Re: WordPad/riched20.dll buffer overflow

[core.lists.bugtraq () CORE-SDI COM (Gerardo Richarte)]

Solar Eclipse wrote:

> When I tried this, I found out that code CAN be executed on the heap,
> although the heap descriptor has no execute permissions. I don't know
> why. If somebody can confirm this it would be great.

    I remember reading something about this i a book named Windows NT Device
Driver Development, let me check it out...
    Ok, here it is, on page 58, it's talking about Access Control of virtual
pages, and it says, literally if a page can be read, it can be executed. I
remember that this took my attention for some days, then I forgot about it, until
you mentioned it.

    richie

--
A390 1BBA 2C58 D679 5A71 - 86F9 404F 4B53 3944 C2D0
Investigacion y Desarrollo - CoreLabs - Core SDI
http://www.core-sdi.com

--- For a personal reply use gera () core-sdi com