Re:Warning: Implicit Backdoor
by jackewiehose on Wednesday September 04, 2019 @03:22PM
(#20880534)
This alone is not a backdoor but it might lead to one.
This assumes a scenario where an attacker is in full control of "num".
For example: A lot of protocols have a structure like "<SIZE><PAYLOAD>"
where the sending side (the attacker) specifies SIZE and the receiving
side allocates a buffer of that size).
The code calling that function assumes it will never create a buffer
that is larger then 256 bytes, so perhaps it is doing something like
this:
This assumes a scenario where an attacker is in full control of "num".
For example: A lot of protocols have a structure like "<SIZE><PAYLOAD>" where the sending side (the attacker) specifies SIZE and the receiving side allocates a buffer of that size).
The code calling that function assumes it will never create a buffer that is larger then 256 bytes, so perhaps it is doing something like this:
If the limit-check fails and the supplied size is in a valid range for malloc, it would be a typical buffer overflow.