Yet another Buffer Overflow in PHP of the AirMax Products
该报告还没有中文解读。
原文摘录
摘自原文（2115 字符中的一小部分）
After the Report [#73491](https://hackerone.com/reports/73491) and the [#74004](https://hackerone.com/reports/74004), I bring another Buffer Overflow, this one look more like #74004, which is a overflow in stack.
原文中的代码
int ub_process_content(struct upload_buffer* ub)
{
char line[512];
size_t length;
/** some code **/
if ((~ub->got) & GOT_BOUNDARY) {
eol = (char*)memmem(ptr, size, "\r\n", 2);
if (!eol) break;
length = eol - ptr + 2;
memcpy(line, ptr, length); //!!Problem!!//
line[length] = …默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 Ubiquiti Inc. 所有。
时间线
- 报告提交
- 公开披露
阅读 HackerOne 原文 ↗作者 @rbran · 版权归作者与 Ubiquiti Inc. 所有