int
set_cmnd_path(struct sudoers_context *ctx, const char *runchroot)
{
...
/* Pivot root. */
if (runchroot != NULL) {
if (!pivot_root(runchroot, &pivot_state))
goto error;
}
...
ret = resolve_cmnd(ctx, cmnd_in, &cmnd_out, path);
...
if (runchroot != NULL)
(void)unpivot_root(&pivot_state);
...

DEFINE_DATABASE (aliases)
DEFINE_DATABASE (ethers)
DEFINE_DATABASE (group)
DEFINE_DATABASE (group_compat)
DEFINE_DATABASE (gshadow)
DEFINE_DATABASE (hosts)
DEFINE_DATABASE (initgroups)
DEFINE_DATABASE (netgroup)
DEFINE_DATABASE (networks)
DEFINE_DATABASE (passwd)
DEFINE_DATABASE (passwd_compat)
DEFINE_DATABASE (protocols)
DEFINE_DATABASE (publickey)
DEFINE_DATABASE (rpc)
DEFINE_DATABASE (services)
DEFINE_DATABASE (shadow)
DEFINE_DATABASE (shadow_compat)

for (int i = 0; i < NSS_DATABASE_COUNT; ++i)
if (staging->services[i] == NULL)
{
ok = nss_database_select_default (&cache, i,
&staging->services[i]);
if (!ok)
break;
}

static const char per_database_defaults[NSS_DATABASE_COUNT] =
{
[nss_database_group] = nss_database_default_compat,
[nss_database_group_compat] = nss_database_default_nis,
[nss_database_gshadow] = nss_database_default_files,
[nss_database_hosts] = nss_database_default_dns,
[nss_database_initgroups] = nss_database_default_none,
[nss_database_networks] = nss_database_default_dns,
[nss_database_passwd] = nss_database_default_compat,
[nss_database_passwd_compat] = nss_database_default_nis,
[nss_database_publickey] = nss_database_default_nis_nisplus,
[nss_database_shadow] = nss_database_default_compat,
[nss_database_shadow_compat] = nss_database_default_nis,
};


static bool
nss_database_select_default (struct nss_database_default_cache *cache,
enum nss_database db, nss_action_list *result)
{
enum nss_database_default def = per_database_defaults[db];
...
case nss_database_default_none:
/* Very special case: Leave *result as NULL.  */
return true;
...
*result = __nss_action_parse (line);
if (*result == NULL)
{
assert (errno == ENOMEM);
return false;
}
return true;

static bool
nss_database_check_reload_and_get (struct nss_database_state *local,
nss_action_list *result,
enum nss_database database_index)
{
struct __stat64_t64 str;
/* Acquire MO is needed because the thread that sets reload_disabled
may have loaded the configuration first, so synchronize with the
Release MO store there.  */
if (atomic_load_acquire (&local->data.reload_disabled))
{
*result = local->data.services[database_index];
/* No reload, so there is no error.  */
return true;
}
struct file_change_detection initial;
if (!__file_change_detection_for_path (&initial, _PATH_NSSWITCH_CONF))
return false;
__libc_lock_lock (local->lock);
if (__file_is_unchanged (&initial, &local->data.nsswitch_conf))
{
/* Configuration is up-to-date.  Read it and return it to the
caller.  */
*result = local->data.services[database_index];
__libc_lock_unlock (local->lock);
return true;
}
int stat_rv = __stat64_time64 ("/", &str);
if (local->data.services[database_index] != NULL)
{
/* Before we reload, verify that "/" hasn't changed.  We assume that
errors here are very unlikely, but the chance that we're entering
a container is also very unlikely, so we err on the side of both
very unlikely things not happening at the same time.  */
if (stat_rv != 0
|| (local->root_ino != 0
&& (str.st_ino != local->root_ino
||  str.st_dev != local->root_dev)))
{
/* Change detected; disable reloading and return current state.  */
atomic_store_release (&local->data.reload_disabled, 1);
*result = local->data.services[database_index];
__libc_lock_unlock (local->lock);
return true;
}
}
if (stat_rv == 0)
{
local->root_ino = str.st_ino;
local->root_dev = str.st_dev;
}
__libc_lock_unlock (local->lock);
/* Avoid overwriting the global configuration until we have loaded
everything successfully.  Otherwise, if the file change
information changes back to what is in the global configuration,
the lookups would use the partially-written  configuration.  */
struct nss_database_data staging = { .initialized = true, };
bool ok = nss_database_reload (&staging, &initial);
if (ok)
{
__libc_lock_lock (local->lock);
/* See above for memory order.  */
if (!atomic_load_acquire (&local->data.reload_disabled))
/* This may go back in time if another thread beats this
thread with the update, but in this case, a reload happens
on the next NSS call.  */
local->data = staging;
*result = local->data.services[database_index];
__libc_lock_unlock (local->lock);
}
return ok;
}

