---
Creating a device context with the flag (DCX_NORESETATTRS​) and selecting a brush object into the device context will result in the brush being freed on process exit without the reference to the object being cleared. The PoC consists of two files (prime304.cpp  and poc304.cpp). poc304 will execute prime304, which triggers the issue and allows poc304 to retrieve a handle to the device context with the pointer to the freed object. We can confirm this by requesting the handle for the brush object from the device context, resulting in reading freed memory. In some cases the issue leads to memory corruption when for example another object is allocated into the space of the free brush object (see attached crash logs for examples).
---

This bug is subject to a 90 day disclosure deadline. If 90 days elapse
without a broadly available patch, then the bug report will automatically
become visible to the public.

 

prime304.cpp 781 bytes Download

bug304.cpp 2.5 KB Download

crash2.txt 6.2 KB View Download

crash1.txt 9.7 KB View Download

systemcalls.h 910 bytes Download