| शीर्षक | libimobiledevice fa0f79190142bc309307967c058f89c1b36eb6b8 - version 1.4.0 Memory corruption heap out of bound |
|---|
| विवरण | Heap overflow: this_len > entire_len
Location: src/afc.c:308-314
entire_len = (uint32_t)header.entire_length - sizeof(AFCPacket); // allocation size
this_len = (uint32_t)header.this_length - sizeof(AFCPacket); // recv size
buf = (char*)malloc(entire_len);
if (this_len > 0) { err = ...service_receive(client->parent, buf, this_len, &recv_len); }
Root cause. Only header.this_length < sizeof(AFCPacket) is rejected (line 293). There is no this_len <= entire_len check, no entire_length >= sizeof(AFCPacket) check, and the u64 fields are silently narrowed to uint32_t. service_receive (src/service.c:177) → idevice_connection_receive_timeout (src/idevice.c:749) performs a single recv of up to size bytes, so the peer makes the host write this_len bytes into an entire_len-byte buffer. |
|---|
| स्रोत | ⚠️ https://bohmid-com.vercel.app/#/article/blog-afc-writeup |
|---|
| उपयोगकर्ता | ahmed0000 (UID 51651) |
|---|
| सबमिशन | 01/10/2026 05:14 PM (25 दिन पहले) |
|---|
| संयम | 25/10/2026 06:44 PM (24 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 426297 [libimobiledevice तक 1.4.0 AFC src/afc.c बफ़र ओवरफ़्लो] |
|---|
| अंक | 20 |
|---|