【OOB】MSHTML!CPaste­Command::Convert­Bitmapto­Png heap-based buffer overflow学习

IE 11 MSHTML!CPaste­Command::Convert­Bitmapto­Png heap-based buffer overflow学习

MS14-056, CVE-2014-4138

Time-line

8 May 2014: This vulnerability was submitted to ZDI.
9 June 2014: This vulnerability was acquired by ZDI.
23 June 2014: This vulnerability was disclosed to Microsoft by ZDI.
14 October 2014: This vulnerability was address by Microsoft in MS14-056.
21 December 2016: Details of this vulnerability are released.

越界访问漏洞

版本：Microsoft Internet Explorer 11.0.9600.16521

概述

图片被粘贴到IE11中，会把BMP格式转换成PNG格式，MSHTML!CPaste­Command::Convert­Bitmapto­Png函数执行这个操作。

这个函数使用BMP图片的大小来储存转换好的PNG图片，如果转换后的PNG大于BMP则会发生溢出

CPaste­Command::Convert­Bitmapto­Png 伪代码

  函数原型
    Convert­Bitmapto­Png(
      [IN] VOID* po­Bitmap,
      UINT u­Bitmap­Size,
      [OUT] VOID** ppo­Png­Image,
      UINT* pu­Png­Image­Size
    ) 

    {
      // BMP到PNG的转换
      CMem­Stm* po­CMem­Stm;
      IWICStream* po­Wic­Bitmap;
      STATSTG o­Stat­Stg;
      TSmart­Array<unsigned char> po­Png­Image;
      UINT u­Read­Size;
      // Create a CMem­Stm for the PNG image.
      Create­Stream­On­HGlobal(NULL, True, po­CMem­Stm);
      // Create an IWICStream from the BMP image.
      Initialize­From­Memory(po­Bit­Map, u­Bitmap­Size,
          &GUID_­Container­Format­Bmp, &po­Wic­Bitmap)));
      // Write BMP image in IWICStream to PNG image in CMem­Stm
      Write­Wic­Bitmap­To­Stream(po­Wic­Bitmap, &GUID_­Container­Format­Png, po­CMem­Stm);
      // Get size of PNG image in CMem­Stm and save it to the output variable.
      o­CMem­Stm->Stat(&o­Stat­Stg, 0);
      *pu­Png­Image­Size = o­Stat­Stg.cb­Size.Low­Part;
      // Allocate memory for the PNG
      //这一句产生问题，使用了BMP的大小给PNG分配内存
      po­Png­Image->New(u­Bitmap­Size);
      // Go to start of PNG image in CMem­Stm
      po­CMem­Stm->Seek(0, STREAM_­SEEK_­SET, NULL, &p­Position­Low);
      // Read PNG image in CMem­Stm to allocated memory.
      //这一句读入PNG的内容，导致溢出
      po­CMem­Stm->Read(po­Png­Image, *pu­Png­Image­Size, &u­Read­Size);
      // Save location of allocated memory with PNG image to output variable.
      *ppo­Png­Image = po­Png­Image;
    }

POC

只有用js实现图片复制的脚本，图片本身需要另外生成

这个洞因为没有完整的POC所以我没有调，但是其实作者在概述里已经说的很清楚了，这个洞的成因比较有意思放在这里开阔一下思路。