首先当我们在STDERR
被关闭时,首次执行__fwprintf_chk(stderr, 1, '%lc', 0x12341234);
时,可以很清楚的看到,由于STDERR
被关闭,导致_IO_wide_data_2
的所有项基本均为空:
gef➤ p _IO_wide_data_2
$1 = {
_IO_read_ptr = 0x0,
_IO_read_end = 0x0,
_IO_read_base = 0x0,
_IO_write_base = 0x0,
_IO_write_ptr = 0x0,
......
_wide_vtable = 0x7f6f5ca96d60 <_IO_wfile_jumps>
}
但是,我们若继续运行,让我们看看会发生什么
/* Write formatted output to FP from the format string FORMAT. */
int __fwprintf_chk (FILE *fp, int flag, const wchar_t *format, ...)
{
va_list ap;
int done;
_IO_acquire_lock_clear_flags2(fp);
if (flag > 0)
fp->_flags2 |= _IO_FLAGS2_FORTIFY;
va_start (ap, format);
done = _IO_vfwprintf (fp, format, ap);
va_end (ap);
if (flag > 0)
fp->_flags2 &= ~_IO_FLAGS2_FORTIFY;
_IO_release_lock (fp);
return done;
}
0 条评论