# Format string implementation vulnerability, resulting in code execution

Integer overflow in Perl's sprintf precision/width handling overflows the buffer, corrupting a function pointer for potential code execution.

- Payout: hidden
- Severity: medium
- Program: Internet Bug Bounty
- Found by: aerodudrizzt
- Disclosed: 2019-10-13
- Write-up quality: 8/10
- Original: https://hackerone.com/reports/271330
- Library page: https://bugbountylibrary.com/r/h1%3A271330
- Tags: area:oss domain:oss impact:rce kind:bounty platform:hackerone sev:medium tech:linux technique:source-review vuln:memory-corruption vuln:rce

**Target:** Perl interpreter sprintf (Perl_sv_vcatpvfn_flags in sv.c)
**Root cause:** Large precision/width size_t values cause integer overflows when computing 'need' allocation size; later width-based space padding assumes sufficient buffer space and overflows it.
**Steps:**
1. Craft format with large precision and width, e.g. `%2000.2000f` then `%4000.4294967245a`
2. Run `print sprintf("%2000.2000f this is a spacer %4000.4294967245a", 1, 0x0.00008234p+9);`
3. First %f enlarges buffer; second format's width overflows it, corrupting adjacent memory (eax becomes 0x20202020)
4. Crash occurs when Perl_runops_standard dereferences the corrupted pointer
**How found:** Security audit of sprintf implementation in Perl 5.24.1; reading Perl_sv_vcatpvfn_flags in sv.c, noticed 'need' computed from precision/width size_t values could integer-overflow, then width padding assumed buffer space.
**Exploitation:** A hostile format string passed to sprintf overflows the heap buffer; the corrupted pointer (eax filled with 0x20 spaces) is later dereferenced/executed in Perl_runops_standard, giving a path to code execution on the interpreter.
**Escalation:** Chaining a benign large-precision %f to grow the buffer with a second width-controlled overflow to corrupt a function pointer.
**Insight:** In memory-managed interpreters, audit C-level format/printf internals: size_t precision/width arithmetic can integer-overflow allocation sizing even though the language is 'safe'.