0

My question is related to the strlen function from the C and C++.

I am reversing a program, that reads a byte data from allocated memory and sends to the strlen directly. To be completely honest this data is the hash value, so bytes could vary from 00 to FF.

I have found out that I can abuse this function with zero bytes to make strlen outputting less value than it should (as an example the string is 10 bytes long, but strlen output is 6).

Is there any way to abuse the function with any byte data inputted to strlen to output a bigger value(lets say 14)?

Thank you.

0

Yes, if the input is not 0-terminated. If that's the case, strlen will happily continue counting bytes until it finds one, moving out of the input's bounds. It then depends on how clean the memory is where the input is allocated.

| improve this answer | |
  • Thank you, it looks very logical. Also, do you know anything about the cases when strlen negative return happens? Or should I better create another question for it? – Matthew Darens Nov 17 '19 at 13:15
  • Well man strlen says that signature is size_t strlen(const char *s);. size_t is unsigned so it should not return negative values @MatthewDarens It could have been casted to a signed value. – sudhackar Dec 5 '19 at 3:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.