Closed Fusl closed 6 months ago
Ah i think i found the source of the bug. In memdupdec we update all null bytes in the right side of a query to be replaced with REPLACE_NULL_BYTE
but this never is performed on the left side for some reason. I'll see if this quick patch also fixes the other issues you opened - though I don't suspect it will.
Thanks for digging into this!
trurl seems to improperly handle strings with null characters in query string when trying to urldecode in
memdupdec
, causing an out of bounds write to the adjacent memory region right of the allocated memory region:This bug was discovered with the help of AFL++ in combination with ASan.