{"action":"created","issue":{"url":"https://api.github.com/repos/ret2libc/ctfs/issues/1","repository_url":"https://api.github.com/repos/ret2libc/ctfs","labels_url":"https://api.github.com/repos/ret2libc/ctfs/issues/1/labels{/name}","comments_url":"https://api.github.com/repos/ret2libc/ctfs/issues/1/comments","events_url":"https://api.github.com/repos/ret2libc/ctfs/issues/1/events","html_url":"https://github.com/ret2libc/ctfs/issues/1","id":178259577,"number":1,"title":"Why it has to use function send() instead of sendline() in  CSAW 2016 hungman?","user":{"login":"Arvin-X","id":12729836,"avatar_url":"https://avatars.githubusercontent.com/u/12729836?v=3","gravatar_id":"","url":"https://api.github.com/users/Arvin-X","html_url":"https://github.com/Arvin-X","followers_url":"https://api.github.com/users/Arvin-X/followers","following_url":"https://api.github.com/users/Arvin-X/following{/other_user}","gists_url":"https://api.github.com/users/Arvin-X/gists{/gist_id}","starred_url":"https://api.github.com/users/Arvin-X/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Arvin-X/subscriptions","organizations_url":"https://api.github.com/users/Arvin-X/orgs","repos_url":"https://api.github.com/users/Arvin-X/repos","events_url":"https://api.github.com/users/Arvin-X/events{/privacy}","received_events_url":"https://api.github.com/users/Arvin-X/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2016-09-21T06:38:05Z","updated_at":"2016-09-24T04:45:10Z","closed_at":"2016-09-24T04:45:10Z","body":"I am confused with the use of function \"send\" in csaw2016 hungman, line 81, because if I use sendline() here instead of send(), the program will exit with code -11 before I can receive next \"Continue? \".  In my view, the use of send() and sendline() should have the same result in the next code segment decompiled by IDA so I am very confused:\r\n\r\n```\r\n        namep = malloc(0xF8uLL);\r\n        memset(namep, 0, 0xF8uLL);\r\n        new_name_len = read(0, namep, 0xF8uLL);\r\n        objp->name_len = new_name_len;\r\n        v14 = strchr((const char *)namep, 10);\r\n        if ( v14 )\r\n          *v14 = 0;\r\n        memcpy((void *)objp->namep, namep, new_name_len);// ---- overflow  \r\n        free(namep);\r\n```\r\n\r\nThanks for any help!"},"comment":{"url":"https://api.github.com/repos/ret2libc/ctfs/issues/comments/249345021","html_url":"https://github.com/ret2libc/ctfs/issues/1#issuecomment-249345021","issue_url":"https://api.github.com/repos/ret2libc/ctfs/issues/1","id":249345021,"user":{"login":"Arvin-X","id":12729836,"avatar_url":"https://avatars.githubusercontent.com/u/12729836?v=3","gravatar_id":"","url":"https://api.github.com/users/Arvin-X","html_url":"https://github.com/Arvin-X","followers_url":"https://api.github.com/users/Arvin-X/followers","following_url":"https://api.github.com/users/Arvin-X/following{/other_user}","gists_url":"https://api.github.com/users/Arvin-X/gists{/gist_id}","starred_url":"https://api.github.com/users/Arvin-X/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Arvin-X/subscriptions","organizations_url":"https://api.github.com/users/Arvin-X/orgs","repos_url":"https://api.github.com/users/Arvin-X/repos","events_url":"https://api.github.com/users/Arvin-X/events{/privacy}","received_events_url":"https://api.github.com/users/Arvin-X/received_events","type":"User","site_admin":false},"created_at":"2016-09-24T04:45:10Z","updated_at":"2016-09-24T04:45:10Z","body":"Oh...finally I find what's wrong with sendline()...The point is that strchr@got.plt is followed by printf@got.plt so that using sendline() will make new_name_len=9 and this will result in printf@got.plt being crashed. :)"}}
{"actor":{"display_login":"Arvin-X"}}