Re: [SC-L] Off-by-one errors: a brief explanation

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

I know how heap overflows work, that wasnt the question- well 'not how can 
overwritting 5 bytes help you', but what error do you code thats a 
miscount by 5 bytes? I mean, of by one is understandable, but what logic 
error causes you to miscount by 5 bytes?


j


- -- 

It is only the great men who are truly obscene.  If they had not dared to 
be obscene, they could never have dared to be great.
                -- Havelock Ellis
 


On Thu, 6 May 2004, Yves Younan wrote:

> On Thu, 2004-05-06 at 00:26, jnf wrote:
> > -----BEGIN PGP SIGNED MESSAGE-----
> > Hash: SHA1
> > 
> > I will add that a phrack paper, which im pretty sure introduced the 
> > concept to the public called 'overwriting the frame pointer', or something 
> > similar to that effect explains in all its gruesome detail.
> It's called "The Frame Pointer Overwrite" by klog, Phrack 55, article 8.
> http://www.phrack.org/show.php?p=55&a=8. But as Steven mentioned, Olaf
> Kirch was the first, that i know of, to publicly mention using an
> off-by-one error to overwrite the frame pointer.
> 
> > im not sure if it covered off-by-five 
> > errors though, and thats an error i never fully understood [how do you 
> > miscount the index by five?]
> The off-by-five errors are used for heap overflows that attempt to abuse
> the dynamic memory allocator (dlmalloc by Doug Lea et al. in Linux).
> Chunks are aligned on 8 byte boundaries, but the prev_size field of the
> next chunk will be used for data if that previous chunk is in use, and
> will store the size of the previous chunk if it is not.
> So to get past the padding you need 4 bytes, and then you need 1 byte to
> overwrite the least significant bit (little endian) of the size field of
> the next chunk. If the chunks are aligned correctly you only need 1 byte
> to overwrite the size. 
> I.e. the off-by-five is the least amount of bits you need to use this
> technique in the general case and the off-by-one is a specific case if
> alignment is correct. 
> 
> More details in "Once upon a free()" by 'anonymous' in Phrack 57 article
> 9 http://www.phrack.org/show.php?p=57&a=9 and in my master thesis, page
> 48, http://fort-knox.org/thesis.php.
> I'll also point out that Solar Designer was the first to use the malloc
> library to gain control over the control flow,
> http://www.openwall.com/advisories/OW-002-netscape-jpeg.txt.
> 
> - YY
> They that give up essential liberty to obtain a little temporary safety
> deserve neither liberty nor safety.
>                 - Benjamin Franklin
> 
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.2 (OpenBSD)

iD8DBQFAmhyQsKAeTAhLiCERAi1VAJ9gplyNf5oiigbDFOpl6Tid57aZIwCfZ4YE
dN4xZKuIwKsdnW+kH1uDODY=
=C1tI
-----END PGP SIGNATURE-----