Broadcast crash in Xpand Rally 1.0.0.0

[Luigi Auriemma <aluigi@xxxxxxxxxxxxx>]

#######################################################################

                             Luigi Auriemma

Application:  Xpand Rally
              http://www.xpandrally.com
Versions:     1.0.0.0
Platforms:    Windows
Bug:          reading and writing on unallocated memory (crash)
Exploitation: remote, versus server and clients (broadcast)
Date:         30 Jan 2005
Author:       Luigi Auriemma
              e-mail: aluigi@xxxxxxxxxxxxx
              web:    http://aluigi.altervista.org


#######################################################################


1) Introduction
2) Bug
3) The Code
4) Fix


#######################################################################

===============
1) Introduction
===============


Xpand Rally is the recent rally game developed by Techland
(http://www.techland.pl) and released in September 2004.


#######################################################################

======
2) Bug
======


The problem is caused by an unchecked memory allocation controlled by
the attacker that can decide the exact amount of data to allocate
through a 32 bits number in his packets.

If the memory to allocate is too big the malloc() function will fail
and no instructions will check it so the game will try to write into a
bad memory zone (0x00000000)

Instead if the number is enough big but can be allocated, memcpy() will
fail because will try to read the unallocated memory after the packet's
data.

Naturally also clients are affected and a malicious server visible in
the master server list is able to passively crash any vulnerable client
in the world.


#######################################################################

===========
3) The Code
===========


http://aluigi.altervista.org/poc/xprallyboom.zip


#######################################################################

======
4) Fix
======


Version 1.1.0.0.


#######################################################################


--- 
Luigi Auriemma
http://aluigi.altervista.org