aircrack-ng/aircrack-ng — pull request #13 by NickSampanis (2014-10-02 09:16:03+00:00)
Title: gps_tracker stack overflow

I found a stack overflow at gps_tracker() in airodump-ng. The function receives a string(line) from server and checks if the string "{\"class\":\"DEVICES\",\"devices\":[]}" exists, otherwise it will store the length of the string to a int variable "pos". Afterwards the function receives a string stored to the same buffer plus the "pos" variable. A stack overflow occurs because the last recv() could write 256 bytes to an arbitary position

char line[256];
int pos;
recv( gpsd_sock, line, sizeof( line ) - 1, 0 );
...
pos = strlen(line);
recv( gpsd_sock, line+pos, sizeof( line ) - 1, 0 );