Re[2]: memcpy with negative length and destination on heap - exploitable?

From: 3APA3A (3APA3A@SECURITY.NNOV.RU)
Date: 12/26/01 

Date: Wed, 26 Dec 2001 22:02:18 +0300
From: 3APA3A <3APA3A@SECURITY.NNOV.RU>
To: dullien@gmx.de

Hello dullien,

--Wednesday, December 26, 2001, 6:13:30 PM, you wrote to 3APA3A@SECURITY.NNOV.RU:

3>> memcpy(dst, src + POSITION + 1, len); len is too long then
3>> converted to size_t and memcpy will crash... Is it possible to
3>> avoid it if destination buffer is on heap? Program is available
3>> on all possible platforms :)

dgd> If it happens on the stack (under NT), you might be able to
dgd> overwrite SEH structures before segfaulting and thus gain control.

If it happens on the stack it may be possible to overwrite 'len'
argument with any desired value. If memcpy() doesn't use register copy
of len (for example one from libuucp) it makes it possible to exploit
it. 

-- 
~/ZARAZA
Ибо факты есть факты, и изложены они лишь для того, чтобы их поняли и в них поверили. (Твен)

Relevant Pages

  • Debugging kernel assembly calls - no stack frame
    ... Previous frame inner to this frame ... Inside the memcpy frame I see that %edi is 0x10, ... Memcpy pushes two registers onto the stack immediately. ... info registers esp ...
    (freebsd-hackers)
  • stack exploits, was: AMD 64-bit w/o paging?
    ... overwrite return address with code-on-stack, ... overwrite stack with code. ... also eventual return address of memcpy) ... complex system you can usually find an equivalent function at a fixed ...
    (alt.lang.asm)
  • Re: Apache Exploit
    ... > here is my little explanation how bsd memcpy can be exploited: ... This way you can easily survive the call and overwrite ... length is also constrained to be its own stack offset, ...
    (Bugtraq)
  • Re: Apache Exploit
    ... > here is my little explanation how bsd memcpy can be exploited: ... This way you can easily survive the call and overwrite ... length is also constrained to be its own stack offset, ...
    (Vuln-Dev)