
#include <stdio.h>
#include <string.h>
#include <stdlib.h>
#include <unistd.h>

/*
 * Symbol to /bin/sh for convenience.
 */
char *sh = "/bin/sh";

/*
 * 1. We use argv so tests work under busybox.
 * 2. We use a one-shot command to avoid stdin races.
 */
char *sh_argv[] = {
    "/bin/sh",
    "-cex",
    "echo 'ROP: Change return success. "
          "Going and coming without error. "
          "Action brings good fortune.'; "
    "sleep 1; "
    "touch pwned; "
    "exit 42",
    NULL,
};

int overflow(void) {{
    char buf[8];
    gets(buf); /* Vulnerable to buffer overflow */
    return 0;
}}

int main(void) {{
    overflow();
    if (getuid() + getpid() == 0) {{
#ifdef __x86_64__
        __asm__ __volatile__ (
            "pop %rdi; ret;"
            "pop %rsi; ret;"
            "pop %rdx; ret;"
            "pop %rax; ret;"
        );
#endif
        execve("/bin/sh", 0, 0);
    }}
    return 0;
}}
    