BugId: | AVR:PoisonUninitialized+0x5E 237.b22 |
Location: | acrord32.exe!acrord32.dll+0x605454 |
Description: | An Access Violation exception happened at 0xC0C0C11E while attempting to read memory at 0xC0C0C11E using a pointer that was not initialized. |
Version: | AcroRd32.exe: 18.11.20040.19174 (x86) AcroRd32.dll: 18.11.20040.19174 (x86) |
Security impact: | Potentially exploitable security issue |
Arguments: | ['/n', 'AVR@PoisonUninitialized@0x605454.pdf'] |
eax = 0xC0C0C0C0 | xmm0 = 0x0 |
ebx = 0x0 | xmm1 = 0x0 |
ecx = 0xC0C0C0C0 | xmm2 = 0x0 |
edx = 0x38A0000 | xmm3 = 0x0 |
esi = 0x3D934F88 | xmm4 = 0x0 |
edi = 0x0 | xmm5 = 0x0 |
esp = 0x99BEB0 | xmm6 = 0x0 |
ebp = 0x99BF20 | xmm7 = 0x0 |
5ee05384 | 8d4da0 | lea ecx,[ebp-60h] |
5ee05387 | e84bc90000 | call AcroRd32!CTJPEGRect::operator=+0x11cb6 (5ee11cd7) |
5ee0538c | 8b462c | mov eax,dword ptr [esi+2Ch] |
5ee0538f | 8d4da0 | lea ecx,[ebp-60h] |
5ee05392 | 33db | xor ebx,ebx |
5ee05394 | 8945b4 | mov dword ptr [ebp-4Ch],eax |
5ee05397 | 895dfc | mov dword ptr [ebp-4],ebx |
5ee0539a | e836ca0000 | call AcroRd32!CTJPEGRect::operator=+0x11db4 (5ee11dd5) |
5ee0539f | 6a10 | push 10h |
5ee053a1 | 8d4da0 | lea ecx,[ebp-60h] |
5ee053a4 | e872c90000 | call AcroRd32!CTJPEGRect::operator=+0x11cfa (5ee11d1b) |
5ee053a9 | 8bf8 | mov edi,eax |
5ee053ab | 85ff | test edi,edi |
5ee053ad | 752f | jne AcroRd32!CTJPEGRect::operator=+0x53bd (5ee053de) |
5ee053af | ff765c | push dword ptr [esi+5Ch] |
5ee053b2 | 8d45d0 | lea eax,[ebp-30h] |
5ee053b5 | 50 | push eax |
5ee053b6 | 8d45a0 | lea eax,[ebp-60h] |
5ee053b9 | 50 | push eax |
5ee053ba | e8ddda0000 | call AcroRd32!CTJPEGRect::operator=+0x12e7b (5ee12e9c) |
5ee053bf | 8bf8 | mov edi,eax |
5ee053c1 | 83c40c | add esp,0Ch |
5ee053c4 | 85ff | test edi,edi |
5ee053c6 | 7516 | jne AcroRd32!CTJPEGRect::operator=+0x53bd (5ee053de) |
5ee053c8 | 8d4da0 | lea ecx,[ebp-60h] |
5ee053cb | e827e7ffff | call AcroRd32!CTJPEGRect::operator=+0x3ad6 (5ee03af7) |
5ee053d0 | 834dfcff | or dword ptr [ebp-4],0FFFFFFFFh |
5ee053d4 | 8d4da0 | lea ecx,[ebp-60h] |
5ee053d7 | e818c90000 | call AcroRd32!CTJPEGRect::operator=+0x11cd3 (5ee11cf4) |
5ee053dc | eb6a | jmp AcroRd32!CTJPEGRect::operator=+0x5427 (5ee05448) |
5ee053de | 834dfcff | or dword ptr [ebp-4],0FFFFFFFFh |
5ee053e2 | 8d4da0 | lea ecx,[ebp-60h] |
5ee053e5 | e80ac90000 | call AcroRd32!CTJPEGRect::operator=+0x11cd3 (5ee11cf4) |
5ee053ea | 8bc7 | mov eax,edi |
5ee053ec | e98b000000 | jmp AcroRd32!CTJPEGRect::operator=+0x545b (5ee0547c) |
5ee053f1 | 8b462c | mov eax,dword ptr [esi+2Ch] |
5ee053f4 | 8d4dbc | lea ecx,[ebp-44h] |
5ee053f7 | c6400d08 | mov byte ptr [eax+0Dh],8 |
5ee053fb | e8aa0b0100 | call AcroRd32!CTJPEGRect::operator=+0x15f89 (5ee15faa) |
5ee05400 | 8b462c | mov eax,dword ptr [esi+2Ch] |
