3 ms·
Can someone explain to me please why reading less than the actual length of the body is dangerous? I’d have expected the opposite to be case.
by barbazoo 3y ago
Can someone explain to me please why reading less than the actual length of the body is dangerous? I’d have expected the opposite to be case.
- dwattttt 3y agoFrom the description, it allocates a buffer based on Content-Length, but copies the size of the buffer it received, thus writing out of bounds of the allocation.
- lcnPylGDnU4H9OF 3y ago> When retrieving files via HTTP or related protocols, shim attempts to allocate a buffer to store the received data. Unfortunately, this means getting the size from an HTTP header, which can be manipulated to specify a size that's smaller than the received data. In this case, the code accidentally uses the header for the allocation but the protocol metadata to copy it from the rx buffer, resulting in an out-of-bounds write.