32768 × 32768 × 4 = 2^32
In 32-bit arithmetic: 0.
That's how the size check in discord/lilliput computes its output buffer
requirement. "0 > buffer_len" is never true, so the guard is inert — the
PNG decoder then writes 4 GiB into an 8 MiB buffer.
Trigger: a 10 KB, perfectly valid PNG.
Not RCE — the product only wraps at 2^32, so every overflow is ≥4 GiB and
hits unmapped memory immediately. No write primitive. Reliable DoS though.
Reported to Discord today. Writeup (German):
aethersec.de/heap-buffer-overflow-in-lilliput-discord
#infosec #vulnresearch #memorysafety #discord #dos #securityresearch
