3 ms·

Agreed. q3k@nihilism ~/Projects/longs $ python2 -c "print 'GET / HTTP/1.1.\r\n' + 'a'*2000 + '\r\n\r\n'" | nc 127.0.0.1 1337 q3k@nihilism ~/Projects/l

by q3k 10y ago

Agreed. q3k@nihilism ~/Projects/longs $ python2 -c "print 'GET / HTTP/1.1.\r\n' + 'a'*2000 + '\r\n\r\n'" | nc 127.0.0.1 1337 q3k@nihilism ~/Projects/longs $ PORT=1337 ./longs *** Error in `./longs': free(): invalid next size (normal): 0x000000000155a5f0 *** ... Sounds like a fun heap exploitation challenge. Almost CTF-like. EDIT: It also throws a whole bunch of warning when compiling. [moved this here from the first line after child post mention]

ryanlm 10y ago
That's not a warning. That's a runtime error.
- q3k 10y ago
  I know, this is some internal glibc allocation code failing because that request overflowed a buffer on the heap. The bug is, as tptacek mentioned, in the header receiving function [1]. The compilation warnings was an additional remark, I should've phrased that post better. [1] - https://github.com/riolet/longs/blob/master/wafer.c#L334-337 https://github.com/riolet/longs/blob/master/wafer.c#L334-337
  - tptacek 10y ago
    Not the only case of this, either.
longs 10y ago
Thank you for raising this issue. We're currently working on fixing this. Here's the issue on the [tracker](https://github.com/riolet/longs/issues/6 https://github.com/riolet/longs/issues/6).