ROOTPLOIT
Server: LiteSpeed
System: Linux in-mum-web1878.main-hosting.eu 5.14.0-570.21.1.el9_6.x86_64 #1 SMP PREEMPT_DYNAMIC Wed Jun 11 07:22:35 EDT 2025 x86_64
User: u435929562 (435929562)
PHP: 7.4.33
Disabled: system, exec, shell_exec, passthru, mysql_list_dbs, ini_alter, dl, symlink, link, chgrp, leak, popen, apache_child_terminate, virtual, mb_send_mail
Upload Files
File: //opt/golang/1.22.0/test/fixedbugs/issue45851.go
// run

// Copyright 2021 The Go Authors. All rights reserved.
// Use of this source code is governed by a BSD-style
// license that can be found in the LICENSE file.

// This tickles a stack-allocation bug when the register ABI is enabled.
// The original report was from cue, internal/core/adt/equality.go,
// function equalVertex.

// In the failing case, something bad gets passed to equalTerminal.

package main

import "fmt"

type Kind uint16
type Flag uint16

const (
	allKinds Kind = 1
	TopKind  Kind = (allKinds - 1)
)
type Value interface {
	Kind() Kind
}
type Vertex struct {
	BaseValue Value
	name string
}
func (v *Vertex) Kind() Kind {
	return TopKind
}

func main() {
	vA := &Vertex{name:"vA",}
	vB := &Vertex{name:"vB",}
	vX := &Vertex{name:"vX",}
	vA.BaseValue = vX
	vB.BaseValue = vX
	_ = equalVertex(vA, vB, Flag(1))
}

var foo string

//go:noinline
func (v *Vertex) IsClosedStruct() bool {
	return true
}

func equalVertex(x *Vertex, v Value, flags Flag) bool {
	y, ok := v.(*Vertex)
	if !ok {
		return false
	}
	v, ok1 := x.BaseValue.(Value)
	w, ok2 := y.BaseValue.(Value)
	if !ok1 && !ok2 {
		return true // both are struct or list.
	}
	return equalTerminal(v, w, flags)
}

//go:noinline
func equalTerminal(x Value, y Value, flags Flag) bool {
	foo = fmt.Sprintf("EQclosed %s %s %d\n", x.(*Vertex).name, y.(*Vertex).name, flags)
	return true
}