I was debugging a program, and discovered a line of code like so:
memcpy(stack_variable, attacker_supplied, read_length_from_packet(pPacket));
The read_length_from_packet
returns -1 if the length is bigger than 0x1FF, but seems they forgot to actually check for -1.
And since memcpy
takes a size_t
(unsigned), the -1 gets converted to 0xFFFFFFFF, and I can massively override the stack, so much it writes on memory it shouldn't, raises an exception, and crashes.
Is there a way to make an exploit out of this, or it'll just stay in a crash?