Tag Info

New answers tagged

0

This is floating around in the above answers, but I believe it should be made explicit. C/C++'s character array handling has a number of potential off-by-one hazards... Examples: "" // a zero length string requiring one byte of storage // in memory: 00 "Hi." // a length 3 string requiring four bytes of storage // in memory: 48 69 2e 00 ...


2

As you indicated in your response, buffer overflows are a likely vulnerability if a programmer does not terminate a character string with a NULL byte. The reason is that most string functions assume this, and will continue until they encounter a zero. If you are lucky, the error is bad enough that you get a segmentation fault error early in development, so ...


18

String Termination Vulnerability Upon thinking about this more, using strncpy() is probably the most common way (that I can think of) that could create null termination errors. Since generally people think of the length of the buffer as not including \0. So you'll see something like the following: strncpy(a, "0123456789abcdef", sizeof(a)); Assuming ...


3

Null bytes in your return address are hard to beat. Since its an address as opposed to code you cannot use an encoding stub. There are however a few potential ways to get around this: 1)Find the perfect address. Sometimes the application will copy code onto the stack or other areas in memory. If you're lucky you can find a static location that contain a ...


2

When you are exploiting a buffer overflow, your attack is possible because of an underlying misschecking on the asm code. In your case, strcpy use is in fault so you have some limitations. Indeed, strcpy is a string function. As you said, you can't have \x00 byte. You can find other cases (not relying on stcpy) when \x00 can be allowed but not in this case. ...


5

It is not only possible, it has been documented several times in the past. http://www.cvedetails.com/vulnerability-list/vendor_id-72/product_id-960/GNU-GCC.html For example, http://www.cvedetails.com/cve/CVE-2008-1367/ shows a memory corruption attack that could lead to various types of compromise, if they were sufficiently exploited. A compiler is just ...


4

At least C++ compilation is turing complete so it is possible/easy to produce infinite loop impacting system performance and producing infinite output (exhausting ram and/or disk place). More info on how C++ compilation is turing complete : http://stackoverflow.com/questions/189172/c-templates-turing-complete



Top 50 recent answers are included