金山WPSOffice远程堆溢出漏洞分析（CVE-2020-25291）
WPS Office软件中存在一个远程执行代码漏洞，是当Office软件在分析特制Office文件时不正确地处理内存中的对象时引起的。成功利用此漏洞的攻击者可以在当前用户的上下文中运行任意代码。
从这里我们可以知道代码实际上没有从指针释放任何东西。一旦移至EDX，EDX将保留指向索引数组的指针：
- eax=00000000 ebx=00791878 ecx=00000005 edx=cf69afbc esi=cb07de18 edi=0000001c
- eip=6ba3cb8f esp=00791780 ebp=00791870 iopl=0 nv up ei pl nz na po nc
- cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00200202
- QtCore4!path_gradient_span_gen::path_gradient_span_gen+0x6a6b:
- 6ba3cb8f 8b4df4 mov ecx,dword ptr [ebp-0Ch] ss:002b:00791864=d1326100
- 0:000> dc cf69afbc
- cf69afbc c88baf80 d1326100 00000003 00000280 .....a2.........
- cf69afcc 0000055f 00000012 c0c0c0c0 1c3870e2 _............p8.
- cf69afdc 40ad870e 1c3870e2 40ad870e 00000000 ...@.p8....@....
- cf69afec 00000000 c0c0c0c1 6c1d12c0 00000000 ...........l....
- cf69affc c0c0c0c0 ???????? ???????? ???????? ....????????????
- cf69b00c ???????? ???????? ???????? ???????? ????????????????
- cf69b01c ???????? ???????? ???????? ???????? ????????????????
- cf69b02c ???????? ???????? ???????? ???????? ????????????????
- 0:000> dc c88baf80
- c88baf80 00000001 0000001c 00000010 00000001 ................
- c88baf90 ff000000 ff800000 ff008000 ff808000 ................
- c88bafa0 ff000080 ff800080 ff008080 ff808080 ................
- c88bafb0 ffc0c0c0 ffff0000 ff00ff00 ffffff00 ................
- c88bafc0 ff0000ff ffff00ff ff00ffff ffffffff ................
- c88bafd0 c0c0c0c0 c0c0c0c0 c0c0c0c0 c0c0c0c0 ................
- c88bafe0 c0c0c0c0 c0c0c0c0 c0c0c0c0 c0c0c0c0 ................
- c88baff0 c0c0c0c0 c0c0c0c0 c0c0c0c0 c0c0c0c0 ................
崩溃后的堆栈跟踪：
- 0:000> kvL
- # ChildEBP RetAddr Args to Child
- 00 012f18d4 6ba3cb98 cc53afbc 00000048 00000000 QtCore4!QMatrix::dy+0x48a8
- 01 012f19d0 6b8143ef 00000000 012f1b78 012f1a5c QtCore4!path_gradient_span_gen::path_gradient_span_gen+0x6a74
- 02 012f1a30 6b814259 0000002e 012f5bd0 00000000 QtCore4!QBrush::setMatrix+0x234
- 03 012f5b14 6b8249a4 0000003b 012f5b68 cc780e18 QtCore4!QBrush::setMatrix+0x9e
- 04 012f5b2c 6b80cc84 0000003b 012f5b68 cc780e18 QtCore4!QImage::rect+0x22b
- 05 012f5b48 6b857ccc 0000003b 012f5b68 cc780e18 QtCore4!QTransform::inverted+0xec8
- 06 012f64dc 6b81c55b 00000000 003c0000 00000000 QtCore4!QSvgFillStyle::setFillOpacity+0x1b59
- 07 012f66c0 6b896844 012f6724 cc818ff0 0000001c QtCore4!QPainter::drawPixmap+0x1c98
- 08 012f67b4 6d1e0fbd 012f69ec 012f66d4 012f6864 QtCore4!QPainter::drawImage+0x325
- 09 012f67d4 6d0dd155 012f6a54 012f69ec 012f6864 kso!GdiDrawHoriLineIAlt+0x11a1a
- 0a 012f67ec 6d0c8d88 012f69ec 012f68e0 012f6864 kso!kpt::PainterExt::drawBitmap+0x23
原创文章，作者： Admin ，转载请注明出处：https://secvery.com/3192.html