5ee05403 | 8d4dbc | lea ecx,[ebp-44h] |
5ee05406 | c745fc01000000 | mov dword ptr [ebp-4],1 |
5ee0540d | 8945cc | mov dword ptr [ebp-34h],eax |
5ee05410 | e884120100 | call AcroRd32!CTJPEGRect::operator=+0x16678 (5ee16699) |
5ee05415 | 33db | xor ebx,ebx |
5ee05417 | 8d4dbc | lea ecx,[ebp-44h] |
5ee0541a | 53 | push ebx |
5ee0541b | ff765c | push dword ptr [esi+5Ch] |
5ee0541e | e8a90c0100 | call AcroRd32!CTJPEGRect::operator=+0x160ab (5ee160cc) |
5ee05423 | 8bf8 | mov edi,eax |
5ee05425 | 8d4dbc | lea ecx,[ebp-44h] |
5ee05428 | 85ff | test edi,edi |
5ee0542a | 740b | je AcroRd32!CTJPEGRect::operator=+0x5416 (5ee05437) |
5ee0542c | 834dfcff | or dword ptr [ebp-4],0FFFFFFFFh |
5ee05430 | e8cbbb9fff | call AcroRd32!AIDE::PixelPartInfo::~PixelPartInfo (5e801000) |
5ee05435 | ebb3 | jmp AcroRd32!CTJPEGRect::operator=+0x53c9 (5ee053ea) |
5ee05437 | e8ee110100 | call AcroRd32!CTJPEGRect::operator=+0x16609 (5ee1662a) |
5ee0543c | 834dfcff | or dword ptr [ebp-4],0FFFFFFFFh |
5ee05440 | 8d4dbc | lea ecx,[ebp-44h] |
5ee05443 | e8b8bb9fff | call AcroRd32!AIDE::PixelPartInfo::~PixelPartInfo (5e801000) |
5ee05448 | 807e0424 | cmp byte ptr [esi+4],24h |
5ee0544c | 742c | je AcroRd32!CTJPEGRect::operator=+0x5459 (5ee0547a) |
5ee0544e | 8b4664 | mov eax,dword ptr [esi+64h] |
5ee05451 | 8b4e60 | mov ecx,dword ptr [esi+60h] |
5ee05454 | 6639585e | cmp word ptr [eax+5Eh],bx // current instruction |
5ee05458 | 7406 | je AcroRd32!CTJPEGRect::operator=+0x543f (5ee05460) |
5ee0545a | 0fb64654 | movzx eax,byte ptr [esi+54h] |
5ee0545e | eb04 | jmp AcroRd32!CTJPEGRect::operator=+0x5443 (5ee05464) |
5ee05460 | 0fb6405a | movzx eax,byte ptr [eax+5Ah] |
5ee05464 | 50 | push eax |
5ee05465 | ff7650 | push dword ptr [esi+50h] |
5ee05468 | ff764c | push dword ptr [esi+4Ch] |
5ee0546b | ff765c | push dword ptr [esi+5Ch] |
5ee0546e | e8f41b0000 | call AcroRd32!CTJPEGRect::operator=+0x7046 (5ee07067) |
5ee05473 | 8bce | mov ecx,esi |
5ee05475 | e835e1feff | call AcroRd32!AX_PDXlateToHostEx+0x25e381 (5edf35af) |
5ee0547a | 33c0 | xor eax,eax |
5ee0547c | e8a81da2ff | call AcroRd32!AIDE::PixelPartInfo::~PixelPartInfo+0x26229 (5e827229) |
5ee05481 | c3 | ret |
5ee05482 | 56 | push esi |
5ee05483 | 8bf1 | mov esi,ecx |
5ee05485 | e86c130100 | call AcroRd32!CTJPEGRect::operator=+0x167d5 (5ee167f6) |
5ee0548a | 85c0 | test eax,eax |
5ee0548c | 7570 | jne AcroRd32!CTJPEGRect::operator=+0x54dd (5ee054fe) |
5ee0548e | 8b4e2c | mov ecx,dword ptr [esi+2Ch] |
5ee05491 | e81de0feff | call AcroRd32!AX_PDXlateToHostEx+0x25e285 (5edf34b3) |
5ee05496 | a801 | test al,1 |
5ee05498 | 8ad0 | mov dl,al |
5ee0549a | 0f97c1 | seta cl |
5ee0549d | d0ea | shr dl,1 |
5ee0549f | 80e203 | and dl,3 |
5ee054a2 | 0fb6c9 | movzx ecx,cl |
5ee054a5 | a808 | test al,8 |
