| शीर्षक | libimobiledevice fa0f79190142bc309307967c058f89c1b36eb6b8 - version 1.4.0 heap leak |
|---|
| विवरण | unchecked realloc + memcpy
Location: src/webinspector.c:221-230
if (!packet) {
packet = (char*)malloc(length * sizeof(char));
} else {
newpacket = (char*)realloc(packet, (packet_length + length) * sizeof(char));
packet = newpacket; // NULL not checked
}
memcpy(packet + packet_length, buffer, length); // NULL -> SIGSEGV
Root cause. Partial messages reassembled via realloc; the result is assigned to packet without checking NULL. On allocation failure the old pointer is lost (leak) and memcpy dereferences NULL (crash). Public entry: webinspector_receive_with_timeout (include/libimobiledevice/webinspector.h:131).
normal path: one WIRPartialMessageKey chunk + one WIRFinalMessageKey chunk of a valid binary plist → client reassembles and prints the plist (exercises the realloc path once).
many partial chunks, no final → packet grows without bound (memory DoS; crash requires forcing realloc to fail, e.g. under ASAN size caps).
Impact. Heap leak under OOM; reliable NULL-memcpy crash when realloc fails; unbounded memory growth with an endless partial stream. |
|---|
| स्रोत | ⚠️ https://bohmid-com.vercel.app/#/article/blog-afc-writeup |
|---|
| उपयोगकर्ता | ahmed0000 (UID 51651) |
|---|
| सबमिशन | 01/10/2026 05:29 PM (25 दिन पहले) |
|---|
| संयम | 25/10/2026 06:44 PM (24 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 426301 [libimobiledevice तक 1.4.0 Web Inspector src/webinspector.c webinspector_receive_with_timeout बफ़र ओवरफ़्लो] |
|---|
| अंक | 20 |
|---|