Another possibility for remote code execution would be to trigger a
context-switch mid-memcpy which would halt the memory copy operation
before it hits an unpaged address. This, if possible, might leave the
heap in a corrupted state but allow another thread to access/traverse
the heap before the exception occurs. However, Microsoft compilers
optimize the memcpy() function call to the REPNE MOVSD instruction. This makes it extremely unlikely, if not statistically impossible, to
get a context switch at the right time before an unpaged address is
accessed. Once again, this cannot be used to exploit this bug.
REP string instructions (eg. REP MOVS), like all other instructions, all check for HW interrupts after each iteration is complete. It is not possible to load ECX with FFFFFFFFh and do a REP LODSD to stop HW interrupts from occuring until ECX is 0.
_________________________________________________________________
Plan your next US getaway to one of the super destinations here. http://special.msn.com/local/hotdestinations.armx
