I was debugging a program, and discovered a line of code like so:memcpy(stack_variable, attacker_supplied, read_length_from_packet(pPacket));The read_length_from_packet returns -1 if the length is bigger than 0x1FF, but seems they forgot to actually check for -1.And since memcpy takes a size_t (unsigned), the -1 gets converted to 0xFFFFFFFF, and I can massively override the stack, so much it writes on memory it shouldn't, raises an exception, and crashes.Is there a way to make an exploit out of this, or it'll just stay in a crash?
Is there a way to exploit 4-byte integer overflows to -1? [memcpy(dest, source, -1)]
exploit