if (atomic_load_acquire (&local->data.reload_disabled))
{
*result = local->data.services[database_index];
/* No reload, so there is no error.  */
return true;
}

struct file_change_detection initial;
if (!__file_change_detection_for_path (&initial, _PATH_NSSWITCH_CONF))
return false;
__libc_lock_lock (local->lock);
if (__file_is_unchanged (&initial, &local->data.nsswitch_conf))
{
/* Configuration is up-to-date.  Read it and return it to the
caller.  */
*result = local->data.services[database_index];
__libc_lock_unlock (local->lock);
return true;
}

if (local->data.services[database_index] != NULL)
{
/* Before we reload, verify that "/" hasn't changed.  We assume that
errors here are very unlikely, but the chance that we're entering
a container is also very unlikely, so we err on the side of both
very unlikely things not happening at the same time.  */
if (stat_rv != 0
|| (local->root_ino != 0
&& (str.st_ino != local->root_ino
||  str.st_dev != local->root_dev)))
{
/* Change detected; disable reloading and return current state.  */
atomic_store_release (&local->data.reload_disabled, 1);
*result = local->data.services[database_index];
__libc_lock_unlock (local->lock);
return true;
}
}

if (stat_rv == 0)
{
local->root_ino = str.st_ino;
local->root_dev = str.st_dev;
}

(gdb) n
418	      *result = local->data.services[database_index];
(gdb) l
413	  __libc_lock_lock (local->lock);
414	  if (__file_is_unchanged (&initial, &local->data.nsswitch_conf))
415	    {
416	      /* Configuration is up-to-date.  Read it and return it to the
417	         caller.  */
418	      *result = local->data.services[database_index];
419	      __libc_lock_unlock (local->lock);
420	      return true;
421	    }
422
(gdb)

if (local->data.services[database_index] != NULL)
{
/* Before we reload, verify that "/" hasn't changed.  We assume that
errors here are very unlikely, but the chance that we're entering
a container is also very unlikely, so we err on the side of both
very unlikely things not happening at the same time.  */
if (stat_rv != 0
|| (local->root_ino != 0
&& (str.st_ino != local->root_ino
||  str.st_dev != local->root_dev)))
{
/* Change detected; disable reloading and return current state.  */
atomic_store_release (&local->data.reload_disabled, 1);
*result = local->data.services[database_index];
__libc_lock_unlock (local->lock);
return true;
}
}

setpwent();
while(gets(buf) != NULL)
{
if((sp = getspnam(buf)) != (struct spwd *) 0 )
{
printf("Vaild login name is:%s\n",sp->sp_namp);
}
else
{
setspent();
while((sp = getspent()) != (struct spwd *)0)
{
printf("%s\n", sp->sp_namp);
}
}

void
SETFUNC_NAME (STAYOPEN)
{
int save;
__libc_lock_lock (lock);
__nss_setent (SETFUNC_NAME_STRING, DB_LOOKUP_FCT, &nip, &startp,
&last_nip, STAYOPEN_VAR, STAYOPEN_TMPVAR, NEED__RES);
save = errno;
__libc_lock_unlock (lock);
__set_errno (save);
}

