bugtraq - Re: [funsec] Technical Paper on the ZERT Patch and VML [was: Re: ZERT patch for setSlice()]

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Wed, 04 Oct 2006 11:39:57 -0700
From: Alexander Sotirov <asotirov@...ermina.com>
To: Gadi Evron <ge@...uxbox.org>
Cc: full-disclosure@...ts.grok.org.uk, funsec@...uxbox.org,
	vuln-dev@...urityfocus.com, bugtraq@...urityfocus.com
Subject: Re: [funsec] Technical Paper on the ZERT Patch and VML [was: Re:
 ZERT patch for setSlice()]

Gadi Evron wrote:
> Our (ZERT's) VML patch was what you refer to as "real". There was space
> issue with not enough bytes to play with, so Gil Dabah, one of our
> members, re-wrote the vulnerable function in Yasm, compiled it, and
> hard-coded the compiled code into the binary, with room to spare, saving
> functionality. Code crunching is back in style. :)

Rewriting the entire function in asm is a lot of unnecessary effort. Why didn't
you add a simple length check and a 5-byte jump to it in the vulnerable function?

Patch right before the call to _IE5_SHADETYPE_TEXT::TOKENS::Ptok, check the
length of the string, and you're done. Or you can patch the copy loop and count
the characters there. It's easier and safer than rewriting the function.

Alex