Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

MemIOCallback::read has a integer overflow bug #147

Closed
fatshi opened this issue Nov 1, 2023 · 1 comment · Fixed by #148
Closed

MemIOCallback::read has a integer overflow bug #147

fatshi opened this issue Nov 1, 2023 · 1 comment · Fixed by #148
Labels

Comments

@fatshi
Copy link

fatshi commented Nov 1, 2023

function MemIOCallback::read at line 70 has an integer overflow:
image

POC code as below:

#include "ebml/MemIOCallback.h"

using namespace libebml;

int main() {
    char buff[128] = {};
    MemIOCallback memoryBuffer;

    memoryBuffer.write(buff, 124);

    char outBuff[128];
    memoryBuffer.read(outBuff, 0xfffffffffffffff0);

    return 0;
}

terminal output is:

Process finished with exit code 139 (interrupted by signal 11: SIGSEGV)
@robUx4
Copy link
Contributor

robUx4 commented Nov 1, 2023

Indeed, thanks a lot for this finding! There was also some potential issue when writing.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants