0

I am trying to reproduce the following bug, called information leak which reads the memory from the current process.

I am interested in how was done the information leak bug from Foxit in order to leak addresses in userland to reproduce my own test cases.

enter image description here

Jabberwocky
  • 48,281
  • 17
  • 65
  • 115
xx22111
  • 1
  • 4
  • So you're saying you just want a test case where memory is leaked? Just create a block of memory like `char *mem = new char[100];` and then don't `delete` it. – spartygw May 19 '20 at 17:44
  • such information leak is usually done by returning more information than needed, "heartbleed" could be such an example, but in the case of userland application, it would require some kind of scripting engine, or in some case field in the parsed format that would allow for memory overwritting or overreading. – dvhh May 19 '20 at 17:52
  • 1
    @spartygw I think it's not that kind of leak he's talking about, rather information disclosure. – Jabberwocky May 19 '20 at 18:07
  • I didn't get the _"(source code)"_ part of your title. – Jabberwocky May 19 '20 at 18:08
  • @Jabberwocky I mean with source code a working example of information disclosure in order to implement on my test cases, but I also found it could be possible with `misused std::shared_ptr` , but how can I correctly create them for such examples? – xx22111 May 19 '20 at 18:31

0 Answers0