T3MP3ST public launch build

bench/cve-hunt/samples/CVE-2014-0160/source.c

@@ -0,0 +1,56 @@
+/*
+ * tls1_process_heartbeat() — extracted from openssl 1.0.1f, pre-CVE-2014-0160 patch.
+ * Simplified for benchmark: structure & vulnerability faithful to original.
+ */
+
+#include <stdint.h>
+#include <string.h>
+#include <stdlib.h>
+
+#define TLS1_HB_REQUEST  1
+#define TLS1_HB_RESPONSE 2
+
+typedef struct ssl_st {
+    unsigned char *s3_rrec_data;
+    unsigned int   s3_rrec_length;
+} SSL;
+
+static unsigned char *OPENSSL_malloc(size_t n) { return (unsigned char *)malloc(n); }
+static void           OPENSSL_free(void *p)    { free(p); }
+static int            ssl3_write_bytes(SSL *s, int type, const unsigned char *buf, int len) { (void)s; (void)type; (void)buf; (void)len; return 0; }
+static void           RAND_pseudo_bytes(unsigned char *buf, int n) { for (int i = 0; i < n; i++) buf[i] = (unsigned char)i; }
+
+#define n2s(c, s) ((s = (((unsigned int)(c[0])) << 8) | ((unsigned int)(c[1]))), c += 2)
+#define s2n(s, c) (*(c)++ = (unsigned char)(((s) >> 8) & 0xff), *(c)++ = (unsigned char)((s) & 0xff))
+
+int tls1_process_heartbeat(SSL *s) {
+    unsigned char *p = s->s3_rrec_data, *pl;
+    unsigned short hbtype;
+    unsigned int   payload;
+    unsigned int   padding = 16;
+
+    hbtype = *p++;
+    n2s(p, payload);
+    pl = p;
+
+    if (hbtype == TLS1_HB_REQUEST) {
+        unsigned char *buffer, *bp;
+        int r;
+
+        buffer = OPENSSL_malloc(1 + 2 + payload + padding);
+        bp = buffer;
+
+        *bp++ = TLS1_HB_RESPONSE;
+        s2n(payload, bp);
+        memcpy(bp, pl, payload);
+        bp += payload;
+        RAND_pseudo_bytes(bp, padding);
+
+        r = ssl3_write_bytes(s, 24, buffer, 3 + payload + padding);
+
+        OPENSSL_free(buffer);
+        return r;
+    }
+
+    return 0;
+}