RE: [Full-Disclosure] Misinformation in Security Advisories (ASN.1)

["first last" <randnut () hotmail com>]

John Compton john_compton24 () yahoo com wrote:
> Another possibility for remote code execution would be to trigger a
> context-switch mid-memcpy which would halt the memory copy operation
> before it hits an unpaged address. This, if possible, might leave the
> heap in a corrupted state but allow another thread to access/traverse
> the heap before the exception occurs. However, Microsoft compilers
> optimize the memcpy() function call to the REPNE MOVSD instruction. This 
> makes it extremely unlikely, if not statistically impossible, to
> get a context switch at the right time before an unpaged address is
> accessed. Once again, this cannot be used to exploit this bug.

REP string instructions (eg. REP MOVS), like all other instructions, all 
check for HW interrupts after each iteration is complete. It is not possible 
to load ECX with FFFFFFFFh and do a REP LODSD to stop HW interrupts from 
occuring until ECX is 0.

_________________________________________________________________
Plan your next US getaway to one of the super destinations here. 
http://special.msn.com/local/hotdestinations.armx