# Python 2.7 strop.replace Integer Overflow

Integer overflow in Python 2.7 strop.replace() size calculation causes heap buffer overflow via memcpy, enabling out-of-bounds write and potential code execution.

- Payout: $500
- Severity: high
- Program: Internet Bug Bounty
- Credited: johnleitch
- Disclosed: 2016-05-02
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/129771
- Library page: https://bugbountylibrary.com/r/h1%3A129771
- Tags: domain:oss impact:rce kind:bounty platform:hackerone sev:high tech:python technique:source-review vuln:dos vuln:memory-corruption

**Target:** strop module mymemreplace() in CPython 2.7
**Root cause:** new_len = len + nfound*(sub_len - pat_len) is computed without overflow check; a wrapped small/negative value is used for PyMem_MALLOC while memcpy still copies based on original len, writing past the allocation.
**Steps:**
1. Run `import strop; strop.replace("\x75"*0xEAAA, "\x75", "AA"*0xAAAA)` under Python 2.7
2. Observe new_len arithmetic overflow in mymemreplace()
3. Debugger shows memcpy writing 'A' fill pattern past the heap allocation at 0x57096000, access violation c0000005
**How found:** Code review of stropmodule.c mymemreplace() spotted unchecked arithmetic in new_len computation, then crafted input sizes to force the overflow and confirmed under a debugger.
**Exploitation:** Attacker-controlled replace() call with large input/substitution triggers heap overflow write of attacker-chosen bytes past the allocated buffer; with heap grooming this can corrupt adjacent objects toward code execution. No full exploit chain demonstrated.
**Insight:** Deprecated-but-shipped C extension modules (strop, and similar legacy helpers) often predate Py_ssize_t overflow checks; grep for `len + n*(sub - pat)`-style size math in any C string-replace routine and test with lengths near 2^31/2^63.