write up of ezhp

ezhp.c

struct heap
{
	int head;
	int next;
	int prev;
	/* data */
};


int notes[0x3fe];
int note_count;

void add_note(void) {
	int delta;
	char *note;

	if (note_count <= 0x3fe)
	{
		puts("Please give me a size");
		fflush(stdout);
		scanf("%d%*c", &delta);
		note = self_malloc(delta);
		notes[note_count] = note;
		note_count += 1;
	} else {
		puts("The emperor says there are too many notes!");
		fflush(stdout);
	}
}

void change_note(void) {
	int id;
	char *note;
	int input_nbyte;

	puts("Please give me an id.");
	fflush(stdout);
	scanf("%d%*c", &id);
	if (note_count > id || id < -1) {
		return;
	}

	note = notes[id];
	if (note == 0)
	{
		return;
	}

	puts("Please give me a size.");
	fflush(stdout);
	scanf("%d%*c", &input_nbyte);
	puts("Please input your data.");
	fflush(stdout);
	read(0, note, input_nbyte); // vuln!!

}

void print_note(void) {
	int id;
	puts("Please give me an id.");
	fflush(stdout);
	scanf("%d%*c", &id);

	if (note_count > id || id < -1) {
		return;
	}
	puts(notes[id]);
	return;
}

void remove_note(void) {
	int id;
	puts("Please give me an id.");
	fflush(stdout);
	scanf("%d%*c", &id);

	if (note_count > id || id < -1) {
		return;
	}

	if (notes[id] != 0) {
		self_free(notes[id]);
	}
	notes[id] = 0;

	return;
}