It's amazing how similar this vulnerability is to the 20+ year-old Quake 3 vulnerabilities found by Luigi Auriemma (aluigi), which exploited the exact same 256-to-1024 character range using nothing more than a long string of AAAA....
In both cases, you're just feeding >256 A's up to a 1024-byte limit until the underlying C code trips over its own length cap. Back in the mid-2000s, Luigi was famous for publishing one-line .cfg scripts where the entire exploit was literally "/say aaaaa..." repeated a few hundred times. ¹ ²
A great example is Jedi Academy, a 2003 Quake 3 engine game whose multiplayer is still actively played today (its open-source engine port, openjk, is even in the Debian repos btw). Luigi had two classic scripts for it on his site: Jedi Academy <= 1.011 in-game server buffer-overflow (jamsgbof)¹, which crashed the server just by pushing a string of as past the 1024-byte console buffer, and Quake 3 engine in-game players kicking (q3msgboom)², where a wall of as hit the engine's 1022-char truncation limit and the leftover bytes confused the parser into disconnecting everyone on the server.
Kind of wild that 20 years later, the exact same payload goes from crashing Quake 3 matches from the tilde console to getting root on some SSH servers.
In both cases, you're just feeding >256 A's up to a 1024-byte limit until the underlying C code trips over its own length cap. Back in the mid-2000s, Luigi was famous for publishing one-line .cfg scripts where the entire exploit was literally "/say aaaaa..." repeated a few hundred times. ¹ ²
A great example is Jedi Academy, a 2003 Quake 3 engine game whose multiplayer is still actively played today (its open-source engine port, openjk, is even in the Debian repos btw). Luigi had two classic scripts for it on his site: Jedi Academy <= 1.011 in-game server buffer-overflow (jamsgbof)¹, which crashed the server just by pushing a string of as past the 1024-byte console buffer, and Quake 3 engine in-game players kicking (q3msgboom)², where a wall of as hit the engine's 1022-char truncation limit and the leftover bytes confused the parser into disconnecting everyone on the server.
Kind of wild that 20 years later, the exact same payload goes from crashing Quake 3 matches from the tilde console to getting root on some SSH servers.
[1] https://web.archive.org/web/20101227181948/http://aluigi.alt... [2] https://web.archive.org/web/20060522175643/http://aluigi.alt...