3 ms·
This alone is not a backdoor but it might lead to one. This assumes a scenario where an attacker is in full control of "num". For example: A lot of protocols
by jackewiehose 7y ago
This alone is not a backdoor but it might lead to one.
This assumes a scenario where an attacker is in full control of "num".
For example: A lot of protocols have a structure like "<SIZE><PAYLOAD>"
where the sending side (the attacker) specifies SIZE and the receiving
side allocates a buffer of that size).
The code calling that function assumes it will never create a buffer
that is larger then 256 bytes, so perhaps it is doing something like
this:
char buf[256];
strcpy (buf, allocatebufs (ATTACKER_SIZE))
If the limit-check fails and the supplied size is in a valid range for
malloc, it would be a typical buffer overflow.