Vulnerability title: Invalid Handling of Length Parameter in Stratum mining.notify Message Leads to Heap Overflow CVE: CVE-2014-4502 Affected version: SGMiner before 4.2.2, CGMiner before 4.3.5, BFGMiner before 4.1.0 Reported by: Mick Ayzenberg of Deja vu Security Details: A pool responds to a "mining.subscribe" Stratum request with a list of parameters the application will use when mining. Two of these parameters are "Extranonce1", a hex-encoded string, and "Extranonce2_size", the length of a nonce the miner can increment. A malicious pool or an attacker who is in middle of a valid Stratum connection can respond to a "mining.subscribe" request from a client with arbitrary Extranonce1 and Extranonce2_size parameters. An attacker can then send a valid "mining.notify" request to initiate mining. The "mining.notify" message specifies parameters "coinb1" and "coinb2", hex encoded strings of arbitrary length. Cgminer, Sgminer, and Bfgminer will use the values provided to calculate memory requirements for a valid block and copy parameters into this allocated space. By setting the value of "Extranonc2_size" to be negative or large, an attacker can force the "parse_notify" function to allocate less memory than expected and overwrite memory in the heap.