Vulnerability Development: Re: New bugs discovered!

[Syzop <syz () dds nl>]

jnf wrote:

> Am I just stupid? How does that work?
>
> esp            0xbffff210       0xbffff210
> eip            0x40071a47       0x40071a47
>
> he didnt even overwrite the esp/eip??
That's right, the crash is because of the free() at gzip.c line 1719:
    if (env != NULL)  free(env),  env  = NULL;
it's trying to free(0x41414141) if you pass a lot of A'z.
However, free() bugs are also exploitable...
see for example the two articles (8&9) in the last phrack (#57).

    Syzop.