5ee054a7 | 66894e68 | mov word ptr [esi+68h],cx |
5ee054ab | 88566a | mov byte ptr [esi+6Ah],dl |
5ee054ae | 0f97c0 | seta al |
5ee054b1 | 0fb6c0 | movzx eax,al |
5ee054b4 | 6689466c | mov word ptr [esi+6Ch],ax |
5ee054b8 | 6685c9 | test cx,cx |
5ee054bb | 753f | jne AcroRd32!CTJPEGRect::operator=+0x54db (5ee054fc) |
5ee054bd | 84d2 | test dl,dl |
5ee054bf | 7525 | jne AcroRd32!CTJPEGRect::operator=+0x54c5 (5ee054e6) |
5ee054c1 | 53 | push ebx |
5ee054c2 | 57 | push edi |
5ee054c3 | 6a04 | push 4 |
5ee054c5 | 8d7e74 | lea edi,[esi+74h] |
5ee054c8 | 5b | pop ebx |
5ee054c9 | 8b4e2c | mov ecx,dword ptr [esi+2Ch] |
5ee054cc | e8e2dffeff | call AcroRd32!AX_PDXlateToHostEx+0x25e285 (5edf34b3) |
5ee054d1 | 8847fc | mov byte ptr [edi-4],al |
5ee054d4 | 8b4e2c | mov ecx,dword ptr [esi+2Ch] |
5ee054d7 | e8d7dffeff | call AcroRd32!AX_PDXlateToHostEx+0x25e285 (5edf34b3) |
5ee054dc | 8807 | mov byte ptr [edi],al |
5ee054de | 47 | inc edi |
5edf335c | 8bd9 | mov ebx,ecx |
5edf335e | e8b6a3a3ff | call AcroRd32!AcroWinMainSandbox+0x3795 (5e82d719) |
5edf3363 | 59 | pop ecx |
5edf3364 | 8bc8 | mov ecx,eax |
5edf3366 | 894dfc | mov dword ptr [ebp-4],ecx |
5edf3369 | 85c9 | test ecx,ecx |
5edf336b | 7508 | jne AcroRd32!AX_PDXlateToHostEx+0x25e147 (5edf3375) |
5edf336d | 6a03 | push 3 |
5edf336f | 58 | pop eax |
5edf3370 | e917010000 | jmp AcroRd32!AX_PDXlateToHostEx+0x25e25e (5edf348c) |
5edf3375 | 56 | push esi |
5edf3376 | 33f6 | xor esi,esi |
5edf3378 | 57 | push edi |
5edf3379 | 8bfe | mov edi,esi |
5edf337b | 397314 | cmp dword ptr [ebx+14h],esi |
5edf337e | 0f86df000000 | jbe AcroRd32!AX_PDXlateToHostEx+0x25e235 (5edf3463) |
5edf3384 | 8b4318 | mov eax,dword ptr [ebx+18h] |
5edf3387 | 8b04b8 | mov eax,dword ptr [eax+edi*4] |
5edf338a | 397040 | cmp dword ptr [eax+40h],esi |
5edf338d | 0f84c6000000 | je AcroRd32!AX_PDXlateToHostEx+0x25e22b (5edf3459) |
5edf3393 | 66397024 | cmp word ptr [eax+24h],si |
5edf3397 | 0f85af000000 | jne AcroRd32!AX_PDXlateToHostEx+0x25e21e (5edf344c) |
5edf339d | 89482c | mov dword ptr [eax+2Ch],ecx |
5edf33a0 | 8b4318 | mov eax,dword ptr [ebx+18h] |
5edf33a3 | 8b0cb8 | mov ecx,dword ptr [eax+edi*4] |
5edf33a6 | 0fb64104 | movzx eax,byte ptr [ecx+4] |
5edf33aa | 83f827 | cmp eax,27h |
5edf33ad | 7f55 | jg AcroRd32!AX_PDXlateToHostEx+0x25e1d6 (5edf3404) |
5edf33af | 744c | je AcroRd32!AX_PDXlateToHostEx+0x25e1cf (5edf33fd) |
5edf33b1 | 83f814 | cmp eax,14h |
5edf33b4 | 7f36 | jg AcroRd32!AX_PDXlateToHostEx+0x25e1be (5edf33ec) |
5edf33b6 | 742d | je AcroRd32!AX_PDXlateToHostEx+0x25e1b7 (5edf33e5) |
5edf33b8 | 2bc6 | sub eax,esi |
5edf33ba | 7422 | je AcroRd32!AX_PDXlateToHostEx+0x25e1b0 (5edf33de) |
5edf33bc | 83e804 | sub eax,4 |
5edf33bf | 7413 | je AcroRd32!AX_PDXlateToHostEx+0x25e1a6 (5edf33d4) |
