Microsoft Windows – Uniscribe Heap Out-of-Bounds Read in ‘USP10!ScriptApplyLogicalWidth’ Triggered via EMF (MS17-013)

  • 作者： Google Security Research
    日期： 2017-03-20
  • 类别：
    平台：
  • 来源：https://www.exploit-db.com/exploits/41658/
  • Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1053

We have encountered a crash in the Windows Uniscribe user-mode library, in the USP10!ScriptApplyLogicalWidth function, while trying to display a malformed EMF file:

---
(920c.9190): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=001e6fe4 ebx=00000000 ecx=00000007 edx=00000000 esi=00000007 edi=00000007
eip=751e6f3c esp=002ef0c8 ebp=002ef0ec iopl=0 nv up ei pl zr na pe nc
cs=0023ss=002bds=002bes=002bfs=0053gs=002b efl=00010246
USP10!ScriptApplyLogicalWidth+0x10c:
751e6f3c 8b04b8mov eax,dword ptr [eax+edi*4] ds:002b:001e7000=????????
0:000> kb
ChildEBP RetAddrArgs to Child
002ef0ec 751f4039 001e6fe4 0000008f 0000008f USP10!ScriptApplyLogicalWidth+0x10c
002ef140 751f435d 00000105 002ef170 0a6a1cbc USP10!ApplyPiDxToItem+0x89
002ef184 751e7a04 ffffffff 00000004 000000a0 USP10!ScriptStringAnalyzeGlyphs+0x20d
002ef19c 76ca5465 1d011f2d 0a6a1bd8 00001000 USP10!ScriptStringAnalyse+0x284
002ef1e8 76ca3a3d 1d011f2d 0935f000 00001000 LPK!LpkStringAnalyse+0xe5
002ef238 76ca3af2 1d011f2d 00000064 00000064 LPK!InternalTextOut+0x1cd
002ef26c 76ccda50 1d011f2d 00000064 00000064 LPK!LpkExtTextOut+0x32
002ef7d8 76ccda90 1d011f2d 00000064 00000064 GDI32!ExtTextOutInternalA+0x3aa
002ef804 76ce7fed 1d011f2d 00000064 00000064 GDI32!ExtTextOutA+0x24
002ef838 76cd50cd 1d011f2d 04ed8ff8 00000002 GDI32!MREXTTEXTOUT::bPlay+0x7f
002ef8b0 6c85fc37 1d011f2d 04ed8ff8 001e01e8 GDI32!PlayEnhMetaFileRecord+0x2c5
002ef8c8 6c860e3a 00000053 07bdbcb0 00006044 gdiplus!EmfEnumState::PlayRecord+0x3a
002ef8e0 6c83881a 00000053 00006044 001e01f0 gdiplus!EmfEnumState::ProcessRecord+0xb1
002ef8fc 6c8389e0 00000053 00000000 00006044 gdiplus!GdipPlayMetafileRecordCallback+0x6c
002ef924 76cd58a4 1d011f2d 04ed8ff8 001e01f0 gdiplus!EnumEmfDownLevel+0x6e
002ef9b0 6c83abb4 1d011f2d 403581b3 6c838972 GDI32!bInternalPlayEMF+0x6a3
002ef9e8 6c83d317 1d011f2d 924626c1 002efa74 gdiplus!MetafilePlayer::EnumerateEmfRecords+0x104
002efa90 6c83f3c1 00000000 924626c1 002efbd8 gdiplus!GpGraphics::EnumEmf+0x391
002efbf0 6c8448c9 00000000 00000001 00000001 gdiplus!GpMetafile::EnumerateForPlayback+0x5a7
002efcec 6c84494d 07bd5f28 00000000 00000000 gdiplus!GpGraphics::DrawImage+0x3f5
002efd50 6c80e03f 07bd5f28 002efd78 002efd88 gdiplus!GpGraphics::DrawImage+0x51
002efdb8 6c80e0d3 07bd1d28 438f3857 00000000 gdiplus!GdipDrawImage+0x130
002efde4 013e1747 07bd1d28 07bd5f28 00000000 gdiplus!GdipDrawImageI+0x49
[...]
---

The issue reproduces on Windows 7. It is easiest to reproduce with PageHeap enabled. In order to reproduce the problem with the provided samples, it might be necessary to use a custom program which displays images using GDI+, or any existing GDI+ client (such as Microsoft Office).

Attached is ane EMF file which triggers the crash.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/41658.zip