printf("file:"); make_up_value(); break; - case 4: printf("http:"); make_up_value(); break; - case 5: printf("about:"); make_up_value(); break; - case 6: printf("_blank"); break; - case 7: printf("_self"); break; - case 8: printf("top"); break; - case 9: printf("left"); break; - case 10: putchar('&'); make_up_value(); putchar(';'); break; - case 11: make_up_value(); make_up_value(); break; - - case 12 ... 20: { - int c = R(10) ? R(10) : (1 + R(MAXSTR2) * R(MAXSTR2)); - char* x = malloc(c); - memset(x,R(256),c); - fwrite(x,c,1,stdout); - free(x); - break; - } - - case 21: printf("%s","%n%n%n%n%n%n"); break; - case 22: putchar('#'); break; - case 23: putchar('*'); break; - default: if (R(2)) putchar('-'); printf("%d",rand()); break; - - } - - if (c) putchar('"'); - -} - - -void random_tag(void) { - int tn, tc; - - do tn = R(MAXTAGS); while (!tags[tn][0]); - tc = R(MAXPCOUNT) + 1; - - putchar('<'); - - switch (R(10)) { - case 0: putchar(R(256)); break; - case 1: putchar('/'); - } - - printf("%s", tags[tn][0]); - - while (tc--) { - int pn; - switch (R(32)) { - case 0: putchar(R(256)); - case 1: break; - default: putchar(' '); - } - do pn = R(MAXPARS-1) + 1; while (!tags[tn][pn]); - printf("%s", tags[tn][pn]); - switch (R(32)) { - case 0: putchar(R(256)); - case 1: break; - default: putchar('='); - } - - make_up_value(); - - } - - putchar('>'); - -} - - -int main(int argc,char** argv) { - int tc,seed; - char* x = getenv("QUERY_STRING"); - - if (!x || sscanf(x,"%x",&seed) != 1) { - printf("Content-type: text/plain\n\nMissing or invalid parameter.\n"); - exit(1); - } - - printf("Content-Type: text/html;charset=utf-8\nRefresh: 0;URL=remangle.cgi?0x%08x\n\n", seed); - printf("<HTML><HEAD><META HTTP-EQUIV=\"Refresh\" content=\"0;URL=remangle.cgi?0x%08x\">\n", seed); - printf("<script language=\"javascript\">setTimeout('window.location=\"remangle.cgi?0x%08x\"', 1000);</script>\n", seed); - - srand(seed); - - tc = R(MAXTCOUNT) + 1; - while (tc--) random_tag(); - fflush(0); - return 0; -} |