5edf33c1 | 48 | dec eax |
5edf33c2 | 48 | dec eax |
5edf33c3 | 740f | je AcroRd32!AX_PDXlateToHostEx+0x25e1a6 (5edf33d4) |
5edf33c5 | 48 | dec eax |
5edf33c6 | 740c | je AcroRd32!AX_PDXlateToHostEx+0x25e1a6 (5edf33d4) |
5edf33c8 | 83e809 | sub eax,9 |
5edf33cb | 757c | jne AcroRd32!AX_PDXlateToHostEx+0x25e21b (5edf3449) |
5edf33cd | e80f150100 | call AcroRd32!CTJPEGRect::operator=+0x48c0 (5ee048e1) |
5edf33d2 | eb71 | jmp AcroRd32!AX_PDXlateToHostEx+0x25e217 (5edf3445) |
5edf33d4 | 56 | push esi |
5edf33d5 | 56 | push esi |
5edf33d6 | 56 | push esi |
5edf33d7 | e8100a0100 | call AcroRd32!CTJPEGRect::operator=+0x3dcb (5ee03dec) |
5edf33dc | eb67 | jmp AcroRd32!AX_PDXlateToHostEx+0x25e217 (5edf3445) |
5edf33de | e879ec0000 | call AcroRd32!CTJPEGRect::operator=+0x203b (5ee0205c) |
5edf33e3 | eb60 | jmp AcroRd32!AX_PDXlateToHostEx+0x25e217 (5edf3445) |
5edf33e5 | e85d170100 | call AcroRd32!CTJPEGRect::operator=+0x4b26 (5ee04b47) |
5edf33ea | eb59 | jmp AcroRd32!AX_PDXlateToHostEx+0x25e217 (5edf3445) |
5edf33ec | 83e816 | sub eax,16h |
5edf33ef | 74f4 | je AcroRd32!AX_PDXlateToHostEx+0x25e1b7 (5edf33e5) |
5edf33f1 | 48 | dec eax |
5edf33f2 | 74f1 | je AcroRd32!AX_PDXlateToHostEx+0x25e1b7 (5edf33e5) |
5edf33f4 | 83e80d | sub eax,0Dh |
5edf33f7 | 7404 | je AcroRd32!AX_PDXlateToHostEx+0x25e1cf (5edf33fd) |
5edf33f9 | 48 | dec eax |
5edf33fa | 48 | dec eax |
5edf33fb | 754c | jne AcroRd32!AX_PDXlateToHostEx+0x25e21b (5edf3449) |
5edf33fd | e8211f0100 | call AcroRd32!CTJPEGRect::operator=+0x5302 (5ee05323) // call |
5edf3402 | eb41 | jmp AcroRd32!AX_PDXlateToHostEx+0x25e217 (5edf3445) // return address |
5edf3404 | 83f832 | cmp eax,32h |
5edf3407 | 7f28 | jg AcroRd32!AX_PDXlateToHostEx+0x25e203 (5edf3431) |
5edf3409 | 741f | je AcroRd32!AX_PDXlateToHostEx+0x25e1fc (5edf342a) |
5edf340b | 83e828 | sub eax,28h |
5edf340e | 7413 | je AcroRd32!AX_PDXlateToHostEx+0x25e1f5 (5edf3423) |
5edf3410 | 48 | dec eax |
5edf3411 | 48 | dec eax |
5edf3412 | 740f | je AcroRd32!AX_PDXlateToHostEx+0x25e1f5 (5edf3423) |
5edf3414 | 48 | dec eax |
5edf3415 | 740c | je AcroRd32!AX_PDXlateToHostEx+0x25e1f5 (5edf3423) |
5edf3417 | 83e805 | sub eax,5 |
5edf341a | 752d | jne AcroRd32!AX_PDXlateToHostEx+0x25e21b (5edf3449) |
5edf341c | e8b6e10000 | call AcroRd32!CTJPEGRect::operator=+0x15b6 (5ee015d7) |
5edf3421 | eb22 | jmp AcroRd32!AX_PDXlateToHostEx+0x25e217 (5edf3445) |
5edf3423 | e8d8200100 | call AcroRd32!CTJPEGRect::operator=+0x54df (5ee05500) |
5edf3428 | eb1b | jmp AcroRd32!AX_PDXlateToHostEx+0x25e217 (5edf3445) |
5edf342a | e862000000 | call AcroRd32!AX_PDXlateToHostEx+0x25e263 (5edf3491) |
5edf342f | eb14 | jmp AcroRd32!AX_PDXlateToHostEx+0x25e217 (5edf3445) |
5edf3431 | 83e833 | sub eax,33h |
