jduck

From 8f95773c9bcae728e3f753d99e2abebd41ae7060 Mon Sep 17 00:00:00 2001
From: "Joshua J. Drake" <[email protected]>
Date: Sat, 15 Aug 2015 08:17:03 -0500
Subject: [PATCH] Prevent integer issues in ID3::Iterator::findFrame

Integer overflows could occur a few places within findFrame. These can lead to
out-of-bounds reads and potentially infinite loops. Ensure that arithmetic does
not wrap around to prevent these behaviors.

Change-Id: I72a61df7d5719d1d3f2bd0b37fba86f0f4bbedee

jduck

From e746bacbf150fad31628357a4be27167d1060bcc Mon Sep 17 00:00:00 2001
From: "Joshua J. Drake" <[email protected]>
Date: Thu, 13 Aug 2015 18:20:45 -0500
Subject: [PATCH] Prevent integer truncation in 'tx3g' processing

Whenever the length of an atom in an MPEG4 file is set to 1, a 64-bit length is
read from the atom's data and stored in the variable 'chunk_size'. A value
larger than SIZE_MAX could satisfy the check added in the previous patch and,
because the new[] operator only accepts 32-bit lengths on 32-bit platforms,
integer truncation can occurr in the resulting allocation. Reject chunk_size

jduck

commit 8f0ec1f9369b4199654a6dc5fd1b06268bdf0c15
Author: Linus Torvalds <[email protected]>
Date:   Fri Nov 23 15:10:12 2007 -0500

    Import 1.3.22

diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c
index 0339895..c9999f1 100644
--- a/net/ipv4/raw.c
+++ b/net/ipv4/raw.c

jduck

--- crackaddr-bad.c.1	2011-08-25 14:37:47.000000000 -0500
+++ crackaddr-bad.c	2015-03-27 22:42:59.956804489 -0500
@@ -85,8 +85,11 @@
 #include <string.h>
 #include <ctype.h>
 
+#include <unistd.h>
+#include <fcntl.h>
+
 /* ccured needs this */

jduck

{
  "lang": "en",
  "retweeted": false,
  "favorited": false,
  "entities": {
    "urls": [],
    "user_mentions": [
      {
        "indices": [
          0,

jduck

Script started on Mon 16 Mar 2015 10:42:04 PM CDT
duoct:0:~$ cd work
duoct:0:~/work$ ls -l fread-intof.c
-rw------- 1 jdrake jdrake 500 Jun 13  2013 fread-intof.c
duoct:0:~/work$ cat fread-intof.c 
#include <stdio.h>
#include <unistd.h>
#include <stdlib.h>

int

jduck

diff --git a/project.py b/project.py
index 8b02b7c..890de8c 100644
--- a/project.py
+++ b/project.py
@@ -1878,6 +1878,7 @@ class Project(object):
                           ssh_proxy=ssh_proxy)
       ret = gitcmd.Wait()
       if ret == 0:
+        print(gitcmd.stderr, file=sys.stderr)
         ok = True

jduck

#!/usr/bin/env ruby
#
# PoC to show bug in ProgressBar/Zlib handling
#
# Joshua J. Drake (jduck)
#

COMPRESSED_WRONG_SIZE_URL = "http://sourceforge.net/projects/pocfiles/files/"

require 'uri'

jduck

--- src/uniq.c.orig	2013-01-30 18:46:24.000000000 -0600
+++ src/uniq.c	2015-02-23 02:30:06.000000000 -0600
@@ -66,6 +66,7 @@
 enum countmode
 {
   count_occurrences,		/* -c Print count before output lines. */
+  count_syslog, 		/* -l Print "last line repeated XX times" */
   count_none			/* Default.  Do not print counts. */
 };
 

jduck

#!/usr/bin/env ruby
#
# The goal of this script is to symlink various things into Metasploit's
# "lib" directory. Since it is first in the include path, putting symlinks
# there effectively eliminates tons of failed open(2) system calls.
#
# There are several scenarios to deal with here. Each has to be treated
# specially.
#
# 1. Gems - When using RVM, they are under some place in $GEM_HOME. They are