An issue was discovered in map.c in FreedroidRPG 1.0rc2. It assumes lengths of data sets read from saved game files. It copies data from a file into a fixed-size heap-allocated buffer without size verification, leading to a heap-based buffer overflow.
The product writes data past the end, or before the beginning, of the intended buffer.
| Link | Tags |
|---|---|
| https://bugs.freedroid.org/b/issue951 | issue tracking exploit vendor advisory |
| https://logicaltrust.net/blog/2020/02/freedroid.html | third party advisory exploit |