CH22 V1.0.0.1 Stack Overflow in formQuickMode Function

CH22 Vulnerability Summary Vulnerability Overview Product Name: CH22 Version: V1.0.0.1 Vulnerability Type: Stack Overflow Description: In the function of , there is a user-provided parameter . When the length of is 2, this variable is passed to the function without length checking, resulting in a stack overflow. Impact/Scope Affected File: Affected Functions: , Related Code (Assembly/Disassembly) ```assembly sub_38088: push rbp mov rbp, rsp sub rsp, 40h mov [rbp-20h], rdi mov [rbp-18h], esi mov [rbp-10h], edx mov [rbp-8], ecx mov eax, [rbp-20h] mov ecx, [rbp-18h] mov edx, [rbp-10h] mov esi, [rbp-8] call sub_38088 mov eax, [rbp-20h] mov ecx, [rbp-18h] mov edx, [rbp-10h] mov esi, [rbp-8] call sub_38088 mov eax, [rbp-20h] mov ecx, [rbp-18h] mov edx, [rbp-10h] mov esi, [rbp-8] call sub_38088 mov eax, [rbp-20h] mov ecx, [rbp-18h] mov edx, [rbp-10h] mov esi, [rbp-8] call sub_38088 mov eax, [rbp-20h] mov ecx, [rbp-18h] mov edx, [rbp-10h] mov esi, [rbp-8] call sub_38088 mov eax, [rbp-20h] mov ecx, [rbp-18h] mov edx, [rbp-10h] mov esi, [rbp-8] call sub_38088 mov eax, [rbp-20h] mov ecx, [rbp-18h] mov edx, [rbp-10h] mov esi, [rbp-8] call sub_38088 mov eax, [rbp-20h] mov ecx, [rbp-18h] mov edx, [rbp-10h] mov esi, [rbp-8] call sub_38088 mov eax, [rbp-20h] mov ecx, [rbp-18h] mov edx, [rbp-10h] mov esi, [rbp-8] call sub_38088 mov eax, [rbp-20h] mov ecx, [rbp-18h] mov edx, [rbp-10h] mov esi, [rbp-8] call sub_38088 mov eax, [rbp-20h] mov ecx, [rbp-18h] mov edx, [rbp-10h] mov esi, [rbp-8] call sub_38088 mov eax, [rbp-20h] mov ecx, [rbp-18h] mov edx, [rbp-10h] mov esi, [rbp-8] call sub_38088 mov eax, [rbp-20h] mov ecx, [rbp-18h] mov edx, [rbp-10h] mov esi, [rbp-8] call sub_38088 mov eax, [rbp-20h] mov ecx, [rbp-18h] mov edx, [rbp-10h] mov esi, [rbp-8] call sub_38088 mov eax, [rbp-20h] mov ecx, [rbp-18h] mov edx, [rbp-10h] mov esi, [rbp-8] call sub_38088 mov eax, [rbp-20h] mov ecx, [rbp-18h] mov edx, [rbp-10h] mov esi, [rbp-8] call sub_38088 mov eax, [rbp-20h] mov ecx, [rbp-18h] mov edx, [rbp-10h] mov esi, [rbp-8] call sub_38088 mov eax, [rbp-20h] mov ecx, [rbp-18h] mov edx, [rbp-10h] mov esi, [rbp-8] call sub_38088 mov eax, [rbp-20h] mov ecx, [rbp-18h] mov edx, [rbp-10h] mov esi, [rbp-8] call sub_38088 mov eax, [rbp-20h] mov ecx, [rbp-18h] mov edx, [rbp-10h] mov esi, [rbp-8] call sub_38088 mov eax, [rbp-20h] mov ecx, [rbp-18h] mov edx, [rbp-10h] mov esi, [rbp-8] call sub_38088 mov eax, [rbp-20h] mov ecx, [rbp-18h] mov edx, [rbp-10h] mov esi, [rbp-8] call sub_38088 mov eax, [rbp-20h] mov ecx, [rbp-18h] mov