/* Internal implementation of __nss_module_load.  */
static bool
module_load (struct nss_module *module)
{
if (strcmp (module->name, "files") == 0)
return module_load_nss_files (module);
if (strcmp (module->name, "dns") == 0)
return module_load_nss_dns (module);
void *handle;
{
char *shlib_name;
if (__asprintf (&shlib_name, "libnss_%s.so%s",
module->name, __nss_shlib_revision) < 0)
/* This is definitely a temporary failure.  Do not update
module->state.  This will trigger another attempt at the next
call.  */
return false;
handle = __libc_dlopen (shlib_name);
free (shlib_name);
}
/* Failing to load the module can be caused by several different
scenarios.  One such scenario is that the module has been removed
from the disk.  In which case the in-memory version is all that
we have, and if the module->state indidates it is loaded then we
can use it.  */
if (handle == NULL)
{
/* dlopen failure.  We do not know if this a temporary or
permanent error.  See bug 22041.  Update the state using the
double-checked locking idiom.  */
__libc_lock_lock (nss_module_list_lock);
bool result = result;
switch ((enum nss_module_state) atomic_load_acquire (&module->state))
{
case nss_module_uninitialized:
atomic_store_release (&module->state, nss_module_failed);
result = false;
break;
case nss_module_loaded:
result = true;
break;
case nss_module_failed:
result = false;
break;
}
__libc_lock_unlock (nss_module_list_lock);
return result;
}
nss_module_functions_untyped pointers;
/* Look up and store locally all the function pointers we may need
later.  Doing this now means the data will not change in the
future.  */
for (size_t idx = 0; idx < array_length (nss_function_name_array); ++idx)
{
char *function_name;
if (__asprintf (&function_name, "_nss_%s_%s",
module->name, nss_function_name_array[idx]) < 0)
{
/* Definitely a temporary error.  */
__libc_dlclose (handle);
return false;
}
pointers[idx] = __libc_dlsym (handle, function_name);
free (function_name);
PTR_MANGLE (pointers[idx]);
}

/* PFMERGE dest src1 src2 src3 ... srcN => OK */
void pfmergeCommand(client *c){
uint8_t max[HLL_REGISTERS];
struct hllhdr *hdr;
int j;
int use_dense = 0; /* Use dense representation as target? */

/* Compute an HLL with M[i] = MAX(M[i]_j).
* We store the maximum into the max array of registers. We'll write
* it to the target variable later. */
memset(max,0,sizeof(max));
for (j = 1; j < c->argc; j++) {
...
/* Merge with this HLL with our 'max' HLL by setting max[i]
* to MAX(max[i],hll[i]). */
if (hllMerge(max,o) == C_ERR) { // hllMerge [1] stack oob write
...
}
}


/* Convert the destination object to dense representation if at least
* one of the inputs was dense. */
if (use_dense && hllSparseToDense(o) == C_ERR) { // hllSparseToDense [2] heap oob write
...
}

...
}

int hllSparseToDense(robj *o){
sds sparse = o->ptr, dense;
struct hllhdr *hdr, *oldhdr = (struct hllhdr*)sparse;
int idx = 0, runlen, regval;
uint8_t *p = (uint8_t*)sparse, *end = p+sdslen(sparse);

/* If the representation is already the right one return ASAP. */
hdr = (struct hllhdr*) sparse;
if (hdr->encoding == HLL_DENSE) return C_OK;

/* Create a string of the right size filled with zero bytes.
* Note that the cached cardinality is set to 0 as a side effect
* that is exactly the cardinality of an empty HLL. */
dense = sdsnewlen(NULL,HLL_DENSE_SIZE);
hdr = (struct hllhdr*) dense;
*hdr = *oldhdr; /* This will copy the magic and cached cardinality. */
hdr->encoding = HLL_DENSE;

/* Now read the sparse representation and set non-zero registers
* accordingly. */
p += HLL_HDR_SIZE;
while(p < end) {
if (HLL_SPARSE_IS_ZERO(p)) {
runlen = HLL_SPARSE_ZERO_LEN(p);
idx += runlen;
p++;
} else if (HLL_SPARSE_IS_XZERO(p)) {
runlen = HLL_SPARSE_XZERO_LEN(p);
idx += runlen;
p += 2;
} else {
runlen = HLL_SPARSE_VAL_LEN(p);
regval = HLL_SPARSE_VAL_VALUE(p);
if ((runlen + idx) > HLL_REGISTERS) break; /* Overflow. */
while(runlen--) {
HLL_DENSE_SET_REGISTER(hdr->registers,idx,regval);
idx++;
}
p++;
}
}

/* If the sparse representation was valid, we expect to find idx
* set to HLL_REGISTERS. */
if (idx != HLL_REGISTERS) {
sdsfree(dense);
return C_ERR;
}

