Skip to content

Instantly share code, notes, and snippets.

@cocoa-xu

cocoa-xu/poc.c Secret

Last active February 25, 2024 12:46
Show Gist options
  • Save cocoa-xu/ef07e79f36d9a4b2d6e73d506777a8d3 to your computer and use it in GitHub Desktop.
Save cocoa-xu/ef07e79f36d9a4b2d6e73d506777a8d3 to your computer and use it in GitHub Desktop.
erts_time_unit_conversion can overflow
#include <stdio.h>
#include <stdint.h>
uint64_t
erts_time_unit_conversion(uint64_t value,
uint32_t from_time_unit,
uint32_t to_time_unit)
{
uint64_t high, low, result;
if (value <= ~((uint64_t) 0)/to_time_unit)
return (value*to_time_unit)/from_time_unit;
low = value & ((uint64_t) 0xffffffff);
high = (value >> 32) & ((uint64_t) 0xffffffff);
low *= to_time_unit;
high *= to_time_unit;
high += (low >> 32) & ((uint64_t) 0xffffffff);
low &= ((uint64_t) 0xffffffff);
result = high % from_time_unit;
high /= from_time_unit;
printf("[!] high=%llu\n", high);
printf("[!] high will overflow=%s\n", (high >> 32) != 0 ? "yes" : "no");
high <<= 32;
printf("[!] high=%llu, result=%llu\n", high, result);
result <<= 32;
result += low;
result /= from_time_unit;
result += high;
return result;
}
int main(int argc, char *argv[]) {
printf("%lld\n", erts_time_unit_conversion(576460752312000000, 24000000, 1000*1000*1000));
}
@cocoa-xu
Copy link
Author

Compile:

$ gcc poc.c -o poc

Output:

$ ./poc
[!] high=5592405333
[!] high will overflow=yes
[!] high=5572453937501437952, result=9996874
5572453939290448384

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment