Untitled

Hi Derek,

Fine.  Attached  you  find  0,0001%  of  samples  in  my  Database  of
testcases, in particular the ACE format.

I   included   enough   of  them  to  trigger  some  nice  exceptions,
including some after the getavsoversion() call. (see below)

Please note, if you want me to test your engine thoroughly or would
be   interested   in  integrating  procedures/tests (read SDL) to  have
a  more mature/secure   product,   I  am  available  for  contracting.
Please understand that I cannot hand over all tests cases as this took
months to generate.

PS.   In   case  your  engineers say this would be norma, I would give
them training. The scan doesn't even finish, the  client  Errors,
even  without  any second chance exception, that's because  you  corrupted
memory  with  all  the  access  violations and subsequent SEH pseudo
recovery as nothing was paradigm.


-----------------------------------------------------------------------
-
[21:50:14.0220] pid 3716 tid 3752: Access violation (first chance) at libav!getAvSoVersion+0x139

Registers:
eax=03cef518 ebx=32b169b8 ecx=03cb1cac edx=00000430 esi=035fcdb0 edi=00000430
eip=10005c89 esp=01117e90 ebp=01120000 iopl=0         no up ei pl nz na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010206

ebp -> b8 83 31 00 00 00 90 2a 2a 41 43 45 2a 2a 14 14  ..1....**ACE**..
esi -> 35 04 00 00 30 04 00 00 36 04 00 00 31 04 00 00  5...0...6...1...

Code disassembly:
   10005c79 | e8 32f8ffff | call libav!avduplicatehandle+0xc60
   10005c7e |     83c4 04 | add esp, 0x4
   10005c81 |        85c0 | test eax, eax
   10005c83 |       74 75 | jz libav!getavsoversion+0x1aa
   10005c85 |   8b5c24 18 | mov ebx, [esp+0x18]
 * 10005c89 |     8b48 11 | mov ecx, [eax+0x11] *******
   10005c8c |     8d70 04 | lea esi, [eax+0x4]
   10005c8f |        3bcb | cmp ecx, ebx
   10005c91 |       74 79 | jz libav!getavsoversion+0x1bc
   10005c93 |        8b00 | mov eax, [eax]
   10005c95 |     83f8 01 | cmp eax, 0x1
   10005c98 |          76 | db 0x76

Stack pointers:
[esp+0x04] -> 35 04 00 00 30 04 00 00 36 04 00 00 31 04 00 00  5...0...6...1...
[esp+0x08] -> b8 83 31 00 00 00 90 2a 2a 41 43 45 2a 2a 14 14  ..1....**ACE**..
[esp+0x0f] -> b0 59 32 e2 00 00 00 00 05 b7 05 00 00 00 00 00  .Y2.............
[esp+0x10] -> 83 c4 28 5f 5e 5d 5b c3 90 90 90 90 90 90 90 90  ..(_^][.........
[esp+0x14] -> 01 00 00 00 0c 00 00 00 00 00 00 00 00 00 00 00  ................
[esp+0x20] -> 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
[esp+0x28] -> b8 83 31 00 00 00 90 2a 2a 41 43 45 2a 2a 14 14  ..1....**ACE**..

Stack dump:
01117e90: 30 04 00 00 b0 cd 5f 03 00 00 12 01 35 04 00 00  0....._.....5...
01117ea0: 5c 5c 00 10 70 9a c0 00 b8 69 b1 32 30 04 00 00  \\..p....i.20...
01117eb0: 18 7f 11 01 00 00 00 00 00 00 12 01 35 04 00 00  .¦..........5...
01117ec0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
01117ed0: 35 04 00 00 70 9a c0 00 00 00 12 01 0d 16 00 10  5...p...........
01117ee0: 70 9a c0 00 00 00 12 01 35 04 00 00 18 7f 11 01  p.......5....¦..
01117ef0: 00 00 00 00 70 9a c0 00 b0 81 11 01 00 00 00 00  ....p...........
01117f00:  00  00  00  00  00  00  00  00  1c  84  11  01  00 00 00 00

-----------------------------------------------------------------------


[21:52:57.0354] pid 3716 tid 3752: Access violation (first chance) at libav!get
vSoVersion+0xc1

Registers:
eax=035fac30 ebx=00001691 ecx=00001adb edx=000011e8 esi=000011f0 edi=000023ce
eip=10005c11 esp=01117ecc ebp=01120000 iopl=0         no up ei pl nz na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010206

ebp -> 29 da 1b 00 00 00 80 2a 2a 41 43 45 2a 2a 0a 0c  )......**ACE**..

Code disassembly:
   10005c01 |   7e ff | jle libav!getavsoversion+0xb2
   10005c03 |    33d2 | xor edx, edx
   10005c05 |    85ff | test edi, edi
   10005c07 |   7c 1d | jl libav!getavsoversion+0xd6
   10005c09 |    8bcf | mov ecx, edi
   10005c0b |    2bca | sub ecx, edx
   10005c0d |    d1f9 | sar ecx, 0x1
   10005c0f |    03ca | add ecx, edx
 * 10005c11 |  8b34c8 | mov esi, [eax+ecx*8]
   10005c14 |    3bf3 | cmp esi, ebx
   10005c16 |   76 05 | jbe libav!getavsoversion+0xcd
   10005c18 | 8d79 ff | lea edi, [ecx-0x1]
   10005c1b |   eb 05 | jmp libav!getavsoversion+0xd2
   10005c1d |   73 0f | jae libav!getavsoversion+0xde
   10005c1f |      8d | db 0x8d
   10005c20 |      51 | push ecx

