On Fri, 09 Mar 2007 16:33:58 EST, "M. Shirk" said: > 0x8040 through 0x9D40 Crash > > But 0x9E40 does not crash (72x40512) :-) Shooting in the dark here - I wonder if that's being treated as a signed number and thus negative, and from 0x8040 to 0x9D40 lands it on something that's immediately critical and causes a crash, but 0x9E40 lands on some memory that isn't used very soon, thus avoiding an immediate crash but producing destabilizing results down the road, like your bookmarks evaporating, or strange infinite loops, or any of the other usual symptoms of random fandango-on-core memory overlays.... One has to wonder if any offset happens to land on something that eventually leads to a remote-code-execute.
Attachment:
pgpYJ71Ghbj0X.pgp
Description: PGP signature
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/