edx, [rbp-10h] mov esi, [rbp-8] call sub_38088 mov eax, [rbp-20h] mov ecx, [rbp-18h] mov edx, [rbp-10h] mov esi, [rbp-8] call sub_38088 mov eax, [rbp-20h] mov ecx, [rbp-18h] mov edx, [rbp-10h] mov esi, [rbp-8] call sub_38088 mov eax, [rbp-20h] mov ecx, [rbp-18h] mov edx, [rbp-10h] mov esi, [rbp-8] call sub_38088 mov eax, [rbp-20h] mov ecx, [rbp-18h] mov edx, [rbp-10h] mov esi, [rbp-8] call sub_38088 mov eax, [rbp-20h] mov ecx, [rbp-18h] mov edx, [rbp-10h] mov esi, [rbp-8] call sub_38088 mov eax, [rbp-20h] mov ecx, [rbp-18h] mov edx, [rbp-10h] mov esi, [rbp-8] call sub_38088 mov eax, [rbp-20h] mov ecx, [rbp-18h] mov edx, [rbp-10h] mov esi, [rbp-8] call sub_38088 mov eax, [rbp-20h] mov ecx, [rbp-18h] mov edx, [rbp-10h] mov esi, [rbp-8] call sub_38088 mov eax, [rbp-20h] mov ecx, [rbp-18h] mov edx, [rbp-10h] mov esi, [rbp-8] call sub_38088 mov eax, [rbp-20h] mov ecx, [rbp-18h] mov edx, [rbp-10h] mov esi, [rbp-8] call sub_38088 mov eax, [rbp-20h] mov ecx, [rbp-18h] mov edx, [rbp-10h] mov esi, [rbp-8] call sub_38088 mov eax, [rbp-20h] mov ecx, [rbp-18h] mov edx, [rbp-10h] mov esi, [rbp-8] call sub_38088 mov eax, [rbp-20h] mov ecx, [rbp-18h] mov edx, [rbp-10h] mov esi, [rbp-8] call sub_38088 mov eax, [rbp-20h] mov ecx, [rbp-18h] mov edx, [rbp-10h] mov esi, [rbp-8] call sub_38088 mov eax, [rbp-20h] mov ecx, [rbp-18h] mov edx, [rbp-10h] mov esi, [rbp-8] call sub_38088 mov eax, [rbp-20h] mov ecx, [rbp-18h] mov edx, [rbp-10h] mov esi, [rbp-8] call sub_38088 mov eax, [rbp-20h] mov ecx, [rbp-18h] mov edx, [rbp-10h] mov esi, [rbp-8] call sub_38088 mov eax, [rbp-20h] mov ecx, [rbp-18h] mov edx, [rbp-10h] mov esi, [rbp-8] call sub_38088 mov eax, [rbp-20h] mov ecx, [rbp-18h] mov edx, [rbp-10h] mov esi, [rbp-8] call sub_38088 mov eax, [rbp-20h] mov ecx, [rbp-18h] mov edx, [rbp-10h] mov esi, [rbp-8] call sub_38088 mov eax, [rbp-20h] mov ecx, [rbp-18h] mov edx, [rbp-10h] mov esi, [rbp-8] call sub_38088 mov eax, [rbp-20h] mov ecx, [rbp-18h] mov edx, [rbp-10h] mov esi, [rbp-8] call sub_38088 mov eax, [rbp-20h] mov ecx, [rbp-18h] mov edx, [rbp-10h] mov esi, [rbp-8] call sub_38088 mov eax, [rbp-20h] mov ecx, [rbp-18h] mov edx, [rbp-10h] mov esi, [rbp-8] call sub_38088 mov eax, [rbp-20h] mov ecx, [rbp-18h] mov edx, [rbp-10h] mov esi, [rbp-8] call sub_38088 mov eax, [rbp-20h] mov ecx, [rbp-18h] mov edx, [rbp-10h] mov esi, [rbp-8] call sub_38088 mov eax, [rbp-20h] mov ecx, [rbp-18h] mov edx, [rbp-10h] mov esi, [rbp-8] call sub_38088 mov eax, [rbp-20h]

Goal Reached Thanks to every supporter — we hit 100%!

CH22 V1.0.0.1 Stack Overflow in formQuickMode Function

More from this source