intreuse

heap-buffer-overflow in png_set_text_2

2

in my research in FLIF, a craft file can cause a heap overflow in libpng. I wonder wheather it is the bug with FLIF or libpng. flif --overwrite -d $poc...

NULL pointer dereference bug in ulaw2linear_buf, in G711.cpp

5

There exists one NULL pointer dereference bug in ulaw2linear_buf, in G711.cpp, which allows an attacker to cause a denial of service via a crafted file. To reproduce with the attached...

out of bound heap access in SimpleModule.h

1

There exists one out of bound heap access in SwapModule::runSwap, in SimpleModule.h:82, which allows an attacker to cause a denial of service via a crafted file. sfconvert $poc output format...

在测试用例CWE78_OS_Command_Injection__char_connect_socket_system_01.out失败，经过分析发现，没有处理System调用返回值，导致在判断返回值时依据错误的rax值，导致部分路径不可达，从而未分析到漏洞路径。 sVar2 = strlen((char *)local_10); *(undefined4 *)((longlong)local_10 + sVar2) = 0x2a2e2a; iVar1 = system((char *)local_10); 没有处理返回值，此时iVar1变量即rax是错误值 if (iVar1 != 0) {进入该分支，exit函数无返回导致分析中止， printLine("command execution failed!"); /* WARNING: Subroutine does not return...