Vulnerabilities / Heap overflows
Heap overflows
Note — this looked simple. It was not.
A heap overflow is what happens when you write past the end of a heap-allocated buffer and the allocator, being an optimist, lets you. The interesting security consequences almost never come from the overwrite itself — they come from what lives next door in memory.
The reliable primitives worth chasing:
- Adjacent object corruption
- Overwrite a neighbouring object's function pointer or length field. Groom the heap so the neighbour is something you control.
- Allocator metadata
- Classic, mostly historical on modern allocators, still alive on embedded targets that time forgot.
- Length-field confusion
- Corrupt a size stored next to the buffer, turn a bounded overflow into an unbounded read/write. My personal favourite.
Grooming, briefly
Reliability is the whole game. A one-shot exploit that works 40% of the time is a demo; a boring exploit that works 99% of the time is a finding. Spend your effort making the heap layout deterministic before you spend any of it on the overwrite.
See also: Heap grooming, Use-after-free.
Last edited when I finally understood it · revision ∞