Microsoft Windows – Uniscribe Heap Out-of-Bounds Read in ‘USP10!ScriptApplyLogicalWidth’ Triggered via EMF (MS17-013)
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1053 We have encountered a crash in the Windows Uniscribe user-mode library, in the USP10!ScriptApplyLogicalWidth function, while trying to display a malformed EMF file: --- (920c.9190): Access violation - code c0000005 (first chance) First chance exceptions are reported before any exception handling. This exception may be expected and handled. eax=001e6fe4 ebx=00000000 ecx=00000007 edx=00000000 esi=00000007 edi=00000007 eip=751e6f3c esp=002ef0c8 ebp=002ef0ec iopl=0 nv up ei pl zr na pe nc cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010246 USP10!ScriptApplyLogicalWidth+0x10c: 751e6f3c 8b04b8 mov eax,dword ptr [eax+edi*4] ds:002b:001e7000=???????? 0:000> kb ChildEBP RetAddr Args to Child 002ef0ec 751f4039 001e6fe4 0000008f 0000008f USP10!ScriptApplyLogicalWidth+0x10c 002ef140 751f435d 00000105 002ef170 0a6a1cbc USP10!ApplyPiDxToItem+0x89 002ef184 751e7a04 ffffffff 00000004 000000a0 USP10!ScriptStringAnalyzeGlyphs+0x20d 002ef19c 76ca5465 1d011f2d 0a6a1bd8 00001000 USP10!ScriptStringAnalyse+0x284 002ef1e8 76ca3a3d 1d011f2d 0935f000 00001000 LPK!LpkStringAnalyse+0xe5 002ef238 76ca3af2 1d011f2d 00000064 00000064 LPK!InternalTextOut+0x1cd 002ef26c 76ccda50 1d011f2d 00000064 00000064 LPK!LpkExtTextOut+0x32 002ef7d8 76ccda90 1d011f2d 00000064 00000064 GDI32!ExtTextOutInternalA+0x3aa 002ef804 76ce7fed 1d011f2d 00000064 00000064 GDI32!ExtTextOutA+0x24 002ef838 76cd50cd 1d011f2d 04ed8ff8 00000002 GDI32!MREXTTEXTOUT::bPlay+0x7f 002ef8b0 6c85fc37 1d011f2d 04ed8ff8 001e01e8 GDI32!PlayEnhMetaFileRecord+0x2c5 002ef8c8 6c860e3a 00000053 07bdbcb0 00006044 gdiplus!EmfEnumState::PlayRecord+0x3a 002ef8e0 6c83881a 00000053 00006044 001e01f0 gdiplus!EmfEnumState::ProcessRecord+0xb1 002ef8fc 6c8389e0 00000053 00000000 00006044 gdiplus!GdipPlayMetafileRecordCallback+0x6c 002ef924 76cd58a4 1d011f2d 04ed8ff8 001e01f0 gdiplus!EnumEmfDownLevel+0x6e 002ef9b0 6c83abb4 1d011f2d 403581b3 6c838972 GDI32!bInternalPlayEMF+0x6a3 002ef9e8 6c83d317 1d011f2d 924626c1 002efa74 gdiplus!MetafilePlayer::EnumerateEmfRecords+0x104 002efa90 6c83f3c1 00000000 924626c1 002efbd8 gdiplus!GpGraphics::EnumEmf+0x391 002efbf0 6c8448c9 00000000 00000001 00000001 gdiplus!GpMetafile::EnumerateForPlayback+0x5a7 002efcec 6c84494d 07bd5f28 00000000 00000000 gdiplus!GpGraphics::DrawImage+0x3f5 002efd50 6c80e03f 07bd5f28 002efd78 002efd88 gdiplus!GpGraphics::DrawImage+0x51 002efdb8 6c80e0d3 07bd1d28 438f3857 00000000 gdiplus!GdipDrawImage+0x130 002efde4 013e1747 07bd1d28 07bd5f28 00000000 gdiplus!GdipDrawImageI+0x49 [...] --- The issue reproduces on Windows 7. It is easiest to reproduce with PageHeap enabled. In order to reproduce the problem with the provided samples, it might be necessary to use a custom program which displays images using GDI+, or any existing GDI+ client (such as Microsoft Office). Attached is ane EMF file which triggers the crash. Proof of Concept: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/41658.zip |