The recent WannaCry ransomware attack exploited a vulnerability in older Windows SMB code. The presumably reverse-engineered function that has been cited 1 as vulnerable is as follows:
unsigned int __fastcall SrvOs2FeaToNt(int a1, int a2)
# {
# int v4; // edi@1
# _BYTE *v5; // edi@1
# unsigned int result; // eax@1
#
# v4 = a1 + 8;
# *(_BYTE *)(a1 + 4) = *(_BYTE *)a2;
# *(_BYTE *)(a1 + 5) = *(_BYTE *)(a2 + 1);
# *(_WORD *)(a1 + 6) = *(_WORD *)(a2 + 2);
# _memmove((void *)(a1 + 8), (const void *)(a2 + 4), *(_BYTE *)(a2 + 1));
# v5 = (_BYTE *)(*(_BYTE *)(a1 + 5) + v4);
# *v5++ = 0;
# _memmove(v5, (const void *)(a2 + 5 + *(_BYTE *)(a1 + 5)), *(_WORD*)(a1 + 6));
# result = (unsigned int)&v5[*(_WORD *)(a1 + 6) + 3] & 0xFFFFFFFC;
# *(_DWORD *)a1 = result - a1;
# return result;
# }
While it looks like this function copies data from one place to another and we're told the application fails to perform adequate boundary-checks on user-supplied input can someone explain in detail what this function is supposed to do line by line and where it is flawed?