Stack pointers:
[esp+0x03] -> 31 00 22 00 20 00 25 00 2a 00 00 00 65 00 00 00  1."...%.*...e...
[esp+0x08] -> 01 00 00 00 0c 00 00 00 00 00 00 00 00 00 00 00  ................
[esp+0x0c] -> 29 da 1b 00 00 00 80 2a 2a 41 43 45 2a 2a 0a 0c  )......**ACE**..
[esp+0x0f] -> 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
[esp+0x10] -> 83 c4 10 85 c0 75 0d c7 44 24 14 01 00 00 00 e9  .....u..D$......
[esp+0x14] -> 01 00 00 00 0c 00 00 00 00 00 00 00 00 00 00 00  ................
[esp+0x18] -> 29 da 1b 00 00 00 80 2a 2a 41 43 45 2a 2a 0a 0c  )......**ACE**..
[esp+0x1b] -> 00 22 00 20 00 25 00 2a 00 00 00 65 00 00 00 69  ."...%.*...e...i
[esp+0x20] -> 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
[esp+0x28] -> 01 00 00 00 0c 00 00 00 00 00 00 00 00 00 00 00  ................
[esp+0x2c] -> e0 84 11 01 a2 99 3a 00 70 9a c0 00 00 00 12 01  ......:.p.......
[esp+0x3c] -> 02 00 00 00 00 00 00 00 00 00 00 00 48 84 11 01  ............H...

Stack dump:
01117ecc: 00 00 00 00 91 16 00 00 70 9a c0 00 00 00 12 01  ........p.......
01117edc: 0d 16 00 10 70 9a c0 00 00 00 12 01 91 16 00 00  ....p...........
01117eec: 18 7f 11 01 00 00 00 00 70 9a c0 00 b0 81 11 01  .¦......p.......
01117efc: 00 00 00 00 00 00 00 00 00 00 00 00 1c 84 11 01  ................
01117f0c: 00 00 00 00 ff ff ff ff 0c 00 00 00 00 00 00 00  ................
01117f1c: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
01117f2c: 00 00 00 00 00 00 12 01 00 00 00 00 00 00 00 00  ................
01117f3c: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................

-----------------------------------------------------------------------
--

[22:02:11.0546] pid 3716 tid 3752: Access violation (first chance) at libav!avDu
plicateHandle+0xc77

Registers:
eax=00003e86 ebx=00003e9f ecx=03a74c84 edx=00003e86 esi=0361a060 edi=00003e86
eip=100054c7 esp=01117e88 ebp=01120000 iopl=0         no up ei ng nz ac po cy
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010293

ebp -> 3b f8 1b 00 00 00 80 2a 2a 41 43 45 2a 2a 0a 0c  ;......**ACE**..
ecx -> 00 00 00 00 26 00 00 00 4c 00 00 00 72 00 00 00  ....&...L...r...
esi -> 9f 3e 00 00 86 3e 00 00 a0 3e 00 00 87 3e 00 00  .>...>...>...>..

Code disassembly:
   100054b7 |          211a | and [edx], ebx
   100054b9 |          103b | adc [ebx], bh
   100054bb |    c172 03 33 | sal dword [edx+0x3], 0x33
   100054bf |       c0c3 8b | rol bl, 0x8b
   100054c2 |   0d a4211a10 | or eax, libav!start+0xbdd97
 * 100054c7 |        8b0481 | mov eax, [ecx+eax*4]
   100054ca | 8b0d a8211a10 | mov ecx, [libav!start+0xbdd9b]
   100054d0 |          03c1 | add eax, ecx
   100054d2 |            c3 | ret
   100054d3 |            90 | nop
   100054d4 |            90 | nop
   100054d5 |            90 | nop
   100054d6 |            90 | nop

Stack pointers:
[esp+0x00] -> 83 c4 04 85 c0 74 75 8b 5c 24 18 8b 48 11 8d 70  .....tu.\$..H..p
[esp+0x0c] -> 9f 3e 00 00 86 3e 00 00 a0 3e 00 00 87 3e 00 00  .>...>...>...>..
[esp+0x10] -> 3b f8 1b 00 00 00 80 2a 2a 41 43 45 2a 2a 0a 0c  ;......**ACE**..
[esp+0x17] -> b0 59 32 e2 00 00 00 00 05 b7 05 00 00 00 00 00  .Y2.............
[esp+0x18] -> 83 c4 28 5f 5e 5d 5b c3 90 90 90 90 90 90 90 90  ..(_^][.........
[esp+0x1c] -> 01 00 00 00 0c 00 00 00 00 00 00 00 00 00 00 00  ................
[esp+0x28] -> 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
[esp+0x30] -> 3b f8 1b 00 00 00 80 2a 2a 41 43 45 2a 2a 0a 0c  ;......**ACE**..

Stack dump:
01117e88: 7e 5c 00 10 86 3e 00 00 86 3e 00 00 60 a0 61 03  ~\...>...>..`.a.
01117e98: 00 00 12 01 9f 3e 00 00 5c 5c 00 10 70 9a c0 00  .....>..\\..p...
01117ea8: a7 b4 a1 f1 86 3e 00 00 18 7f 11 01 00 00 00 00  .....>...¦......
01117eb8: 00 00 12 01 9f 3e 00 00 00 00 00 00 00 00 00 00  .....>..........
01117ec8: 00 00 00 00 00 00 00 00 9f 3e 00 00 70 9a c0 00  .........>..p...
01117ed8: 00 00 12 01 0d 16 00 10 70 9a c0 00 00 00 12 01  ........p.......
01117ee8: 9f 3e 00 00 18 7f 11 01 00 00 00 00 70 9a c0 00  .>...¦......p...
01117ef8: b0 81 11 01 00 00 00 00 00 00 00 00 00 00 00 00  ................


-----------------------------------------------------------------------