Haojie's large-eye processing of TGA file format Buffer Overflow Vulnerability (EIP controllable)

Haojie's large-eye processing of TGA file format Buffer Overflow Vulnerability (EIP controllable)
Software Introduction: http://baike.baidu.com/view/222352.html

:
Http://www.onlinedown.net/soft/2704.htm
Http://dl.pconline.com.cn/html_2/1/114/id=1879&pn=0.html
The buffer overflow vulnerability exists when processing the TGA file format, and the eip is controllable.

Poc:

Code Region

0200080000000064 0064000100010010 ffffffffffffffffccccccccffff

Save the data in hexadecimal format and rename it poc. tga.



Environment Configuration:

Windows xp sp3

Grand-eye version 2.5

(You cannot open the hero first and then load the image. This will not trigger the vulnerability. You can right-click the image to view it with big eyes)

After installation, you must register all image formats in tool-register image types.

Right-click the poc sample and choose preview with big eyes"

Under normal circumstances, the program will crash and crash. When debugging with OD, we will find that the EIP has been changed to the value we defined CCCCCCCCH.

 

The eip has been modified.

Solution:

Check the validity of the sample.