Bugtraq mailing list archives
Re: [funsec] Technical Paper on the ZERT Patch and VML [was: Re: ZERT patch for setSlice()]
From: Alexander Sotirov <asotirov () determina com>
Date: Wed, 04 Oct 2006 11:39:57 -0700
Gadi Evron wrote:
Our (ZERT's) VML patch was what you refer to as "real". There was space issue with not enough bytes to play with, so Gil Dabah, one of our members, re-wrote the vulnerable function in Yasm, compiled it, and hard-coded the compiled code into the binary, with room to spare, saving functionality. Code crunching is back in style. :)
Rewriting the entire function in asm is a lot of unnecessary effort. Why didn't you add a simple length check and a 5-byte jump to it in the vulnerable function? Patch right before the call to _IE5_SHADETYPE_TEXT::TOKENS::Ptok, check the length of the string, and you're done. Or you can patch the copy loop and count the characters there. It's easier and safer than rewriting the function. Alex
Current thread:
- Technical Paper on the ZERT Patch and VML [was: Re: ZERT patch for setSlice()] Gadi Evron (Oct 04)
- Re: [funsec] Technical Paper on the ZERT Patch and VML [was: Re: ZERT patch for setSlice()] Alexander Sotirov (Oct 04)