HexBrain

Cosmos · Report #2806356

Heap-Buffer-Overread in contains_whitespace when calling parser_validate after supplying a maliciously crafted buffer to parser_parse

Validstatus
$2,000bounty
34upvotes
19 Nov 2024disclosed

Summary

A fuzz crash case was discovered, resulting in a heap-buffer-overread in the contains_whitespace function. This crash was not exploitable in the primary use case of the library, however a length check was added to prevent this case from triggering. This report was awarded a one-time bounty as it was the first valid submission for this target. Future crashes will need to be exploitable to be eligible for bounties for this component going forward.

How it was found

The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original