# CVE-2016-0799 memory issues in BIO_*printf functions

Integer overflow in OpenSSL BIO_*printf fmtstr length calc and doapr_outch allocation failure causes OOB read/write when printing very long untrusted strings.

- Payout: hidden
- Severity: low
- Program: Internet Bug Bounty
- Found by: guido
- Disclosed: 2016-03-27
- CVE: CVE-2016-0799
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/118855
- Library page: https://bugbountylibrary.com/r/h1%3A118855
- Tags: area:oss domain:oss impact:dos impact:integrity kind:bounty platform:hackerone sev:low tech:linux vuln:dos vuln:memory-corruption

**Target:** BIO_*printf functions (fmtstr, doapr_outch) in libcrypto
**Root cause:** fmtstr overflows while computing string length for '%s', causing OOB read; doapr_outch writes to an OOB location near NULL on allocation failure when buffer size exceeds INT_MAX.
**Steps:**
1. Pass a very long untrusted string as a '%s' argument to a BIO_*printf function (e.g. via ASN.1 human-readable dump printing).
2. fmtstr length calculation overflows, producing an OOB read while printing.
3. Trigger allocation failure with buffer size > INT_MAX to reach doapr_outch OOB write near NULL.
**Exploitation:** Requires an application passing large amounts of untrusted data to BIO_*printf, such as printing ASN.1 dumps of untrusted data or CLI args; libssl remote connections unlikely due to message size limits.
**Insight:** Audit length arithmetic in printf-style helpers handling '%s' with attacker-controlled sizes; integer overflow in size calc can mask a second OOB write on allocation failure.