FFDshow – Overflow (SEH) Exception Leading to Null Pointer on Read
FFDshow SEH Exception leading to NULL pointer on Read Author: Matthew Bergin Website: http://berginpentesting.com/ Email: matt@berginpentesting.com Date: 09/02/10 Filename: C:\Program Files\K-Lite Codec Pack\FFDshow\ffdshow.ax Version: v1.1.3530.0 License: GNU General Public License Description Crash Instructions kernel32.7c812afb 5E POP ESI ffdshow.02659580 <- Exception E06d7363 kernel32.7c812afc C9 LEAVE kernel32.7c812afd C2 1000 RETN 10 ffdshow.0261a804 C9 LEAVE ffdshow.0261a805 C2 0800 RETN 8 ffdshow.023cc407 8b45 08 MOV EAX, DWORD PTR SS:[EBP+8] ffdshow.023cc4da 50 PUSH EAX ffdshow.026fbe9c ffdshow.023cc4db E8 70FEFFFF CALL ffdshow.023cc350 ffdshow.023cc350 55 PUSH EBP ffdshow.023cc351 8BEC MOV EBP,ESP ffdshow.023cc353 6A FF PUSH -1 ffdshow.023cc355 68 C1826402 PUSH ffdshow.026482c1 ffdshow.023cc35a 61:A1 00000000 MOV EAX, DWORD PTR FS:[0] ffdshow.023cc360 50 PUSH EAX ffdshow.023cc361 64:8925 00000000 MOV DWORD PTR FS:[0], ESP ffdshow.023CC368 83EC 1C SUB ESP,1C ffdshow.023CC36B 53 PUSH EBX ffdshow.023CC36C 33C0 XOR EAX,EAX ffdshow.023CC36E 56 PUSH ESI ffdshow.023CC36F 8945 EC MOV DWORD PTR SS:[EBP-14],EAX ffdshow.023CC372 57 PUSH EDI ffdshow.023CC373 8B7D 08 MOV EDI,DWORD PTR SS:[EBP+8] ffdshow.023CC376 8907 MOV DWORD PTR DS:[EDI],EAX ffdshow.023CC378 8965 F0 MOV DWORD PTR SS:[EBP-10],ESP ffdshow.023CC37B 8947 04 MOV DWORD PTR DS:[EDI+4],EAX ffdshow.023CC37E 8D45 E4 LEA EAX,DWORD PTR SS:[EBP-1C] ffdshow.023CC381 BB 01000000 MOV EBX,1 ffdshow.023CC386 50 PUSH EAX ffdshow.023CC387 895D EC MOV DWORD PTR SS:[EBP-14],EBX ffdshow.023CC38A 895D FC MOV DWORD PTR SS:[EBP-4],EBX ffdshow.023CC38D E8 EEFDFFFF CALL ffdshow.023CC180 ... ... ffdshow.023CC19E 33C0 XOR EAX,EAX ffdshow.023CC1A0 8965 F0 MOV DWORD PTR SS:[EBP-10],ESP ffdshow.023CC1A3 50 PUSH EAX ffdshow.023CC1A4 50 PUSH EAX ffdshow.023CC1A5 8945 EC MOV DWORD PTR SS:[EBP-14],EAX ffdshow.023CC1A8 8945 FC MOV DWORD PTR SS:[EBP-4],EAX ffdshow.023CC1AB E8 0CE62400 CALL ffdshow.0261A7BC ffdshow.023CC1B0 8B4D E8 MOV ECX,DWORD PTR SS:[EBP-18] ffdshow.023CC1B3 8B01 MOV EAX,DWORD PTR DS:[ECX] <- Access Violation when reading 00000000 NULL pointer ffdshow.023CC1B5 8B10 MOV EDX,DWORD PTR DS:[EAX] ffdshow.023CC1B7 FFD2 CALL EDX Crash Registers on Exception EAX 01d0db3c ECX 00000000 EDX 01d0dbe0 EBX 00000000 ESP 01d0db38 EBP 01d0db8c ESI 01d0dbc4 EDI 00000000 EIP 7c812afb kernel32.7c812afb Crash Registers on Violation EAX 01d0da8c ECX 00000000 EDX 01d0dbe0 EBX 00000001 ESP 01d0db24 EBP 01d0db88 ESI 02659580 ffdshow.02659580 EDI 026fbe9c ffdshow.026fbe9c EIP 023cc1b3 ffdshow.023cc1b3 Stack 01D0DBD0 |026FBE9C ffdshow.026FBE9C 01D0DBD4 |00000000 01D0DBD8 |02659580 ffdshow.02659580 01D0DBDC |00000000 01D0DBE0 |0265B7E4 ffdshow.0265B7E4 01D0DBE4 |00000000 01D0DBE8 |0265BC88 ASCII "boost::current_exception()" 01D0DBEC |0265BC58 ASCII "src\boost/exception/detail/exception_ptr.hpp" 01D0DBF0 |00000050 01D0DBF4 |0265B7D8 ffdshow.0265B7D8 01D0DBF8 |0265B544 ASCII "bad allocation" 01D0DBFC |00000000 01D0DC00 |0265B8C4 ffdshow.0265B8C4 01D0DC04 |00000000 01D0DC08 |01D0DBD4 01D0DC0C |01D0DC50 Pointer to next SEH record 01D0DC10 |026482D0 SE handler 01D0DC14 |00000000 01D0DC18 ]01D0DC6C 01D0DC1C |023CC5A4 RETURN to ffdshow.023CC5A4 from ffdshow.023CC490 01D0DC20 |026FBE9C ffdshow.026FBE9C 01D0DC24 |01D0DC30 01D0DC28 |023B0000 ffdshow.023B0000 01D0DC2C |00000000 01D0DC30 |0265B7C4 ffdshow.0265B7C4 01D0DC34 |00000000 01D0DC38 |0265BC88 ASCII "boost::current_exception()" 01D0DC3C |0265BC58 ASCII "src\boost/exception/detail/exception_ptr.hpp" 01D0DC40 |00000050 01D0DC44 |0265B7CC ffdshow.0265B7CC 01D0DC48 |0265B544 ASCII "bad allocation" 01D0DC4C |00000000 01D0DC50 |01D0DCBC Pointer to next SEH record 01D0DC54 |026482FE SE handler Reproduction Use attached PoC: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/14882.rar (FFDshowSEHExceptionleadingtoNULLpointeronRead.rar) |