Inside the Windows Meta File Format
In fact, the CreateRectRgn function was also vulnerable, but an attack against this would require a file
that was one gigabyte in size.
In addition to the denial-of-service attacks described above, at least 14 functions are known to be vul-
nerable to conditions that cause Internet Explorer on all platforms, and Windows Explorer on
Windows XP (including SP2), to crash instantly upon opening malformed files. The vulnerable
functions are the same as those listed for the buffer overflow functions above, including the
CreateRectRgn function, with the addition of the following functions:
[W]ant [M]ore [F]reedom
One function is of particular interest in WMF format: the Escape function. The Escape function
enables applications to bypass the GDI layer, and communicate directly with a particular device. This
communication is intended to be directed to a printer, but the display device will accept some
of the commands too.
The Escape function supports a number of subfunctions, most of which are related to printer control,
such as StartDoc and StartPage, and the corresponding EndDoc and EndPage. Not surprisingly, at
least three of these subfunctions contain bugs.
The bugs appear if a non-placeable WMF calls the StartDoc (3 or 4110) or StartPage (10) subfunction
before any call is made to CreateDC(). This is possible in Windows Explorer on Windows XP, for exam-
ple, because there the created device context is compatible with both printer and display devices. The
result is that the viewing application will crash. In order to attack the Windows XP platform, where
the GDI+ layer exists, the minimum file length is 62 bytes.
Finally, we reach the most trusting part of the WMF format parser, which is the cause of most of the
trouble: the SetAbortProc WMF subfunction.