#heap-overflow
2 writeups.
-
libnfs's NFSv4 GETATTR decoder bounds-checked every field read, then forgot to subtract two consumed strings from its remaining-length counter — so the checks passed while the read pointer walked off the reply buffer. A study in how present checks get defeated by absent bookkeeping.
-
A short, targeted fuzzing session against dr_libs turned up a heap out-of-bounds read in dr_flac's SEEKTABLE metadata handling — and the interesting part was the discipline around the bug, not the bug.