blob: 1319cb2a2bab5471222ec32b3f29548057a28201 [file] [log] [blame]
#define _GNU_SOURCE 1
#include <assert.h>
#include <stdio.h>
#include <stdlib.h>
#include <pthread.h>
static char* s_mem;
static volatile int s_freed;
static void* thread_func(void* arg)
{
// Busy-wait until pthread_create() has finished.
while (s_freed == 0)
pthread_yield();
free(s_mem);
__sync_add_and_fetch(&s_freed, 1);
return NULL;
}
int main(int argc, char** argv)
{
pthread_t tid;
int quiet;
char result;
quiet = argc > 1;
s_mem = malloc(10);
if (!quiet)
fprintf(stderr, "Pointer to allocated memory: %p\n", s_mem);
assert(s_mem);
pthread_create(&tid, NULL, thread_func, NULL);
__sync_add_and_fetch(&s_freed, 1);
// Busy-wait until the memory has been freed.
while (s_freed == 1)
pthread_yield();
// Read-after-free.
result = s_mem[0];
if (!quiet)
fprintf(stderr, "Read-after-free result: %d\n", result);
pthread_join(tid, NULL);
fprintf(stderr, "Done.\n");
return 0;
}