[36840] in bugtraq
Re: EEYE: RealPlayer pnen3260.dll Heap Overflow
daemon@ATHENA.MIT.EDU (Chenghuai Lu)
Tue Oct 5 14:17:14 2004
Message-ID: <20041005145452.83542.qmail@web53705.mail.yahoo.com>
Date: Tue, 5 Oct 2004 07:54:52 -0700 (PDT)
From: Chenghuai Lu <luchenghuai@yahoo.com>
To: BUGTRAQ@securityfocus.com, Marc Maiffret <mmaiffret@eEye.com>
In-Reply-To: <098A9BA9A97D474FAD883D2A0560B7CC1ECB70@owa.eeye.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Hi Marc and all,
I have a question here.
> The code in pnen3260.dll among other things is
> responsible for handling
> .rm files. The vulnerability is triggered by setting
> the length field of
> the VIDORV30 data chunk to 0xFFFFFFF8 - 0xFFFFFFFF
> this will cause an
> integer overflow which leads to a small block of
> memory being allocated,
> we call this movie from a SMIL file to handle the
> initial exception,
> eventually overflowing the buffer.
I check the Real Media file format at:
http://home.pcisys.net/~melanson/codecs/rmff.htm
According to what I understand, a data chunk has a
4-byte object_id as "DATA". This makes me a little
confused. What does a VIDORV30 data chunk mean? How do
I differentiate a general data chunk from a VIDORV30
data chunk?
Thank you in advance for any advice.
__________________________________
Do you Yahoo!?
Y! Messenger - Communicate in real time. Download now.
http://messenger.yahoo.com
