CVE-2017-11367: Global buffer overflow (READ of size 4) in shoco C library
该报告还没有中文解读。
原文摘录
摘自原文（1371 字符中的一小部分）
The shoco_decompress function in the API in shoco through 2017-07-17 `allows remote attackers to cause a denial of service (buffer over-read and application crash) via malformed compressed data`. The vendor has been unresponsive since this was reported in February of 2017.
原文中的代码
==19039==ERROR: AddressSanitizer: global-buffer-overflow on address 0x0000004d0548 at pc 0x0000004bfdda bp 0x7ffd2945a650 sp 0x7ffd2945a648
READ of size 4 at 0x0000004d0548 thread T0
#0 0x4bfdd9 in shoco_decompress (/root/shoco/shoco+0x4bfdd9)
#1 0x4c017c in main …默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 Internet Bug Bounty 所有。
时间线
- 报告提交
- 公开披露
阅读 HackerOne 原文 ↗作者 @geeknik · 版权归作者与 Internet Bug Bounty 所有