Tag
memory-corruption
- May 15, 2025 How a Format String Becomes an Arbitrary Write The %n conversion stores a count through a pointer the caller supplies on the stack, and variadic argument handling makes that pointer reachable from the format itself. security
- Apr 27, 2024 Stack Frame Layout and Why a Linear Overflow Reaches the Return Address How the System V x86-64 frame places locals, the saved frame pointer, and the return address, and why writing past a buffer lands on control data. security