1. OpenBSD and FreeBSD use the dynamic memory allocation routines written by
Poul-Henning Kamp.
2. 'response[i]' receives pointers returned from other calls to malloc().
Therefore, the overwriting values can't be controlled, practically. If the
buffer were on the stack, we could hope to have one of the pointers
overwrite a saved instruction pointer, thus providing offset-independent
redirection (for your hacking knowledge base, many programs are vulnerable
to stack-based pointer array overflows of this kind). We still are afforded
offset-independence here, but we have to search harder for something to
overwrite... a function pointer perhaps... but what are the chances? We'll
put aside that problem for now.
No comments:
Post a Comment