Re: strings / libbfd crasher

[mancha <mancha1 () zoho com>]

On Thu, Oct 23, 2014 at 08:24:00AM -0700, Michal Zalewski wrote:
> > http://lcamtuf.coredump.cx/stringme
>
> The immediate cause is due to srec_scan() in srec.c decreasing 'bytes'
> without range checking until it wraps around. The already-bad value of
> 'bytes' is assigned to 'sec->size' few lines before the crash, so
> perhaps there would be potential for exploitability later down the
> line; but the code ends up crashing soon thereafter in a 'while (bytes
> > 0)' loop that has no other exit conditions. That loop would need to
> go over the entire address space without SEGV to avoid the crash.

I'm no leporidae but I agree srec_scan needs tlc.

Fun-with-NULL:

http://sf.net/projects/mancha/files/rnd/stringmetoo

--mancha

Attachment: _bin
Description: