|
Windows 7 Beta -
04-23-2009, 19:50
| posts: 1
I work at Microsoft and we're experiencing a problem with atitray.sys on our Operating Systems. It's come to our attention on Windows 7 Beta however it's not exclusive to that OS.
Application is the latest non-beta release (version 1.3.6.1042, May 22, 2007) of "ATI Tray Tools" program.
Crash is not Win7-specific.
Problem occurs in the support driver atitray.sys inside the IOCTL handler when processing the control code 0x800020c4.
Driver is missing the parameter validation (eax is fetched from the user-caller's buffer that is the user-mode buffer in this case):
0: kd> u atitray+0x1332
atitray+0x1332:
8dafb332 83e007 and eax,7 <-- eax ensured to be in range of 0..7
8dafb335 0fb6b8ecd2af8d movzx edi,byte ptr atitray+0x32ec (8dafd2ec)[eax] <-- Peek byte at atitray+0x32ec
8dafb33c 56 push esi
8dafb33d e8c4fdffff call atitray+0x1106 (8dafb106) <- Does not touch edi inside
8dafb342 0faffb imul edi,ebx
8dafb345 8b5634 mov edx,dword ptr [esi+34h]
8dafb348 83e007 and eax,7
8dafb34b 0fb688ecd2af8d movzx ecx,byte ptr atitray+0x32ec (8dafd2ec)[eax]
8dafb352 0fb6450a movzx eax,byte ptr [ebp+0Ah]
8dafb356 0fafc2 imul eax,edx
8dafb359 d1e0 shl eax,1
8dafb35b 33d2 xor edx,edx
8dafb35d f7f7 div eax,edi <-- Divide by edi that is zero.
Only three values in array are safe, all the rest will cause an exception.
0: kd> db atitray+0x32ec l8
8dafd2ec 00 01 02 04 08 00 00 00
I was able to confirm that same pattern exist in the latest available beta - 1.6.9.1382 Beta (February 21, 2009).
Are you aware of this problem?
|