How does the recent discovered PowerPoint exploit work?

Question

One of the recent blogs in Project Zero described a bug in the Symantec virus scanner in relation with PowerPoint files.

But I do not understand how the rounding up to the length of the cache can result in a buffer overflow. My data is still well contained within the cache, even if the size is incorrectly rounded up. Thus, how do I get an buffer overflow, if the cache is still bigger than the input data?

Answer 1

If the cache length lets say is 10.1kb well then the memory block will look something like this (Lets say the whole block is 30kb [Notice the middle block is our PP cache]):

|~~~~~9.95kb~~~~~|~~~~~~10.1kb~~~~~|~~~~~~9.95kb~~~~~~|

Now lets use the exploit, our data will look like this (Notice we just ran over 9kb of the next segment!):

|~~~~~9.95kb~~~~~|~~~~~~10.1kb~~~~~|~~|~~~~9.95kb~~~~~~|

This just ran over the next block causing us to inject data the data segment that is not part of the PP cache which is a buffer overflow.