Is there a way to exploit 4-byte integer overflows to -1? [memcpy(dest, source, -1)]

Question

I was debugging a program, and discovered a line of code like so:

memcpy(stack_variable, attacker_supplied, read_length_from_packet(pPacket));

The read_length_from_packet returns -1 if the length is bigger than 0x1FF, but seems they forgot to actually check for -1.

And since memcpy takes a size_t (unsigned), the -1 gets converted to 0xFFFFFFFF, and I can massively override the stack, so much it writes on memory it shouldn't, raises an exception, and crashes.

Is there a way to make an exploit out of this, or it'll just stay in a crash?

Answer 1

Well, it's a simple buffer overflow, so probably yes, depending on what mitigations are available on the software/system you are targeting.

What you need to do is to overwrite something useful like:

• return address stored on the stack.
• SE handler address stored on the stack.
• anything that lets you control the execution flow of the program.