<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=gb2312">
<META content="MSHTML 6.00.2900.3395" name=GENERATOR>
<STYLE>BLOCKQUOTE {
MARGIN-TOP: 0px; MARGIN-BOTTOM: 0px; MARGIN-LEFT: 2em
}
OL {
MARGIN-TOP: 0px; MARGIN-BOTTOM: 0px
}
UL {
MARGIN-TOP: 0px; MARGIN-BOTTOM: 0px
}
</STYLE>
</HEAD>
<BODY style="FONT-SIZE: 10pt; FONT-FAMILY: verdana">
<DIV><FONT face=Verdana size=2>
<DIV><FONT face=Verdana size=2>Hi, all, </FONT></DIV>
<DIV> </DIV>
<DIV>I'm not sure what the open_registry function in loader/registry.c is
used for, but a crafted "registry" file could trigger an integer
overflow and result in heap overflow.</DIV>
<DIV> </DIV>
<DIV>Look at the code snippets:</DIV>
<DIV> </DIV>
<DIV> fd = open(localregpathname,
O_RDONLY);<BR> if (fd == -1)<BR>
{<BR> printf("Creating new
registry\n");<BR>
create_registry();<BR>
return;<BR> }<BR> read(fd, ®_size,
4);<BR> regs=(struct reg_value*)malloc(reg_size*sizeof(struct
reg_value));<BR> head = 0;<BR> for(i=0;
i<reg_size; i++)<BR>
{<BR>
read(fd,®s[i].type,4);<BR></DIV>
<DIV>reg_size is read from a file. If reg_size is huge enough,
reg_size*sizeof(struct reg_value) will overflow.</DIV>
<DIV> </DIV>
<DIV>Regards.</DIV></FONT></DIV>
<DIV><FONT face=Verdana size=2></FONT> </DIV>
<DIV align=left><FONT face=Verdana color=#c0c0c0 size=2>2008-09-08
</FONT></DIV><FONT face=Verdana size=2>
<HR style="WIDTH: 122px; HEIGHT: 2px" align=left SIZE=2>
<DIV><FONT face=Verdana color=#c0c0c0 size=2><SPAN>tielei.wang</SPAN>
</FONT></DIV></FONT></BODY></HTML>