Re: [SC-L] Off-by-one errors: a brief explanation

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Ah I see, I wasn't confusing the two, technically a off by five could also 
work in the stacks sense, but that wasnt my rationale, I figured while we 
were on the subject of off by ones id ask about off by fives, anyways I 
appreciate the reply/info.

j


- -- 

It is only the great men who are truly obscene.  If they had not dared to 
be obscene, they could never have dared to be great.
                -- Havelock Ellis
 


On Thu, 6 May 2004, Yves Younan wrote:

> On Thu, 2004-05-06 at 13:07, jnf wrote:
> > -----BEGIN PGP SIGNED MESSAGE-----
> > Hash: SHA1
> > 
> > I know how heap overflows work, 
> I assumed you did, that's why I didn't mention them much, except
> pointing out that you were confusing heap and stack overflows in your
> explanation: mentioning the 5 byte overflow in the frame pointer
> overwrite where you'd need a maximum of 4 bytes in the case of alignment
> to 4 bytes. 
> 
> > that wasnt the question- well 'not how can 
> > overwritting 5 bytes help you', but what error do you code thats a 
> > miscount by 5 bytes? I mean, of by one is understandable, but what logic 
> > error causes you to miscount by 5 bytes?
> I was just giving the rationale for describing a 5 byte overflow: if you
> have limited space to overflow (for some reason or another), 5 bytes is
> the minimum needed in the general case for the heap-based overflow. I
> don't know of general cases where you'd explicitly miscount by exactly 5
> bytes, but you might misallocate by a small amount of space, still
> causing an exploitable vulnerability.
> 
> - YY
> They that give up essential liberty to obtain a little temporary safety
> deserve neither liberty nor safety.
>                 - Benjamin Franklin
> 
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.2 (OpenBSD)

iD8DBQFAmsMwsKAeTAhLiCERAob+AJ4vHRuCdRQInNgLoqtiH5XWFlf/vQCbBBfv
I8fKVuhTlccmyT45hyk4kGc=
=32eo
-----END PGP SIGNATURE-----