Re:How to Swiftly Destroy a $370 Million Dollar Rocket with ...
by mpweiher on Thursday June 26, 2014 @07:25AM
(#7949053)
You're not making any sense: I already wrote "protect against buffer overflow instead of integer overflow" and your response is "buffer overflow".
Re:How to Swiftly Destroy a $370 Million Dollar Rocket with ...
by zvrba on Thursday June 26, 2014 @08:04AM
(#7949159)
Integer overflow can be a causal cause of buffer overflow. Like this for example:
read(fd, &header, sizeof(header));
int total_len = header.data_len + header.code_len;
char *data = malloc(total_len);
read(fd, data, total_len);
Now, the attacker crafts the file and.. there's your buffer overflow which is a direct consequence of undetected integer overflow [i.e., the program being allowed to proceed].
Or you can use overflow to make the program to allocate too small buffer thus obtaining the buffer overflow you need to proceed further.