Microsoft Windows .ANI file BITMAPINFOHEADER.biClrUsed bounds check missing

Quoting http://msdn.microsoft.com/en-us/library/aa930622.aspx:
typedef struct tagBITMAPINFOHEADER {
DWORD biSize;
LONG biWidth;
LONG biHeight;
WORD biPlanes;
WORD biBitCount
DWORD biCompression;
DWORD biSizeImage;
LONG biXPelsPerMeter;
LONG biYPelsPerMeter;
DWORD biClrUsed;
DWORD biClrImportant;
} BITMAPINFOHEADER;

“If the bitmap is a packed bitmap (a bitmap in which the bitmap array immediately follows the BITMAPINFO header and is referenced by a single pointer), the biClrUsed member must be either zero or the actual size of the color table.”

ANI files stores each frame of the animated cursor as a packed bitmap inside the ANI file…

ASPsh – A remote shell written in ASP.

Today I am releasing another old project called ASPsh. The goal of this project was to create an ASP page that can be used on a server to provide a “command line shell”-like experience when opening the page in a webbrowser…

Internet Exploiter 2 – bypassing DEP

In 2005 I released Internet Exploiter 2, which helped make heap spraying popular in browser exploits…

Wiki back up

In other news: I am looking for a better hosting provider, or at least one that does what I pay them to do, or at the very least what they promis.

Google Chrome 4

Google Chrome 4 has been released

Microsoft Internet Explorer 6.0/7.0 NULL pointer crashes

Two crashes caused by NULL pointer dereferences have been discovered in MSIE 6.0/7.0. These issues do not affect MSIE 8.0…

Advances in heap spraying #1: when size matters.

http://skypher.com/SkyLined/heap_spray/small_heap_spray_generator.html

I’ve created a heap-spray generator…

Wiki temporarily down

Unfortunately, our wiki is broken. Due to having a social life, it may be a while before we can restore functionality.

w32-exec-calc-shellcode released

I’ve released the source for a 97 byte shellcode that executes calc.exe.

Download and LoadLibrary shellcode released

Everyone and their dog seems to want to use download and execute shellcode in their exploits. Even though this has some drawbacks:

You need to create an .exe file on the system, which will very likely draw unwanted attention…