I got accidental code execution via glibc?

scarybeastsecurity.blogspot.com

89 pointsthere7 comments

I'm not usually a meta poster (famous last words), but I would love to see more of this (hardcore systems stuff) on hackers news.

As an aside, anyone know other good sites for this kind of stuff?

I like http://www.reddit.com/r/ReverseEngineering/

and sometimes http://www.reddit.com/r/compsci/

Well, there is http://news.usethesource.com/

This guy doesn't really seem to understand the bug he's trying to explain or actually what happened in his "accident".

I think he understands it all too well (and missed explaining a lot of things that a casual reader really needs to know)

The code execution is not the point of the story.

The title makes me think that the code execution is the point of the story and he doesn't seem to understand how that happens in fnmatch().

He's established that the stack pointer rolls over due to integer overflow. He hasn't established exactly which part of the input data gets copied over the return pointer, but you're only really interested in that if you're trying to exploit the weakness. Establishing that the stack pointer does overflow is sufficient for the purposes of fixing the bug.

Reply on news.ycombinator.com