BugTraq
VideoLAN VLC Media Player <= 2.0.4 Crash Bug Nov 05 2012 08:54AM
bingxuefenggu 126 com
poc:

This crash will be triggered by a special file name.

we can rename the normal file name to make sure that the length of absolute path is a odd number.Then we add the file to the vlc player, it will crash.

Reason:

When this program call the function SHAddToRecentDocs without a unicode parameter,it will crash.

This is because it will bypass the '\x00' at the end of string during the calculations of the string's length using the 'lstrlenw'.

The windbg result:
(we can see the file path in the memory is not the unicode)
#(1100.158c): Access violation ? code c0000005 (first chance)
#First chance exceptions are reported before any exception handling.
#This exception may be expected and handled.
#eax=17339000 ebx=0a1abb1c ecx=1733d000 edx=17338fe2 esi=00000000 edi=00000000
#eip=754f7240 esp=0a1abab8 ebp=0a1abae0 iopl=0 nv up ei ng nz na pe nc
#cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00210286
#KERNELBASE!lstrlenW+0x1a:
#754f7240 668b08 mov cx,word ptr [eax] ds:0023:17339000=????
#0:002> dc eax-40
#17338fc0 abcdbbbb 017f1000 0000001f 00001000 ?????.
#17338fd0 00000000 00000000 004755c4 dcbabbbb ???UG?..
#17338fe0 555c3a43 73726573 6573755c 65445c72 C:UsersuserDe
#17338ff0 6f746b73 31315c70 6e702e31 d0000067 sktop111.png?
#17339000 ???????? ???????? ???????? ???????? ????????????????
#17339010 ???????? ???????? ???????? ???????? ????????????????
#17339020 ???????? ???????? ???????? ???????? ????????????????
#17339030 ???????? ???????? ???????? ???????? ????????????????
#0:002> kb
#ChildEBP RetAddr Args to Child
#0a1abae0 7692ae5d 17338fe0 00000000 00000000 KERNELBASE!lstrlenW+0x1a
#0a1abaf8 75c41a88 17338fe0 0a1abb1c 00000000 SHLWAPI!SHStrDupW+0×24
#0a1abb30 75cd6bbd 17338fe0 191c8fc8 0a1abba8 SHELL32!SHParseDisplayName+0×39
#0a1abb78 75cd6b32 17338fe0 0a1abba8 191a9fc0 SHELL32!ParseRecentDoc+0×58
#*** ERROR: Symbol file could not be found. Defaulted to export symbols for C:Program FilesVideoLANVLCpluginsguilibqt4_plugin.dll -
#0a1acbf8 65f44c93 00000003 17338fe0 6687ce2c SHELL32!SHAddToRecentDocs+0xb5
------------------------------------------------------------------------
------

[ reply ]


 

Privacy Statement
Copyright 2010, SecurityFocus