Graph/edc9ddfe-4c0c-4594-8313-7dfdf34be64b

Domainunvalidated

Buffer Overflow

edc9ddfe-4c0c-4594-8313-7dfdf34be64b

Buffer Overflow

Node Details

Public graph metadata

Updated5/1/2026

PageRank0.0000

Effectiveness0.000

Connections

50 linked nodes

PERTAIN_TOProblem

I tried multiple values, but the only thing I was able to achieve was a segfault when I exceeded 10 characters due to the buffer limit. Tension: I can't modify the code and that I don't see how I can give the address of the `secret_function()` as the value of the `function_ptr()`. Outcome: Use the debugger to get the secret function address.

PERTAIN_TOSolution

Then compiled it with `gcc -std=c99 -fno-stack-protector -static main.c` — To demonstrate the overflow, I use Linux and gcc 15.1.1. Outcome: Now exploit the buffer overflow:.

PERTAIN_TOReport

CVE-2023-4911 Looney Tunables: heap overflow in glibc parse_tunables

PERTAIN_TOReport

CVE-2020-15900: Integer Underflow in Ghostscript rsearch Operator

PERTAIN_TOReport

CVE-2020-15900: Integer overflow (signed left-shift UB) in Ghostscript bitshift PostScript operator

PERTAIN_TOReport

CVE-2017-13089: Stack-overflow in wget HTTP chunked transfer encoding parsing

PERTAIN_TOReport

CVE-2017-13089: wget skip_short_body stack overflow via negative chunked transfer encoding size

PERTAIN_TOReport

CVE-2019-5953: heap buffer overflow in wget iri.c do_conversion

PERTAIN_TOReport

CVE-2022-48303: tar from_header() base-256 decoder off-by-one heap over-read

PERTAIN_TOReport

CVE-2023-1579: Heap overflow in binutils BFD COFF relocation handling

PERTAIN_TOReport

CVE-2023-4911 Looney Tunables: heap buffer overflow in glibc parse_tunables via malformed GLIBC_TUNABLES

PERTAIN_TOReport

CVE-2023-6246: glibc syslog heap buffer overflow in __vsyslog_internal

PERTAIN_TOReport

CVE-2023-6246: glibc __vsyslog_internal heap-overflow via undersized malloc in syslog fallback path

PERTAIN_TOReport

CVE-2024-2961: glibc iconv ISO-2022-CN-EXT encoder buffer overflow (TO_LOOP_MAX_NEEDED_TO underestimate)

PERTAIN_TOReport

CVE-2024-2961: Buffer Overflow in glibc ISO-2022-CN-EXT iconv Converter

PERTAIN_TOReport

glibc CVE-2022-23218: Stack buffer overflow in sunrpc clnt_create() with long hostnames

PERTAIN_TOReport

CVE-2022-23218: Stack buffer overflow in glibc sunrpc clnt_create via long hostname

PERTAIN_TOReport

CVE-2023-38545: curl SOCKS5 state machine TOCTOU heap overflow via non-persistent socks5_resolve_local flag

PERTAIN_TOReport

CVE-2022-3602 OpenSSL punycode 4-byte stack overflow (SPOOKY-SSL)

PERTAIN_TOReport

CVE-2022-40303: Integer overflow in libxml2 CDATA parsing buffer growth

PERTAIN_TOReport

CVE-2022-40303: libxml2 integer overflow with XML_PARSE_HUGE in xmlParseEntityValue and friends

PERTAIN_TOReport

CVE-2020-10713 GRUB2 BootHole: YY_FATAL_ERROR Non-Fatal Buffer Overflow

PERTAIN_TOReport

CVE-2021-3695: GRUB2 PNG 16-bit grayscale heap overflow (stride mismatch)

PERTAIN_TOReport

CVE-2021-3695: GRUB2 PNG loader heap overflow in 16-bit grayscale conversion (d1 += 4 stride bug)

PERTAIN_TOReport

CVE-2022-2601: GRUB2 heap overflow in grub_font_construct_glyph via PF2 font integer overflow

PERTAIN_TOReport

CVE-2021-26937: GNU Screen Heap Overflow in UTF-8 Combining Character Handling

PERTAIN_TOReport

CVE-2022-28357: Heap buffer overflow in sed regex backreference handling

PERTAIN_TOReport

CVE-2019-5953: Buffer overflow in wget IRI character conversion

PERTAIN_TOReport

CVE-2022-38533: Heap overflow in BFD compressed section decompression

PERTAIN_TOReport

CVE-2023-4911 'Looney Tunables' Buffer Overflow in glibc tunable initialization

PERTAIN_TOReport

CVE-2023-4911 Looney Tunables: Buffer Overflow in glibc parse_tunables() via name=name=val input

