Skip to main content
Tweeted twitter.com/#!/StackSecurity/status/560943892745699328

Why is this code maliciousit dangerous when an attacker can control the `n` parameter to `memcpy()`?

Changed the title because it did not make sense and some modification in the text to make it more understandable.
Source Link

Why does hisis this code malicious?

I was reading a paper and saw this piece of code has an information leakage vulnerability. It was saying the following code will Leak memory layout information to the attackers

Could somebody please explain me how will it leakthis leaks information?

struct userInfo{
    char username[16];
    void* (*printName)(char*);
} user;
...
user.printName = publicFunction.
...
n = attacker_controllable_value; //20
memcpy(buf, user.username, n);   //get function ptr
SendToServer(buf);

I can see memcpy will give exception but why should it return memory address to attacker(or whatever it is returning)?

Thanks in advance

Why does his code malicious

I was reading a paper and saw this piece of code has information leakage vulnerability. It was saying the following code will Leak memory layout information to the attackers

Could somebody please explain me how will it leak information?

struct userInfo{
    char username[16];
    void* (*printName)(char*);
} user;
...
user.printName = publicFunction.
...
n = attacker_controllable_value; //20
memcpy(buf, user.username, n);   //get function ptr
SendToServer(buf);

I can see memcpy will give exception but why should it return memory address to attacker(or whatever it is returning)?

Thanks in advance

Why is this code malicious?

I was reading a paper and saw this piece of code has an information leakage vulnerability. It was saying the following code will Leak memory layout information to the attackers

Could somebody please explain me how this leaks information?

struct userInfo{
    char username[16];
    void* (*printName)(char*);
} user;
...
user.printName = publicFunction.
...
n = attacker_controllable_value; //20
memcpy(buf, user.username, n);   //get function ptr
SendToServer(buf);

I can see memcpy will give exception but why should it return memory address to attacker(or whatever it is returning)?

Thanks in advance

Source Link
smttsp
  • 366
  • 2
  • 13

Why does his code malicious

I was reading a paper and saw this piece of code has information leakage vulnerability. It was saying the following code will Leak memory layout information to the attackers

Could somebody please explain me how will it leak information?

struct userInfo{
    char username[16];
    void* (*printName)(char*);
} user;
...
user.printName = publicFunction.
...
n = attacker_controllable_value; //20
memcpy(buf, user.username, n);   //get function ptr
SendToServer(buf);

I can see memcpy will give exception but why should it return memory address to attacker(or whatever it is returning)?

Thanks in advance