NotificationsYou must be signed in to change notification settings
Fork0
Star0

Commitd6bf4b3

Anadote

committed

Moved Stack increment higher

This can potentially be turned into a information leak.If SP = 1023, then it will pass the check before being updated to 1024.This gives us a OOB, which allows u to set the value of SP to 0-0xffff.With careful heap control, you can get a pointer.This can be stored/examined by the program using ret,as they do not do an upper bound check.

1 parent9c5c23a commitd6bf4b3Copy full SHA for d6bf4b3

File tree

1 file changed

-3

lines changed

src
- simple-vm-opcodes.c

1 file changed

-3

lines changed

`‎src/simple-vm-opcodes.c‎`

Lines changed: 2 additions & 3 deletions

Original file line number	Diff line number	Diff line change
`@@ -1164,6 +1164,8 @@ void op_stack_call(struct svm *svm)`
`1164`	`1164`
`1165`	`1165`
`1166`	`1166`	`intsp_size=sizeof(svm->stack) /sizeof(svm->stack[0]);`
	`1167`	`+svm->SP+=1;`
	`1168`	`+`
`1167`	`1169`	`if (svm->SP >=sp_size)`
`1168`	`1170`	`svm_default_error_handler(svm,"stack overflow - stack is full!");`
`1169`	`1171`
`@@ -1172,9 +1174,6 @@ void op_stack_call(struct svm *svm)`
`1172`	`1174`	`* on the stack so that the "ret(urn)" instruction will go`
`1173`	`1175`	`* to the correct place.`
`1174`	`1176`	`*/`
`1175`		`-svm->SP+=1;`
`1176`		`-`
`1177`		`-`
`1178`	`1177`	`svm->stack[svm->SP]=svm->ip+1;`
`1179`	`1178`
`1180`	`1179`	`/**`

0 commit comments

Comments

(0)

Movatterモバイル変換

Navigation Menu

Search code, repositories, users, issues, pull requests...

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Commitd6bf4b3

File tree

1 file changed

1 file changed

`‎src/simple-vm-opcodes.c‎`

0 commit comments