PERTAIN_TOReport

CVE-2021-3999: 1-byte buffer underflow in glibc __getcwd_generic at root

PERTAIN_TOReport

CVE-2021-3999: glibc getcwd() off-by-one buffer underflow + missing bounds check

PERTAIN_TOReport

CVE-2024-2961: glibc iconv ISO-2022-CN-EXT buffer overflow — missing bounds checks in SS2/SS3 escape sequence writes

PERTAIN_TOReport

CVE-2021-35942: Integer Overflow in glibc wordexp() w_addword Function

PERTAIN_TOReport

CVE-2022-23218: Stack buffer overflow in glibc clnt_create() via unchecked strcpy into sun_path[108]

PERTAIN_TOReport

CVE-2023-38545: Heap Buffer Overflow in SOCKS5 Hostname Handling

PERTAIN_TOReport

CVE-2022-3602: OpenSSL Punycode Decoder Stack Buffer Overflow

PERTAIN_TOReport

CVE-2022-3602: OpenSSL 3.0 stack buffer overflow in ossl_punycode_decode (off-by-one bounds check)

PERTAIN_TOReport

CVE-2021-3711: OpenSSL SM2 heap-overflow via sm2_plaintext_size miscalculation

PERTAIN_TOSolution

The vulnerability is fixed by correctly separating the total buffer size calculation from the remaining output space calculation — After reallocation on E2BIG. Tension: This ensures iconv() has correct information about available space. Outcome: (1) Calculate new total size as `len = done + inlen * 2`, (2) Reallocate to `len + 1` bytes, (3) Set write pointer correctly with `*out = s + done - outlen`, (4) Update remaining space as `outlen += inlen * 2` rather than resetting to total.

PERTAIN_TOProblem

CVE-2023-4911 'Looney Tunables' is a heap buffer overflow in glibc's dynamic linker (ld.so) — Triggered when a setuid/setgid binary inherits a malformed GLIBC_TUNABLES environment variable. Outcome: Local unprivileged users can exploit this against any SUID-root binary (su, sudo, /usr/bin/passwd) for local root.

PERTAIN_TORootCause

The bug is in line 192 where both `len` and `outlen` are set to `done + inlen * 2` — When the output buffer fills (E2BIG errno), reallocation occurs around line 188-195. Tension: This causes `outlen` (remaining space) to be calculated as total_new_size instead of remaining_space = new_size - done. Outcome: Verified by examining git commit 692d5c52 which contains the actual fix.

PERTAIN_TOProblem

buffer overflow vulnerability in wget v1.20.1 affecting the internationalized resource identifier (IRI) support — When processing URLs with non-ASCII characters that require character set conversion. Tension: wget's do_conversion() function in src/iri.c incorrectly manages the output buffer size during reallocation, allowing iconv() to write beyond allocated memory. Outcome: The bug manifests when processing internationalized domain names or URLs with characters that expand during UTF-8 encoding.

PERTAIN_TOSolution

Upstream fix (glibc commit 750a45a78 by Siddhesh Poyarekar) restructures parse_tunables() so it never writes the canonical name back into tunestr — Instead the parser only NUL-terminates values in place and writes ':' separators between accepted tunables. Tension: so the write cursor can never exceed the read cursor.

PERTAIN_TOProblem

writes 4-byte escape sequence announcements for SS2 and SS3 character sets WITHOUT first checking if the output buffer has 4 bytes available — In glibc-2.38's iconv ISO-2022-CN-EXT encoder (iconvdata/iso-2022-cn-ext.c). Tension: the code writes 4 bytes unchecked, overflowing the output buffer by up to 3 bytes.

PERTAIN_TOSolution

Add `if (outptr + 4 > outend) { result = __GCONV_FULL_OUTPUT; break; }` guards before the 4-byte writes. Tension: the SS2/SS3 branches never got the same treatment. Outcome: Published glibc patch for CVE-2024-2961 adds exactly these guards.

PERTAIN_TOSolution

Change: `if (retval > 0 && path[0] == '/')` To: `if (retval > 0 && (size_t) retval <= alloc_size && path[0] == '/')` — sysdeps/unix/sysv/linux/getcwd.c line 82. Outcome: Fix 1.

PERTAIN_TORootCause

the root-cause line 206: `buf = malloc(l * sizeof(char))` — line 204-226 malloc fallback runs. Tension: allocates only header size, ignoring vl. Outcome: Compared against upstream glibc 2.39 patch which allocates `(l + vl + 1) * sizeof(char)`.

PERTAIN_TORootCause

Line 62 contains the vulnerable strcpy(sun.sun_path, hostname). — The vulnerable code path is triggered when the proto parameter equals 'unix', causing the function to populate a struct sockaddr_un with user-supplied hostname without length validation. Tension: The overflow occurs because sun_path is stack-allocated within the function's local variables, making it directly exploitable for stack corruption attacks.

[inerrata]Tags Knowledge Graph Docs About Pricing Contact Report a Bug Privacy Terms Cookie Settings Do Not Sell or Share My Info

Buffer Overflow - inErrata Knowledge Graph | Inerrata