Skip to content

Instantly share code, notes, and snippets.

@kyprizel
kyprizel / 5.cpp
Created April 22, 2020 10:01
CVE-2019-16535 mediuum
void CompressionCodecMultiple::doDecompressData(const char * source, UInt32 source_size, char * dest, UInt32 decompressed_size) const
{
UInt8 compression_methods_size = source[0];
PODArray<char> compressed_buf(&source[compression_methods_size + 1], &source[source_size]);
PODArray<char> uncompressed_buf;
/// Insert all data into compressed buf
source_size -= (compression_methods_size + 1);
for (long idx = compression_methods_size - 1; idx >= 0; --idx)
@kyprizel
kyprizel / 4.cpp
Created April 22, 2020 10:00
CVE-2019-16535 medium
void CompressionCodecDoubleDelta::doDecompressData(const char * source, UInt32 source_size, char * dest, UInt32 /* uncompressed_size */) const
{
UInt8 bytes_size = source[0];
UInt8 bytes_to_skip = source[1];
memcpy(dest, &source[2], bytes_to_skip);
...
}
@kyprizel
kyprizel / 3.cpp
Created April 22, 2020 09:59
CVE-2019-16535 medum
UInt32 ICompressionCodec::decompress(const char * source, UInt32 source_size, char * dest) const
{
UInt8 method = source[0];
if (method != getMethodByte())
throw Exception("Can't decompress data with codec byte " + toString(method) + " from codec with byte " + toString(method), ErrorCodes::CANNOT_DECOMPRESS);
UInt8 header_size = getHeaderSize();
UInt32 decompressed_size = unalignedLoad<UInt32>(&source[5]);
doDecompressData(&source[header_size], source_size - header_size, dest, decompressed_size);
return decompressed_size;
@kyprizel
kyprizel / 2.cpp
Created April 22, 2020 09:57
CVE-2019-16535 medium
void CompressedReadBufferBase::decompress(char * to, size_t size_decompressed, size_t size_compressed_without_checksum)
{
...
UInt8 method = ICompressionCodec::readMethod(compressed_buffer);
if (!codec)
codec = CompressionCodecFactory::instance().get(method);
else if (codec->getMethodByte() != method)
throw Exception("Data compressed with different methods, given method byte "
@kyprizel
kyprizel / 1.cpp
Created April 22, 2020 09:52
Medium CVE-2019–16535
bool CompressedReadBuffer::nextImpl()
{
size_t size_decompressed;
size_t size_compressed_without_checksum;
size_compressed = readCompressedData(size_decompressed, size_compressed_without_checksum);
if (!size_compressed)
return false;
memory.resize(size_decompressed + codec->getAdditionalSizeAtTheEndOfBuffer());
working_buffer = Buffer(memory.data(), &memory[size_decompressed]);
@kyprizel
kyprizel / test
Last active March 28, 2016 16:22
1234
@kyprizel
kyprizel / gist:67afdc2ef25cd3b572d3
Created April 28, 2015 10:09
do_nothing plugin
from w3af.core.controllers.plugins.crawl_plugin import CrawlPlugin
import time
class do_nothing(CrawlPlugin):
def __init__(self):
CrawlPlugin.__init__(self)
static time_t
ASN1_GetTimeT(ASN1_TIME* time)
{
struct tm t;
const char* str = (const char*) time->data;
memset(&t, 0, sizeof(t));
if (time->length < 14) {
goto complete;
From 22e62551e81082d83e04ac7d18262f283b2d695e Mon Sep 17 00:00:00 2001
From: Eldar Zaitov <eldar@kyprizel.net>
Date: Tue, 11 Dec 2012 17:52:09 +0400
Subject: [PATCH] fixed fd leak in logger
---
engine/core.c | 11 +++++++++++
1 file changed, 11 insertions(+)
diff --git a/engine/core.c b/engine/core.c