search

jnz / q3vm

Q3VM - Single file (vm.c) bytecode virtual machine/interpreter for C-language input
GNU General Public License v2.0
830 stars 57 forks source link

opStack is not zero-initialized which leads to the memory disclosure #38

Open rivit98 opened 1 month ago

rivit98 commented 1 month ago

Hello, during my research on this project, I noticed that opStack variable is not zero-initialized (https://github.com/jnz/q3vm/blob/master/src/vm/vm.c#L873). This can lead to the memory disclosure issue. Ideally, opStack should be zeroed on function entry.

Please see PoC and more details here: https://github.com/TeamAustria/writeups/blob/main/2024-justctf/q3vm.md https://enzo.run/posts/justctf2024/