Re: [SC-L] Off-by-one errors: a brief explanation

On Thu, 2004-05-06 at 13:07, jnf wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> I know how heap overflows work, 
I assumed you did, that's why I didn't mention them much, except
pointing out that you were confusing heap and stack overflows in your
explanation: mentioning the 5 byte overflow in the frame pointer
overwrite where you'd need a maximum of 4 bytes in the case of alignment
to 4 bytes. 

> that wasnt the question- well 'not how can 
> overwritting 5 bytes help you', but what error do you code thats a 
> miscount by 5 bytes? I mean, of by one is understandable, but what logic 
> error causes you to miscount by 5 bytes?
I was just giving the rationale for describing a 5 byte overflow: if you
have limited space to overflow (for some reason or another), 5 bytes is
the minimum needed in the general case for the heap-based overflow. I
don't know of general cases where you'd explicitly miscount by exactly 5
bytes, but you might misallocate by a small amount of space, still
causing an exploitable vulnerability.

- YY
They that give up essential liberty to obtain a little temporary safety
deserve neither liberty nor safety.
                - Benjamin Franklin

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)

iD8DBQBAmjGTrwaBAykIYdsRAqSxAJ9oySRfL7GP2Dx6qCMwg+24v9lkRQCcDOUw
7dBRPAo3zdfJLzzUyi2kzIg=
=hsj9
-----END PGP SIGNATURE-----