# Yet another Buffer Overflow in PHP of the AirMax Products

Stack buffer overflow in Ubiquiti AirMax CGI upload parser: a multipart line over 512 bytes overflows `line[512]` in `ub_process_content`, crashing the CGI.

- Payout: hidden
- Severity: high
- Program: Ubiquiti Inc.
- Found by: rbran
- Disclosed: 2016-04-07
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/74025
- Library page: https://bugbountylibrary.com/r/h1%3A74025
- Tags: area:devices domain:iot impact:dos kind:bounty platform:hackerone sev:high tech:curl technique:source-review vuln:dos vuln:memory-corruption

**Target:** CGI upload handler (login.cgi) parsing multipart POST content
**Root cause:** `ub_process_content` copies `length = eol - ptr + 2` bytes from the POST body into a fixed 512-byte stack buffer `line` via `memcpy` without bounds checking, then writes `line[length] = 0` past the buffer.
**Steps:**
1. Send a POST to `/login.cgi` with `Content-Type: multipart/form-data` and a boundary.
2. Include a body line longer than 512 bytes before any `\r\n`.
3. `memmem` finds the CRLF, `length` exceeds 512, and `memcpy(line, ptr, length)` overflows the stack buffer.
4. CGI crashes with segmentation fault (exit code 11), indicating return-pointer overwrite.
**How found:** Author had already reported two prior overflows (#73491, #74004) in the same AirMax CGI code and continued source review of the upload parsing path, spotting the unchecked `memcpy` into `line[512]`.
**Insight:** In multipart/CGI upload parsers, the line-length computation `eol - ptr + 2` is a classic unchecked copy size; grep for fixed-size stack buffers fed by `memmem`-derived lengths in embedded firmware CGI binaries.