5edf3434 | 740d | je AcroRd32!AX_PDXlateToHostEx+0x25e215 (5edf3443) |
5edf3436 | 48 | dec eax |
5edf3437 | 7410 | je AcroRd32!AX_PDXlateToHostEx+0x25e21b (5edf3449) |
5edf3439 | 48 | dec eax |
5edf343a | 750d | jne AcroRd32!AX_PDXlateToHostEx+0x25e21b (5edf3449) |
5edf343c | e8a8220100 | call AcroRd32!CTJPEGRect::operator=+0x56c8 (5ee056e9) |
5edf3441 | eb02 | jmp AcroRd32!AX_PDXlateToHostEx+0x25e217 (5edf3445) |
5edf3443 | 8bc6 | mov eax,esi |
5edf3445 | 85c0 | test eax,eax |
5edf3447 | 7541 | jne AcroRd32!AX_PDXlateToHostEx+0x25e25c (5edf348a) |
5edf3449 | 8b4dfc | mov ecx,dword ptr [ebp-4] |
5edf344c | 8b4318 | mov eax,dword ptr [ebx+18h] |
5edf344f | 33d2 | xor edx,edx |
5edf3451 | 42 | inc edx |
5edf3452 | 8b04b8 | mov eax,dword ptr [eax+edi*4] |
5edf3455 | 66895024 | mov word ptr [eax+24h],dx |
5edf3459 | 47 | inc edi |
5edf345a | 3b7b14 | cmp edi,dword ptr [ebx+14h] |
5edf345d | 0f8221ffffff | jb AcroRd32!AX_PDXlateToHostEx+0x25e156 (5edf3384) |
5edf3463 | 51 | push ecx |
5edf3464 | e8b5c7a3ff | call AcroRd32!AcroWinMainSandbox+0x5c9a (5e82fc1e) |
5edf3469 | 59 | pop ecx |
5edf346a | 39730c | cmp dword ptr [ebx+0Ch],esi |
5edf346d | 7619 | jbe AcroRd32!AX_PDXlateToHostEx+0x25e25a (5edf3488) |
5edf346f | 8bfe | mov edi,esi |
5edf3471 | 8b4b10 | mov ecx,dword ptr [ebx+10h] |
5edf3474 | 03cf | add ecx,edi |
5edf3476 | e861e20000 | call AcroRd32!CTJPEGRect::operator=+0x16bb (5ee016dc) |
5edf347b | 85c0 | test eax,eax |
5edf347d | 750b | jne AcroRd32!AX_PDXlateToHostEx+0x25e25c (5edf348a) |
Loaded symbol image file | c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe |
Image path | AcroRd32.exe |
Image name | AcroRd32.exe |
Timestamp | Fri May 11 00:19:40 2018 (5AF4C57C) |
CheckSum | 0022F148 |
ImageSize | 00230000 |
File version | 18.11.20040.19174 |
Product version | 18.11.20040.19174 |
File flags | 0 (Mask 3F) |
File OS | 50004 CE Win32 |
File type | 1.0 App |
File date | 00000000.00000000 |
Translations | 0409.04e4 |
CompanyName | Adobe Systems Incorporated |
ProductName | Adobe Acrobat Reader DC |
OriginalFilename | AcroRd32.exe |
ProductVersion | 18.11.20040.281318 |
FileVersion | 18.11.20040.281318 |
FileDescription | Adobe Acrobat Reader DC |
LegalCopyright | Copyright 1984-2017 Adobe Systems Incorporated and its licensors. All rights reserved. |
Loaded symbol image file | c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.dll |
Image path | c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.dll |
Image name | AcroRd32.dll |
Timestamp | Fri May 11 00:19:00 2018 (5AF4C554) |
CheckSum | 016EAE0A |
ImageSize | 01722000 |
File version | 18.11.20040.19174 |
Product version | 18.11.20040.19174 |
File flags | 0 (Mask 3F) |
File OS | 50004 CE Win32 |
File type | 2.0 Dll |
File date | 00000000.00000000 |
Translations | 0409.04e4 |