4 ms·
> how exactly did they re-write the program counter to point to the address of the system call My understanding is: with the double-free, they managed to overw
by icebraining 7y ago
> how exactly did they re-write the program counter to point to the address of the system call
My understanding is: with the double-free, they managed to overwrite "info", including the location of the function "rewindFunction". When the parsing process calls that function, it will therefore actually call whatever function the attacker has pointed "rewindFunction" to.
- aloknnikhil 7y agoI see now. That's really clever. The fact that there's a double free AND that the WhatsApp gallery parses a GIF twice for some reason is a great catch.
- l33tman 7y agoYes, it's not something you typically think about when writing code even if you're security-conscious. IMO it's not good that the double-free bug has these consequences.