4 ms·
It doesn’t actually have to transfer all 4GB, since you’re just spoofing a header to claim that 4GB is available. The actual payload can be much smaller (like a
by malcolmst 5y ago
It doesn’t actually have to transfer all 4GB, since you’re just spoofing a header to claim that 4GB is available. The actual payload can be much smaller (like a few kB)
- malcolmst 5y agoI was trying to use this same vuln for information disclosure since it also has an out-of-bounds read due to that lack of validation, but couldn’t get the extra data to be transferred back to the server. Would’ve been a nice way to defeat ASLR if it had worked