Spooky C++

12 points by raymii

aw1621107

My guess as to how the bug works:

  1. Construct a temporary std::string from "foobarbazbug". This is 12 characters so it can be stored inline, on the stack

  2. Pass a pointer to the temporary to Sanitize

  3. Sanitize constructs a std::string_view pointing to the temporary's data on the stack. This is returned.

  4. The temporary is destroyed

  5. Construct admin_id from "root_1231231" in the newly-vacated stack space formerly occupied by the temporary. This string data is also short enough for SSO to apply so it basically replaces "foobarbazbug" on the stack.

  6. Execute username == admin_id. Since username is basically a pointer to the memory now occupied by admin_id this comparison is effectively admin_id == admin_id, which is trivially true.