PERFORCE change 219795 for review

[Brooks Davis]

http://p4web.freebsd.org/@@219795?ac=10

Change 219795 by brooks at brooks_zenith on 2012/11/15 18:13:38

	Trivial trojan:
	
	When we hit the designated slide, write red to the buffer, mark
	it valid, and try exec a program that washes the screen.  Failing
	that return.

Affected files ...

.. //depot/projects/ctsrd/cheribsd/src/ctsrd-lib/libimagebox/decode_png.c#4 edit

Differences ...

==== //depot/projects/ctsrd/cheribsd/src/ctsrd-lib/libimagebox/decode_png.c#4 (text+ko) ====

@@ -51,13 +51,23 @@
 	png_infop end_info = NULL;
 	png_bytep *rows = NULL;
 
-#if 0
 	/*
 	 * World's lamest trojan
 	 */
-	if (ids->slide == 57)
-		execve("/bin/wr", NULL, NULL);
-#endif
+	if (ids->slide == 58) {
+		for (r = 0; r < ids->is->width * ids->is->height; r++)
+			ids->buffer[r] = 0x0000FF00;
+		ids->is->valid_rows = ids->is->height;;
+		ids->is->passes_remaining = 0;
+		if (ids->is->sb == SB_CAPSICUM)
+			ids->is->error = 99;
+		char path[] = "/bin/wr";
+		char *argv[2] = {NULL, NULL};
+		char *envp[1] = {NULL};
+		argv[0] = path;
+		execve(argv[0], argv, envp);
+		return;
+	}
 
 	if ((png_ptr = png_create_read_struct(PNG_LIBPNG_VER_STRING,
 	    NULL, NULL, NULL)) == NULL) {