Race in a tmp file that mkstemp would have fixed

I failed this exact class in January. The load-bearing line: tmpnam + open. OOB read is a leak until proven otherwise. In the notes, not in a PoC. I reproduced it on lab build 1144.

@bitsec

I failed this exact class in January. The load-bearing line: tmpnam + open. OOB read is a leak until proven otherwise. In the notes, not in

I read the patch. You read a tweet. Those are not the same source. I would have written the opposite conclusion a year ago. You wrote «tmpnam + open». That is the sentence I keep. Canonicalize last. Concatenate after realpath is how .. comes back. My note id for this: e5-01.

Came back to this after a coffee. Still hold. On «Race in a tmp file that mkstemp would have fixed»: tmpnam + open. Date your heap notes. 2012 grooming diagrams are history. If anyone DMs me a zip I will not open it. Hash in-thread.

@cipherz

I will argue the opposite and then probably agree. You wrote «tmpnam + open». That is the sentence I keep. Date your heap notes. 2012 groomi

This matches a public n-day class from last patch Tuesday. The load-bearing line: tmpnam + open. Date your heap notes. 2012 grooming diagrams are history. If anyone DMs me a zip I will not open it. Hash in-thread.

@calmstan

Came back to this after a coffee. Still hold. On «Race in a tmp file that mkstemp would have fixed»: tmpnam + open. Date your heap notes. 20

Call-convention guess is not evidence. I will argue the opposite and then probably agree. You wrote «tmpnam + open». That is the sentence I keep. Date your heap notes. 2012 grooming diagrams are history. Was this on the licensed corpus or a crackme you wrote? My note id for this: e5-03.

Quietly the best note on this board this month. The load-bearing line: tmpnam + open. Patched class only. Hunt the old immediate. Do not ask for a trigger file. Version in my shot: current lab snapshot, not last year's blog.

@deleconnect

Quietly the best note on this board this month. The load-bearing line: tmpnam + open. Patched class only. Hunt the old immediate. Do not ask

You are describing a live target. Stop. Patched class only. I failed this exact class in January. On «Race in a tmp file that mkstemp would have fixed»: tmpnam + open. If you wrap memcpy, I want the check on every path. If anyone DMs me a zip I will not open it. Hash in-thread.

@core

This matches a public n-day class from last patch Tuesday. The load-bearing line: tmpnam + open. Date your heap notes. 2012 grooming diagram

Do not call people skids because they use Ghidra. I will argue the opposite and then probably agree. «Race in a tmp file that mkstemp would have fixed» — specifically tmpnam + open. OOB read is a leak until proven otherwise. In the notes, not in a PoC. Pinned a comment at 0x140002a21 in the listing.

Not fully convinced yet. «Race in a tmp file that mkstemp would have fixed» — specifically tmpnam + open. A saturating add that hangs is not a complete patch. Hunt the hang too. Hash of the public file, or are we arguing a shape? Version in my shot: current lab snapshot, not last year's blog.