5 ms·

Anyone know how this is bootstrapped to code execution? In the part written up, seems to get as far as “data reads past the end of a buffer”.

• diamondo25 10y ago
  When this happens, you can override the stack. As variables are pushed on the stack, you can influence the execution of the program, for example return address. This can be exploited using ROP (Return Oriented Programming) and then you've got full control.
  • waynecochran 10y ago
    This isn't always possible in practice and the article never suggests anything worse than crashing the app or preventing it from running.
    • mark4o 10y ago
      In https://support.apple.com/en-us/HT207617 https://support.apple.com/en-us/HT207617 Apple admits that this may lead to arbitrary code execution.
  • kenferry 10y ago
    How do you override the stack without writes?