# Buffer Overflow in PHP of the AirMax Products

ub_normalize_filename in AirMax uploadbuffer.c memmoves from last backslash to last forward slash, overflowing heap when backslash precedes forward slash in multipart filename.

- Payout: hidden
- Severity: medium
- Program: Ubiquiti Inc.
- Found by: rbran
- Disclosed: 2016-04-01
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/73491
- Library page: https://bugbountylibrary.com/r/h1%3A73491
- Tags: area:devices domain:iot impact:dos kind:bounty platform:hackerone sev:medium tech:php technique:source-review vuln:memory-corruption vuln:path-traversal

**Target:** HTTP multipart upload filename parser (uploadbuffer.c)
**Root cause:** The code assumes the last backslash always precedes the last forward slash; when a forward slash comes after a backslash, memmove copies size-(back_slash-filename) bytes to fwd_slash+1, writing past the string end.
**Steps:**
1. Locate ub_normalize_filename in uploadbuffer.c (patch 430-smart-post-upload.patch, SDK.UBNT.v5.5).
2. Send HTTP POST with multipart filename value `"\asdfasdfasdfasdfsdfgdsfg/a"`.
3. Parser sets back_slash at index 0 and fwd_slash near end; memmove copies the tail past the buffer end, overflowing heap.
**How found:** Code review of the filename normalization patch; noticed the memmove length is computed from back_slash offset regardless of fwd_slash position, then crafted a filename with backslash before forward slash to test the assumption.
**Insight:** When auditing path-normalization helpers, check whether the code assumes ordering between two searched delimiters (last '/' vs last '\\'); a filename with reversed delimiter order breaks the length calculation and turns memmove into an overflow.