3 ms·
Integer overflow can be a causal cause of buffer overflow. Like this for example: read(fd, &header, sizeof(header)); int total_len = header.data_len + head
by zvrba 12y ago
Integer overflow can be a causal cause of buffer overflow. Like this for example:
read(fd, &header, sizeof(header));
int total_len = header.data_len + header.code_len;
char *data = malloc(total_len);
read(fd, data, total_len);
Now, the attacker crafts the file and.. there's your buffer overflow which is a direct consequence of undetected integer overflow [i.e., the program being allowed to proceed].
- mpweiher 12y agoOnce again: if you protect against buffer overflow, an integer overflow that might lead to buffer overflow doesn't matter. The C example doesn't matter because C has neither.