One of the recent blogs in Project Zero described a bug in the Symantec virus scanner in relation with PowerPoint files.

But I do not understand how the rounding up to the length of the cache can result in a buffer overflow. My data is still well contained within the cache, even if the size is incorrectly rounded up. Thus, how do I get an buffer overflow, if the cache is still bigger than the input data?

1 Answer 1


If the cache length lets say is 10.1kb well then the memory block will look something like this (Lets say the whole block is 30kb [Notice the middle block is our PP cache]):


Now lets use the exploit, our data will look like this (Notice we just ran over 9kb of the next segment!):


This just ran over the next block causing us to inject data the data segment that is not part of the PP cache which is a buffer overflow.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .