client9 / client9/libinjection
Integer overflow(hs.token_len)
Open
- Dominant language
- C
- Stars
- 1k
- Forks
- 282
- PR merge metrics
- No merged PRs in 30d
Description
Test case: libinjection_xss("<%", 1); //call API with open tag following by percent. Note, string length is 1.
Cause: in libinjection_is_xss() token operation(reading in libinjection_h5_next(&h5) ) run out of boundary, led hs.token_len into overflow(i.e. hs.pos-hs.pos).
Affects subsequent string operation relying on h5.token_len to fail (e.g. memchr(h5.token_start, '`', h5.token_len)).
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.