Re: Windows Heap Overflows In General

> *) Remember with heap based overflows you can write multiple sets of 4
do
> the other structure bytes control? Size does matter!

In the case overflowing the data section of one object into the vtable of another object you'll be overwriting function pointers and when one is called you can redirect program control

e.g.
call dword ptr [ecx + 14H]

It's important to remember that heap overflows isn't just about overflowing character arrays that have been malloc()ed.

Cheers,
David Litchfield
http://www.ngssoftware.com/ Received on Mon Dec 2 11:54:30 2002