-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Windows Api SHGetPathFromIDList Buffer Overflow To all those people who sent email to us asking for more information about the SHGetPathFromIDList Windows Api overflow. Here is a more specific description about the problem. All Structure lengths, or Length of string, can be a modified or altered and cause whatever handles the shortcuts to crash. SHGetPathFromIDList Converts an item identifier list to a file system path. BOOL SHGetPathFromIDList( LPCITEMIDLIST pidl, LPSTR pszPath ); Parameters pidl Address of an item identifier list that specifies a file or directory location relative to the root of the namespace (the desktop). pszPath Address of a buffer to receive the file system path. This buffer must be at least MAX_PATH characters in size. Return Values Returns TRUE if successful, or FALSE otherwise. Disassembly of a hypothetical shortcut file Offset Bytes Contents Header 0000 4C 00 00 00 =91L=92 Magic value 0004 01 04 02 00 GUID of shortcut files 00 00 00 00 C0 00 00 00 00 00 00 46 0014 3F 00 00 00 Flags Has item id list Target is a file Has description string Has relative pathname Has a working directory Has a custom icon 0018 20 00 00 00 File attibutes Archive 001C C0 0E 82 D5 Time 1 C1 20 BE 01 0024 00 08 BF 46 Time 2 D5 20 BE 01 002C 00 47 AA EC Time 3 EC 15 BE 01 0034 A0 86 00 00 File length is 34464 bytes. 86A0h 0038 05 00 00 00 Icon number 5 003C 01 00 00 00 Normal window 0040 46 06 00 00 Ctrl-Alt-F hotkey 0044 00 00 00 00 Always zero, unknown/reserved 0048 00 00 00 00 Always zero, unknown/reserved Item Id List 004C 2A 00 Size of item id list First item 004E 28 00 Length of first item 0050 32 00 ??? 0052 A0 86 00 00 File length 0056 76 25 71 3E ??? 005A 20 00 File attributes? 005C 62 65 73 74 5F 37 =93best_773.mid=94 Long name 37 33 2E 6D 69 64 00 Null terminator 0069 42 45 53 54 5F 37 =93BEST_773.MID=94 Short name 37 33 2E 4D 49 44 00 Null terminator Last item 0076 00 00 Zero length value File location info 0078 74 00 00 00 Structure length 007C 1C 00 00 00 Offset past last item in structure 0080 03 00 00 00 Flags Local volume Network volume 0084 1C 00 00 00 Offset of local volume table 0088 34 00 00 00 Offset of local path string 008C 40 00 00 00 Offset of network volume table 0090 5F 00 00 00 Offset of final path string Local volume table 0094 18 00 00 00 Length of local volume table 0098 03 00 00 00 Fixed disk 009C D0 07 33 3A Volume serial number 3A33-07D0 00A0 10 00 00 00 Offset to volume label 00A4 44 52 49 56 45 20 =93DRIVE C=94,0 43 00 00AC 43 3A 5C 57 49 4E =93C:\ WINDOWS\=94 local path string 44 4F 57 53 5C 00 Network volume table 00B8 1F 00 00 00 Length of network volume table 00BC 02 00 00 00 ??? 00C0 14 00 00 00 Offset of share name 00C4 00 00 00 00 ??? 00C8 00 00 02 00 ??? 00CC 5C 5C 4A 45 53 53 =93\\ JESSE\ WD=94,0 Share name 45 5C 57 44 00 00D7 44 65 73 6B 74 6F =93Desktop\ best_773.mid=94,0 70 5C 62 65 73 74 Final path name 5F 37 37 33 2E 6D 69 64 00 Description string 00EC 12 00 Length of string 00EE 42 65 73 74 20 37 =93Best 773 midi file=94 37 33 20 6D 69 64 69 20 66 69 6C 65 Relative path 0100 0E 00 Length of string 0102 2E 5C 62 65 73 74 =93.\ best_773.mid=94 5F 37 37 33 2E 6D 69 64 Working directory 0114 12 00 Length of string 0116 43 3A 5C 57 49 4E =93C:\ WINDOWS\ Desktop=94 44 4F 57 53 5C 44 65 73 6B 74 6F 70 Command line arguments 0128 06 00 012A 2F 63 6C 6F 73 65 =93/close=94 Icon file 0130 16 00 Length of string 0132 43 3A 5C 57 49 4E =93C:\ WINDOWS\ Mplayer.exe=94 44 4F 57 53 5C 4D 70 6C 61 79 65 72 2E 65 78 65 Ending stuff 0148 00 00 00 00 Length 0 - no more stuff The target is located at: C:\ WINDOWS\ Desktop\ best_773.mid The windows directory is shared as: \\ JESSE\ WD Note: This overflow does not work under win2k u n d e r g r o u n d s e c u r i t y s y s t e m s r e s e a r c h http://www.ussrback.com -----BEGIN PGP SIGNATURE----- Version: PGPfreeware 6.5.2 for non-commercial use iQA/AwUBOJsyuNybEYfHhkiVEQJHNACg58a5nakFaSPNoFVOLZ0WMPMHVYcAn0TT 2HEPwsUBJTmD4Fzah4yZ+Zjh =3DBFth -----END PGP SIGNATURE-----