Jesus fuck, I was reading through vaguely (VERY VAGUELY) following along and it looks disgusting. You just write what you want where you want, because the check is done after the STORE (writing to memory, but then diverted to disk because the intended 4byte section of the STORE is now occupied by attacker-controlled buffer, forcing the STORE to go wherever the attacker wants)
That's how I understood it, and I don't even know if I'm right because I only barely understand it.
NosirrahSec 🏴☠️ guillotine enthusiast
npub1pc…0v4ws
2026-05-07 20:41:34 UTC
in reply to nevent1q…m83y
Author Public Key
npub1pccauxavadzwc0f34scs9p74mpwyf8rlqeth7emg4e8hpgsygzqqe0v4wsSeen on
wss://relay.momostr.pinkPublished at
2026-05-07 20:41:34 UTCEvent JSON
{
"id": "eb96cc673b26d577955f381d38f2924b44496b99bcd00fdd5bd412e85c8c044a",
"pubkey": "0e31de1baceb44ec3d31ac310287d5d85c449c7f06577f6768ae4f70a2044080",
"created_at": 1778186494,
"kind": 1,
"tags": [
[
"p",
"86b397086a130510861dd58f255fadeee1c47815185fa3bb628a06b4d6af31ac"
],
[
"e",
"df33b1c3ac14805a00a670c983df9e01c6f92a69afda6b899f2baf26d6766354",
"",
"root",
"86b397086a130510861dd58f255fadeee1c47815185fa3bb628a06b4d6af31ac"
],
[
"proxy",
"https://infosec.exchange/@NosirrahSec/116535230074436858",
"web"
],
[
"proxy",
"https://infosec.exchange/users/NosirrahSec/statuses/116535230074436858",
"activitypub"
],
[
"L",
"pink.momostr"
],
[
"l",
"pink.momostr.activitypub:https://infosec.exchange/users/NosirrahSec/statuses/116535230074436858",
"pink.momostr"
],
[
"-"
]
],
"content": "Jesus fuck, I was reading through vaguely (VERY VAGUELY) following along and it looks disgusting. You just write what you want where you want, because the check is done after the STORE (writing to memory, but then diverted to disk because the intended 4byte section of the STORE is now occupied by attacker-controlled buffer, forcing the STORE to go wherever the attacker wants)\n\nThat's how I understood it, and I don't even know if I'm right because I only barely understand it.",
"sig": "a927f55ffa169edf90dca65b2205928c55a71b88fb632ac1a224c83d8b064ad1524858b5b54f6a50b169e49c7c902a4397b0173dea69c651258c2db6964bc6e1"
}