/* Free the old representation and set the new one. */
sdsfree(o->ptr);
o->ptr = dense;
return C_OK;
}

while(p < end) {
if (HLL_SPARSE_IS_ZERO(p)) {
runlen = HLL_SPARSE_ZERO_LEN(p);
idx += runlen;
p++;
} else if (HLL_SPARSE_IS_XZERO(p)) {
runlen = HLL_SPARSE_XZERO_LEN(p);
idx += runlen;
p += 2;
} else {
runlen = HLL_SPARSE_VAL_LEN(p);
regval = HLL_SPARSE_VAL_VALUE(p);
if ((runlen + idx) > HLL_REGISTERS) break; /* Overflow. */
while(runlen--) {
HLL_DENSE_SET_REGISTER(hdr->registers,idx,regval);
idx++;
}
p++;
}
}

if ((runlen + idx) > HLL_REGISTERS) break; /* Overflow. */

#define HLL_DENSE_SET_REGISTER(p,regnum,val) do { \
uint8_t *_p = (uint8_t*) p; \
unsigned long _byte = (regnum)*HLL_BITS/8; \
unsigned long _fb = (regnum)*HLL_BITS&7; \
unsigned long _fb8 = 8 - _fb; \
unsigned long _v = (val); \
_p[_byte] &= ~(HLL_REGISTER_MAX << _fb); \
_p[_byte] |= _v << _fb; \
_p[_byte+1] &= ~(HLL_REGISTER_MAX >> _fb8); \
_p[_byte+1] |= _v >> _fb8; \
} while(0)

// 1. HLL 总体结构
struct hllhdr {
char magic[4];      /* "HYLL" */
uint8_t encoding;   /* HLL_DENSE or HLL_SPARSE. */
uint8_t notused[3]; /* Reserved for future use, must be zero. */
uint8_t card[8];    /* Cached cardinality, little endian. */
uint8_t registers[]; /* Data bytes. */
};

#define HLL_P 14 /* The greater is P, the smaller the error. */
#define HLL_REGISTERS (1<<HLL_P) /* With P=14, 16384 registers. */
#define HLL_DENSE_SIZE (HLL_HDR_SIZE+((HLL_REGISTERS*HLL_BITS+7)/8))

+---------+----------+-----------+--------+-----------
| "HYLL"  | encoding |  noused   | card   | registers
+---------+----------+--------------------+-----------
4字节      1字节        3字节       8字节    12288字节

static inline size_t sdslen(const sds s){
unsigned char flags = s[-1];
switch(flags&SDS_TYPE_MASK) {
case SDS_TYPE_5:
return SDS_TYPE_5_LEN(flags);
case SDS_TYPE_8:
return SDS_HDR(8,s)->len;
case SDS_TYPE_16:
return SDS_HDR(16,s)->len;
case SDS_TYPE_32:
return SDS_HDR(32,s)->len;
case SDS_TYPE_64:
return SDS_HDR(64,s)->len;
}
return 0;
}

//func sdsnewlen()-> _sdsnewlen() ->

static inline char sdsReqType(size_t string_size){
if (string_size < 1<<5)
return SDS_TYPE_5;
if (string_size < 1<<8)
return SDS_TYPE_8;
if (string_size < 1<<16)
return SDS_TYPE_16;
#if (LONG_MAX == LLONG_MAX)
if (string_size < 1ll<<32)
return SDS_TYPE_32;
return SDS_TYPE_64;
#else
return SDS_TYPE_32;
#endif
}

