1

One of the recent blogs in Project Zero described a bug in the Symantec virus scanner in relation with PowerPoint files.

But I do not understand how the rounding up to the length of the cache can result in a buffer overflow. My data is still well contained within the cache, even if the size is incorrectly rounded up. Thus, how do I get an buffer overflow, if the cache is still bigger than the input data?

1

If the cache length lets say is 10.1kb well then the memory block will look something like this (Lets say the whole block is 30kb [Notice the middle block is our PP cache]):

|~~~~~9.95kb~~~~~|~~~~~~10.1kb~~~~~|~~~~~~9.95kb~~~~~~|

Now lets use the exploit, our data will look like this (Notice we just ran over 9kb of the next segment!):

|~~~~~9.95kb~~~~~|~~~~~~10.1kb~~~~~|~~|~~~~9.95kb~~~~~~|

This just ran over the next block causing us to inject data the data segment that is not part of the PP cache which is a buffer overflow.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.