扫码分享
验证：
体验盒子|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 |
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1205 We have encountered a crash in the Windows Uniscribe user-mode library, in the USP10!otlReverseChainingLookup::apply function, while trying to display text using a corrupted TTF font file: --- (678.6c8): Access violation - code c0000005 (first chance) First chance exceptions are reported before any exception handling. This exception may be expected and handled. eax=0360c018 ebx=0000ffff ecx=035acffa edx=00000012 esi=0012efa8 edi=0000ffff eip=7750786b esp=0012e9fc ebp=0012ea38 iopl=0 nv up ei pl nz na pe nc cs=001bss=0023ds=0023es=0023fs=003bgs=0000 efl=00010206 USP10!otlReverseChainingLookup::apply+0xbb: 7750786b 0fb700movzx eax,word ptr [eax] ds:0023:0360c018=???? 0:000> kb # ChildEBP RetAddrArgs to Child 00 0012ea38 77501533 0012ef8c 0012efa8 0012eebc USP10!otlReverseChainingLookup::apply+0xbb 01 0012eaa0 77508c6f 00000000 0012ef8c 00000022 USP10!ApplyLookup+0x2b3 02 0012eb24 77508531 0012eb90 42555347 0012ef8c USP10!applyContextLookups+0x21f 03 0012ebf8 77501508 42555347 0012ef8c 015acc64 USP10!otlChainingLookup::apply+0x701 04 0012ec78 775039f1 00000000 0012ef8c 00000040 USP10!ApplyLookup+0x288 05 0012ee7c 774fefcf 42555347 0012efb8 0012ef8c USP10!ApplyFeatures+0x481 06 0012eec8 774fb203 00000000 035aeffa 035aef70 USP10!SubstituteOtlGlyphs+0x1bf 07 0012eef4 774f6edc 0012ef24 0012ef9c 0012efb8 USP10!ShapingLibraryInternal::SubstituteOtlGlyphsWithLanguageFallback+0x23 08 0012f160 774e55da 0012f26c 0012f298 0012f280 USP10!GenericEngineGetGlyphs+0xa1c 09 0012f220 774e273f 0012f26c 0012f298 0012f280 USP10!ShapingGetGlyphs+0x36a 0a 0012f308 774b5c6f a801011c 03586124 03586318 USP10!ShlShape+0x2ef 0b 0012f34c 774c174a a801011c 03586124 03586318 USP10!ScriptShape+0x15f 0c 0012f3ac 774c2bd4 00000000 00000000 0012f42c USP10!RenderItemNoFallback+0xfa 0d 0012f3d8 774c2e62 00000000 00000000 0012f42c USP10!RenderItemWithFallback+0x104 0e 0012f3fc 774c43f9 00000000 0012f42c 03586124 USP10!RenderItem+0x22 0f 0012f440 774b7a04 000004a0 00000400 a801011c USP10!ScriptStringAnalyzeGlyphs+0x1e9 10 0012f458 760a1736 a801011c 03586040 0000000a USP10!ScriptStringAnalyse+0x284 11 0012f4a4 760a18c1 a801011c 0012f928 0000000a LPK!LpkStringAnalyse+0xe5 12 0012f5a0 760a17b4 a801011c 00000000 00000000 LPK!LpkCharsetDraw+0x332 13 0012f5d4 77df56a9 a801011c 00000000 00000000 LPK!LpkDrawTextEx+0x40 14 0012f614 77df5a64 a801011c 00000000 00000000 USER32!DT_DrawStr+0x13c 15 0012f660 77df580f a801011c 0012f928 0012f93c USER32!DT_GetLineBreak+0x78 16 0012f70c 77df5882 a801011c 00000000 0000000a USER32!DrawTextExWorker+0x250 17 0012f730 77df5b68 a801011c 0012f928 ffffffff USER32!DrawTextExW+0x1e [...] --- The issue reproduces on Windows 7, and could be potentially used to disclose sensitive data from the process heap. It is easiest to reproduce with PageHeap enabled, but it is also possible to observe a crash in a default system configuration. In order to reproduce the problem with the provided samples, it might be necessary to use a custom program which displays all of the font's glyphs at various point sizes. Attached are 2 proof of concept malformed font files which trigger the crash. Proof of Concept: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/42241.zip |
体验盒子