sds _sdsnewlen(const void *init, size_t initlen, int trymalloc) {
char type = sdsReqType(initlen);
/* Empty strings are usually created in order to append. Use type 8
* since type 5 is not good at this. */
if (type == SDS_TYPE_5 && initlen == 0) type = SDS_TYPE_8;
int hdrlen = sdsHdrSize(type);
unsigned char *fp; /* flags pointer. */
size_t usable;
...
s = (char*)sh+hdrlen;
fp = ((unsigned char*)s)-1;
...
switch(type) {
case SDS_TYPE_5: {
*fp = type | (initlen << SDS_TYPE_BITS);
break;
}
case SDS_TYPE_8: {
SDS_HDR_VAR(8,s);
sh->len = initlen;
sh->alloc = usable;
*fp = type;
break;
}
case SDS_TYPE_16: {
SDS_HDR_VAR(16,s);
sh->len = initlen;
sh->alloc = usable;
*fp = type;
break;
}
case SDS_TYPE_32: {
SDS_HDR_VAR(32,s);
sh->len = initlen;
sh->alloc = usable;
*fp = type;
break;
}
case SDS_TYPE_64: {
SDS_HDR_VAR(64,s);
sh->len = initlen;
sh->alloc = usable;
*fp = type;
break;
}
}
if (initlen && init)
memcpy(s, init, initlen);
s[initlen] = '\0';
return s;

pwndbg> p/x 0x8c & 0x3
$106 = 0x0
pwndbg> p idx
$107 = -38252
pwndbg> p idx*6/8
$108 = -28689
pwndbg> p hdr->registers
$109 = 0x7ffff797d015 ""
pwndbg>
pwndbg> x/20bx 0x7ffff7976000
0x7ffff7976000: 0xfa    0x37    0xfa    0x37    0x02    0x00    0x00    0x00
0x7ffff7976008: 0x00    0x00    0x00    0x00    0x00    0x00    0x00    0x00
0x7ffff7976010: 0x00    0x00    0x00    0x00

pwndbg> x/20bx  0x7ffff7976000+0x37fa-8
0x7ffff79797f2: 0x00    0x00    0x00    0x00    0x00    0x42    0x42    0x42
0x7ffff79797fa: 0x42    0x42    0x42    0x42    0x42    0x00    0xfa    0x37
0x7ffff7979802: 0xfa    0x37    0x02    0x00
pwndbg>
pwndbg> p/x *(struct sdshdr16 *)0x7ffff7976000
$104 = {
len = 0x37fa,
alloc = 0x37fa,
flags = 0x2,
buf = 0x7ffff7976005
}
pwndbg>

static inline size_t sdslen(const sds s){
unsigned char flags = s[-1];
switch(flags&SDS_TYPE_MASK) {
case SDS_TYPE_5:
return SDS_TYPE_5_LEN(flags);
case SDS_TYPE_8:
return SDS_HDR(8,s)->len;
case SDS_TYPE_16:
return SDS_HDR(16,s)->len;
case SDS_TYPE_32:
return SDS_HDR(32,s)->len;
case SDS_TYPE_64:
return SDS_HDR(64,s)->len;
}
return 0;
}

struct __attribute__ ((__packed__)) sdshdr16 {
uint16_t len; /* used */
uint16_t alloc; /* excluding the header and null terminator */
unsigned char flags; /* 3 lsb of type, 5 unused bits */
char buf[];
};

struct __attribute__ ((__packed__)) sdshdr64 {
uint64_t len; /* used */
uint64_t alloc; /* excluding the header and null terminator */
unsigned char flags; /* 3 lsb of type, 5 unused bits */
char buf[];
};

typedef struct RedisModuleType {
uint64_t id; /* Higher 54 bits of type ID + 10 lower bits of encoding ver. */
struct RedisModule *module;
moduleTypeLoadFunc rdb_load;
moduleTypeSaveFunc rdb_save;
moduleTypeRewriteFunc aof_rewrite;
moduleTypeMemUsageFunc mem_usage;
moduleTypeDigestFunc digest;
moduleTypeFreeFunc free;
moduleTypeFreeEffortFunc free_effort;
moduleTypeUnlinkFunc unlink;
moduleTypeCopyFunc copy;
moduleTypeDefragFunc defrag;
moduleTypeAuxLoadFunc aux_load;
moduleTypeAuxSaveFunc aux_save;
moduleTypeMemUsageFunc2 mem_usage2;
moduleTypeFreeEffortFunc2 free_effort2;
moduleTypeUnlinkFunc2 unlink2;
moduleTypeCopyFunc2 copy2;
moduleTypeAuxSaveFunc aux_save2;
int aux_save_triggers;
char name[10]; /* 9 bytes name + null term. Charset: A-Z a-z 0-9 _- */
} moduleType;


void freeModuleObject(robj *o){
moduleValue *mv = o->ptr;
mv->type->free(mv->value);
zfree(mv);
}