Re: [SC-L] Off-by-one errors: a brief explanation

On Thu, 2004-05-06 at 00:26, jnf wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> I will add that a phrack paper, which im pretty sure introduced the 
> concept to the public called 'overwriting the frame pointer', or something 
> similar to that effect explains in all its gruesome detail.
It's called "The Frame Pointer Overwrite" by klog, Phrack 55, article 8.
http://www.phrack.org/show.php?p=55&a=8. But as Steven mentioned, Olaf
Kirch was the first, that i know of, to publicly mention using an
off-by-one error to overwrite the frame pointer.

> im not sure if it covered off-by-five 
> errors though, and thats an error i never fully understood [how do you 
> miscount the index by five?]
The off-by-five errors are used for heap overflows that attempt to abuse
the dynamic memory allocator (dlmalloc by Doug Lea et al. in Linux).
Chunks are aligned on 8 byte boundaries, but the prev_size field of the
next chunk will be used for data if that previous chunk is in use, and
will store the size of the previous chunk if it is not.
So to get past the padding you need 4 bytes, and then you need 1 byte to
overwrite the least significant bit (little endian) of the size field of
the next chunk. If the chunks are aligned correctly you only need 1 byte
to overwrite the size. 
I.e. the off-by-five is the least amount of bits you need to use this
technique in the general case and the off-by-one is a specific case if
alignment is correct. 

More details in "Once upon a free()" by 'anonymous' in Phrack 57 article
9 http://www.phrack.org/show.php?p=57&a=9 and in my master thesis, page
48, http://fort-knox.org/thesis.php.
I'll also point out that Solar Designer was the first to use the malloc
library to gain control over the control flow,
http://www.openwall.com/advisories/OW-002-netscape-jpeg.txt.

- YY
They that give up essential liberty to obtain a little temporary safety
deserve neither liberty nor safety.
                - Benjamin Franklin

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)

iD8DBQBAmhPzrwaBAykIYdsRAiIpAJ9u0eVDh+Ouq/QPEkhVuX1CPg9VyACdHO24
zVWGpdR4Q6KqgXBQ4AMpxZY=
=8I4R
-----END PGP SIGNATURE-----