Heap-Buffer-Überlauf im Discord-Backend

32768 × 32768 × 4 = 2^32 In 32-bit arithmetic: 0. That's how the size check in discord/lilliput computes its output buffer requirement. "0 > buffer_len" is never true, so the guard is inert — the PNG decoder then writes 4 GiB into an 8 MiB buffer. Trigger: a 10 KB, perfectly valid PNG. Not RCE — the product only wraps at 2^32, so every overflow... Weiterlesen