1

If I call malloc and then overflow the buffer I created, I am then writing to unused memory. Is there any security impact from me being able to do so? I would think you'd want to call malloc twice, then overflow the first buffer you allocated. That way you can overwrite heap management metadata in the second buffer, or other data in the second buffer.

EDIT: Please assume I can only overflow a kilobyte and this is a on Debian Wheezy. The heap and stack are very far apart.

1

A win for an attacker is a bit of a vague term.

Depending on other safeguards you could possibly fill up memory and overflow the stack. Or you could initialize memory which might be used later with certain values. Or you could just make whatever entry is in this spot too big and make other code fail which relies on its size.

Exploiting usually relies on a careful combination of many things and people find very creative ways to use even the most innocuous errors.

Even overflows by a single byte have been exploited.

Is it a win? Depends on the circumstances. Is it a problem? Definitely.

  • I'm overwriting unused memory though. It seems like being able to heap overflow into unused memory is pretty innocuous. If you're lucky, someone else might later use that data without memsetting it? That seems like the only real possibility. I don't understand this line: ". Or you could just make whatever entry is in this spot too big and make other code fail which relies on its size." What would that look like? – returneax Jul 24 '17 at 19:43
  • Suppose you're storing a string and somebody else doesn't check the size of that string again but assumes that it was initially correct. You can now create buffer overflows elsewhere. – Elias Jul 24 '17 at 21:30
  • 1
    I'm not sure what you're trying to do but you should always fix this. At the very least you probably have undefined behavior and the compiler might destroy your program in seemingly random ways. – Elias Jul 24 '17 at 21:31
  • I'm trying to write an exploit and I can overflow the buffer, but it's the most recently allocated buffer. I don't see what I can overwrite to cause a crash or even code execution. Heap metadata structures? – returneax Jul 24 '17 at 23:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.