Re: partial analysis of vulndev-1.c

• Original Message -----
  > From: "David R. Piegdon" <fleshyCPU@gmx.net>
  > [...]
  

Just because Linux may allocate the memory on the heap doesn't mean it can't be overflowed. This is a comon misconception that bites a lot of us. (Chances are you already know this)

You could muck with it and trick the free into overwriting arbitrary memory locations with exploit data. There is a pretty good paper on this over at: http://www.w00w00.org/files/articles/heaptut.txt. Although heap overflows are much harder to predict and architect, it is still quite possible. I wouldn't count on the fact Linux uses the heap as a saving grace against an attack like this.

---
Regards,
Dana M. Epp